A method and system for managing software based on a dongle

Abstract

This invention discloses a method and system for managing software based on encryption locks, belonging to the field of information security technology. The method includes a process where a primary encryption lock initiates software authorization to a master encryption lock, and a process where a secondary encryption lock runs the software encrypted by the master encryption lock through an authorization file. This invention employs a hierarchical authorization architecture to achieve software authorization management. The master encryption lock securely creates and encrypts software, and then authorizes the use of that software to secondary encryption locks. Multiple secondary encryption locks can exist, enabling flexible management of the authorization status of the secondary encryption locks and enhancing the controllability of software authorization and the flexibility of software use.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and particularly relates to a method and system for managing software based on encryption locks. BACKGROUND

[0002] Software is an important digital asset and intellectual property, and its security protection and authorization management are crucial to prevent unauthorized copying, distribution and use, and protecting the legal rights of software developers in the software field is crucial.

[0003] The common software protection technology at present is usually to store authorization information in a hardware encryption lock, and to detect and verify the existence of the lock when the software runs to protect the use of the software. Although the hardware encryption lock provides high security, the traditional single encryption lock authorization mode still has defects in software authorization and centralized management, for example, one encryption lock is only bound to one software or one user / device; it is difficult to realize flexible authorization and redistribution of software within a limited range (for example, distribution to different departments / employees in an enterprise, distribution to students in an educational institution, etc.).

[0004] Therefore, there is an urgent need for a solution that can inherit the security advantages of hardware encryption locks and simplify the authorization process of software. SUMMARY

[0005] To solve the above technical problems, the present application provides a method and system for managing software based on encryption locks.

[0006] Therefore, according to a first aspect of the present application, a method for managing software based on encryption locks is provided, which is suitable for the method comprising: a software authorization process and a software running process;

[0007] The software authorization process comprises the following steps:

[0008] Step S1, the first authorization system sends an instruction to the slave encryption lock to obtain the slave encryption lock HID and the first authorization information, and receives the slave encryption lock HID and the first authorization information returned by the slave encryption lock;

[0009] Step S2, the first authorization system initiates a software authorization request for the slave encryption lock to the second authorization system according to the slave encryption lock HID, the first authorization information and the encrypted software name input by the user;

[0010] Step S3, the first authorization system receives the authorization file issued by the master encryption lock through the second authorization system, and sends the authorization file to the slave encryption lock;

[0011] Step S4, the slave dongle decrypts the authorization file by the preset upgrade key to obtain a slave dongle HID and second authorization information, compares the decrypted slave dongle HID with the slave dongle HID stored by itself, if the comparison is consistent, step S5 is executed, otherwise, an error is prompted and the process is ended.

[0012] Step S5, the slave dongle performs a saving operation of authorization information according to the second authorization information, the second authorization information including a master dongle ID and an authorized software ID.

[0013] The software running process includes the following steps:

[0014] Step P1, the encrypted software receives a start trigger information of a user, acquires a fixed key in an encrypted software package, decrypts an authorization structure in the encrypted software package by the fixed key to obtain decryption data, and sends the decryption data to the slave dongle.

[0015] Step P2, the slave dongle determines whether the encrypted software is authorized according to a master dongle ID and an authorized software ID in the saved authorization information and the decryption data, if yes, returns an authorization existing response to the encrypted software, and step P3 is executed, otherwise, an error is prompted and the process is ended.

[0016] Step P3, the slave dongle receives a ninth random number sent by the encrypted software, processes the ninth random number by a preset algorithm to obtain a first key, and sends the first key to the encrypted software.

[0017] Step P4, the encrypted software decrypts a code segment ciphertext in the encrypted software package by the first key to obtain a decrypted code segment, and normally runs by loading the decrypted code segment.

[0018] According to a second aspect of the present application, a system for managing software based on a dongle is provided, the system comprising: a first authorization system, a second authorization system, a third authorization system, a master dongle and a slave dongle, the first authorization system, the second authorization system, the third authorization system, the master dongle and the slave dongle being configured to implement the method for managing software based on a dongle according to any one of claims 1 to 8.

[0019] According to a third aspect of the present application, a computer device is provided, comprising a memory, a processor and a computer program stored in the memory, the processor executing the computer program to implement the method for managing software based on a dongle.

[0020] According to a fourth aspect of the present application, there is provided a computer readable storage medium having stored thereon computer programs / instructions which, when executed by a processor, implement the method for managing software based on encryption locks as described above.

