Authorization management method and system

Abstract

An authorization management method suitable for deployment software installed on a first processing device, the method comprising: deactivating, by the first processing device, at least a portion of the deployment software, after the deactivation, outputting, by the first processing device, an encrypted value based on device information of the first processing device, the second processing device receives and decrypts the encryption value to obtain decryption information, and when the decryption information accords with pre-stored information of the second processing device, the second processing device releases the authorization limit of the corresponding deployment software, and the pre-stored information comprises device information.

Description

Technical Field

[0001] The invention relates to an authorization management method and system. Background Art

[0002] Software vendors usually only authorize a limited number of machines to allow the software to be installed on those machines. When a customer wants to change the authorized machines, those machines must be connected to the software vendor's server through the network. The software vendor's server will only allow the new machine to use the original authorized quota after confirming that the software on the original machine has been removed and the authorized quota has been released.

[0003] However, more and more machines can only operate in an offline environment due to commercial confidentiality and other factors. As a result, when a client wants to change the authorized machine, the software provider cannot verify the machine and is unable to effectively confirm whether the software on the original machine has been removed. Summary of the invention

[0004] In view of the above, the present invention provides an authorization management method and system for solving the above problems.

[0005] An authorization management method according to an embodiment of the present invention is applicable to deployment software installed on a first processing device, the method comprising: deactivating at least a portion of the deployment software by the first processing device; after the deactivation, outputting an encrypted value by the first processing device based on device information of the first processing device; receiving and decrypting the encrypted value by a second processing device to obtain decrypted information; and when the decrypted information matches pre-stored information of the second processing device, releasing the authorization amount corresponding to the deployment software by the second processing device, wherein the pre-stored information includes device information.

[0006] According to an embodiment of the present invention, an authorization management system includes: a first processing device and a second processing device. The first processing device is installed with deployment software, and the first processing device is used to trigger the deactivation of at least a part of the deployment software, and after the deactivation, output an encrypted value based on the device information of the first processing device.

[0007] In summary, the authorization management method and system according to one or more embodiments of the present invention are applicable to offline machines, allowing software vendors to identify the machine to release the authorization by decryption. In addition, by first deactivating at least a portion of the deployed software and then generating the encrypted value, the software vendor can effectively confirm whether the software on the original machine has been removed.

[0008] The above description of the content of the present invention and the following description of the implementation modes are used to demonstrate and explain the spirit and principle of the present invention, and to provide further explanation for the protection scope of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1The block diagram of the authorization management system is shown according to an embodiment of the present invention.

[0010] Figure 2 The block diagram of the authorization management system is shown according to another embodiment of the present invention.

[0011] Figure 3 The flowchart is a method for authorization management according to an embodiment of the present invention.

[0012] Figure 4 The present invention is a flowchart of a method for generating an encryption value according to an embodiment of the present invention.

[0013] Figure 5 The flowchart of the fool-proof mechanism is shown according to an embodiment of the present invention.

[0014] Figure 6 The flowchart of the fool-proof mechanism is shown according to another embodiment of the present invention.

[0015] [Description of Reference Numerals]

[0016] 1,2: Authorization management system

[0017] 11,21: First processing device

[0018] 12,22: Second processing device

[0019] 111,211: Deploy software

[0020] 1111: Encrypted part

[0021] 1112: Logical operation part

[0022] 212: Encryption software

[0023] 121,221: Management machine

[0024] 122,222: Server

[0025] S101, S103, S105, S107, S109, S111, S201, S203, S301, S303, S305, S401, S403, S405: Steps DETAILED DESCRIPTION

[0026] The detailed features and advantages of the present invention are described in detail in the following embodiments, and the contents are sufficient to enable ordinary technicians in the field to understand the technical content of the present invention and implement it accordingly. According to the contents, protection scope and drawings disclosed in this specification, ordinary technicians in the field can easily understand the relevant purposes and advantages of the present invention. The following examples are to further illustrate the viewpoints of the present invention in detail, but are not intended to limit the scope of the present invention in any way.

