Computer program product, computing device, device having a computing device, and method of operation thereof

Abstract

A computer program product (CPP) comprising program instructions which, when executed by a computing device (11), cause the computing device to generate a license request (LA) adapted to be sent to a license checking device (20) corresponding to the computer program product (CPP), the program instructions causing the computing device (11) to jointly perform a hash code generation process on identification information (ID) identifying the computing device (11) and coded information (CI) stored in the computer program product (CPP), and to generate a hash code (HC1) associated with the identification information (ID) and the coded information (CI), the hash code constituting the license request (LA) or a component of the license request (LA).

Description

[0001] This invention relates to a computer program product comprising program instructions that, when executed by a computing device, cause the computing device to generate a license request suitable for transmission to a license checking device corresponding to the computer program product. Such computer program products are generally known.

[0002] In terms of license inspection, licensors and licensees have different interests. Typically, licensors aim to prevent a license purchased for a single computing device from being executed on multiple computing devices after the corresponding computer program product has been copied and installed multiple times; for this reason, licensors are often interested in making the activation of the computer program product dependent on knowledge of identification information identifying the computing device, so that the activation of the computer program product can only be performed once or for a specific computing device, or can only be activated a limited number of times for a limited number of computing devices.

[0003] The technical problem to be solved by the present invention is to provide a computer program product that implements a license check that is technically attractive to both the licensor and the licensee.

[0004] This technical problem is solved according to the invention by a computer program product having the features of claim 1. Advantageous designs of the computer program product according to the invention are given in the dependent claims.

[0005] According to the present invention, the program instructions cause the computing device to perform hash code generation processing on identification information identifying the computing device together with encoded information stored in the computer program product, and generate a hash code associated with the identification information and the encoded information, the hash code constituting the license request or a component thereof.

[0006] A significant advantage of the computer program product according to the invention is that it avoids transmitting the identification information itself, which typically allows for specific inferences about the hardware of a computing device, because such transmission is encrypted due to the inclusion of encoded information. The licensor therefore does not know the specific identification information or the associated hardware. Nevertheless, the hash code transmission according to the invention allows the licensor to restrict access to the computing device involved in the initial license request: once the license request is confirmed, the licensor, i.e., the license checking device here, can store the hash code considered for that license request and prevent further or repeated access for another computing device (for which a different hash code would be transmitted). In other words, the license checking device can restrict access to a single computing device or a predetermined number of computing devices without knowing or needing to know the identification information of the computing device or the associated hardware information; therefore, access can be said to be quasi-anonymous based on the hash code.

[0007] Regarding the licensee, an advantage of the computer program product according to the present invention is that even if the transmission of the license request is intercepted by a malicious third party, that third party cannot obtain the identification information, and therefore cannot obtain any information about the licensee's hardware. For the licensee, this minimizes the risk that the transmission of the license request would allow a malicious third party to obtain the identification information and, knowing the identification information and the hardware information typically associated with it, launch a targeted external attack on the security architecture of the computing device. External attacks are significantly more difficult without knowledge of the specific hardware of the computing device, and are generally much less likely to succeed than when the specific hardware is known.

[0008] The computer program product is preferably designed such that it does not transmit the identification information itself to the outside, or prevents the identification information itself from being transmitted to the outside.

[0009] The encoded information is preferably hidden as a secret within the computer program product. This hiding is preferably designed such that the bit information of the encoded information is placed in at least two separate segments of the computer program product. By hiding the encoded information, it is ensured that the encoded information cannot be read, or at least that reading it becomes extremely difficult.

[0010] Upon receiving a license confirmation, the computing device preferably enables the functionality of the computing device related to the license confirmation, provided that the license confirmation is recognized as valid by the computing device or has not been abandoned by the computing device.

[0011] The computer-side access to the computer program product is considered advantageous if the program instructions cause the computing device to check whether the received license confirmation contains a hash code that matches the hash code previously sent to the license checking device, and to abandon the license confirmation if the license confirmation does not contain the corresponding hash code.

[0012] Also advantageously, the program instructions cause the computing device, upon receiving the license confirmation, to perform additional hash code generation processing on the identification information identifying the computing device and the encoded information stored in the computer program product to generate a comparison hash code. The hash code received from the license checking device is then compared with the comparison hash code, and if the received hash code does not match the comparison hash code, the license confirmation is abandoned. Re-determining the hash code or determining the comparison hash code avoids the need to store the hash code sent with the license query in the computing device before subsequent hash code comparisons can be performed.

[0013] Furthermore, it can be advantageously stipulated that the program instructions cause the computing device to perform signature verification upon receiving a signed license confirmation, wherein the signature verification includes checking whether the signed license confirmation was signed by the license verification device. If the signature verification fails, the license confirmation is preferably abandoned.

[0014] In the latter implementation variant mentioned, it may also be advantageously stipulated that the program instructions cause the computing device, upon receiving the signed license confirmation, to enable the functionality of the computer program product relating to the license confirmation based on: the signature verification being passed, and the received signed license confirmation containing a hash code that matches the hash code previously sent to the license checking device or the comparison hash code.