[0021] The technical solution provided by the present application has at least the following beneficial effects:

[0022] The method and system for managing software based on encryption locks provided by the present application achieve authorization management of software by using a hierarchical authorization architecture, securely create and encrypt software by a master encryption lock, and authorize the use right of the software to slave encryption locks, which can be multiple, to achieve flexible management of the authorization state of the slave encryption locks, and to enhance the controllability of software authorization and the flexibility of software use. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate, the following will be combined with the drawings to briefly introduce the embodiments of the present application or the prior art. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0024] Figure 1 Fig. 1 is a schematic diagram of the software authorization process in the method for managing software based on encryption locks provided by the first embodiment of the present application;

[0025] Figure 2 Fig. 2 is a schematic diagram of the software authorization issuing process in the method for managing software based on encryption locks provided by the first embodiment of the present application;

[0026] Figure 3 Fig. 3 is a schematic diagram of the process of managing the master encryption lock in the method for managing software based on encryption locks provided by the first embodiment of the present application;

[0027] Figure 4 Fig. 4 is a schematic diagram of the encryption process of the encryption lock to the software to be encrypted in the method for managing software based on encryption locks provided by the second embodiment of the present application;

[0028] Figure 5 Fig. 5 is a schematic diagram of the running process of the encryption lock to the encrypted software in the method for managing software based on encryption locks provided by the second embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present application more clear, the following will be combined with the drawings to further describe the embodiments of the present application in detail.

[0030] The following description refers to the accompanying drawings. Unless otherwise noted, reference to a given patent document in a description of a given element in one drawing set does not constitute a disclaimer of that element in another drawing set. The implementations described in the following examples do not represent all implementations consistent with the present disclosure. Instead, they are merely examples of apparatuses and methods consistent with some aspects of the present disclosure as described in the appended claims. Embodiment one

[0031] The embodiment one of the present application provides a method for managing software based on encryption lock, at least including one master encryption lock and one slave encryption lock, wherein the master encryption lock is distributed to software developers / software development departments by software developers / managers through an encryption lock authorization system, the software developers / software development departments encrypt the encrypted software through the master encryption lock as the software authorization manager, and authorize the slave encryption lock according to the software authorization request; the slave encryption lock is held by software users after production, and is used for cooperating with the software to normally run according to the authorized information;

[0032] In the embodiment, the authorization management of the software is carried out through the encryption lock authorization system, and the encryption lock authorization system specifically includes a first authorization system, a second authorization system and a third authorization system, wherein the first authorization system is used by the software users with the slave encryption lock to realize the initiation of the software authorization request and the reception of the software authorization file; the second authorization system is used by the software authorization manager to realize the authorization management of the software, and the third authorization system is used by the software developers / managers to realize the management of the master encryption lock;

[0033] In the embodiment, the data pre-set in the master encryption lock when it is factory-produced includes a master account public key (used for decrypting the master encryption lock ID ciphertext issued by the system), an upgrade key (used for encrypting the authorization information to obtain the authorization file), a private key in an initial communication key pair (used for negotiating the communication key), and attribute information (including the initial ID of the encryption lock, which will be re-set later); the data pre-set in the slave encryption lock when it is factory-produced includes the upgrade key (used for decrypting the authorization file to obtain the authorization information), the private key in the initial communication key pair (used for negotiating the communication key), the attribute information (including the encryption lock identification and the encryption lock ID), and the encryption lock hardware serial number (HID) for identifying the unique identity of the encryption lock;

[0034] The method provided by the present application includes a software authorization process and an authorization issuing process:

[0035] On one hand, the software authorization process is initiated by the authorization request of the slave encryption lock through the first authorization system, as shown in FIG. 1, the software authorization process includes: Figure 1

[0036] Step 101, the first authorization system receives the authorization request, detects whether the encryption lock is inserted, if yes, step 102 is executed, otherwise, it is prompted to insert the encryption lock;​

[0037] Step 102, the first authorization system negotiates with the encryption lock to obtain a first communication key;

[0038] In an implementable manner, step 102 specifically comprises:

[0039] Step 1021, the first authorization system generates a first random number, encrypts the first random number using the public key in the saved initial communication key pair, sends a negotiation communication key instruction to the encryption lock with the first random number ciphertext as instruction data;

[0040] In this embodiment, the initial communication key pair comprises a public key and a private key, the public key is saved in the first authorization system and used for encryption and decryption of data when negotiating the communication key with the encryption lock, and the private key is saved in the encryption lock and used for encryption and decryption of data when negotiating the communication key with the first authorization system;

[0041] Step 1022, after receiving the negotiation communication key instruction sent by the first authorization system, the encryption lock decrypts the ciphertext data in the instruction by using the private key in the preset initial communication key pair to obtain the first random number, generates a second random number, encrypts the second random number by using the private key in the preset initial communication key pair, returns the second random number ciphertext to the first authorization system as response data, and organizes the data obtained by the first random number and the second random number as the first communication key;

