Method for the authorized protection of instrument options and system therefor

Abstract

This invention relates to a method and system for authorizing and protecting instrument options, and pertains to the field of information security. The method includes: instrument software acquiring a unique hardware identifier, generating an encrypted information code, and storing it in the hardware module; the authorizing party decrypting the information code and generating a digital signature registration code by combining it with option authorization information; the instrument software receiving the registration code and performing local verification and signature verification using the local information code and the authorizing party's public key; if successful, the option is activated; the software periodically re-verifies the information code and authorization status. This invention binds authorization to specific devices through a combination of software and hardware, employs multiple encryption and verification mechanisms, and combines them with an intelligent timed check strategy, effectively improving the security, tamper resistance, and copy resistance of instrument option authorization in offline environments, while also considering system performance and user experience.

Description

Technical Field

[0001] This invention relates to the fields of data processing and information security technology, specifically to a method and system for protecting the licenses of optional components in a hardware and software integrated product. Background Technology

[0002] With the development of electronic technology, high-end instruments and meters typically include a variety of optional functional modules (options). To meet the needs of different customers, manufacturers need to provide flexible option licensing mechanisms. Traditional pure software licensing schemes are highly vulnerable to attacks such as reverse engineering and memory modification in offline environments, posing a risk of unauthorized use or tampering, and failing to effectively protect the manufacturer's intellectual property rights and commercial interests.

[0003] Therefore, existing technologies lack an instrument option authorization protection scheme that can effectively resist cracking, ensure strong binding between authorization and physical devices, and have minimal impact on user operation in offline or weak network environments. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for the authorization protection of instrument options that combines hardware and software, performs multiple verifications, and has high security.

[0005] To achieve the above objectives, the invention provides a method and system for protecting the authorization of instrument options as follows: The authorization protection method for this instrument option is characterized by comprising the following steps: (1) The software module running in the instrument obtains the unique hardware identification information of the instrument, generates an information code based on the unique hardware identification information, and stores the information code in the hardware module of the instrument. (2) The licensor receives the information code from the instrument, decrypts the information code based on the pre-stored decryption key to obtain the hardware information digest, and generates a registration code by combining the authorization information of the target option. The registration code is digitally signed by the licensor's private key. (3) The software module receives the registration code input by the user, reads the information code stored locally, performs local verification calculation based on the information code and the authorization information of the target option, obtains the local verification result, and uses the public key of the authorizing party to perform signature verification on the registration code. (4) If the signature verification passes and the local verification result is consistent with the verification information contained in the registration code, the authorization is deemed successful and the target option is activated. (5) During operation, the software module periodically executes a verification process, which includes re-acquiring the unique hardware identifier information and generating a verification information code, comparing the verification information code with the stored information code, and / or re-executing the local verification calculation based on the current information code and comparing it with the activation status information.

[0006] Preferably, the unique hardware identification information mentioned in step (1) includes at least one of the following: CPU serial number, MAC address, hard disk serial number, motherboard serial number, and dedicated encryption chip ID.

[0007] Preferably, step (1) generates the information code in the following manner: First, a hash operation is performed on the hardware unique identifier information to obtain the device feature hash value. Then, a symmetric encryption algorithm is used to encrypt the device feature hash value to generate the information code.

[0008] Preferably, the hash operation uses the SHA-256 algorithm; the symmetric encryption algorithm uses the AES algorithm.

[0009] Preferably, step (2) generates the registration code in the following manner: The hardware information digest obtained from decryption is combined with the authorization information of the target option. The combined data is hashed to obtain the authorization digest hash value. The authorization digest hash value is digitally signed using the private key of the licensor to generate the registration code.

[0010] Preferably, the authorization information includes the option module ID and / or the authorization validity period.

[0011] Preferably, step (3) involves local verification calculation in the following manner: The hardware unique identifier information is hashed to obtain a local device feature hash value. The local device feature hash value is then combined with the authorization information of the target option and hashed to obtain a local authorization digest hash value, which is used as the local verification result.

[0012] Preferably, the triggering strategy for the periodic verification in step (5) includes: performing the first verification when the software module starts; performing periodic verification at preset fixed time intervals during the operation of the software module; and configuring the periodic verification to be performed during system idle periods.

[0013] Preferably, it also includes an offline fault tolerance mechanism: when the instrument is offline and cannot complete periodic verification, the verification is allowed to be postponed within a preset grace period; if the verification still fails after the grace period, the user is prompted to reactivate the authorization.

[0014] Preferably, the hardware module is a dedicated encryption chip, EEPROM, or flash memory with non-volatile storage function.

