Product authorization method and device, product activation method and device, equipment, storage medium and product

Abstract

The invention discloses a product authorization method and device, an activation method and device, equipment, a storage medium and a product, relates to the technical field of data security, and discloses a method for extracting a combined authorization code corresponding to a plurality of products from a combined authorization request in response to the combined authorization request; acquiring authorization information of the plurality of products based on the combined authorization code; based on the authorization information of the plurality of products, generating a combined authorization certificate corresponding to the plurality of products, the combined authorization certificate comprising the authorization information of the plurality of products; and returning a combined authorization certificate to the sender of the combined authorization request, wherein the combined authorization certificate is used for activating the plurality of products. The method can effectively reduce the number of authorization codes and authorization certificates.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a product authorization method, an activation method, a device, an apparatus, a storage medium and a product. BACKGROUND

[0002] In the wide application scenarios of today's digital products, product authorization codes and authorization certificates play a crucial role. An authorization code is a specific combination of characters, which serves as a verification credential for product usage rights, generated by product developers and distributed to users. An authorization certificate is a legally binding electronic document that details the authorization information of a product. Both are mainly used to confirm the legal use of the product by the user and prevent the product from being used illegally.

[0003] In related technologies, independent authorization codes and authorization certificates need to be generated for each product. As the number of products grows rapidly, the number of authorization codes and authorization certificates that need to be managed also expands rapidly, resulting in a significant increase in the difficulty of managing authorization codes and authorization certificates. Therefore, there is an urgent need for a method to effectively reduce the number of authorization codes and authorization certificates to reduce the management difficulty.

[0004] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide a product authorization method, an activation method, a device, an apparatus, a storage medium and a product, which can effectively reduce the number of authorization codes and authorization certificates.

[0006] To achieve the above purpose, the present application provides a product authorization method, which is executed by a server, and the method comprises:

[0007] In response to a combined authorization request, extracting a combined authorization code corresponding to a plurality of products from the combined authorization request;

[0008] Based on the combined authorization code, obtaining authorization information of the plurality of products;

[0009] Based on the authorization information of the plurality of products, generating a combined authorization certificate corresponding to the plurality of products, wherein the combined authorization certificate includes the authorization information of the plurality of products;

[0010] Returning the combined authorization certificate to the sender of the combined authorization request, wherein the combined authorization certificate is used to activate the plurality of products.

[0011] Optionally, the generating of the combined authorization certificate corresponding to the plurality of products based on the authorization information of the plurality of products comprises:

[0012] The authorization information of the plurality of products is encrypted by using different keys to obtain encrypted authorization files of the plurality of products.

[0013] A combined authorization certificate containing the encrypted authorization files of the plurality of products is generated.

[0014] Optionally, the authorization information of the plurality of products is encrypted by using different keys to obtain encrypted authorization files of the plurality of products, including:

[0015] For any product, a random symmetric key of the product is generated;

[0016] The authorization information of the product is encrypted by using the random symmetric key to obtain an encrypted authorization file of the product;

[0017] The random symmetric key of the product is encrypted by using a public key of a digital certificate of the product to obtain a key exchange file of the product;

[0018] The combined authorization certificate containing the encrypted authorization files of the plurality of products is generated, including:

[0019] A combined authorization certificate containing the encrypted authorization files and the key exchange files of the plurality of products is generated.

[0020] Optionally, the combined authorization certificate containing the encrypted authorization files and the key exchange files of the plurality of products is generated, including:

[0021] For any product, an index file of the product is created, the index file containing a file name of the encrypted authorization file and the key exchange file associated with the product;

[0022] The index file is encrypted by using a fixed symmetric key of the product to obtain an encrypted index file of the product;

[0023] A combined authorization certificate containing the encrypted index files, the encrypted authorization files, and the key exchange files of the plurality of products is generated.

[0024] Optionally, before the index file is encrypted by using the fixed symmetric key of the product to obtain the encrypted index file of the product, the method further includes:

[0025] The combined authorization code is converted according to a key conversion mode corresponding to the product to obtain the fixed symmetric key of the product.

[0026] Optionally, the combined authorization code is converted according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product, including:

[0027] decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code;

[0028] splice the plaintext string and a preset string corresponding to the product to obtain a spliced string;

[0029] perform a hash operation on the spliced string to obtain a hash value;

[0030] extract a preset field from the hash value as the fixed symmetric key.

[0031] Optionally, the encrypting the random symmetric key of the product by using the public key of the digital certificate of the product to obtain the key exchange file includes:

[0032] encrypting the random symmetric key of the product by using the public key of the digital certificate of the product to obtain key encryption data of the product;

[0033] signing the key encryption data by using the private key of the authorization center, and encrypting the signed key encryption data by using the fixed symmetric key of the product to obtain the key exchange file.

[0034] Optionally, the encrypting the random symmetric key of the product by using the public key of the digital certificate of the product to obtain the key exchange file includes:

[0035] sending a certificate signing request to the authorization center, wherein the certificate signing request contains metadata of the product and the key encryption data;

[0036] receiving an identity authentication certificate returned by the authorization center, wherein the identity authentication certificate contains the metadata, the key encryption data, a certificate validity period, and a signature of the authorization center;

[0037] encrypting the identity authentication certificate by using the fixed symmetric key of the product to obtain the key exchange file.

[0038] Optionally, the method further includes:

[0039] randomly generating an asymmetric key pair, wherein the asymmetric key pair includes a random public key and a random private key;

[0040] the certificate signing request further carries the random public key;

[0041] the encrypting the identity authentication certificate by using the fixed symmetric key of the product to obtain the key exchange file includes:

[0042] The fixed symmetric key is used to encrypt the identity authentication certificate and the random private key, and a key exchange file is obtained.

[0043] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0044] Optionally, the obtaining of the authorization information of the plurality of products based on the combined authorization code comprises:

[0045] querying the authorization information of the plurality of products associated with the combined authorization code.

[0046] Optionally, the method further comprises:

[0047] extracting, from the combined authorization request, machine codes corresponding to the plurality of products, the machine codes being unique identifiers of devices on which the plurality of products are installed;

[0048] associating the machine codes with the combined authorization code;

[0049] checking a number of machine codes currently associated with the combined authorization code, and determining that the machine code check passes in a case where the number of machine codes associated with the combined authorization code is determined to be not greater than a preset threshold, the server being configured to return the combined authorization certificate in a case where the machine code check passes.

[0050] Optionally, before the extracting, from the combined authorization request, the combined authorization code corresponding to the plurality of products, the method further comprises:

[0051] generating the combined authorization code in response to a combined purchase request of the plurality of products, an authorization type field in the combined authorization code being marked as combined authorization;

[0052] associating the combined authorization code with the authorization information of the plurality of products;

[0053] sending the combined authorization code to a purchaser of the plurality of products.

[0054] Optionally, the plurality of products are respectively software and hardware combined products, and the combined authorization code does not contain authorization information for product activation; the method further comprises:

[0055] generating a separate authorization code corresponding to a pure software product in response to a purchase request of the pure software product, the separate authorization code containing authorization information for activation of the pure software product;

[0056] sending the separate authorization code to a purchaser of the pure software product.

[0057] Optionally, in the case that the authorization type of the pure software product is offline authorization, the authorization type field in the individual authorization code is marked as offline authorization, and the pure software product of offline authorization refers to a pure software product that does not need to be online verified for the number of machine codes associated with the corresponding individual authorization code in the activation process.

[0058] Or, in the case that the authorization type of the pure software product is online authorization, the authorization type field in the individual authorization code is marked as online authorization, and the pure software product of online authorization refers to a pure software product that needs to be online verified for the number of machine codes associated with the corresponding individual authorization code in the activation process.

[0059] Optionally, the method further comprises:

[0060] In response to an individual authorization request, extracting the machine code corresponding to the pure software product and the individual authorization code from the individual authorization request, the machine code being a unique identifier of a device installing the pure software product;

[0061] Associating the machine code corresponding to the pure software product with the individual authorization code;

[0062] Verifying the number of machine codes currently associated with the individual authorization code, and determining that the machine code verification is passed in the case that the number of machine codes associated with the individual authorization code is determined to be not greater than a preset threshold.

[0063] Returning a product activation notification to the sender of the individual authorization request.

[0064] In addition, to achieve the above-mentioned purpose, the application further provides a product activation method, which is executed by a terminal, and the method comprises:

[0065] In response to an input combined authorization code corresponding to a plurality of products, sending a combined authorization request containing the combined authorization code;

[0066] Receiving a combined authorization certificate returned based on the combined authorization request, the combined authorization certificate including authorization information of the plurality of products;

[0067] Extracting the authorization information of the plurality of products from the combined authorization certificate respectively;

[0068] Based on the authorization information of the plurality of products, activating the plurality of products installed in the terminal.

[0069] Optionally, the combined authorization certificate includes encrypted authorization files of the plurality of products;

[0070] The extracting the authorization information of the plurality of products from the combined authorization certificate respectively comprises:

[0071] decrypt the encrypted authorization file of each product by using the key of each product to obtain authorization information of each product, and the keys of the products are different.

[0072] Optionally, the combined authorization certificate further comprises a key exchange file of the plurality of products; and the decrypting the encrypted authorization file of each product by using the key of each product to obtain authorization information of each product comprises:

[0073] For any product, decrypt the key exchange file of the product by using the private key of the digital certificate of the product to obtain the random symmetric key of the product;

[0074] Decrypt the encrypted authorization file of the product by using the random symmetric key of the product to obtain the authorization information of the product.

[0075] Optionally, the combined authorization certificate further comprises an encrypted index file of the plurality of products; and before the decrypting the key exchange file of the product by using the private key of the digital certificate of the product to obtain the random symmetric key of the product, the method further comprises:

[0076] For any product, decrypt the encrypted index file of the product by using the fixed symmetric key of the product to obtain the index file of the product, and the index file comprises the file name of the encrypted authorization file and the key exchange file associated with the product;

[0077] Based on the file name, query the encrypted authorization file and the key exchange file of the product from the combined authorization certificate.

[0078] Optionally, before the decrypting the encrypted index file of the product by using the fixed symmetric key of the product to obtain the index file of the product, the method further comprises:

[0079] For any product, convert the combined authorization code according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product.

[0080] Optionally, the converting the combined authorization code according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product comprises:

[0081] Decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code;

[0082] Splice the plaintext string and a preset string corresponding to the product to obtain a spliced string;

[0083] hashing the concatenated string to obtain a hash value;

[0084] extracting a preset field from the hash value as the fixed symmetric key.

[0085] Optionally, the decrypting the key exchange file of the product by using the private key of the digital certificate of the product to obtain the random symmetric key of the product comprises:

[0086] decrypting the key exchange file of the product by using the fixed symmetric key of the product, and verifying a signature carried by the decrypted key encrypted data by using the public key of the authorization center;

[0087] In the case that the signature verification is passed, decrypting the key encrypted data by using the private key of the digital certificate of the product to obtain the random symmetric key of the product.

[0088] Optionally, the decrypting the key exchange file of the product by using the fixed symmetric key of the product, and verifying a signature carried by the decrypted key encrypted data by using the public key of the authorization center comprises:

[0089] decrypting the key exchange file by using the fixed symmetric key of the product to obtain an identity authentication certificate, wherein the identity authentication certificate comprises the key encrypted data, a certificate validity period and a signature of the authorization center;

[0090] verifying the signature by using the public key of the authorization center, and extracting the key encrypted data from the identity authentication certificate in the case that the signature verification is passed and the current time is within the certificate validity period.