[0042] Step 1023, the first authorization system receives the response data sent by the encryption lock, decrypts the response data by using the public key in the saved initial communication key pair to obtain the second random number, and organizes the data obtained by the first random number and the second random number as the first communication key;

[0043] The first communication key is used for encryption and decryption of communication data between the first authorization system and the encryption lock after step 102;

[0044] Step 103, the first authorization system verifies whether the encryption lock is the slave encryption lock, if yes, step 104 is performed, otherwise, an error is prompted and the process ends;

[0045] In an implementable manner, verifying whether the encryption lock is the slave encryption lock specifically comprises:

[0046] Step 1031, the first authorization system sends an instruction for obtaining attribute information of the encryption lock to the encryption lock, the instruction comprising ciphertext data encrypted by the first communication key;

[0047] Step 1032, the first authorization system receives the data returned by the encryption lock, decrypts the data returned by the encryption lock by using the first communication key to obtain the attribute information of the encryption lock, and determines whether the encryption lock is the slave encryption lock according to the attribute information;

[0048] Specifically, step 1031 further includes: receiving, by the encryption lock, the instruction sent by the first authorization system, obtaining the attribute information stored in the encryption lock, encrypting the attribute information by using the first communication key to obtain encrypted attribute information, and sending the encrypted attribute information to the first authorization system.

[0049] In the embodiment, the attribute information of the encryption lock specifically includes an encryption lock identifier, a COS version in the encryption lock, an encryption lock type, a manufacturing date, and an encryption lock ID.

[0050] Specifically, determining whether the encryption lock is a slave encryption lock according to the attribute information specifically includes: determining the encryption lock identifier in the attribute information.

[0051] For example, the COS version is 0x0201, indicating that the COS version is 2.01.

[0052] The encryption lock type is 0xFF, indicating a standard version; the encryption lock type is 0x00, indicating a standard clock lock; and the encryption lock type is 0x02, indicating a standard U disk lock.

[0053] The encryption lock identifier is 0x01, indicating a master encryption lock; and the encryption lock identifier is 0x00, indicating a slave encryption lock.

[0054] Step 104: The first authorization system sends an instruction to the slave encryption lock to obtain the slave encryption lock HID and the first authorization information.

[0055] In the embodiment, step 104 further includes: obtaining, by the slave encryption lock, the built-in slave encryption lock HID and the first authorization information, encrypting the slave encryption lock HID and the first authorization information by using the first communication key to obtain encrypted data ciphertext, and returning the encrypted data ciphertext to the first authorization system.

[0056] In the embodiment, the first authorization information is specifically software authorization information stored in the slave encryption lock. When the slave encryption lock is used for the first time, the first authorization information is empty. When the slave encryption lock is not used for the first time, the first authorization information is authorization information previously stored and issued by the second authorization system. When the authorization is performed on the slave encryption lock, the first authorization information is used as a reference to adjust to obtain new authorization information.

[0057] Step 105: The first authorization system receives the slave encryption lock HID and the first authorization information returned by the slave encryption lock, and initiates a software authorization request for the slave encryption lock to the second authorization system according to the slave encryption lock HID, the first authorization information, and the encryption software name input by the user.

[0058] In the embodiment, the step 105 specifically comprises: the first authorization system receiving the data sent from the slave dongle, decrypting the data by the first communication key to obtain the slave dongle HID and the first authorization information, receiving the encrypted software name input by the user, and initiating the software authorization request of the slave dongle to the second authorization system according to the slave dongle HID, the first authorization information and the encrypted software name input by the user.

[0059] In an implementable mode, after the first authorization system initiates the software authorization request of the slave dongle, the first authorization system further comprises:

[0060] The step 106 comprises: the first authorization system receiving the authorization file issued by the second authorization system and sending the authorization file to the slave dongle.

[0061] In an implementable mode, the step of sending the authorization file to the slave dongle specifically comprises: the first authorization system sending the authorization file to the slave dongle after encrypting the authorization file by the first communication key.

[0062] In the embodiment, the slave dongle can be multiple.

[0063] In the embodiment, the authorization file is issued by the second authorization system by using the master dongle, and the authorization file comprises the slave dongle HID and the second authorization information.

[0064] The step 107 comprises: the slave dongle decrypting the authorization file by the preset upgrade key to obtain the slave dongle HID and the second authorization information.

[0065] In the embodiment, the upgrade key is preset when the master dongle and the slave dongle are produced, the upgrade key in the master dongle is used for encrypting the authorization file, and the upgrade key in the slave dongle is used for decrypting the encrypted authorization file.