[0015] The authorization protection system for the instrument option used to implement the above-described method is characterized in that the system includes a software module and a hardware module deployed on the instrument, as well as a registration server that interacts with the licensor. The software module is configured to obtain unique hardware identification information, generate information codes, receive registration codes, perform local verification and signature verification, activate options, and perform periodic verification. The hardware module is configured to securely store the information code and registration code. The registration server is configured to receive information codes and generate digitally signed registration codes based on decryption keys and authorization information.

[0016] Preferably, the system further includes a periodic check module, which is integrated into the software module and is used to manage the triggering timing and execution logic of the periodic checks, and to implement an offline fault tolerance mechanism.

[0017] The licensing protection method and system for protecting optional licenses in hardware and software integrated products, as described in this invention, have the following technical advantages: 1. Deep integration of hardware and software to prevent copying and tampering: The authorization is strongly bound to the unique identification information of the instrument hardware. Even if the software is copied, it cannot be activated on other devices, fundamentally preventing the illegal dissemination of software authorization. Key information codes are stored in the hardware module, increasing the difficulty of direct tampering.

[0018] 2. Multiple encryption and verification for high security: Employing multiple modern encryption technologies such as SHA-256, AES, and asymmetric encryption digital signatures, the system protects each link in the authorization chain, effectively preventing information leakage, man-in-the-middle attacks, and tampering with authorization information.

[0019] 3. Intelligent scheduled check mechanism, balancing security and user experience: A strategy combining startup verification and low-frequency periodic verification (e.g., set during system idle periods) continuously monitors the authorization status. An offline grace period mechanism is also introduced, ensuring convenience for offline use while providing timely alerts in case of authorization anomalies, avoiding interference with normal user operations.

[0020] 4. Clear, flexible, and reliable process: From information code generation and registration code distribution to local activation and periodic verification, a complete authorization loop is formed. It supports independent authorization of different optional modules, offers flexible configuration, and reliably protects the vendor's software assets and business model. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the registration and operation process of the authorization protection method for the instrument option of the present invention. Detailed Implementation

[0022] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0023] Before describing the embodiments of the present invention in detail, it should be noted that, in the following, the terms “comprising,” “including,” or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0024] The authorized protection method for this instrument option of the present invention adopts the following technical solution: 1. The software acquires hardware information and generates an information code: Hardware information source: The software reads unique hardware identification information through the operating system API or hardware interface, including but not limited to CPU serial number, MAC address, hard drive serial number, motherboard serial number, and the ID of a dedicated encryption chip (such as a TPM module). This information is unique and tamper-proof, ensuring the reliability of the hardware fingerprint.

[0025] Information code generation: Hardware information is processed using encryption algorithms. Specifically, the SHA-256 algorithm is used to generate a hash value from the hardware information as a base, and then the AES algorithm (with a 256-bit key length) is used for encryption to generate the information code. The AES key is stored using a secure key management scheme, such as a Hardware Security Module (HSM) or white-box encryption technology, to protect the key and prevent leakage. The information code is distributed and stored in the hardware module (such as EEPROM or flash memory), and is also provided to the manufacturer.

[0026] 2. Manufacturer generates registration code: After receiving the information code, the manufacturer decrypts it using the corresponding AES key to obtain the hardware information hash value. Then, combining this hash with information about the optional modules purchased by the customer (such as module ID, expiration date, etc.), the manufacturer aggregates the data and generates a digest using the SHA-256 algorithm. Finally, the manufacturer digitally signs the digest using their private key (based on RSA or ECC asymmetric encryption algorithms) to generate a registration code. This method ensures the integrity and authenticity of the registration code and prevents tampering.

[0027] 3. Customer activation option module: The customer enters the registration code in the instrument software. The software reads the stored information code from the hardware module, parses the hardware information, and uses the same SHA-256 and AES algorithms to generate a local activation code. The activation code is compared and verified with the registration code: the software uses the manufacturer's public key to verify the signature of the registration code and checks the hash value of the hardware information and the option module information. If the verification passes, activation is successful, and the activation code and activation information are stored; otherwise, registration fails.

[0028] 4. Regular inspection mechanism: The software periodically checks the registration status to prevent registration information from being altered. The check frequency is set to an intelligent strategy: an initial check is performed upon software startup, followed by low-frequency checks every 24 hours during system idle periods (e.g., 2 AM) to avoid impacting user experience. Offline, delayed verification is allowed (up to 7 days), and the user is prompted to reactivate upon verification failure, without causing system lag or false positives. The verification process includes regenerating the information code and activation code, comparing them with the stored registration code to ensure consistency.