[0091] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0092] Optionally, the sending a combined authorization request comprising the combined authorization code in response to the input combined authorization code corresponding to the plurality of products comprises:

[0093] sending a combined authorization request comprising the combined authorization code and a machine code in response to the input combined authorization code corresponding to the plurality of products and the machine code, wherein the machine code is a unique identifier of a device on which the plurality of products are installed.

[0094] Optionally, the plurality of products are software and hardware combined products respectively, and the combined authorization code does not comprise authorization information for product activation; the method further comprises:

[0095] parsing authorization information of a pure software product from a separate authorization code of the pure software product in response to the input separate authorization code of the pure software product.

[0096] activate the pure software product installed in the terminal based on the authorization information of the pure software product.

[0097] Optionally, the activating the pure software product installed in the terminal based on the authorization information of the pure software product comprises:

[0098] in a case where the authorization type in the authorization information is offline authorization, activating the pure software product installed in the terminal based on the authorization information of the pure software product; or

[0099] in a case where the authorization type in the authorization information is online authorization, sending a separate authorization request containing the separate authorization code and a machine code, wherein the machine code refers to a unique identifier of a device on which the pure software product is installed, and in a case where a product activation notification returned based on the separate authorization request is received, activating the pure software product installed in the terminal based on the authorization information of the pure software product.

[0100] Optionally, the terminal is a proxy activation terminal, and after the activating the plurality of products installed in the terminal based on the authorization information of the plurality of products, the method further comprises:

[0101] determining a plurality of agented terminals associated with the proxy activation terminal;

[0102] sending the authorization information of the plurality of products to each agented terminal, so that each agented terminal activates the plurality of products locally installed based on the authorization information of the plurality of products.

[0103] In addition, to achieve the above object, the application further provides a product authorization device configured in a server, comprising:

[0104] a request response module configured to extract a combined authorization code corresponding to a plurality of products from a combined authorization request in response to the combined authorization request;

[0105] an information acquisition module configured to acquire authorization information of the plurality of products based on the combined authorization code;

[0106] a certificate generation module configured to generate a combined authorization certificate corresponding to the plurality of products based on the authorization information of the plurality of products, wherein the combined authorization certificate comprises the authorization information of the plurality of products;

[0107] a certificate sending module configured to return the combined authorization certificate to a sender of the combined authorization request, wherein the combined authorization certificate is used to activate the plurality of products.

[0108] Optionally, the certificate generating module comprises:

[0109] an encryption unit configured to encrypt the authorization information of the plurality of products by using different keys to obtain encrypted authorization files of the plurality of products;

[0110] a generating unit configured to generate a combined authorization certificate containing the encrypted authorization files of the plurality of products.

[0111] Optionally, the encryption unit comprises:

[0112] a first sub-unit configured to generate, for any product, a random symmetric key of the product;

[0113] a second sub-unit configured to encrypt the authorization information of the product by using the random symmetric key to obtain an encrypted authorization file of the product;

[0114] a third sub-unit configured to encrypt the random symmetric key of the product by using a public key of a digital certificate of the product to obtain a key exchange file of the product;

[0115] the generating unit is configured to generate a combined authorization certificate containing the encrypted authorization files and the key exchange files of the plurality of products.

[0116] Optionally, the generating unit is configured to, for any product, create an index file of the product, the index file containing file names of the encrypted authorization file and the key exchange file associated with the product; encrypt the index file by using a fixed symmetric key of the product to obtain an encrypted index file of the product; and generate a combined authorization certificate containing the encrypted index files, the encrypted authorization files, and the key exchange files of the plurality of products.

[0117] Optionally, the encryption unit further comprises:

[0118] a fourth sub-unit configured to convert the combined authorization code according to a key conversion mode corresponding to the product to obtain the fixed symmetric key of the product.

[0119] Optionally, the fourth sub-unit is configured to decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; splice the plaintext string and a preset string corresponding to the product to obtain a spliced string; perform a hash operation on the spliced string to obtain a hash value; and extract a preset field from the hash value as the fixed symmetric key.

[0120] Optionally, the third subunit is configured to encrypt the random symmetric key of the product by using the public key of the digital certificate of the product to obtain key encryption data of the product; sign the key encryption data by using the private key of the authorization center, and encrypt the signed key encryption data by using the fixed symmetric key of the product to obtain the key exchange file.

[0121] Optionally, the third subunit is configured to send a certificate signing request to the authorization center, the certificate signing request containing the metadata of the product and the key encryption data; receive an identity authentication certificate returned by the authorization center, the identity authentication certificate containing the metadata, the key encryption data, a certificate validity period, and a signature of the authorization center; and encrypt the identity authentication certificate by using the fixed symmetric key of the product to obtain the key exchange file.

[0122] Optionally, the third subunit is further configured to randomly generate an asymmetric key pair, the asymmetric key pair including a random public key and a random private key; carry the random public key in the certificate signing request; and encrypt the identity authentication certificate and the random private key by using the fixed symmetric key to obtain the key exchange file.

[0123] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0124] Optionally, the information obtaining module is configured to query authorization information of a plurality of products associated with the combined authorization code.

[0125] Optionally, the apparatus further includes:

[0126] The first checking module is configured to extract machine codes corresponding to the plurality of products from the combined authorization request, the machine codes being unique identifiers of devices on which the plurality of products are installed; associate the machine codes with the combined authorization code; and check a number of machine codes currently associated with the combined authorization code, and determine that the machine code checking passes in a case where the number of machine codes currently associated with the combined authorization code is not greater than a preset threshold value, the server being configured to return the combined authorization certificate in a case where the machine code checking passes.

[0127] Optionally, the apparatus further includes:

[0128] The authorization code sending module is configured to generate the combined authorization code in response to a combined purchase request for the plurality of products, the authorization type field in the combined authorization code being marked as combined authorization; associate the combined authorization code with authorization information of the plurality of products; and send the combined authorization code to a purchaser of the plurality of products.

[0129] Optionally, the plurality of products are respectively combined software and hardware products, and the combined authorization code does not contain authorization information for product activation.

[0130] The authorization code sending module is further configured to, in response to a purchase request for a pure software product, generate a separate authorization code corresponding to the pure software product, the separate authorization code containing authorization information for activation of the pure software product, and send the separate authorization code to a purchaser of the pure software product.

[0131] Optionally, in a case where the authorization type of the pure software product is offline authorization, an authorization type field in the separate authorization code is marked as offline authorization, and the offline authorized pure software product refers to a pure software product that does not need to be online verified for a quantity of machine codes associated with a corresponding separate authorization code in an activation process.

[0132] Alternatively, in a case where the authorization type of the pure software product is online authorization, an authorization type field in the separate authorization code is marked as online authorization, and the online authorized pure software product refers to a pure software product that needs to be online verified for a quantity of machine codes associated with a corresponding separate authorization code in an activation process.

[0133] Optionally, the device further comprises:

[0134] The second verification module is configured to, in response to a separate authorization request, extract a machine code and a separate authorization code corresponding to the pure software product from the separate authorization request, the machine code being a unique identifier of a device on which the pure software product is installed, associate the machine code corresponding to the pure software product with the separate authorization code, and verify a quantity of machine codes currently associated with the separate authorization code, and determine that the machine code verification is passed in a case where it is determined that the quantity of machine codes associated with the separate authorization code is not greater than a preset threshold, and return a product activation notification to a sender of the separate authorization request.

[0135] In addition, to achieve the above object, the application further provides a product activation device configured in a terminal, the device comprising:

[0136] The request sending module is configured to, in response to an input combined authorization code corresponding to a plurality of products, send a combined authorization request containing the combined authorization code.

[0137] The certificate receiving module is configured to receive a combined authorization certificate returned based on the combined authorization request, the combined authorization certificate containing authorization information of the plurality of products.

[0138] The information extracting module is configured to extract the authorization information of the plurality of products from the combined authorization certificate respectively.

[0139] a product activation module, configured to activate the plurality of products installed in the terminal based on the authorization information of the plurality of products.

[0140] Optionally, the combined authorization certificate comprises encrypted authorization files of the plurality of products.

[0141] The information extraction module is configured to decrypt the encrypted authorization file of each product by using the key of each product to obtain the authorization information of each product, and the keys of the plurality of products are different.

[0142] Optionally, the combined authorization certificate further comprises key exchange files of the plurality of products; and the information extraction module comprises:

[0143] a key decryption unit, configured to, for any product, decrypt the key exchange file of the product by using the private key of the digital certificate of the product to obtain a random symmetric key of the product.

[0144] an information decryption unit, configured to decrypt the encrypted authorization file of the product by using the random symmetric key of the product to obtain the authorization information of the product.

[0145] Optionally, the combined authorization certificate further comprises encrypted index files of the plurality of products; and the information extraction module further comprises:

[0146] a file query unit, configured to, for any product, decrypt the encrypted index file of the product by using the fixed symmetric key of the product to obtain an index file of the product, the index file comprising file names of the encrypted authorization file and the key exchange file associated with the product; and query the encrypted authorization file and the key exchange file of the product from the combined authorization certificate based on the file names.

[0147] Optionally, the information extraction module further comprises:

[0148] a key conversion unit, configured to, for any product, convert the combined authorization code according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product.

[0149] Optionally, the key conversion unit is configured to decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; concatenate the plaintext string with a preset string corresponding to the product to obtain a concatenated string; perform a hash operation on the concatenated string to obtain a hash value; and extract a preset field from the hash value as the fixed symmetric key.

[0150] Optionally, the key decryption unit is configured to decrypt the key exchange file of the product by using the fixed symmetric key of the product, and verify a signature carried by the decrypted key encrypted data by using the public key of the authorization center; in a case where the signature verification is passed, decrypt the key encrypted data by using the private key of the digital certificate of the product to obtain the random symmetric key of the product.

[0151] Optionally, the key decryption unit is configured to decrypt the key exchange file by using the fixed symmetric key of the product to obtain an identity authentication certificate, the identity authentication certificate containing the key encrypted data, a certificate validity period and a signature of the authorization center; verify the signature by using the public key of the authorization center, and in a case where the signature verification is passed and the current time is within the certificate validity period, extract the key encrypted data from the identity authentication certificate.

[0152] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0153] Optionally, the request sending module is configured to send a combined authorization request containing the combined authorization code and a machine code in response to the input combined authorization code corresponding to the plurality of products and the machine code, the machine code being a unique identifier of a device on which the plurality of products are installed.

[0154] Optionally, the plurality of products are respectively software and hardware combined products, and the combined authorization code does not contain authorization information for product activation; the apparatus further comprises:

[0155] an authorization code analysis module configured to analyze the authorization information of the pure software product from a single authorization code of the pure software product in response to the input single authorization code of the pure software product;

[0156] The product activation module is further configured to activate the pure software product installed in the terminal based on the authorization information of the pure software product.

[0157] Optionally, the product activation module is configured to activate the pure software product installed in the terminal based on the authorization information of the pure software product in a case where the authorization type in the authorization information is offline authorization; or, in a case where the authorization type in the authorization information is online authorization, send a single authorization request containing the single authorization code and a machine code, and activate the pure software product installed in the terminal based on the authorization information of the pure software product in a case where a product activation notification returned based on the single authorization request is received, the machine code being a unique identifier of a device on which the pure software product is installed.