[0066] In an implementable mode, the step 107 specifically comprises: the slave dongle decrypting the received data by the first communication key to obtain the authorization file, and decrypting the authorization file by the preset upgrade key to obtain the slave dongle HID and the second authorization information.

[0067] The step 108 comprises: the slave dongle verifying whether the slave dongle HID obtained by decryption is same as the slave dongle HID saved by the slave dongle, if yes, executing the step 109, otherwise, prompting an error and ending.

[0068] The step 109 comprises: the slave dongle executing a saving operation of the authorization information according to the second authorization information.

[0069] Specifically, the slave dongle executes the saving operation of the authorization information according to the second authorization information, which comprises: the slave dongle parsing the second authorization information to obtain an operation type, a master dongle ID and an authorized software ID, and executing the saving of the authorization information according to the operation type.

[0070] Further, the saving of the authorization information is performed according to the operation type, specifically including: determining the operation type, if the operation type is adding authorization, writing the master encryption lock ID and the authorized software ID into the specified file, completing the saving of the authorization information, and if the operation type is deleting authorization, finding the master encryption lock ID and the authorized software ID from the specified file and deleting them.

[0071] On the other hand, the software authorization issuing process is a process of distributing software authorization information from the master encryption lock to the slave encryption lock through the second authorization system, as shown in the following figure: Figure 2 As shown in the following figure, the software authorization issuing process includes the following steps:

[0072] Step 201, the second authorization system receives the software authorization request of the slave encryption lock sent by the first authorization system;

[0073] Step 202, the second authorization system acquires the encrypted software name, the slave encryption lock HID and the first authorization information in the software authorization request, and prompts to insert the encryption lock;

[0074] In this embodiment, the authority determines the encryption lock required for authorization according to the encrypted software name in the software authorization request, and inserts the encryption lock;

[0075] In an implementable manner, after prompting to insert the encryption lock, the following steps are further included:

[0076] Step 2021, the second authorization system detects whether the encryption lock is inserted, if yes, step 2022 is performed, otherwise, it prompts to insert the encryption lock;

[0077] Step 2022, the second authorization system negotiates with the encryption lock to obtain the second communication key;

[0078] In an implementable manner, the second authorization system negotiates with the encryption lock to obtain the second communication key, specifically including:

[0079] Step D1, the second authorization system generates a third random number, encrypts the third random number through the public key in the saved initial communication key pair, takes the third random number ciphertext as instruction data, and sends the negotiation communication key instruction to the encryption lock;

[0080] In this embodiment, the initial communication key pair includes a public key and a private key, the public key is saved in the second authorization system and used for encrypting and decrypting data when negotiating the communication key with the encryption lock, and the private key is saved in the encryption lock and used for encrypting and decrypting data when negotiating the communication key with the second authorization system;

[0081] Step D2, after receiving the instruction of negotiating communication key sent by the second authorization system, the encryption lock decrypts the ciphertext data in the instruction by the private key of the preset initial communication key pair, obtains the third random number, generates the fourth random number, encrypts the fourth random number by the private key of the preset initial communication key pair, returns the ciphertext of the fourth random number to the second authorization system as response data, and organizes the data obtained by the third random number and the fourth random number as the second communication key;

[0082] Step D3, the second authorization system receives the response data sent by the encryption lock, decrypts the response data by the public key of the saved initial communication key pair, obtains the fourth random number, and organizes the data obtained by the third random number and the fourth random number as the second communication key;

[0083] Step 2023, the second authorization system verifies whether the encryption lock is the master encryption lock, and if yes, step 203 is executed, otherwise, an error is prompted and the process is ended.

[0084] In an implementable manner, verifying whether the encryption lock is the master encryption lock specifically includes:

[0085] Step E1, the second authorization system sends an instruction for obtaining the attribute information of the encryption lock to the encryption lock, and the instruction includes ciphertext data encrypted by the second communication key;

[0086] Step E2, the second authorization system receives the data sent by the encryption lock, decrypts the data sent by the encryption lock by the second communication key to obtain the attribute information of the encryption lock, and determines whether the encryption lock is the master encryption lock according to the attribute information;

[0087] Specifically, step E1 further includes: the encryption lock receives the instruction sent by the second authorization system, obtains the attribute information saved in the lock, encrypts the attribute information by the second communication key to obtain encrypted attribute information, and sends the encrypted attribute information to the second authorization system;

[0088] Step 203, the second authorization system receives the authorization software ID corresponding to the encryption software name input by the authorizer, encrypts the authorization software ID and the encryption lock HID in the software authorization request by the second communication key obtained by negotiation to obtain the first ciphertext, takes the first ciphertext as instruction data, and sends the authorization instruction to the master encryption lock;