[0027] It should be noted that, from the perspective of the software provider, the embodiments described below are applicable to the case where the client wants to change the software installed on an authorized machine to another machine, or wants to remove the software installed on an authorized machine.

[0028] Please refer to Figure 1 ,in Figure 1 FIG. 1 is a block diagram of an authorization management system according to an embodiment of the present invention. Figure 1 As shown, the authorization management system 1 includes a first processing device 11 and a second processing device 12. The first processing device 11 may be a client machine, and the second processing device 12 may be a software provider device for controlling the software installed on the first processing device 11.

[0029] Specifically, the first processing device 11 may include a deployment software 111, and the deployment software 111 may include an encryption part 1111 and a logic operation part 1112. The first processing device 11 may include one or more processors for running the encryption part 1111 and the logic operation part 1112. The encryption part 1111 is used to perform encryption operations on information to obtain an encrypted value, wherein the encryption value may be a proprietary password for releasing the authorization amount corresponding to the deployment software 111. The logic operation part 1112 is used to execute the authorized logic operation function of the deployment software 111. In other words, in this embodiment, the encryption part 1111 and the logic operation part 1112 are respectively part of the deployment software 111. The deployment software 111 can be implemented in the form of an application program (APP).

[0030] The second processing device 12 may include a management machine 121 and a server 122 connected to each other, and the management machine 121 and the server 122 may each include one or more processors. The management machine 121 and the server 122 may be set as the same device, or different devices respectively set at the local end and the remote end. When the management machine 121 and the server 122 are set as the same device, the management machine 121 may be an online management platform (website). The management machine 121 can be used for user operation at the first processing device 11 end to manage the first processing device 11 and obtain the encrypted value, and the server 122 can be used to verify the encrypted value. Specifically, the deployment software 111 can display the encrypted value through the screen, and the user inputs the encrypted value displayed by the deployment software 111 into the management machine 121. The server 122 obtains the encrypted value from the management machine 121, decrypts the encrypted value to obtain the decrypted information, and verifies the decrypted information using the pre-stored information. When the verification result of the server 122 is that the pre-stored information and the decrypted information are consistent, the server 122 can release the authorization amount corresponding to the deployment software 111.

[0031] Please refer to Figure 2 ,in Figure 2 FIG. 1 is a block diagram of an authorization management system according to another embodiment of the present invention. Figure 2 As shown, the authorization management system 2 includes a first processing device 21 and a second processing device 22. The first processing device 21 may include deployment software 211 and encryption software 212. The first processing device 21 may include one or more processors for running the deployment software 211 and the encryption software 212. The deployment software 211 is used to perform authorized logical operation functions, and the encryption software 212 is used to perform encryption operations on information to obtain encrypted values. In other words, in this embodiment, the deployment software 211 and the encryption software 212 may be independent applications in the first processing device 21.

[0032] The second processing device 22 may include a management machine 221 and a server 222 connected to each other. The implementation method of the second processing device 22 may be the same as Figure 1 The second processing device 12 is the same as that of the second processing device 12, so it will not be described here in detail.

[0033] The processor mentioned above is, for example, a central processing unit, a graphics processor, a microcontroller, a programmable logic controller or other processors with computing functions.

[0034] It should also be noted that Figure 1 and Figure 2 The encryption part 1111, the logic operation part 1112, the encryption software 212, the management machine 221 and the server 222 shown in the figure may be optional parts.