[0158] Optionally, the terminal is a proxy activation terminal, and the product activation module is further configured to determine a plurality of agent terminals associated with the proxy activation terminal, and send authorization information of the plurality of products to each of the agent terminals, so that each of the agent terminals activates the plurality of products installed locally based on the authorization information of the plurality of products.

[0159] In addition, to achieve the above object, the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the product authorization method as described above, or the computer program is configured to implement the steps of the product parsing method as described above.

[0160] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer readable storage medium, and a computer program is stored in the storage medium, wherein the computer program is executed by a processor to implement the steps of the product authorization method as described above, or the computer program is executed by a processor to implement the steps of the product parsing method as described above.

[0161] In addition, to achieve the above object, the present application further provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the steps of the product authorization method as described above, or the computer program is executed by a processor to implement the steps of the product parsing method as described above.

[0162] The one or more technical solutions provided by the present application have at least the following technical effects:

[0163] The product authorization scheme provided by the present application does not generate an authorization code and an authorization certificate for each product, but gives a combined authorization code to a plurality of products, and fuses the authorization information of the plurality of products into a combined authorization certificate. In this way, the number of authorization codes and authorization certificates can be greatly reduced, and the management difficulty can be significantly reduced. Moreover, since this scheme does not need to process each product's authorization request one by one, generate a corresponding authorization certificate to authorize each product individually. But based on the combined authorization request, a combined authorization certificate containing the authorization information of multiple products is returned to realize the batch authorization of multiple products, which greatly improves the authorization efficiency of the products. And this scheme also avoids the waste of resources caused by processing a large number of scattered single authorization requests, and improves the resource utilization rate of the server. BRIEF DESCRIPTION OF DRAWINGS

[0164] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application together with the specification.

[0165] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0166] Figure 1 A schematic diagram of an implementation environment for the product authorization method and the activation method of the present application;

[0167] Figure 2 A schematic diagram of the flow provided by the first embodiment of the product authorization method of the present application;

[0168] Figure 3 A schematic diagram of the detailed steps of step S130 in the second embodiment of the product authorization method of the present application;

[0169] Figure 4 A schematic diagram of the newly added steps in the third embodiment of the product authorization method of the present application;

[0170] Figure 5 A schematic diagram of the flow provided by the first embodiment of the product activation method of the present application;

[0171] Figure 6 A schematic diagram of the detailed steps of step S230 in the second embodiment of the product activation method of the present application;

[0172] Figure 7 A schematic diagram of the newly added steps in the third embodiment of the product activation method of the present application;

[0173] Figure 8 A schematic diagram of a product authorization and activation process provided by the embodiments of the present application;

[0174] Figure 9 A schematic diagram of an authorization certificate encryption flow provided by the embodiments of the present application;

[0175] Figure 10 A schematic diagram of an authorization certificate decryption flow provided by the embodiments of the present application;

[0176] Figure 11 A structural schematic diagram of a light asset product authorization function module provided by the embodiments of the present application;

[0177] Figure 12 A structural schematic diagram of a heavy asset product authorization function module provided by the embodiments of the present application;

[0178] Figure 13 A structural schematic diagram of a combined authorization function module provided by the embodiments of the present application;

[0179] Figure 14 Module structure diagram of product authorization device of an embodiment of the present application;

[0180] Figure 15 Module structure diagram of product activation device of an embodiment of the present application;

[0181] Figure 16 Device structure diagram of hardware running environment involved in the method of an embodiment of the present application.

[0182] The object, function features and advantages of the present application will be further explained in combination with embodiments and with reference to the drawings. DETAILED DESCRIPTION

[0183] It should be understood that the specific embodiments described herein are merely intended to explain the technical solutions of the present application, and are not used to limit the present application.

[0184] In order to better understand the technical solutions of the present application, the following will be explained in detail in combination with the drawings of the specification and specific embodiments.

[0185] Figure 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application. Referring to Figure 1 , the implementation environment includes a first terminal 101 and a server 102. The first terminal 101 and the server 102 are connected through a wireless or wired network. Illustratively, the first terminal 101 is installed with a plurality of software products provided by the server 102 with authentication services, and the first terminal 101 can realize functions such as data transmission, message interaction, etc. through each software product. Illustratively, the first terminal 101 is a computer, a mobile phone, a tablet computer or other first terminal. Illustratively, the software product is a software product in the operating system of the first terminal 101, or a software product provided by a third party.

[0186] In the present application, when a user needs to activate multiple software products installed in a first terminal 101, the user can input a combined authorization code of the multiple software products in the first terminal 101. The first terminal 101 sends a combined authorization request containing the combined authorization code to a server 102 in response to the input combined authorization code corresponding to the multiple products. In response to the combined authorization request, the server 102 extracts the combined authorization code corresponding to the multiple products from the combined authorization request. Based on the combined authorization code, the authorization information of the multiple products is obtained. Based on the authorization information of the multiple products, a combined authorization certificate corresponding to the multiple products is generated, which includes the authorization information of the multiple products. Then the combined authorization certificate is returned to the first terminal 101. In response, the first terminal 101 receives the combined authorization certificate and extracts the authorization information of the multiple products from the combined authorization certificate. Based on the authorization information of the multiple products, the multiple products installed in the first terminal are activated. In this way, the user can normally use the functions of the multiple software products.

[0187] It should be noted that the above-mentioned first terminal 101 is the terminal of the product purchaser. The server 102 is the server of the permission authentication platform. The exemplary implementation environment further includes a second terminal 103, which is the terminal of the product supplier. The second terminal 103 is connected to the server 102 of the permission authentication platform. After developing a software product, the product supplier can interact with the server 102 through the second terminal 103, so as to obtain a program installation package (SDK, Software Development Kit) for permission authentication provided by the permission authentication platform. Subsequently, the product supplier can integrate the program installation package into the software product. In this way, after the user purchases the software product of the product supplier and installs the software product in the first terminal 101, the first terminal 101 can interact with the server 102 based on the program installation package for permission authentication integrated in the software product, so as to obtain the authorization of the server 102, thereby activating the installed software product.

[0188] Exemplarily, the program installation package contains multiple versions of programs for permission authentication in Java, Python, C++, etc., supporting multiple operating systems such as Windows, Linux, macOS, etc. Among them, Java, Python, C++ are the names of programming languages, and Windows, Linux, macOS are the names of operating systems. In addition, the programs in the program installation package can run in an independent process to limit direct access to sensitive data and prevent reverse attacks.

[0189] For example, the server 102 of the permission authentication platform can implement automatic interaction with the second terminal 103 through a webhook to provide the product supplier with information about product authorization. For example, a webhook event is defined. The webhook event types include sending a notification when a combined authorization function is enabled, sending a notification 7 days before an authorization code or authorization certificate expires, sending a notification when an authorization certificate is generated, and the like. In this way, when the authorization process reaches the relevant node, the server 102 automatically sends the second terminal 103 a relevant notification.

[0190] In the present application, in the case where a user purchases and installs a plurality of software products provided by a product supplier, the permission authentication platform provides the user with a combined authorization code corresponding to the plurality of software products through the server 102. The user can exchange the combined authorization code for a combined authorization certificate from the server 102 through the first terminal 101, and activate the plurality of software products in batches based on the combined authorization certificate. In this way, not only the efficiency of product authorization by the permission authentication platform is improved, but also the efficiency of product activation by the user is improved, and the resources of the server and the terminal are saved.

[0191] Figure 2 The flowchart of the first embodiment of the product authorization method of the present application is shown. Referring to Figure 2 Taking the server as an example of the execution subject, the product authorization method includes the following steps S110-S140:

[0192] Step S110, in response to a combined authorization request, extracting a combined authorization code corresponding to a plurality of products from the combined authorization request.

[0193] The combined authorization request is a request issued by a user terminal, and its purpose is to obtain authorization for a plurality of products at one time. Unlike a single authorization request, the combined authorization request carries a combined authorization code corresponding to a plurality of products. That is, the combined authorization code is a special authorization code associated with a plurality of products. It is not an ordinary authorization code generated for a single product, and through this combined authorization code, authorization-related content for a plurality of products can be obtained at one time.

[0194] The plurality of products refers to two or more different software products, which can belong to the same type, for example, including a main product and at least one secondary product associated with the main product. Alternatively, they can be products of different types but need to be managed uniformly.

[0195] Optionally, the machine code corresponding to the plurality of products is also carried in the combination authorization request, and the machine code refers to a unique identifier of a device on which the plurality of products are installed. Correspondingly, the server needs to perform machine code verification based on the machine code, and generate a combination authorization certificate and return the combination authorization certificate to the user terminal in the case that the verification is passed. Specifically, the server extracts the machine code corresponding to the plurality of products from the combination authorization request, and associates the machine code with the combination authorization code. Then, the number of machine codes currently associated with the combination authorization code is checked, and it is determined that the machine code verification is passed in the case that the number of machine codes associated with the combination authorization code is determined to be not greater than a preset threshold. The preset threshold refers to the number of machine codes that can be associated with the combination authorization code at most, which means that the plurality of software products can be applied to a corresponding number of devices at most.

[0196] By performing the machine code verification, the number of devices to which the software products are applied can be flexibly limited. The combination authorization code is avoided from being associated with a large number of devices without limitation, so that the software resources are avoided from being excessively used and wasted, and it is ensured that the use of each combination authorization code is within a reasonable range.

[0197] In step S120, authorization information of the plurality of products is obtained based on the combination authorization code.

[0198] The authorization information contains detailed contents of the product use permission, for example, a usable user identifier, a usable time limit, usable function information, a usable device number, a usable platform, a usable region, an authorization type, and the like, which is a basis for legal use of the product.

[0199] Optionally, the server stores an association relationship between the combination authorization code and the authorization information of the plurality of products, and correspondingly, the authorization information of the plurality of products associated with the combination authorization code can be queried based on the combination authorization code. Compared with the authorization information of each product, the query based on the association relationship greatly shortens the response time, can provide the authorization service for the user more quickly, and improves the user experience.

[0200] In step S130, a combination authorization certificate corresponding to the plurality of products is generated based on the authorization information of the plurality of products, and the combination authorization certificate includes the authorization information of the plurality of products.

[0201] The combination authorization certificate is a comprehensive certificate generated according to the authorization information of the plurality of products. It integrates the authorization information of the plurality of products together, which is equivalent to a collection proof of the authorization of the plurality of products. The user holding the certificate can use all the products contained in the certificate, and the certificate can be used for activation operation of the products.

[0202] Optionally, based on the authorization information of the plurality of products, a combined authorization certificate corresponding to the plurality of products is generated, including: encrypting the authorization information of the plurality of products using different keys to obtain encrypted authorization files of the plurality of products; and generating the combined authorization certificate containing the encrypted authorization files of the plurality of products.

[0203] Encrypting the authorization information of each product using different keys is equivalent to setting an independent security lock for the authorization information of each product, and the authorization information of the plurality of products is securely isolated. Even if the key of a certain authorization information is cracked, the attacker can only obtain the authorization information of the corresponding single product, and cannot obtain the authorization information of other products. The risk of stealing the authorization information of multiple products due to the leakage of a single key is avoided, and the security of the overall authorization system is enhanced.

[0204] For example, the authorization information of each product is encrypted using the public key of the digital certificate of each product to obtain the encrypted authorization file of each product. In this way, the encrypted authorization file of each product can only be decrypted by the private key of the corresponding digital certificate.