[0089] Specifically, the second authorization system receives the authorization software ID corresponding to the encryption software name input by the authorizer, including: the second authorization system receives the authorization software ID corresponding to the encryption software name input by the authorizer and the operation type; the operation type includes adding authorization information and / or deleting authorization information;

[0090] Step 204: The master encryption key decrypts the data in the authorization instruction using the second communication key to obtain the slave encryption key HID and the authorization software ID. The authorization software ID and the master encryption key ID stored in the master encryption key are used as new authorization information. The slave encryption key HID and the new authorization information are encrypted using the preset upgrade key to obtain the second ciphertext. The second ciphertext is then encrypted using the second communication key, and the encrypted second ciphertext is sent as response data to the second authorization system.

[0091] Step 205: The second authorization system decrypts the encrypted second ciphertext using the second communication key to obtain the second ciphertext, and sends the second ciphertext as an authorization file to the first authorization system.

[0092] In this embodiment, the user can also manage the master encryption key through a third-party authorization system, specifically, such as... Figure 3 As shown, the process of managing the master encryption key includes:

[0093] Step 301: The third authorization system receives the request to manage the encryption key, checks whether the encryption key is inserted, and if so, proceeds to step 302; otherwise, it prompts the system to insert the encryption key.

[0094] Step 302: The third authorization system negotiates with the encryption key to obtain the fourth communication key;

[0095] One feasible approach, step 302 specifically includes:

[0096] Step F1: The third authorization system generates a fifth random number, encrypts the fifth random number using the public key in the saved initial communication key pair, and sends the ciphertext of the fifth random number as instruction data to the encryption key to negotiate the communication key.

[0097] In this embodiment, the initial communication key pair includes a public key and a private key. The public key is stored in the third authorization system and is used to encrypt and decrypt data when negotiating the communication key with the master encryption lock. The private key is stored in the master encryption lock and is used to encrypt and decrypt data when negotiating the communication key with the third authorization system.

[0098] Step F2: After receiving the negotiation communication key instruction sent by the third authorized system, the encryption lock decrypts the ciphertext data in the instruction using the private key in the preset initial communication key pair to obtain the fifth random number, generates the sixth random number, encrypts the sixth random number using the private key in the preset initial communication key pair, returns the ciphertext of the sixth random number as response data to the third authorized system, and uses the data obtained by combining the fifth and sixth random numbers as the fourth communication key.

[0099] Step F3: The third authorization system receives the response data sent by the encryption lock, decrypts the response data using the public key in the saved initial communication key pair, obtains the sixth random number, and uses the data obtained by combining the fifth and sixth random numbers as the fourth communication key.

[0100] Step 303: The third authorization system verifies whether the dongle is the primary dongle. If it is, proceed to step 304; otherwise, display an error message and end the process.

[0101] One feasible method for verifying whether a dongle is the master dongle specifically includes:

[0102] Step G1: The third authorization system sends an instruction to the encryption key to obtain the encryption key attribute information. The instruction includes ciphertext data encrypted with the fourth communication key.

[0103] Step G2: The third authorization system receives the data sent by the encryption lock, decrypts the data sent by the encryption lock using the fourth communication key to obtain the attribute information of the encryption lock, and determines whether the encryption lock is the master encryption lock based on the attribute information;

[0104] Specifically, after step G1, the following steps are included: the encryption lock receives the instruction sent by the third authorization system, obtains the attribute information stored in the lock, encrypts the attribute information using the fourth communication key to obtain the encrypted attribute information, and sends the encrypted attribute information to the third authorization system.

[0105] Step 304: The third authorization system receives the master encryption lock ID input by the administrator, encrypts the master encryption lock ID with the preset master account private key, encrypts the encrypted master encryption lock ID with the fourth communication key to obtain the third ciphertext, and sends the third ciphertext to the master encryption lock.

[0106] For example, the master encryption key ID is: 00000001

[0107] The encrypted master key ID is:

[0108] 8EB077B147E645EC665C611F72AE7A1BA8540AB8476D1FBB54F708186EC7A720C4FC4B397C3C98D28611AB65BCF522A2FD240750947CD46CC4E82F71E6DBFDFF 4677D87A6E1DED8150CAF3B2707596BB75108E393F943218FE60BEFEBCF704BD867234A785AA1DA7740B94A48DBEA3E040263B28011A6EFE24009C78F6942120

[0109] In this embodiment, the main account private key is specifically the private key in the key pair generated by the user through the production tool during the production process of the encryption lock. The private key in the key pair is held by the user as the main account private key, and the public key in the key pair is written into the main encryption lock as the main account public key.