[0035] Please refer to Figure 3 ,in Figure 3 The following is a flowchart of an authorization management method according to an embodiment of the present invention. Figure 1 The authorization management system 1 describes the authorization management method, but the authorization management method is also applicable to Figure 2 The authorization management system 2. The authorization management method is applicable to the deployment software 111 installed on the first processing device 11, such as Figure 3 As shown, the authorization management method includes: step S101: deactivating at least a part of the deployed software with a first processing device; step S103: after deactivation, outputting an encrypted value with the first processing device based on the device information of the first processing device; step S105: receiving and decrypting the encrypted value with a second processing device to obtain decrypted information; step S107: determining whether the decrypted information is consistent with the pre-stored information of the second processing device; if the determination result of step S107 is "yes", executing step S109: releasing the authorization quota corresponding to the deployed software with the second processing device; and if the determination result of step S107 is "no", executing step S111: not releasing the authorization quota corresponding to the deployed software. Step S111 is a step that is selectively executed.

[0036] First, before step S101, the first processing device 11 can determine whether the first processing device 11 is connected to the second processing device 12 after receiving a user instruction, wherein the user instruction can instruct to remove the deployment software 111 or change the installation machine of the deployment software 111. If the first processing device 11 can be connected to the second processing device 12, the second processing device 12 can execute the program corresponding to the user instruction; if the first processing device 11 determines that there is no communication connection with the second processing device 12, the first processing device 11 is triggered to execute step S101.

[0037] In step S101, the first processing device 11 deactivates a portion of the deployment software 111. Figure 1 Taking the first processing device 11 as an example, the implementation of step S101 may be to disable the logic operation part 1112 and maintain the encryption part 1111; Figure 2 Taking the first processing device 21 as an example, the implementation method of step S101 may be to uninstall the deployment software 211 and maintain the encryption software 212 for generating the encryption value.

[0038] In step S103, after the part of the deployment software 111 is deactivated, the encryption part 1111 of the first processing device 11 encrypts the device information of the first processing device 11 to generate an encrypted value. The encryption part 1111 may pre-store an encryption key, and encrypt the device information of the first processing device 11 with the encryption key to generate an encrypted value. Figure 2 In the embodiment of the present invention, the implementation of step S103 may be that after the deployment software 211 is uninstalled, the encryption software 212 of the first processing device 21 encrypts the device information of the first processing device 11 to generate an encrypted value. The encryption software 212 may pre-store an encryption key, and encrypt the device information of the first processing device 11 with the encryption key to generate an encrypted value. For example, the device information may include at least one of the serial number of the first processing device 11, the device name, the serial number of the deployment software 111 / deployment software 211, and the date on which the first processing device 11 / first processing device 21 is authorized, etc., and the present invention is not limited thereto. The encryption method of the encryption part 1111 / encryption software 212 is, for example, a hash operation, symmetric encryption, or asymmetric encryption, and the present invention is not limited thereto.

[0039] In step S105, the management machine 121 of the second processing device 12 receives the encrypted value input by the user, outputs the encrypted value to the server 122, and the server 122 decrypts the encrypted value to obtain decrypted information. The server 122 may pre-store an encryption key and use the encryption key to decrypt the encrypted value to obtain decrypted information.

[0040] In step S107, the second processing device 12 determines whether the decrypted information matches the pre-stored information of the second processing device 12, and the pre-stored information may include at least one of the serial number of the authorized processing device, the device name, the serial number of the deployed software, and the date when the authorized processing device is authorized. In other words, the data type of the pre-stored information may be the same as the data type of the device information.

[0041] If the second processing device 12 determines that the decrypted information matches the pre-stored information, it means that the pre-stored information includes device information and the first processing device 11 is an authorized processing device. Therefore, in step S109, the second processing device 12 can identify the first processing device 11 according to the decrypted information and release the authorization quota corresponding to the deployment software 111 (or deployment software 211) so that another first processing device can use the authorization quota of the original deployment software 111 (or deployment software 211).

[0042] On the contrary, if the second processing device 12 determines that the decrypted information does not match the pre-stored information, it means that the first processing device 11 is not an authorized processing device. Therefore, in step S111, the second processing device 12 does not release the authorization quota corresponding to the deployment software 111 (or deployment software 211). In addition, when the second processing device 12 determines that the decrypted information does not match the pre-stored information, the second processing device 12 can output a verification failure notification through the management machine 121 to notify the user of the first processing device 11 that the verification has failed.