[0205] In step S140, the combined authorization certificate is returned to the sender of the combined authorization request, and the combined authorization certificate is used to activate the plurality of products.

[0206] The sender of the combined authorization request refers to the subject initiating the combined authorization request, for example, a terminal user using the software, etc., which needs to obtain the authorization of the plurality of products to activate the plurality of products, and therefore sends a request to obtain the combined authorization certificate.

[0207] Activation refers to an operation of changing a software product from an unauthorized state to a normal use state. After obtaining the combined authorization certificate, the user applies it to the corresponding plurality of products, and after verification, the product can be normally used according to the permissions and scope specified in the authorization information.

[0208] The product authorization scheme provided in the present application does not generate an authorization code and an authorization certificate for each product, but rather assigns a combined authorization code to a plurality of products, and integrates the authorization information of the plurality of products into a combined authorization certificate. In this way, the number of authorization codes and authorization certificates can be greatly reduced, and the management difficulty can be significantly reduced. Moreover, since this scheme does not need to process the authorization request of each product one by one, generate the corresponding authorization certificate to authorize each product individually, but rather based on the combined authorization request, returns the combined authorization certificate containing the authorization information of the plurality of products to realize the batch authorization of the plurality of products, greatly improving the authorization efficiency of the product. Moreover, this scheme also avoids the waste of resources caused by processing a large number of scattered single authorization requests, and improves the resource utilization rate of the server.

[0209] Based on the first embodiment, the second embodiment of the present application is proposed. The same or similar contents as the first embodiment can be referred to the foregoing description, and the subsequent description will not be repeated. Refer to Figure 3 In the second embodiment, the step S130 includes steps S1301-S1304:

[0210] Step S1301, for any product, a random symmetric key of the product is generated.

[0211] The random symmetric key is a symmetric key randomly generated by the product. The symmetric key refers to the same key used in the encryption and decryption process.

[0212] Step S1302, the authorization information of the product is encrypted using the random symmetric key, and an encrypted authorization file of the product is obtained.

[0213] The random symmetric key is randomly generated, which means that the keys used to encrypt the authorization information of each product are different, and the keys used to encrypt the authorization information each time are different, which increases the security of the authorization information.

[0214] Step S1303, the random symmetric key of the product is encrypted using the public key of the digital certificate of the product, and a key exchange file of the product is obtained.

[0215] The digital certificate is an authoritative electronic document used to prove the identity of the product and the legality of the public key. In the present application, the product has a digital certificate, and the public key thereof is used to encrypt the random symmetric key to ensure the secure transmission of the key. The private key is embedded in the product and used for decryption.

[0216] The key exchange file is obtained by encrypting the random symmetric key using the public key of the product digital certificate. Its function is to realize the exchange and transmission of the key under the premise of ensuring the security of the random symmetric key, so that the legitimate receiver can decrypt the random symmetric key through the corresponding private key, and then decrypt the authorization information of the product.

[0217] Optionally, the random symmetric key of the product is encrypted using the public key of the digital certificate of the product to obtain the key exchange file of the product, including: the random symmetric key of the product is encrypted using the public key of the digital certificate of the product to obtain key encryption data of the product; the key encryption data is signed using the private key of the authorization center, and the signed key encryption data is encrypted using the fixed symmetric key of the product to obtain the key exchange file.

[0218] The key encryption data is the data obtained by encrypting the random symmetric key of the product using the public key of the product digital certificate. It is an intermediate product in the key exchange process, and the purpose is to preliminarily encrypt the random symmetric key.

[0219] The authorization center is an authoritative agency responsible for managing and distributing authorization information. It has a private key for signing relevant data to verify the source and integrity of the data. By signing the key encryption data using the private key of the authorization center, it can prove that the data is recognized by the authorization center and has not been tampered with during transmission.

[0220] The fixed symmetric key is a symmetric key that is pre-set for the product and does not change. It is used to re-encrypt the signed key encryption data, further enhancing the security of the data.

[0221] In the embodiments of the present application, multiple technologies such as public key encryption, private key signature, and symmetric key encryption are combined. Among them, the public key of the product's digital certificate is used to encrypt the product's random symmetric key, ensuring the secure transmission of the random symmetric key. The private key of the authorization center is used to sign the key encryption data, ensuring the legitimacy of the data source and the integrity of the data content. The fixed symmetric key of the product is used to encrypt the signed key encryption data, providing efficient encryption and decryption performance. The comprehensive use of these technologies effectively ensures the security of the key exchange file, and further ensures the security of the authorization information.

[0222] Optionally, the private key of the authorization center is used to sign the key encryption data, and the fixed symmetric key of the product is used to encrypt the signed key encryption data to obtain the key exchange file, including: sending a certificate signing request to the authorization center, the certificate signing request containing the product's metadata and the key encryption data; receiving the identity authentication certificate returned by the authorization center, the identity authentication certificate containing the metadata, the key encryption data, the certificate validity period and the signature of the authorization center; using the fixed symmetric key of the product to encrypt the identity authentication certificate to obtain the key exchange file.

[0223] The certificate signing request (CSR, Certificate Signing Request) is a request submitted by the server to the authorization center, which contains the product's metadata and the key encryption data. The purpose is to let the authorization center issue an identity authentication certificate with legitimacy and authority.

[0224] The product's metadata is descriptive information about the product, such as product name, country and region, company location, company name, version number, functional characteristics, etc. These information helps the authorization center to identify and verify the identity of the product.

[0225] The identity authentication certificate is a file generated and returned to the server by the authorization center according to the certificate signing request. It contains the product metadata, key encryption data, certificate validity period and signature of the authorization center. The identity authentication certificate is used to prove the legitimacy of the product identity and the authenticity of the related information. For example, the identity authentication certificate can also contain other information, such as issuer information, i.e. the information of the authorization center.

[0226] The certificate validity period specifies the valid use period of the identity authentication certificate. Within this period, the certificate is considered to be legal and effective. For example, the certificate validity period contains the certificate start time and the certificate expiration time. The certificate start time is the time when the certificate is packaged, and the certificate expiration time is the product authorization expiration time.

[0227] The signature of the authorization center is a digital signature obtained by the authorization center using its own private key to encrypt the contents in the identity authentication certificate. Through this signature, the receiver can use the public key of the authorization center to verify the authenticity and integrity of the certificate, and ensure that the certificate is issued by the authorization center and has not been tampered with.

[0228] Optionally, the above-mentioned identity authentication certificate is an X.509 certificate. X.509 is a digital certificate standard developed by the International Telecommunication Union, and the X.509 certificate is a kind of digital certificate complying with the standard. The X.509 certificate is a widely accepted standard format, and different devices, platforms and software can easily verify and identify the X.509 certificate without additional customization development, greatly improving the compatibility and scalability of the system, and facilitating deployment and use in different network environments and application scenarios.

[0229] In the embodiments of the present application, through the certificate signing request, the authorization center audits and signs the product metadata and key encryption data to obtain an identity authentication certificate containing key encryption data. Then the identity authentication certificate is encrypted using the fixed symmetric key of the product, multiple security protections are constructed, and the security of the key encryption data is effectively enhanced. Moreover, the setting of the certificate validity period makes the certificate automatically invalid beyond the validity period, and needs to be re-applied, which helps to update the product information and key in time, and ensures the security and compliance of the entire authorization process.

[0230] Optionally, the server randomly generates an asymmetric key pair including a random public key and a random private key before sending the certificate signing request to the authorization center. The random public key is then carried in the sent certificate signing request. Correspondingly, the identity authentication certificate returned by the authorization center also contains the public key, and the signature of the authorization center is a signature on the product metadata, the key encryption data, the certificate validity period, and the public key. Subsequently, the identity authentication certificate is encrypted using the fixed symmetric key of the product to obtain a key exchange file, including: encrypting the identity authentication certificate and the random private key using the fixed symmetric key to obtain the key exchange file.

[0231] For example, the identity authentication certificate and the random private key are packaged into a PKCS # 12 container, and then the PKCS # 12 container is encrypted using the fixed symmetric key to obtain a PKCS # 12 (Public-Key Cryptography Standards # 12) file. That is, the key exchange file is a PKCS # 12 file. The PKCS # 12 file is a file format defined under the public key cryptography standard system. The PKCS # 12 file has a specific structure and can organize different types of keys, certificates, and other attributes together, so that various information can be clearly identified and distinguished.

[0232] Since the standard PKCS # 12 file is used to transmit a key pair, i.e., a public key and a private key, the key pair needs to be carried. Therefore, the embodiment of the present application randomly generates an asymmetric key pair, which occupies a corresponding position in the key exchange file, so that the key exchange file strictly conforms to the format standard of the PKCS # 12 file. In this way, the standardized, secure, and compatible characteristics of the PKCS # 12 file can be fully utilized to achieve a more efficient and secure key exchange process.

[0233] It should be noted that the key exchange file in the embodiment of the present application conforms to the format standard of the PKCS # 12, but the content therein is changed. The change mainly reflects the addition of the product metadata and the key encryption data, so that the standardized, secure, and compatible characteristics of the PKCS # 12 file can be better utilized to transmit the key encryption data to the user terminal. For example, the above-mentioned PKCS # 12 file can be generated using a standard OpenSSL (an open source toolkit), and then converted to custom content. For example, in order to facilitate the user terminal to find the key encryption data from the key exchange file later, the key encryption data can be named in a predefined manner, for example, named as ans1.2.5.4.13. In this way, the user terminal only needs to find the file with this name from the key exchange file and decrypt it to obtain the random symmetric key.

[0234] For example, the PKCS#12 container is encrypted by using a 3DES (Triple Data Encryption Standard) algorithm to obtain a PKCS#12 file, so as to ensure the security and confidentiality of the data in the container.

[0235] In step S1304, a combined authorization certificate containing the encrypted authorization files and the key exchange files of the plurality of products is generated.

[0236] For example, the product information is contained in the file names of the encrypted authorization files and the key exchange files of the plurality of products, so that the user terminal can find the encrypted authorization data and the key exchange files of each product from the combined authorization certificate.

[0237] Optionally, the generating of the combined authorization certificate containing the encrypted authorization files and the key exchange files of the plurality of products comprises: for any product, creating an index file of the product, the index file containing the file names of the encrypted authorization file and the key exchange file associated with the product, encrypting the index file by using the fixed symmetric key of the product to obtain an encrypted index file of the product; and generating the combined authorization certificate containing the encrypted index files, the encrypted authorization files, and the key exchange files of the plurality of products.

[0238] In the authorization scenario involving the plurality of products, there are a plurality of encrypted authorization files and key exchange files in the combined authorization certificate. By creating the product index file, the names of the encrypted authorization file and the key exchange file associated with each product are recorded in the index file, and the index file is encrypted to generate the combined authorization certificate containing the encrypted index file. On the one hand, when the authorization information of a certain product is needed, the corresponding index file is only needed to be checked, and the required file can be quickly located, which greatly improves the efficiency of file searching. On the other hand, since the index file provides an additional layer of security by encryption, even if an attacker obtains the combined authorization certificate, the attacker cannot decrypt the index file without the corresponding fixed symmetric key, and thus cannot obtain the information of the encrypted authorization file and the key exchange file recorded in the index file, further enhancing the security of the authorization information.