[0110] In one feasible approach, in this embodiment, after the third authorization system sends the encrypted master encryption lock ID to the master encryption lock, the process further includes: the master encryption lock decrypting the encrypted master encryption lock ID using a fourth communication key, decrypting the encrypted master encryption lock ID using a preset master account public key, and saving the master encryption lock ID. Example 2

[0111] Embodiment 2 of the present invention provides another method for managing software based on a dongle, based on the content disclosed in Embodiment 1. The method includes an encryption process for the software to be encrypted and an operation process for the encrypted software:

[0112] Among them, such as Figure 4 The diagram illustrates the encryption process for the software to be encrypted, including the following steps:

[0113] Step 401: The software encryption system receives the authorized software ID corresponding to the encryption software name input by the authorizer, obtains the software to be encrypted, and analyzes the software to be encrypted to obtain the code segment to be encrypted.

[0114] Step 402: The software encryption system checks whether the encryption key is inserted. If yes, proceed to step 403; otherwise, prompt the user to insert the encryption key.

[0115] In this embodiment, before performing step 403, the method further includes: the software encryption system negotiating with the encryption lock to obtain a third communication key;

[0116] One feasible approach involves the software encryption system negotiating a third communication key with the encryption key, including:

[0117] Step H1: The software encryption system generates a seventh random number, encrypts the seventh random number using the public key in the saved initial communication key pair, and sends the ciphertext of the seventh random number as instruction data to the encryption key to negotiate the communication key.

[0118] Step H2: After receiving the negotiation communication key instruction sent by the software encryption system, the encryption lock decrypts the ciphertext data in the instruction using the private key in the preset initial communication key pair to obtain the seventh random number, generates the eighth random number, encrypts the eighth random number using the private key in the preset initial communication key pair, returns the ciphertext of the eighth random number as response data to the software encryption system, and uses the data obtained by combining the seventh and eighth random numbers as the third communication key.

[0119] Step H3: The software encryption system receives the response data sent by the encryption lock, decrypts the response data using the public key in the saved initial communication key pair to obtain the eighth random number, and uses the data obtained by combining the seventh and eighth random numbers as the third communication key.

[0120] Specifically, in this embodiment, the third communication key is used for the encryption and decryption process of communication data between the software encryption system and the encryption lock after step 402;

[0121] Step 403: The software encryption system obtains the attribute information of the encryption lock and determines whether the inserted encryption lock is the main encryption lock based on the attribute information. If it is, proceed to step 404; otherwise, end.

[0122] Step 404: The software encryption system obtains the master encryption lock ID, generates the ninth random number, and sends the ninth random number to the master encryption lock;

[0123] Step 405: The master encryption lock calculates the data encryption key from the ninth random number using a preset algorithm and returns the data encryption key to the software encryption system.

[0124] Step 406: The software encryption system encrypts the code segment to be encrypted using the data encryption key to obtain the encrypted code segment, and encrypts the master encryption lock ID and the authorized software ID using a preset fixed key to obtain the authorized structure;

[0125] Step 407: The software encryption system organizes the encrypted code segment, authorization structure, fixed key and ninth random number to obtain an encrypted software package.

[0126] In this embodiment, the encryption software includes an encryption package, which may be stored in the encryption software in the form of an SDK.

[0127] Among them, such as Figure 5 As shown, the process of encryption software operation based on a dongle includes:

[0128] Step 501: The encryption software receives the user's startup trigger information, obtains the fixed key in the encryption software package, decrypts the authorized structure in the encryption software package using the fixed key to obtain decrypted data, and sends the decrypted data to the encryption key.

[0129] In this embodiment, before obtaining the fixed key from the encryption package, the following steps are included:

[0130] Step M1: The encryption software checks whether the dongle is inserted. If yes, proceed to step M2; otherwise, prompt the user to insert the dongle.

[0131] Step M2: Determine if the dongle is a slave dongle. If so, obtain the fixed key from the encryption package and perform subsequent operations; otherwise, end.

[0132] In this embodiment, one feasible way to determine whether a dongle is a slave dongle is: obtaining the attribute information of the dongle, and determining whether the dongle is a slave dongle based on the attribute information;

[0133] Step 502: Determine whether the software is authorized based on the stored authorization information and the master encryption key ID and authorized software ID in the decryption data. If authorized, return an authorization status response to the encryption software and proceed to step 503; otherwise, prompt an error and end.

[0134] In this embodiment, the decrypted data includes the master encryption lock ID and the authorized software ID. Verifying whether there is corresponding authorization information in the encryption lock based on the decrypted data specifically involves: determining whether there is data in the encryption lock that is the same as the master encryption lock ID and the authorized software ID obtained from decryption. If so, it indicates that there is corresponding authorization information; otherwise, it indicates that there is no corresponding authorization information.