[0029] 5. Safety Enhancement Measures: Throughout the process, all sensitive information (such as hardware information and registration codes) is encrypted or hashed to prevent information leakage. Multiple verification methods (such as hardware information verification, digital signature verification, and periodic checks) are employed to increase the difficulty of cracking. Furthermore, AES and SHA-256 are prioritized over RC5 and MD5 algorithms because AES offers higher security and efficiency, while SHA-256 provides stronger collision resistance and avoids known vulnerabilities.

[0030] In one specific embodiment of the present invention, it is assumed that a high-end instrument has multiple optional modules (such as a data analysis module and a remote communication module). A customer purchases the data analysis module. The implementation process is as follows: (1) Information Code Generation and Storage: After the software in the high-end instrument starts, it calls the operating system interface to read the local CPU serial number and MAC address as unique hardware identifiers. The SHA-256 algorithm is used to hash this identifier information to obtain the device feature hash value H1. Subsequently, H1 is encrypted using a pre-installed AES-256 key (protected by code obfuscation) to generate information code M. This information code M is written to the non-volatile storage area of ​​a dedicated encryption chip (such as TPM) on the instrument's mainboard. The user can view or export this information code M through the software interface.

[0031] (2) Registration Code Generation: The user submits the information code M and the information of the option to be purchased (e.g., "Advanced Data Analysis Module", ID: Module_A) to the instrument manufacturer (authorizer). The manufacturer's registration server decrypts M using the corresponding AES key to obtain the device feature hash value H1. The server concatenates H1 with the option ID "Module_A" and a one-year validity period, and calculates the hash value again using SHA-256 to obtain the authorization digest hash value H2. Finally, the server digitally signs H2 using the RSA private key held by the manufacturer to generate the final registration code R, which is then issued to the user.

[0032] (3) Local Activation Verification: The user enters the received registration code R in the instrument software. The software first reads the locally stored information code M from the encryption chip and decrypts it to obtain the stored device feature hash value H1. Then, the software rereads the current hardware identifier and calculates the local device feature hash value H1'. Next, the software combines H1' with the currently requested activation option ID "Module_A" to calculate the local authorization digest hash value H2'. Then, the software uses the built-in manufacturer RSA public key to decrypt and sign the registration code R, extracting the signed authorization digest hash value H2. Compare H2' with H2; if they are completely identical, the verification is successful. The software records the activation status and validity period of option Module_A in the encryption chip or protected configuration file.

[0033] (4) Periodic Verification: Each time the software starts, it performs a complete verification: rereading the CPU serial number and MAC address, calculating and encrypting a new information code M', and comparing it with the stored M; simultaneously, recalculating the verification hash based on M and the currently activated option information, and comparing it with the stored activation status. In addition, the software sets a timer to automatically perform a similar low-intensity verification once a day at 2:00 AM (system idle period). If the instrument is offline for more than 7 consecutive days, the software will pop up a reminder when the user operates again, prompting that the authorization needs to be re-verified, but the data analysis module can still be used normally within the grace period.

[0034] In another embodiment of the invention, the authorization protection system for the instrument option includes: The instrument client consists of a software module and a hardware encryption chip. The software module includes an information code management unit, a registration verification unit, and a periodic check unit. The hardware encryption chip is used to store information codes and activation status.

[0035] Vendor Authorization Server: Includes a key management unit and a registration code generation unit. It is responsible for securely storing the AES decryption key and RSA private key, processing client authorization requests, and generating signed registration codes.

[0036] By implementing the methods described above, this system provides offline instruments with highly secure option authorization management capabilities.

[0037] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0038] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution device.

[0039] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0040] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0041] In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "embodiment," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0042] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

[0043] The licensing protection method and system for protecting optional licenses in hardware and software integrated products, as described in this invention, have the following technical advantages: 1. Deep integration of hardware and software to prevent copying and tampering: The authorization is strongly bound to the unique identification information of the instrument hardware. Even if the software is copied, it cannot be activated on other devices, fundamentally preventing the illegal dissemination of software authorization. Key information codes are stored in the hardware module, increasing the difficulty of direct tampering.

[0044] 2. Multiple encryption and verification for high security: Employing multiple modern encryption technologies such as SHA-256, AES, and asymmetric encryption digital signatures, the system protects each link in the authorization chain, effectively preventing information leakage, man-in-the-middle attacks, and tampering with authorization information.