[0239] The product information is contained in the file name of the index file of the product, and the product information is not contained in the file name of the encryption authorization file and the key exchange file. For example, the file name of the index file is {product UUID}.data, the file name of the encryption authorization file is {data UUID}.b, and the file name of the key exchange file is {data UUID}.p. The full name of UUID is Universally Unique Identifier, which means unique identifier. The encryption authorization file and the key exchange file use the naming method of {data UUID}.b and {data UUID}.p, and do not contain product information, so that the use and the product to which the files belong have a certain concealment. Even if the files are illegally obtained, it is difficult for an attacker to directly determine from the file name which product they are related to, increasing the difficulty for the attacker to obtain sensitive information of the product and improving the security of the system.

[0240] Optionally, before the index file is encrypted by using the fixed symmetric key of the product, the fixed symmetric key of the product is obtained. The obtaining method is: converting the combined authorization code according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product. Different products correspond to different key conversion modes. Compared with directly storing and using the fixed symmetric key, this key conversion mode based on the combined authorization code makes it necessary for an attacker to not only obtain the combined authorization code but also understand a specific key conversion mode to obtain the key, greatly increasing the difficulty of attack, improving the security of the key, and reducing the risk of leakage of the key in the storage and transmission process.

[0241] Optionally, converting the combined authorization code according to the key conversion mode corresponding to the product to obtain the fixed symmetric key of the product includes: decrypting the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; concatenating the plaintext string with a preset string corresponding to the product to obtain a concatenated string; performing a hash operation on the concatenated string to obtain a hash value; and extracting a preset field from the hash value as the fixed symmetric key. This scheme generates the fixed symmetric key through multiple steps of authorization code decryption, string concatenation, hash operation, and string extraction, making the generation of the fixed symmetric key highly unpredictable and effectively improving the security of the key.

[0242] For example, the preset string corresponding to each product is obtained by encoding the configuration information of each product, and the preset strings corresponding to different products are different. In this way, even if multiple products use the same combined authorization code, the generated fixed symmetric keys will be different due to the different preset strings, ensuring the uniqueness of the key of each product.

[0243] For example, the 16th to 24th characters in the hash value are taken as the fixed symmetric key of the product. Alternatively, the field taken by each product can be different, which is not limited in the present application.

[0244] In the embodiment of the present application, the random symmetric key is used to encrypt the product authorization information to generate an encrypted authorization file. The randomness of the random symmetric key makes each encryption unique, so that the encrypted authorization file is difficult to be cracked. The public key of the digital certificate is used to encrypt the random symmetric key to generate a key exchange file, which ensures that the random symmetric key is not stolen or tampered with during transmission and storage, and guarantees the confidentiality and integrity of the key. This double encryption mode greatly enhances the security of the authorization information.

[0245] Based on the first embodiment of the present application, the third embodiment of the present application is proposed. The same or similar contents as the first embodiment can be referred to the foregoing description, and will not be described in detail hereinafter. For reference Figure 4 In the third embodiment, before step S110, steps S101-S103 are further included.

[0246] In step S101, in response to a combined purchase request for multiple products, a combined authorization code is generated, and the authorization type field in the combined authorization code is marked as combined authorization.

[0247] The combined purchase request refers to a purchase application initiated by a user to multiple products at the same time.

[0248] The combined authorization code is a unique code generated according to the combined purchase request, which is used to authorize the purchaser to use the purchased multiple products. The authorization type field therein is marked as combined authorization, so as to distinguish from the authorization code of a single product, and indicate that the authorization code is for combined authorization of multiple products.

[0249] In step S102, the combined authorization code is associated with the authorization information of the multiple products.

[0250] The authorization information contains various detailed information related to product authorization, and each product has its corresponding authorization information. The combined authorization code is associated with the authorization information of the multiple products, so as to facilitate subsequent query of the authorization information of the multiple products based on the combined authorization code to generate a combined authorization certificate.

[0251] In step S103, the combined authorization code is sent to the purchaser of the multiple products.

[0252] In the embodiment of the present application, in the case that a user purchases multiple products, a combined authorization code is issued to the user. In this way, the user can exchange the combined authorization certificate from the server based on the combined authorization code in the future, so as to realize batch authorization of the multiple products, thereby improving the product activation efficiency.

[0253] It should be noted that the product in the present application refers to a software product. The software product includes a combination of software and hardware products, and a pure software product. Alternatively, the above-mentioned products are respectively a combination of software and hardware products, and the combined authorization code does not include authorization information for product activation. The combination of software and hardware products refers to a product composed of software and hardware, and the two work together to achieve a specific function. Such products have high value and can also be called heavy asset products. In order to ensure the security of the authorization process of such products, the combined authorization code does not carry the authorization information of the product and cannot be directly used to activate the product. The combined authorization code can be regarded as an authorization voucher for obtaining a combined authorization certificate, and then activating the product.

[0254] Unlike the combination of software and hardware products, the pure software product is mainly composed of computer programs, data and related documents, and can be independently run and achieve a specific function without relying on specific hardware devices. Compared with the combination of software and hardware products, the value of the pure software product is relatively low and can also be called a light asset product. In order to ensure the flexibility of the authorization of the pure software product, the software authorization code of the pure software product can carry the product authorization information, so that the pure software product supports direct product activation using the software authorization code. Correspondingly, the method further includes: the server generates a separate authorization code corresponding to the pure software product in response to a purchase request for the pure software product, and sends the separate authorization code to the purchaser of the pure software product. The separate authorization code includes authorization information for activating the pure software product. For example, the user identifier that can be used, the time limit that can be used, the function information that can be used, the number of devices that can be used, the platform that can be used, the region that can be used, the authorization type, etc. The present application does not limit this.

[0255] Alternatively, in the case of offline authorization of the pure software product, the authorization type field in the separate authorization code is marked as offline authorization. The offline authorized pure software product refers to a pure software product that does not need to be online to check the number of machine codes associated with the corresponding separate authorization code during activation. In this way, when the user terminal identifies that the authorization type in the software authorization code is offline authorization, the authorization information in the software authorization code can be locally parsed, and the product can be activated based on the parsed authorization information. This scheme enables the product to support offline activation, greatly improving the flexibility of software activation.

[0256] Or, in the case of the authorization type of the pure software product is online authorization, the authorization type field in the single authorization code is marked as online authorization, and the pure software product of online authorization refers to the pure software product which needs to be verified online in the activation process. The number of machine codes associated with the corresponding single authorization code. In this way, when the user terminal recognizes that the authorization type in the software authorization code is online authorization, it can send a single authorization request carrying the software authorization code and the machine code to the server. The server returns the product activation notification to the user terminal after the machine code verification is passed. The user terminal can activate the product based on the authorization information parsed from the software authorization code locally.

[0257] Optionally, the process of the server performing machine code verification includes: in response to the single authorization request, extracting the machine code corresponding to the pure software product and the single authorization code from the single authorization request, the machine code being a unique identifier of a device installing the pure software product. After associating the machine code corresponding to the pure software product with the single authorization code, the number of machine codes currently associated with the single authorization code is verified. In the case where it is determined that the number of machine codes associated with the single authorization code is not greater than a preset threshold, it is determined that the machine code verification is passed. The sender of the single authorization request returns the product activation notification. In this way, the number of devices of the application software can be limited to avoid illegal overuse of the software.

[0258] In the present application, the authorization type in the software authorization code is used to distinguish the authorization scenarios, so that the authorization system supports more authorization scenarios. For example, the authorization scheme of the present application supports offline activation of pure software products in a network-free environment, and also supports online activation of pure software products that need to be verified by machine code. In addition, it also supports the combination authorization and batch activation of software and hardware combined products. Furthermore, it also supports offline activation of software and hardware combined products by using the authorization certificate after exchanging the authorization certificate.

[0259] In the authorization system constructed in the present application, the authorization type field in the software authorization code is used to accurately distinguish diversified authorization scenarios, greatly expanding the application range of the authorization system. For example, the authorization scheme supports offline activation of pure software products in a network-free environment, providing convenient activation services for users who cannot connect to the network. At the same time, for pure software products that need to be verified by machine code, online activation can also be successfully realized, ensuring the legality and security of software use. For software and hardware combined products, not only combination authorization is supported, but also the demand of users for efficient activation of multiple products is met. In addition, after exchanging the authorization certificate for software and hardware combined products, offline activation can be completed by using the authorization certificate, providing a flexible and reliable authorization method for users in complex and variable use scenarios.

[0260] Figure 5 The flowchart of the first embodiment of the product activation method of the present application is shown. Referring to Figure 5Taking the first terminal as an example, the product activation method comprises the following steps S210-S240:

[0261] Step S210, in response to the inputted combined authorization code corresponding to the plurality of products, a combined authorization request containing the combined authorization code is sent.

[0262] The first terminal is also a terminal of a product purchaser.

[0263] Optionally, in response to the inputted combined authorization code corresponding to the plurality of products, the combined authorization request containing the combined authorization code is sent, comprising: in response to the inputted combined authorization code corresponding to the plurality of products and a machine code, a combined authorization request containing the combined authorization code and the machine code is sent, the machine code being a unique identifier of a device in which the plurality of products are installed. In this way, the server can perform machine code verification, and generate and return a combined authorization certificate if the machine code verification is passed.

[0264] Step S220, the combined authorization certificate returned based on the combined authorization request is received, the combined authorization certificate containing authorization information of the plurality of products.

[0265] It should be noted that if the first terminal in which the plurality of products are currently installed is in a network-free environment, the user can also use other devices to send a combined authorization request to the server and receive a returned combined authorization certificate. Then the combined authorization certificate is imported into the first terminal, so that the first terminal can activate the plurality of products offline based on the combined authorization certificate.

[0266] Step S230, the authorization information of the plurality of products is extracted from the combined authorization certificate respectively.

[0267] It should be noted that after the first terminal receives the combined authorization certificate, the combined authorization certificate is distributed to each software product installed. Correspondingly, each software product extracts the corresponding authorization information from the combined authorization certificate.

[0268] Optionally, the combined authorization certificate contains encrypted authorization files of the plurality of products. Correspondingly, the first terminal decrypts the encrypted authorization files of the plurality of products using the keys of the plurality of products, to obtain the authorization information of the plurality of products, the keys of the plurality of products being different.

[0269] Illustratively, the encrypted authorization files of the plurality of products are encrypted using the public keys of the digital certificates of the plurality of products, and correspondingly, the plurality of products decrypt the corresponding encrypted authorization files using the private keys of the digital certificates.

[0270] Step S240, the plurality of products installed in the terminal are activated based on the authorization information of the plurality of products.

[0271] Optionally, the terminal is an agent activation terminal, after activating the plurality of products installed in the terminal based on the authorization information of the plurality of products, the method further comprises: determining a plurality of agented terminals associated with the agent activation terminal; and sending the authorization information of the plurality of products to each of the agented terminals, so that each of the agented terminals activates the plurality of products installed locally based on the authorization information of the plurality of products.

[0272] The agent activation terminal can also be referred to as a master center, which is responsible for the distribution, recovery, and state monitoring of the authorization information of the plurality of agented terminals. For example, the agent activation terminal provides a graphical interface, and an administrator can select an agented terminal that needs to be authorized based on the interface, send authorization information to the agented terminal, and then activate the products in the agented terminal.

[0273] In an enterprise environment, there are usually a large number of terminal devices that need to install and activate a plurality of products. Using the above-mentioned agent activation scheme, efficient activation of a large number of terminals can be achieved, and centralized management and control of enterprise-level systems is also facilitated.