[0015] The program instructions preferably cause the computing device to activate the functionality of the computer program product related to the license confirmation for a duration corresponding to duration information already included in the license request or transmitted by the license checking device with the license confirmation.

[0016] The computer program product may advantageously have optional functional options, which can be activated individually or in predetermined combinations. The program instructions of the computer program preferably cause the computing device to activate only those functional options defined in the option information, which is included in the license request or transmitted by the license checking device along with the license confirmation.

[0017] The present invention also relates to a computing device. According to the present invention, the computing device is programmed using a computer program product as described above.

[0018] The present invention also relates to an apparatus having a computing device and a license checking device. According to the invention, the computing device is as described above, and the license checking device is designed to perform a license check upon receiving a license request transmitted by the computing device, and, if the license check result is positive, to send back only the hash code contained in the license request as a license confirmation to the computing device, or to send back the hash code as part of the license confirmation to the computing device.

[0019] The license checking device is preferably designed to sign the license confirmation and send the signed license confirmation back to the computing device.

[0020] The present invention also relates to a method for operating a computing device, preferably a computing device as described above. Hereinafter, the computing device is defined as follows:

[0021] - The identification information identifying the computing device is combined with the stored encoded information to generate a hash code, which is associated with the identification information and the encoded information. The hash code constitutes a license request or a component of a license request, and the hash code is transmitted to the license checking device.

[0022] - Upon receiving the license confirmation, check whether the license confirmation contains a hash code.

[0023] - Upon receiving the license confirmation, the identifying information and the encoded information stored in the computer program product are subjected to additional hash code generation processing to generate a comparison hash code.

[0024] - Compare the received hash code with the comparison hash code, and if the received hash code does not match the comparison hash code, then abandon the permission confirmation.

[0025] The present invention also relates to a method for operating an apparatus, such as the apparatus described above, comprising a computing device and a corresponding license checking device associated with the computing device, wherein, in the method:

[0026] The computing device performs hash code generation processing on the identification information identifying the computing device and the stored encoded information, and generates a hash code associated with the identification information and the encoded information. This hash code constitutes a license request or is a component of a license request.

[0027] - Send the license request to the license checking device.

[0028] - The license checking device checks whether the license request meets preset confirmation conditions, and generates a license confirmation when the confirmation conditions are met, wherein the license confirmation includes the hash code or is composed of the hash code.

[0029] - Send the license confirmation back to the computing device, and

[0030] - After receiving the license confirmation, the computing device will perform hash code generation processing again on the identification information identifying the computing device and the stored encoding information to generate a comparison hash code. The received hash code will be compared with the comparison hash code. If the received hash code does not match the comparison hash code, the license confirmation will be abandoned.

[0031] Upon receiving a license confirmation, the computing device preferably enables the functionality of the computing device related to the license confirmation, provided that the computing device recognizes the license confirmation as valid, and in particular, not abandoned.

[0032] The license checking device is preferably a programmed computing device that includes a computing unit and a memory.

[0033] The present invention will be explained in more detail below with the aid of embodiments; wherein, by way of example:

[0034] Figure 1 A first embodiment of a device according to the invention is shown, comprising a first embodiment of a computing device according to the invention and a first embodiment of a computer program product according to the invention, wherein, by means of... Figure 1 The apparatus explains an embodiment of the method according to the present invention.

[0035] Figure 2-4 The device is shown in operation during the licensing inspection, and

[0036] Figure 5 A second embodiment of the apparatus according to the invention is shown, which includes a second embodiment of the computing device according to the invention and a second embodiment of the computer program product according to the invention.

[0037] For clarity, the same reference numerals are used for the same or equivalent components in the accompanying drawings.

[0038] Figure 1 A first embodiment of the device according to the invention is shown. The device has a computing device 10, which includes a computing unit 11 and a memory 12. The computing unit 11 may include one or more processors, which are not further shown in the drawings. The device also includes a license checking device 20.

[0039] The memory 12 stores a computer program product CPP, which programs the computing device 11 of the computing device 10. When executed by the computing device 11, the program instructions of the computer program product CPP cause it to implement an embodiment of the method of operation according to the invention, and thus, together with the license check device 20, implement the operation... Figure 1 The apparatus shown is according to the method of the present invention. Figure 1 In this embodiment, the Computer Program Product (CPP) includes multiple software modules: a License Determination Module (LEM), a Utility Module (NPM), a Hash Code Generation Module (HEM), and a Signature Verification Module (SPM). The Utility Module (NPM) specifies how the Computer Program Product (CPP) operates after a successful license check, or at least collectively determines that operating mode.

[0040] In addition, the Computer Program Product (CPP) includes the coded information CI and the trust anchor VA hidden within the CPP.

[0041] Encoded information (CI) is implemented as a secret within a computer program product (CPP) and cannot be read from the outside, or can only be read with great effort or only with knowledge of the internal, non-publicly available information of the computer program product (CPP). Therefore, encoded information (CI) is considered a secret.

[0042] The trust anchor VA can be a publicly available certificate or a publicly available key of a key pair, which includes a publicly available key and a secret key known only to the authorized inspection device 20.