[0043] Please refer to Figure 4 ,in Figure 4 The present invention is a flowchart of a method for generating an encryption value according to an embodiment of the present invention. Figure 4 Can be considered as Figure 3 The following is a detailed flow chart of an embodiment of step S103. Figure 1 The method for generating an encrypted value is described in the authorization management system 1, but the method for generating an encrypted value is also applicable to Figure 2 Authorization management system 2. Figure 4 As shown, the method for generating an encrypted value includes: step S201: obtaining additional information generated by a second processing device; and step S203: encrypting the device information and the additional information to generate an encrypted value.

[0044] In step S201, the first processing device 11 obtains additional information generated by the second processing device 12. For example, the additional information may include at least one of a garbled code generated after deactivating at least a portion of the deployment software 111, a dedicated password belonging to a dedicated person (e.g., a technician at the first processing device 11), a time point corresponding to deactivating at least a portion of the deployment software 111, and external information captured by the second processing device 12 from an external system (e.g., the cloud). In step S203, the first processing device 11 encrypts the device information and the additional information to generate an encrypted value, wherein the encryption method may be using the encryption key as described above.

[0045] Therefore, if the second processing device 12 subsequently determines that the decrypted information matches the pre-stored information (for example, Figure 3 The determination result of step S107 is "yes", indicating that the pre-stored information further includes additional information.

[0046] Please refer to Figure 1 and Figure 5 ,in Figure 5 This is a flow chart of a foolproof mechanism according to an embodiment of the present invention. Figure 1 The authorization management system 1 describes the foolproof mechanism, but the foolproof mechanism also applies to Figure 2 Authorization management system 2. Figure 5 The steps can be performed in Figure 3 After step S111; or, when Figure 3 When the judgment result of step S107 is "No", the Figure 5 Step S111 is not performed. And, Figure 5 Can be matched Figure 4 In other words, in the embodiment where the encrypted value is generated by the encryption device information and the additional information, when it is determined that the decrypted value does not match the pre-stored information, the second processing device 12 may output a verification failure notification as described above, and then Figure 5 The steps can be performed.

[0047] like Figure 5 As shown, the fool-proof mechanism includes: step S301: receiving an additional information request with a second processing device to generate another additional information; step S303: receiving the another additional information with a first processing device; and step S305: encrypting the device information and the another additional information with the first processing device to generate an encrypted value.

[0048] In step S301, since the second processing device 12 can output a verification failure notification to notify the user, the user can input an additional information request in the second processing device 12. The additional information request is used to request additional information again from the second processing device 12. The second processing device 12 can generate another additional information (hereinafter referred to as "second additional information") according to the additional information request.

[0049] In step S303, the user may input the second additional information generated by the second processing device 12 into the first processing device 11. The second additional information may include at least one of a garbled code generated after deactivating at least a portion of the deployment software 111, a dedicated password belonging to a dedicated person (e.g., a technician at the first processing device 11), a time point corresponding to deactivating at least a portion of the deployment software 111, and external information captured by the second processing device 12 from an external system (e.g., the cloud).

[0050] In step S305, the first processing device 11 encrypts the device information and the second additional information received in step S303 to generate an encrypted value. After the encrypted value is generated and output, the first processing device 11 may then execute Figure 3 Step S105.

[0051] Please refer to Figure 1 and Figure 6 ,in Figure 6 This is a flow chart of a foolproof mechanism according to another embodiment of the present invention. Figure 1 The authorization management system 1 describes the foolproof mechanism, but the foolproof mechanism also applies to Figure 2 Authorization management system 2. Figure 6 The steps can be performed in Figure 3 After step S111; or, when Figure 3 When the judgment result of step S107 is "No", the Figure 6 Step S111 is not performed. And, Figure 6 Can be matched Figure 4 In other words, in the embodiment where the encrypted value is generated by the encryption device information and the additional information, when it is determined that the decrypted value does not match the pre-stored information, the second processing device 12 may output a verification failure notification as described above, and then Figure 6 The steps can be performed.