[0274] The product activation scheme provided by the embodiments of the present application does not need to send an authorization request for each product one by one, obtain a corresponding authorization certificate, and activate each product individually. Instead, a combined authorization request is used to obtain a combined authorization certificate containing authorization information of a plurality of products, so as to achieve batch activation of a plurality of products, greatly improving the authorization efficiency of the products. This scheme enables the user to input only one combined authorization code to complete the activation operation of multiple products, greatly saving the user's time and effort, and reducing the complexity of the activation operation. Especially for users who use multiple related products at the same time, a more convenient and efficient activation experience is provided. Moreover, the authorization and activation of multiple products can be completed by using one combined authorization code and one combined authorization certificate, which can greatly reduce the number of authorization codes and authorization certificates, and significantly reduce the management difficulty. At the same time, resource waste caused by processing a large number of dispersed single authorization requests and single authorization certificates is avoided, and the resource utilization rate of the terminal is improved.

[0275] Based on the first embodiment of the product activation method of the present application, a second embodiment of the product activation method of the present application is provided. The same or similar contents as the first embodiment can be referred to the foregoing description, and will not be described hereinafter. For reference Figure 6 In the second embodiment, step S230 comprises steps S2301-S2303.

[0276] Step S2301, for any product, extracts the key exchange file and the encrypted authorization file of the product from the combined authorization certificate, and the combined authorization certificate includes the key exchange file and the encrypted authorization file of a plurality of products.

[0277] Optionally, the product information is contained in the file names of the encrypted authorization files and the key exchange files of the plurality of products, so that the user terminal finds the encrypted authorization data and the key exchange files of each product from the combined authorization certificate.

[0278] Optionally, the combined authorization certificate further comprises encrypted index files of the plurality of products; for any product, before the product's random symmetric key is obtained by decrypting the product's key exchange file with the private key of the product's digital certificate, the product's index file is obtained by decrypting the product's encrypted index file with the product's fixed symmetric key, and the index file contains the file names of the product's encrypted authorization file and the key exchange file; based on the file names, the product's encrypted authorization file and the key exchange file are queried from the combined authorization certificate. The product information is contained in the file name of the product's index file, and the product information is not contained in the file names of the encrypted authorization file and the key exchange file.

[0279] In the authorization scenario involving a plurality of products, there are a plurality of encrypted authorization files and key exchange files in the combined authorization certificate. When the authorization information of a certain product is needed, the corresponding index file is only needed to be viewed, and the required file can be quickly located, greatly improving the efficiency of file searching. On the other hand, the index file provides an additional layer of security protection through encryption, so that the authorization information of each product is isolated. Each product can only locate its own related file through the corresponding index file, and cannot locate the related file of other products, further enhancing the security of the authorization information of each product.

[0280] Optionally, for any product, before the product's index file is obtained by decrypting the product's encrypted index file with the product's fixed symmetric key, the method further comprises: for any product, converting the combined authorization code according to the key conversion mode corresponding to the product to obtain the product's fixed symmetric key. The key conversion modes corresponding to different products are different.

[0281] Optionally, converting the combined authorization code according to the key conversion mode corresponding to the product to obtain the product's fixed symmetric key comprises: decrypting the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; concatenating the plaintext string with a preset string corresponding to the product to obtain a concatenated string; performing a hash operation on the concatenated string to obtain a hash value; and taking a preset field from the hash value as the fixed symmetric key.

[0282] Step S2302: decrypting the product's key exchange file with the private key of the product's digital certificate to obtain the product's random symmetric key.

[0283] Optionally, the product key exchange file is decrypted by using the private key of the product digital certificate to obtain the random symmetric key of the product, including: the product key exchange file is decrypted by using the fixed symmetric key of the product, and the signature carried by the decrypted key encryption data is verified by using the public key of the authorization center. In the case where the signature verification is passed, the key encryption data is decrypted by using the private key of the product digital certificate to obtain the random symmetric key of the product.

[0284] Optionally, the product key exchange file is decrypted by using the fixed symmetric key of the product, and the signature carried by the decrypted key encryption data is verified by using the public key of the authorization center, including: the product key exchange file is decrypted by using the fixed symmetric key of the product to obtain an identity authentication certificate, the identity authentication certificate containing the key encryption data, the certificate validity period and the signature of the authorization center; the signature is verified by using the public key of the authorization center, and in the case where the signature verification is passed and the current time is within the certificate validity period, the key encryption data is extracted from the identity authentication certificate. Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a PKCS#12 file.

[0285] The private key of the product digital certificate is embedded in the product, so that each product can obtain the private key of the product digital certificate locally. More specifically, the private key of the digital certificate of each product is embedded in a program installation package used for permission authentication, which is integrated in each product and used to perform operations related to product authorization, such as sending an authorization request, parsing a software authorization code, parsing a certificate, etc.

[0286] For example, the identity authentication certificate also contains metadata of the product, so that it can be determined based on the metadata that the key exchange file belongs to which product, and it can be determined whether the decrypted key exchange file is correct.

[0287] Step S2303, the encrypted authorization file of the product is decrypted by using the random symmetric key of the product to obtain the authorization information of the product.

[0288] In the embodiments of the present application, the authorization information of the product is encrypted by using the random symmetric key to generate an encrypted authorization file, and the randomness of the random symmetric key makes each encryption unique, and the terminal can only obtain the authorization information by obtaining the random symmetric key. The random symmetric key is encrypted by using the public key of the digital certificate to generate a key exchange file, so that the terminal can only be decrypted by using the private key of the product digital certificate, ensuring that the random symmetric key is not stolen or tampered with during transmission and storage, and ensuring the confidentiality and integrity of the key. This double encryption mode greatly enhances the security of the authorization information, and avoids attackers from cracking the authorization information except for legal authorization.

[0289] Based on the first embodiment of the product activation method, the third embodiment of the product activation method is provided. The same or similar contents as the first embodiment can be referred to the foregoing description, and will not be described hereinafter. Figure 7 In the third embodiment, steps S201-S202 are further included.

[0290] In step S201, the authorization information of the pure software product is parsed from the inputted individual authorization code of the pure software product.

[0291] Optionally, the products in the first and second embodiments of the product activation method are software and hardware combined products, and the combined authorization code does not include the authorization information for product activation. The product activated in the third embodiment of the product activation method is a pure software product. The individual authorization code of the pure software product inputted by the user carries the authorization information of the pure software product.

[0292] Optionally, the individual authorization code is encrypted, and the terminal can decrypt the individual authorization code by using a corresponding decryption method to obtain the plaintext of the individual authorization code. Then, the plaintext is decoded to obtain the authorization information therein.

[0293] In step S202, the pure software product installed in the terminal is activated based on the authorization information of the pure software product.

[0294] The authorization type is included in the authorization information decoded by the first terminal. The authorization type determines the activation mode of the pure software product. Optionally, in the case that the authorization type in the authorization information is offline authorization, the pure software product installed in the terminal is activated directly based on the authorization information of the pure software product. Or, in the case that the authorization type in the authorization information is online authorization, a single authorization request including the individual authorization code and the machine code is sent to the server, and in the case that a product activation notification returned based on the single authorization request is received, the pure software product installed in the terminal is activated based on the authorization information of the pure software product.

[0295] The machine code refers to the unique identifier of the device on which the pure software product is installed. The machine code can be manually inputted into the software product by the user, or detected by the software product according to a set program, which is not limited in the embodiments of the present application.

[0296] It should be noted that steps S201-S202 describe the activation process of the pure software product, and steps S210-S240 described above describe the activation process of the software and hardware combined product. The two processes do not affect each other, and therefore the execution order of the two activation processes is not limited in the present application.

[0297] Figure 8is a schematic diagram of a product authorization and activation process provided by an embodiment of the present application. Referring to Figure 8 , comprising the following steps:

[0298] Product access platform: access the software product of the product provider to the permission authentication platform.

[0299] Product private key generation: the product provider generates the private key of the digital certificate of the software product by using the service of the permission authentication platform, and embeds the private key into the authorization SDK provided by the platform, that is, the program installation package for permission authentication. In addition, the public key of the product digital certificate is uploaded to the platform.

[0300] Integration of authorization SDK: the product provider integrates the authorization SDK into the software product.

[0301] User purchases product: the user purchases the product of the product provider, and the product order information is synchronized from the system of the product provider to the permission authentication platform.

[0302] Authorization code generation: the permission authentication platform generates the authorization code of the product.

[0303] Authorization code distribution: the permission authentication platform sends the authorization code to the user.

[0304] Whether light asset: after installing the software product on the user terminal, determine the activation method based on the product type. Among them, the activation methods of light asset products and heavy asset products are different.

[0305] Activate the product using the authorization code: in the case of light asset product, activate the product using the authorization code. Here, the difference from heavy asset product is mainly explained. If it is a heavy asset product, the authorization code needs to be sent to the server of the permission authentication platform to obtain an authorization certificate, and then activate the product.

[0306] Parse the authorization code: the authorization SDK integrated by the software product installed in the user terminal parses the authorization code, which includes decrypting the authorization code and extracting various authorization information therein.

[0307] Determine the authorization type: the authorization information contains the authorization type, which determines the activation method of the light asset product. The authorization type includes offline authorization and online authorization.

[0308] Product offline activation: in the case of offline authorization type, activate the product based on the parsed authorization information.

[0309] Product activation after online machine code verification: in the case of online authorization type, send the authorization code of the product and the machine code of the user terminal to the server of the permission authentication platform for machine code verification. After verification, activate the product using the parsed authorization information.

[0310] Authorization code application for authorization certificate: In the case of a product type that is a capital-intensive product, the authorization code is sent to the server of the authorization authentication platform to obtain the authorization certificate returned by the server.

[0311] Control Center Activation: Based on the device type from which the license certificate is imported, there are two activation methods: Control Center Activation and Regular Device Activation. The Control Center acts as an intermediary, acting as a proxy for the connected devices to resolve the certificate.

[0312] Importing the license certificate into the Control Center: The Control Center imports the license certificate into the product's license SDK.

[0313] Authorization SDK decrypts the authorization certificate: The authorization SDK decrypts the authorization certificate to extract authorization information.

[0314] Control Center distributes authorization information to connected devices: The Control Center distributes the authorization information extracted from the authorization certificate to each connected device.

[0315] Each device activates its product: Devices that receive authorization information distributed by the control center activate their products based on that authorization information.

[0316] Device import authorization certificate, authorization SDK decryption of authorization certificate and product activation: After receiving the authorization certificate, ordinary devices obtain authorization information to activate the products installed locally.

[0317] Figure 9 This is a schematic diagram of an authorization certificate encryption process provided in an embodiment of this application. (Reference) Figure 9 This process primarily involves three layers of encryption. First, the authorization code is converted into a fixed symmetric key for the product. The first layer of encryption uses this fixed symmetric key to encrypt the product index file. The second layer of encryption generates a random symmetric key for the product and encrypts this random symmetric key using the public key of the product's digital certificate, resulting in encrypted key data. Then, a Certificate Signature (CSR) containing this encrypted key data is generated. Next, an X.509 certificate containing the authorization center's private key signature is obtained based on this CSR. Then, a key exchange file conforming to the PKCS#12 standard is generated based on the X.509 certificate. The third layer of encryption uses a random symmetric key to encrypt the product's authorization information. This completes the encryption process for the authorization information of one product. Next, it is determined whether the authorization information for multiple products has been successfully encrypted. If not, the above process is repeated until the authorization information for multiple products has been successfully encrypted. Finally, the encrypted files from multiple products are packaged into an authorization certificate.