[0135] Step 503: Receive the ninth random number sent by the encryption software from the dongle, process the ninth random number using a preset algorithm to obtain the first key, and send the first key to the encryption software;

[0136] In this embodiment, the first key is the same as the data encryption key.

[0137] Step 504: The encryption software uses the first key to decrypt the ciphertext of the code segment in the encryption package to obtain the decrypted code segment, and then runs normally by loading the decrypted code segment.

[0138] By providing a hierarchical authorization architecture, a master dongle securely creates and encrypts software, and authorizes the use of the software to multiple slave dongles, flexible management of the authorization status of slave dongles is achieved, enhancing the controllability of software authorization and the flexibility of software use.

[0139] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the embodiments of the apparatus of the present invention, please refer to the embodiments of the method of the present invention.

[0140] An exemplary embodiment of the present invention provides a system for managing software based on a dongle. The system includes: a first authorization system, a second authorization system, a third authorization system, a master dongle, and a slave dongle. The first authorization system, the second authorization system, the third authorization system, the master dongle, and the slave dongle are used to implement the method for managing software based on a dongle as described in the above embodiment.

[0141] It should be noted that the system for managing software based on a dongle provided in the above embodiments is only illustrated by the division of the functional modules described above when executing the method for managing software based on a dongle. In practical applications, the functions can be allocated and performed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the system for managing software based on a dongle provided in the above embodiments and the method embodiments for managing software based on a dongle belong to the same concept, and their implementation process is detailed in the method embodiments, which will not be repeated here.

[0142] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0143] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the methods described in the foregoing embodiments.

[0144] This invention also provides a computer-readable storage medium storing a computer program / instructions thereon, which, when executed by a processor, implements the steps of any of the methods described in the foregoing embodiments. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0145] In this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or order; the term "multiple" refers to two or more unless otherwise explicitly defined. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. The terms "install," "connect," "link," "fix," etc., should be interpreted broadly. For example, "connect" can be a fixed connection, a detachable connection, or an integral connection; "link" can be a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0146] In the description of this invention, it should be understood that the terms "upper" and "lower" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or unit referred to must have a specific orientation or be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention.

[0147] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, equivalent variations made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A method of managing software based on a dongle, characterized by, The method comprises a software authorization process and a software running process; The software authorization process comprises the following steps: Step S1, the first authorization system sends an instruction to the slave dongle to obtain the slave dongle HID and the first authorization information, and receives the slave dongle HID and the first authorization information returned by the slave dongle; Step S2, the first authorization system initiates a software authorization request of the slave dongle to the second authorization system according to the slave dongle HID, the first authorization information and the encryption software name input by the user; Step S3, the first authorization system receives the authorization file issued by the master dongle through the second authorization system, and sends the authorization file to the slave dongle; Step S4, the slave dongle decrypts the authorization file through a preset upgrade key to obtain the slave dongle HID and the second authorization information, compares the decrypted slave dongle HID with the slave dongle HID saved by itself, and if the comparison is consistent, step S5 is performed, otherwise, an error is prompted and the process ends; Step S5, the slave dongle performs a saving operation of the authorization information according to the second authorization information, and the second authorization information comprises the master dongle ID and the authorized software ID; The software running process comprises the following steps: Step P1, the encryption software receives the start trigger information of the user, obtains the fixed key in the encryption software package, decrypts the authorization structure in the encryption software package through the fixed key to obtain decryption data, and sends the decryption data to the slave dongle; Step P2, the slave dongle determines whether the encryption software is authorized according to the master dongle ID and the authorized software ID in the saved authorization information and the decryption data, and if yes, returns an authorization existing response to the encryption software, and step P3 is performed, otherwise, an error is prompted and the process ends; Step P3, the slave dongle receives the ninth random number sent by the encryption software, processes the ninth random number through a preset algorithm to obtain a first key, and sends the first key to the encryption software; Step P4, the encryption software uses the first key to decrypt the code segment ciphertext in the encryption software package to obtain decrypted code segments, and normally runs by loading the decrypted code segments.

2. The method for managing software based on a dongle according to claim 1, wherein, Before step S1, the method further comprises: Step A1, the first authorization system receives an authorization request, detects whether the dongle is inserted, and if yes, negotiates with the dongle to obtain a first communication key, and step A2 is performed, otherwise, prompts the user to insert the dongle, and the first communication key is used for encryption and decryption of communication data between the first authorization system and the dongle after step A1; Step A2, the first authorization system verifies whether the inserted dongle is a slave dongle, and if yes, step S1 is performed, otherwise, an error is prompted and the process ends.