[0052] like Figure 6 As shown, the fool-proof mechanism includes: step S401: outputting a verification failure notification with a second processing device; step S403: receiving another additional information corresponding to the verification failure notification with a first processing device; and step S405: encrypting the device information and the another additional information with the first processing device to generate an encrypted value.

[0053] Specifically, when the second processing device 12 determines that the decrypted information does not match the pre-stored information, it may mean that the additional information input by the user to the first processing device 11 is incorrect, causing the first processing device 11 to generate an incorrect encryption value. Therefore, in step S401, the second processing device 12 outputs a verification failure notification to notify the user, and the user can judge that the additional information previously input may be incorrect.

[0054] In step S403, the first processing device 11 may receive another additional information (hereinafter referred to as "third additional information") input by the user. The third additional information may be the information received by the second processing device 12 at Figure 4 In other words, in step S403, the user can again read the second processing device 12 at Figure 4 The additional information generated in step S201 is read, and the read additional information is used as third additional information input to the first processing device 11.

[0055] In step S405, the first processing device 11 encrypts the device information and the third additional information received in step S403 to generate an encrypted value. After the encrypted value is generated and output, the first processing device 11 may then execute Figure 3 Step S105.

[0056] Figure 5 and Figure 6 The fool-proof mechanism can be executed selectively. Figure 5 and Figure 6 If the encrypted value generated by one of the fool-proof mechanisms is still incorrect, you can then execute Figure 5 and Figure 6 Another one of the fool-proof mechanisms.

[0057] In addition, in one or more of the above embodiments, when it is determined that the decrypted information does not match the pre-stored information, the second processing device 12 may count the number of failures, and when the number of failures is equal to or greater than the preset number, refuse to receive the encrypted value. Specifically, the initial value of the number of failures may be 0, and the second processing device 12 adds 1 to the number of failures when decrypting the encrypted value and determining that the decrypted information does not match the pre-stored information. When the number of failures is equal to or greater than the preset number, it indicates that the device information / additional information and / or the encryption key used to generate the encrypted value is incorrect. Therefore, the second processing device 12 may close the page for receiving the encrypted value on the management machine 121 or the input field for receiving the encrypted value on the page to suspend receiving the encrypted value, and the second processing device 12 may further suspend the operation of the management machine 121 for a preset period of time (e.g., 5 minutes).

[0058] In summary, the authorization management method and system according to one or more embodiments of the present invention are applicable to offline machines, allowing software vendors to identify the machines to release authorization by decryption. In addition, by first deactivating at least a portion of the deployed software and then generating an encrypted value, the software vendor can effectively confirm whether the software on the original machine has been removed. By using the additional information of the second processing device to generate an encrypted value, the verification process can be made safer. In addition, by setting a foolproof mechanism, it is possible to avoid incorrect verification results due to errors in the additional information input by the user.

Claims

1. An authorization management method, applicable to a deployment software installed on a first processing device, characterized in that: The method includes: deactivating, with the first processing device, at least a portion of the deployed software; After the deactivation, outputting an encrypted value by the first processing device based on device information of the first processing device; Receiving and decrypting the encrypted value with a second processing device to obtain a decrypted message; as well as When the decrypted information matches pre-stored information of the second processing device, the second processing device releases the authorization quota corresponding to the deployed software, wherein the pre-stored information includes the device information.

2. The authorization management method according to claim 1, characterized in that: Outputting the encrypted value by the first processing device based on the device information of the first processing device includes: obtaining additional information generated by the second processing device, wherein the pre-stored information further includes the additional information; and The device information and the additional information are encrypted to generate the encrypted value.