[0318] Figure 10 This is a schematic diagram illustrating an authorization certificate decryption process provided in an embodiment of this application. (Reference) Figure 10, mainly involves three layers of decryption. First, the authorization code is converted into a fixed symmetric key of the product, the first layer of decryption: using the fixed symmetric key to decrypt the product index file. The second layer of decryption, decrypt the key exchange file, get X.509 certificate. Then use the public key of the authorization center to verify the signature in the X.509 certificate. Then extract the key encryption data in the X.509 certificate. Use the private key of the product digital certificate to decrypt the key encryption data, get the random symmetric key. The third layer of decryption: using the random symmetric key to decrypt the product authorization information. Finally, use the authorization information to activate the product.

[0319] The application provides a unified authorization framework, including a light asset product authorization function module, a heavy asset product authorization function module and a combination authorization function module. It can support various authorization scenarios such as light asset product authorization, heavy asset product authorization, enterprise-level system authorization, combination authorization, etc. Figure 11 is a structural schematic diagram of a light asset product authorization function module provided by an embodiment of the application. Referring to Figure 11 , the light asset product authorization function module includes an offline activation module and an online activation module. Among them, the offline activation module is mainly responsible for decrypting the authorization code through the SDK, extracting the authorization information carried by the authorization code, and activating the product using the authorization information. The online activation module is mainly responsible for decrypting the authorization code through the SDK, extracting the authorization information carried by the authorization code, performing machine code verification in the cloud, and activating the product using the authorization information after verification.

[0320] Figure 12 is a structural schematic diagram of a heavy asset product authorization function module provided by an embodiment of the application. Referring to Figure 12 , the heavy asset product authorization function module mainly includes an offline certificate activation module and a control center module. Among them, the offline certificate activation module is mainly responsible for downloading the offline authorization certificate by means of the authorization code, decrypting the authorization certificate by the SDK to obtain the authorization information, and activating the product using the authorization information. The control center module is mainly responsible for downloading the offline authorization certificate by means of the authorization code, decrypting the authorization certificate by the SDK to obtain the authorization information, distributing the authorization information to realize batch activation of multiple devices in the enterprise-level system.

[0321] Figure 13 is a structural schematic diagram of a combination authorization function module provided by an embodiment of the application. Referring to Figure 13 , the combination authorization function module is mainly responsible for generating a combination authorization code corresponding to multiple products, wherein the authorization type field in the combination authorization is encoded as combination authorization; establishing an association relationship between the authorization information of multiple products and the combination authorization code; encoding multiple product authorization information into a combination authorization certificate; and activating multiple products using one combination authorization certificate.

[0322] It can be understood that the present application realizes the following remarkable technical effects through the coordinated design of multi-scenario compatible architecture, high-density authorization code coding, combined authorization and triple encryption system.

[0323] 1. Multi-scenario authorization compatibility breakthrough: Through unified architecture supporting mixed business modes, the permission authentication platform can simultaneously manage multiple businesses such as offline authorization of light asset products, online authorization of light asset products, combined authorization of heavy asset products, offline authorization of heavy asset products through authorization certificates, and authorization of heavy asset product control centers, thereby reducing the cost of enterprises needing to maintain multiple authorization systems.

[0324] 2. Reducing operation and maintenance complexity: The permission authentication platform is seamlessly integrated with the systems of product suppliers, such as payment platforms and sales platforms, facilitating the connection of product suppliers' products to the permission authentication platform to provide authorization services for the products. Moreover, the control center centrally manages the authorization of enterprise-level systems, such as distributing authorization information, recycling authorization information, updating authorization information, and monitoring authorization status, which can improve management and authorization efficiency and reduce manual intervention.

[0325] 3. Authorization code coding information density improvement: The authorization code can integrate authorization information, such as customer information, purchase time, valid time, function information, and authorization type, thereby supporting offline authorization of products.

[0326] 4. Combined authorization reduces the number of license files: Through a single authorization code or authorization certificate, the authorization information of multiple products is managed, reducing the number of license files to 1 / N, where N is the number of products, effectively reducing the difficulty of managing license files. Moreover, combined authorization can realize cross-product function linkage control, such as binding a secondary product associated with a primary product. After the user purchases the primary product, a combined authorization code and a combined authorization certificate corresponding to the primary product and the secondary product are generated. In this way, the user activates the primary product to unlock the primary product function, and at the same time, the associated product is automatically activated, and the function of the associated product is also automatically unlocked. This can effectively improve the product use experience.

[0327] 5. Triple encryption system security enhancement: Through multiple encryption systems, attackers need to simultaneously crack symmetric encryption, asymmetric encryption, and the Ed25519 algorithm used for signature, effectively improving the anti-cracking ability of authorization certificates.

[0328] It should be noted that the above examples are only for understanding the present application and do not constitute a limitation on the product authorization method of the present application. Further simple transformations based on this technical concept are within the scope of protection of the present application.

[0329] The present application also provides a product authorization device configured in a server, referring to Figure 14 , the product authorization device comprises:

[0330] The request response module 110 is configured to extract a combined authorization code corresponding to the plurality of products from the combined authorization request in response to the combined authorization request.

[0331] The information acquisition module 120 is configured to acquire authorization information of the plurality of products based on the combined authorization code.

[0332] The certificate generation module 130 is configured to generate a combined authorization certificate corresponding to the plurality of products based on the authorization information of the plurality of products, wherein the combined authorization certificate comprises the authorization information of the plurality of products.

[0333] The certificate sending module 140 is configured to return the combined authorization certificate to a sender of the combined authorization request, wherein the combined authorization certificate is used to activate the plurality of products.

[0334] Optionally, the certificate generation module 130 comprises:

[0335] The encryption unit is configured to encrypt the authorization information of the plurality of products by using different keys to obtain encrypted authorization files of the plurality of products.

[0336] The generation unit is configured to generate a combined authorization certificate comprising the encrypted authorization files of the plurality of products.

[0337] Optionally, the encryption unit comprises:

[0338] The first sub-unit is configured to generate a random symmetric key of a product for any product.

[0339] The second sub-unit is configured to encrypt the authorization information of the product by using the random symmetric key to obtain an encrypted authorization file of the product.

[0340] The third sub-unit is configured to encrypt the random symmetric key of the product by using a public key of a digital certificate of the product to obtain a key exchange file of the product.

[0341] The generation unit is configured to generate a combined authorization certificate comprising the encrypted authorization files and the key exchange files of the plurality of products.

[0342] Optionally, the generation unit is configured to create an index file of a product for any product, wherein the index file comprises file names of the encrypted authorization file and the key exchange file associated with the product; encrypt the index file by using a fixed symmetric key of the product to obtain an encrypted index file of the product; and generate a combined authorization certificate comprising the encrypted index files, the encrypted authorization files, and the key exchange files of the plurality of products.

[0343] Optionally, the encryption unit further comprises:

[0344] The fourth subunit is configured to convert the combined authorization code according to a key conversion mode corresponding to the product, to obtain the fixed symmetric key of the product.

[0345] Optionally, the fourth subunit is configured to decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; concatenate the plaintext string with a preset string corresponding to the product to obtain a concatenated string; perform a hash operation on the concatenated string to obtain a hash value; and extract a preset field from the hash value as the fixed symmetric key.

[0346] Optionally, the third subunit is configured to encrypt the random symmetric key of the product by using a public key of a digital certificate of the product to obtain key encryption data of the product; sign the key encryption data by using a private key of the authorization center, and encrypt the signed key encryption data by using the fixed symmetric key of the product to obtain the key exchange file.

[0347] Optionally, the third subunit is configured to send a certificate signing request to the authorization center, wherein the certificate signing request contains metadata of the product and the key encryption data; receive an identity authentication certificate returned by the authorization center, wherein the identity authentication certificate contains the metadata, the key encryption data, a certificate validity period, and a signature of the authorization center; and encrypt the identity authentication certificate by using the fixed symmetric key of the product to obtain the key exchange file.

[0348] Optionally, the third subunit is further configured to randomly generate an asymmetric key pair, wherein the asymmetric key pair includes a random public key and a random private key; carry the random public key in the certificate signing request; and encrypt the identity authentication certificate and the random private key by using the fixed symmetric key to obtain the key exchange file.

[0349] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0350] Optionally, the information acquisition module 120 is configured to query authorization information of a plurality of products associated with the combined authorization code.

[0351] Optionally, the apparatus further includes:

[0352] The first checking module is configured to extract machine codes corresponding to the plurality of products from the combined authorization request, wherein the machine code is a unique identifier of a device on which the plurality of products are installed; associate the machine codes with the combined authorization code; and check a number of machine codes that have been associated with the combined authorization code, and determine that the machine code checking passes in a case where the number of machine codes that have been associated with the combined authorization code is not greater than a preset threshold value; and the server is configured to return a combined authorization certificate in a case where the machine code checking passes.

[0353] Optionally, the apparatus further includes:

[0354] The authorization code sending module is configured to, in response to a combined purchase request for a plurality of products, generate a combined authorization code, mark an authorization type field in the combined authorization code as a combined authorization, associate the combined authorization code with authorization information of the plurality of products, and send the combined authorization code to a purchaser of the plurality of products.

[0355] Optionally, the plurality of products are respectively soft and hardware combined products, and the combined authorization code does not contain authorization information for product activation.

[0356] The authorization code sending module is further configured to, in response to a purchase request for a pure software product, generate a separate authorization code corresponding to the pure software product, the separate authorization code containing authorization information for activation of the pure software product, and send the separate authorization code to a purchaser of the pure software product.

[0357] Optionally, in a case where an authorization type of the pure software product is offline authorization, the authorization type field in the separate authorization code is marked as offline authorization, and the offline authorized pure software product refers to a pure software product that does not need to be online verified for a quantity of machine codes associated with the corresponding separate authorization code in an activation process.

[0358] Alternatively, in a case where the authorization type of the pure software product is online authorization, the authorization type field in the separate authorization code is marked as online authorization, and the online authorized pure software product refers to a pure software product that needs to be online verified for a quantity of machine codes associated with the corresponding separate authorization code in an activation process.

[0359] Optionally, the apparatus further comprises:

[0360] The second verification module is configured to, in response to a separate authorization request, extract a machine code corresponding to the pure software product and the separate authorization code from the separate authorization request, the machine code being a unique identifier of a device on which the pure software product is installed, associate the machine code corresponding to the pure software product with the separate authorization code, verify a quantity of machine codes currently associated with the separate authorization code, determine that the machine code verification passes in a case where it is determined that the quantity of machine codes associated with the separate authorization code is not greater than a preset threshold, and return a product activation notification to a sender of the separate authorization request.

[0361] The product authorization apparatus provided in the application adopts the product authorization method in the above embodiments, and can solve the technical problem that the related art generates independent authorization codes and authorization certificates for each product, resulting in a sharp expansion of the number of authorization codes and authorization certificates, and thus resulting in a great difficulty in management. Compared with the prior art, the product authorization apparatus provided in the application has the same beneficial effects as the product authorization method provided in the above embodiments, and other technical features in the product authorization apparatus are the same as the features disclosed in the above embodiments, and thus will not be described herein.

[0362] The application further provides a product activation device configured in a terminal, which comprises Figure 15 , and the product activation device comprises:

[0363] The request sending module 210 is configured to send a combined authorization request containing the combined authorization code in response to the input combined authorization code corresponding to the plurality of products.