3. The method for managing software based on a dongle according to claim 1, wherein, Between step S2 and step S3, the method further comprises: Step B1, the second authorization system receives the software authorization request of the slave dongle sent by the first authorization system; Step B2, the second authorization system obtains the encryption software name, the slave dongle HID and the first authorization information in the software authorization request, and prompts the user to insert the dongle; Step B3, the second authorization system receives the authorization software ID corresponding to the encrypted software name input by the authorizer, encrypts the authorization software ID and the slave encryption lock HID by the second communication key obtained through negotiation to obtain the first ciphertext, and sends the authorization instruction to the encryption lock by taking the first ciphertext as the instruction data; Step B4, the encryption lock decrypts the data in the authorization instruction by the second communication key to obtain the slave encryption lock HID and the authorization software ID, takes the authorization software ID and the master encryption lock ID saved by itself as new authorization information, encrypts the slave encryption lock HID and the new authorization information by the preset upgrade key to obtain the second ciphertext, encrypts the second ciphertext by the second communication key, and sends the encrypted second ciphertext to the second authorization system; Step B5, the second authorization system decrypts the encrypted second ciphertext by the second communication key to obtain the second ciphertext, and sends the second ciphertext to the first authorization system as the authorization file.

4. The method for managing software based on a dongle according to claim 3, wherein, The steps B2 and B3 further include: Step B21, the second authorization system detects whether the encryption lock is inserted, and if yes, step B22 is performed, otherwise, the user is prompted to insert the encryption lock; Step B22, the second authorization system verifies whether the inserted encryption lock is the master encryption lock, and if yes, the second communication key is obtained by negotiating with the master encryption lock, step B3 is performed, otherwise, an error is prompted and the process is ended.

5. The method for managing software based on a dongle according to claim 1, wherein, The method further includes: Step C1, the software encryption system receives the authorization software ID corresponding to the encrypted software name input by the authorizer, acquires the software to be encrypted, and analyzes the software to be encrypted to obtain the code segment to be encrypted; Step C2, the software encryption system acquires the master encryption lock ID, generates a ninth random number, and sends the ninth random number to the master encryption lock; Step C3, the software encryption system receives the data encryption key generated and sent by the master encryption lock according to the ninth random number through a preset algorithm; Step C4, the software encryption system encrypts the code segment to be encrypted by the data encryption key to obtain the encrypted code segment, and encrypts the master encryption lock ID and the authorization software ID by the preset fixed key to obtain an authorization structure; Step C5, the software encryption system organizes the encrypted code segment, the authorization structure, the fixed key and the ninth random number to obtain an encrypted software package, and takes the encrypted software package as the encrypted software.

6. The method for managing software based on a dongle according to claim 5, wherein, Before step C2, it includes: Step C21, the software encryption system detects whether the encryption lock is inserted, and if yes, step C22 is performed, otherwise, the user is prompted to insert the encryption lock; Step C22, the software encryption system negotiates the communication key with the encryption lock to obtain a third communication key, and sends an instruction for acquiring the encryption lock attribute information to the encryption lock; Step C23, the software encryption system receives the response data returned by the encryption lock, and decrypts the response data by the third communication key to obtain the encryption lock attribute information; Step C24, the software encryption system determines whether the current encryption lock is the master encryption lock according to the encryption lock identifier in the encryption lock attribute information, and if yes, step C2 is executed, otherwise, an error is prompted and the process ends.

7. The method for managing software based on a dongle according to claim 1, wherein, The method further comprises: Step D1, the third authorization system negotiates a communication key with the master encryption lock to obtain a fourth communication key, receives a master encryption lock ID input by a manager, encrypts the master encryption lock ID by using a preset master account private key, encrypts the encrypted master encryption lock ID by using the fourth communication key to obtain third ciphertext, and sends the third ciphertext to the master encryption lock; Step D2, the master encryption lock decrypts the encrypted master encryption lock ID by using the fourth communication key to obtain the master encryption lock ID, decrypts the encrypted master encryption lock ID by using a preset master account public key to obtain the master encryption lock ID and saves the master encryption lock ID.

8. A system for managing software based on a dongle, characterized by, The system comprises a first authorization system, a second authorization system, a third authorization system, a master encryption lock and a slave encryption lock, and is used to implement the method for managing software based on encryption locks according to any one of claims 1 to 7.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory, wherein the computer program comprises instructions that, when executed by the processor, cause the processor to perform the method of any one of claims 1-8. The processor executes the computer program to implement the method according to any one of claims 1 to 7.

10. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to implement the method according to any one of claims 1 to 7.

Images