3. The authorization management method according to claim 2, characterized in that: Also includes: When the decrypted information does not match the pre-stored information of the second processing device, the second processing device outputs a verification failure notification; receiving, with the first processing device, another additional information corresponding to the verification failure notification; and The device information and the other additional information are encrypted by the first processing device to generate the encrypted value.

4. The authorization management method according to claim 2, characterized in that: Also includes: When the decrypted information does not match the pre-stored information of the second processing device, receiving an additional information request with the second processing device to generate another additional information; receiving the further additional information with the first processing device; as well as The device information and the other additional information are encrypted by the first processing device to generate the encrypted value.

5. The authorization management method according to any one of claims 2, 3 and 4, characterized in that: The additional information includes at least one of a garbled code generated after the deactivation, a dedicated password belonging to a dedicated person, a time point corresponding to the deactivation, and external information captured by the second processing device from an external system.

6. The authorization management method according to claim 1, characterized in that: The deployment software includes an encryption part and a logic operation part, and disabling the at least a part of the deployment software with the first processing device includes: The logic operation part is disabled, and the encryption part is maintained.

7. The authorization management method according to claim 1, characterized in that: Deactivating, with the first processing device, the at least a portion of the deployed software comprises: The deployment software is uninstalled, and an encryption software for generating the encryption value is maintained.

8. The authorization management method according to claim 1, characterized in that: Before disabling the at least a portion of the deployed software with the first processing device, the method further includes: determining with the first processing device that the second processing device cannot be connected.

9. The authorization management method according to claim 1, characterized in that: Also includes: When the decrypted information does not match the pre-stored information of the second processing device, the second processing device counts a number of failures; and When the number of failures is equal to or greater than a preset number, the second processing device closes an input field for receiving the encrypted value.

10. An authorization management system, characterized in that: Include: a first processing device having a deployment software installed therein, the first processing device being configured to deactivate at least a portion of the deployment software upon triggering, and outputting an encrypted value based on device information of the first processing device after the deactivation; as well as A second processing device is used to store a pre-stored information and receive and decrypt the encrypted value to obtain a decrypted information. The second processing device is further used to release the authorization amount corresponding to the deployed software when the decrypted information matches the pre-stored information, wherein the pre-stored information includes the device information.

11. The authorization management system according to claim 10, characterized in that: The first processing device obtains additional information generated by the second processing device, and encrypts the device information and the additional information to generate the encrypted value, wherein the pre-stored information further includes the additional information.

12. The authorization management system according to claim 11, characterized in that: When the decrypted information does not match the pre-stored information of the second processing device, the second processing device outputs a verification failure notification, the first processing device receives another additional information corresponding to the verification failure notification, and encrypts the another device information and the additional information to generate the encrypted value.

13. The authorization management system according to claim 11, characterized in that: When the decrypted information does not match the pre-stored information of the second processing device, the second processing device receives an additional information request to generate another additional information, the first processing device receives the another additional information, and encrypts the device information and the another additional information to generate the encrypted value.

14. The authorization management system according to any one of claims 11, 12 and 13, characterized in that: The additional information includes at least one of a garbled code generated after the deactivation, a dedicated password belonging to a dedicated person, a time point corresponding to the deactivation, and external information captured by the second processing device from an external system.

15. The authorization management system according to claim 10, characterized in that: The deployment software includes an encryption part and a logic operation part. The first processing device disables the logic operation part and maintains the encryption part.

16. The authorization management system according to claim 10, characterized in that: The first processing device deactivates the deployment software.

17. The authorization management system according to claim 10, characterized in that: The first processing device is used to be triggered to disable the at least part of the deployment software when it is determined that there is no communication connection with the second processing device.

18. The authorization management system according to claim 10, characterized in that: The second processing device is further used for counting a failure number when determining that the decrypted information does not match the pre-stored information of the second processing device, and closing an input field for receiving the encrypted value when determining that the failure number is equal to or greater than a preset number.

Images