[0364] The certificate receiving module 220 is configured to receive a combined authorization certificate returned based on the combined authorization request, wherein the combined authorization certificate comprises authorization information of the plurality of products.

[0365] The information extracting module 230 is configured to extract the authorization information of the plurality of products from the combined authorization certificate respectively.

[0366] The product activation module 240 is configured to activate the plurality of products installed in the terminal based on the authorization information of the plurality of products.

[0367] Optionally, the combined authorization certificate comprises encrypted authorization files of the plurality of products.

[0368] The information extracting module 230 is configured to decrypt the encrypted authorization files of the plurality of products by using the keys of the plurality of products to obtain the authorization information of the plurality of products, wherein the keys of the plurality of products are different.

[0369] Optionally, the combined authorization certificate further comprises key exchange files of the plurality of products; and the information extracting module 230 comprises:

[0370] A key decryption unit is configured to, for any product, decrypt the key exchange file of the product by using the private key of the digital certificate of the product to obtain a random symmetric key of the product.

[0371] An information decryption unit is configured to decrypt the encrypted authorization file of the product by using the random symmetric key of the product to obtain the authorization information of the product.

[0372] Optionally, the combined authorization certificate further comprises encrypted index files of the plurality of products; and the information extracting module 230 further comprises:

[0373] A file querying unit is configured to, for any product, decrypt the encrypted index file of the product by using the fixed symmetric key of the product to obtain an index file of the product, wherein the index file contains file names of the encrypted authorization file and the key exchange file associated with the product; and the file querying unit is configured to query the encrypted authorization file and the key exchange file of the product from the combined authorization certificate based on the file names.

[0374] Optionally, the information extracting module 230 further comprises:

[0375] The key conversion unit is configured to convert the combined authorization code according to a key conversion mode corresponding to the product, to obtain the fixed symmetric key of the product.

[0376] Optionally, the key conversion unit is configured to decrypt the combined authorization code to obtain a plaintext string corresponding to the combined authorization code; concatenate the plaintext string with a preset string corresponding to the product to obtain a concatenated string; perform a hash operation on the concatenated string to obtain a hash value; and extract a preset field from the hash value as the fixed symmetric key.

[0377] Optionally, the key decryption unit is configured to decrypt the key exchange file of the product by using the fixed symmetric key of the product, and verify a signature carried by the decrypted key encryption data by using the public key of the authorization center; in a case where the signature verification is passed, decrypt the key encryption data by using a private key of the digital certificate of the product to obtain the random symmetric key of the product.

[0378] Optionally, the key decryption unit is configured to decrypt the key exchange file by using the fixed symmetric key of the product to obtain an identity authentication certificate, the identity authentication certificate including the key encryption data, a certificate validity period and a signature of the authorization center; verify the signature by using the public key of the authorization center, and in a case where the signature verification is passed and the current time is within the certificate validity period, extract the key encryption data from the identity authentication certificate.

[0379] Optionally, the identity authentication certificate is an X.509 certificate, and the key exchange file is a public key cryptography standard No. 12 (PKCS#12) file.

[0380] Optionally, the request sending module 210 is configured to send a combined authorization request including the combined authorization code and a machine code in response to input of the combined authorization code corresponding to the plurality of products and the machine code, the machine code being a unique identifier of a device on which the plurality of products are installed.

[0381] Optionally, the plurality of products are respectively software and hardware combined products, and the combined authorization code does not include authorization information for product activation; and the apparatus further includes:

[0382] The authorization code analysis module is configured to analyze the authorization information of the pure software product from the single authorization code of the pure software product in response to input of the single authorization code of the pure software product.

[0383] The product activation module 240 is further configured to activate the pure software product installed in the terminal based on the authorization information of the pure software product.

[0384] Optionally, the product activation module 240 is configured to, in a case where the authorization type in the authorization information is offline authorization, activate the pure software product installed in the terminal based on the authorization information of the pure software product; or in a case where the authorization type in the authorization information is online authorization, send a separate authorization request containing a separate authorization code and a machine code, and in a case where a product activation notification returned based on the separate authorization request is received, activate the pure software product installed in the terminal based on the authorization information of the pure software product, wherein the machine code refers to a unique identifier of a device on which the pure software product is installed.

[0385] Optionally, the terminal is a proxy activation terminal, and the product activation module 240 is further configured to determine a plurality of agent terminals associated with the proxy activation terminal, and send the authorization information of the plurality of products to each of the agent terminals, so that each of the agent terminals activates a plurality of products installed locally based on the authorization information of the plurality of products.

[0386] The product activation device provided in the application adopts the product activation method in the above embodiments, and can solve the technical problem that the related art generates independent authorization codes and authorization certificates for each product, resulting in a sharp expansion of the number of authorization codes and authorization certificates, thereby causing a great difficulty in management. Compared with the prior art, the product activation device provided in the application has the same beneficial effects as the product activation method provided in the above embodiments, and other technical features in the product activation device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0387] The application provides an electronic device, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the product authorization method or the product activation method in the above embodiment one.

[0388] Reference will now be made to the following description Figure 16 which shows a structural schematic diagram of an electronic device suitable for implementing the embodiments of the application. The electronic device in the embodiments of the application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 16 The electronic device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the application.

[0389] As shown in Figure 16 The electronic device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded into a random access memory (RAM) 1004 from a storage device 1003. In the RAM 1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. In general, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the electronic device to communicate with other devices wirelessly or wired to exchange data. Although the electronic device having various systems is shown in the drawing, it should be understood that all of the systems shown are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0390] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program codes for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments disclosed in the present application are performed.

[0391] The electronic device provided in the present application adopts the method in the above-mentioned embodiments, which can solve the technical problem that the related art generates independent authorization codes and authorization certificates for each product, resulting in a sharp expansion of the number of authorization codes and authorization certificates, thereby causing a great difficulty in management. Compared with the prior art, the electronic device provided in the present application has the same beneficial effects as the method provided in the above-mentioned embodiments, and other technical features in the electronic device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0392] It should be understood that portions of the application disclosed can be implemented in hardware, software, firmware, or combinations thereof. In the description of the embodiments above, specific features, structures, materials or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0393] The above description is merely illustrative of the application and is not intended to limit the scope of the application. Any modifications or equivalents of the application should be construed as falling within the scope of the application. The scope of the application should be determined by the appended claims.

[0394] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., a computer program) for performing the product authorization method or the product activation method in the above-described embodiments.

[0395] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted in any suitable medium, including but not limited to electrical wire, optical cable, RF (Radio Frequency), etc., or any suitable combination of the above.

[0396] The above computer readable storage medium can be included in an electronic device; or can exist separately and not be assembled into an electronic device. The above computer readable storage medium carries one or more programs, which, when executed by an electronic device, cause the electronic device to implement the product authorization method or the product activation method in the above-described embodiments.

[0397] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0398] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0399] The modules involved in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0400] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the product authorization method or the product activation method, and can solve the technical problem that the number of authorization codes and authorization certificates is rapidly expanded due to the generation of independent authorization codes and authorization certificates for each product, thereby causing great difficulty in management. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the method provided by the above embodiments, and will not be described here.

[0401] The application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the product authorization method as described above, or which, when executed by a processor, implements the steps of the product activation method as described above.

[0402] The computer program product provided by the application can solve the technical problem that the related art generates independent authorization codes and authorization certificates for each product, resulting in a sharp increase in the number of authorization codes and authorization certificates, thereby causing great difficulty in management. Compared with the prior art, the beneficial effects of the computer program product provided by the application are the same as those of the method provided by the above-mentioned embodiments, and are not described here.

[0403] The above only describes some embodiments of the application, and does not limit the patent scope of the application. Any equivalent structural transformation made by using the content of the specification and drawings, or direct / indirect application in other related technical fields within the technical concept of the application is included in the patent protection scope of the application.

Claims

1. A product licensing method, characterized in that, The method, executed by the server, includes: In response to a combined authorization request, extract a combined authorization code corresponding to multiple products from the combined authorization request; Based on the combined authorization code, obtain the authorization information of the multiple products; Based on the authorization information of the multiple products, a combined authorization certificate corresponding to the multiple products is generated, wherein the combined authorization certificate includes the authorization information of the multiple products; The combined authorization certificate is returned to the sender of the combined authorization request, and the combined authorization certificate is used to activate the multiple products.

2. The method as described in claim 1, characterized in that, The step of generating a combined authorization certificate corresponding to the multiple products based on the authorization information of the multiple products includes: The authorization information of the multiple products is encrypted using different keys to obtain encrypted authorization files for the multiple products; Generate a combined authorization certificate containing encrypted authorization files for the multiple products.

3. The method as described in claim 2, characterized in that, The authorization information for the multiple products is encrypted using different keys to obtain encrypted authorization files for the multiple products, including: For any product, generate a random symmetric key for that product; The product's authorization information is encrypted using the random symmetric key to obtain the product's encrypted authorization file; The product's random symmetric key is encrypted using the public key of the product's digital certificate to obtain the product's key exchange file; The generation of the combined authorization certificate containing encrypted authorization files for the multiple products includes: Generate a combined authorization certificate containing encrypted authorization files and key exchange files for the multiple products.

4. A product activation method, characterized in that, The method, executed by a terminal, includes: In response to the input combined authorization code corresponding to multiple products, a combined authorization request containing the combined authorization code is sent; Receive a combined authorization certificate returned based on the combined authorization request, wherein the combined authorization certificate includes authorization information for the multiple products; Extract the authorization information of each of the multiple products from the combined authorization certificate; Based on the authorization information of the multiple products, the multiple products installed in the terminal are activated.

5. The method as described in claim 4, characterized in that, The combined authorization certificate includes encrypted authorization files for the multiple products; The step of extracting the authorization information of the multiple products from the combined authorization certificate includes: The encrypted authorization files of each product are decrypted using the product's key to obtain the authorization information for each product. Each product has a different key.

6. A product licensing device, characterized in that, Configured on a server, the device includes: The request-response module is used to respond to a combined authorization request and extract a combined authorization code corresponding to multiple products from the combined authorization request; The information acquisition module is used to acquire the authorization information of the multiple products based on the combined authorization code; The certificate generation module is used to generate a combined authorization certificate corresponding to the multiple products based on the authorization information of the multiple products, wherein the combined authorization certificate includes the authorization information of the multiple products; The certificate sending module is used to return the combined authorization certificate to the sender of the combined authorization request, and the combined authorization certificate is used to activate the multiple products.

7. A product activation device, characterized in that, Configured in a terminal, the device includes: The request sending module is used to send a combined authorization request containing the combined authorization code in response to the input combined authorization code corresponding to multiple products; The certificate receiving module is used to receive a combined authorization certificate returned based on the combined authorization request, wherein the combined authorization certificate includes authorization information of the multiple products; The information extraction module is used to extract the authorization information of the multiple products from the combined authorization certificate respectively; The product activation module is used to activate the multiple products installed on the terminal based on the authorization information of the multiple products.

8. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the product licensing method as claimed in any one of claims 1 to 3, or the computer program being configured to implement the steps of the product activation method as claimed in any one of claims 4 to 5.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the product authorization method as described in any one of claims 1 to 3, or when the computer program is executed by a processor, it implements the steps of the product activation method as described in any one of claims 4 to 5.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the product licensing method as described in any one of claims 1 to 3, or, when executed by a processor, implements the steps of the product activation method as described in any one of claims 4 to 5.

Images