[0045] 3. Intelligent scheduled check mechanism, balancing security and user experience: A strategy combining startup verification and low-frequency periodic verification (e.g., set during system idle periods) continuously monitors the authorization status. An offline grace period mechanism is also introduced, ensuring convenience for offline use while providing timely alerts in case of authorization anomalies, avoiding interference with normal user operations.

[0046] 4. Clear, flexible, and reliable process: From information code generation and registration code distribution to local activation and periodic verification, a complete authorization loop is formed. It supports independent authorization of different optional modules, offers flexible configuration, and reliably protects the vendor's software assets and business model.

[0047] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for authorizing and protecting instrument options, characterized in that, The method includes the following steps: (1) The software module running in the instrument obtains the unique hardware identification information of the instrument, generates an information code based on the unique hardware identification information, and stores the information code in the hardware module of the instrument. (2) The licensor receives the information code from the instrument, decrypts the information code based on the pre-stored decryption key to obtain the hardware information digest, and generates a registration code by combining the authorization information of the target option. The registration code is digitally signed by the licensor's private key. (3) The software module receives the registration code input by the user, reads the information code stored locally, performs local verification calculation based on the information code and the authorization information of the target option, obtains the local verification result, and uses the public key of the authorizing party to perform signature verification on the registration code. (4) If the signature verification passes and the local verification result is consistent with the verification information contained in the registration code, the authorization is deemed successful and the target option is activated. (5) During operation, the software module periodically executes a verification process, which includes re-acquiring the unique hardware identifier information and generating a verification information code, comparing the verification information code with the stored information code, and / or re-executing the local verification calculation based on the current information code and comparing it with the activation status information.

2. The authorized protection method for instrument options according to claim 1, characterized in that, The unique hardware identification information mentioned in step (1) includes at least one of the following: CPU serial number, MAC address, hard disk serial number, motherboard serial number, and dedicated encryption chip ID.

3. The authorized protection method for instrument options according to claim 1, characterized in that, The aforementioned step (1) generates the information code in the following manner: First, a hash operation is performed on the hardware unique identifier information to obtain the device feature hash value. Then, a symmetric encryption algorithm is used to encrypt the device feature hash value to generate the information code.

4. The authorization protection method for instrument options according to claim 3, characterized in that, The hash operation uses the SHA-256 algorithm; the symmetric encryption algorithm uses the AES algorithm.

5. The authorization protection method for instrument options according to claim 1, characterized in that, Step (2) generates the registration code in the following manner: The hardware information digest obtained from decryption is combined with the authorization information of the target option. The combined data is hashed to obtain the authorization digest hash value. The authorization digest hash value is digitally signed using the private key of the licensor to generate the registration code.

6. The authorized protection method for instrument options according to claim 5, characterized in that, The authorization information includes the option module ID and / or the authorization validity period.

7. The authorization protection method for instrument options according to claim 1, characterized in that, The aforementioned step (3) involves local verification calculations as follows: The hardware unique identifier information is hashed to obtain a local device feature hash value. The local device feature hash value is then combined with the authorization information of the target option and hashed to obtain a local authorization digest hash value, which is used as the local verification result.

8. The authorization protection method for instrument options according to claim 1, characterized in that, The triggering strategy for the periodic verification in step (5) includes: performing the first verification when the software module starts; performing periodic verification at preset fixed time intervals during the operation of the software module; and configuring the periodic verification to be performed during system idle periods.

9. The authorization protection method for instrument options according to claim 8, characterized in that, It also includes an offline fault tolerance mechanism: when the instrument is offline and cannot complete the periodic verification, the verification is allowed to be postponed within a preset grace period; if the verification still fails after the grace period, the user is prompted to reactivate the authorization.

10. The authorized protection method for instrument options according to any one of claims 1 to 9, characterized in that, The hardware module is a dedicated encryption chip, EEPROM, or flash memory with non-volatile storage function.

11. An authorized protection system for an instrument option for implementing the method of any one of claims 1 to 9, characterized in that, The system includes software and hardware modules deployed on the instrument, as well as a registration server that interacts with the authorized party. The software module is configured to obtain unique hardware identification information, generate information codes, receive registration codes, perform local verification and signature verification, activate options, and perform periodic verification. The hardware module is configured to securely store the information code and registration code. The registration server is configured to receive information codes and generate digitally signed registration codes based on decryption keys and authorization information.

12. The authorized protection system for instrument options according to claim 11, characterized in that, The system also includes a timed check module, which is integrated into the software module and is used to manage the triggering timing and execution logic of the periodic checks, and to implement an offline fault tolerance mechanism.

Images