[0043] To perform license checks or to check for the existence of licenses required to use the NPM utility module or specific functions of the NPM utility module, the program instructions implemented in the software program module are designed as follows:

[0044] For example, when the computer program product CPP is first launched, the license determination module LEM performs a license determination. Within the scope of the license determination, the license determination module LEM requests the hash code generation module HEM to generate a hash code HC1 associated with the identification information ID of the computing device and the encoded information CI secretly stored in the computer program product CPP; Figure 2 An example is shown.

[0045] Subsequently, the License Determination Module (LEM) generates a License Request LA containing the hash code HC1. In addition to the hash code HC1, the License Determination Module (LEM) may also embed other information into the License Request LA, such as the customer number KN (of which the customer's license should be used) and / or record the order number BN for the license purchase.

[0046] The license request LA is generated by the license determination module LEM or by the computing device 11 when executing the program instructions of the license determination module LEM, and is transmitted to the license checking device 20 (see...). Figure 2 ).

[0047] The license checking device 20 checks the license request LA and, if the license check is successful, sends the license confirmation LB back to the computing device 11 of the computing device 10, such as... Figure 3 As shown in the example. The license confirmation LB contains the hash code of the license request LA (in... Figure 3 The signature (represented by HC2 in the attached diagram) and the signature SIG enable the computer program product (CPP) to verify the authenticity of the license (LB). For information on signature generation, refer to commonly used and known signature generation methods.

[0048] The license confirmation (LB) may include the definition of the license scope (LU), i.e., the functionality that the utility module NPM has to be enabled, and / or the duration information (Tmax), which defines the maximum usage duration for which the utility module NPM should be enabled.

[0049] Upon receiving the license confirmation LB, the license determination module LEM of computing device 10 checks whether the license confirmation LB contains hash code HC2, and if necessary, whether this hash code matches the hash code HC1 previously sent in the license request LA. For security reasons, the license determination module LEM does not store the hash code HC1 previously sent in the license request LA, and this hash code no longer exists for the license determination module LEM. Therefore, the license determination module LEM again controls the hash code generation module HEM (see...). Figure 4 This triggers a recalculation of the hash code based on the identification information ID of the computing device 11 and the encoded information CI hidden in the computer program product CPP. The recalculated hash code is used for comparison purposes and is therefore called the comparison hash code VHC for its intended use.

[0050] Once the hash code is recalculated after generating the comparison hash code VHC, it is compared with the hash code HC2 received from the license check device 20. If the two hash codes HC2 and VHC match, the hash code check is considered to have passed; otherwise, it is considered to have failed, and the license confirmation LB is abandoned.

[0051] Furthermore, the License Determination Module (LEM), in the presence of the Signature Verification Module (SPM), checks whether the License Confirmation LB possesses a valid signature (SIG) from the License Verification Device 20. The Signature Verification Module (SPM) introduces a Trust Anchor (VA) contained within the Computer Program Product (CPP) for signature verification. Generally known and commonly used signature verification methods can be used for signature verification. If signature verification fails, the License Confirmation LB is abandoned.

[0052] If the License Determination Module (LEM) has successfully determined that both the hash code check and signature verification have passed, the LEM will recognize the License Confirmation LB as valid and enable the NPM utility module to run either fully or only within the scope defined in the License Confirmation LB (provided that the License Confirmation LB contains a definition of the License Scope LU), such as permanently or only temporarily, provided that the License Confirmation LB contains a definition of the Time Limit Tlimit.

[0053] Figure 5 A second embodiment of the device according to the invention is shown. Figure 5 The device corresponds to the one based on Figure 1 The difference lies in omitting signature verification. Therefore, the signature verification module (SPM) in a computer program product (CPP) can be omitted. In addition, the above combination... Figure 1 The description of the embodiments is accordingly applicable to Figure 5 Examples of implementations.

[0054] In the above-described variant embodiment, the license checking device 20 may include a computing device 21 and a memory 22, wherein the memory 22 stores software SW suitable for running the computing device 21. The computing device 21 may include one or more processors, which are not further shown in the drawings.

[0055] Finally, it should be mentioned that the features of all the above embodiments can be combined with each other in any way to form other embodiments of the present invention.

[0056] Furthermore, the features of all dependent claims may be combined with each independent claim, and may be combined individually or in any combination with one or more other dependent claims to obtain other embodiments.

[0057] Regardless of the grammatical gender of a particular term, individuals with male, female, or other gender identities are included.

[0058] List of reference numerals

[0059] 10. Computing devices

[0060] 11. Computing device

[0061] 12 Memory

[0062] 20 Permit Inspection Device

[0063] 21 Computing device

[0064] 22 Memory

[0065] BN Order Number

[0066] CI Encoding Information

[0067] CPP computer program products

[0068] FG enabled

[0069] HC1 hash code

[0070] HC2 hash code

[0071] HEM hash code generation module

[0072] ID identification information

[0073] KN Customer Number

[0074] LA License Request

[0075] LB License Confirmation

[0076] LEM License Determination Module

[0077] LU License Scope

[0078] NPM utility module

[0079] SIG signature

[0080] SPM Signature Verification Module

[0081] SW software

[0082] Tlimit time limit

[0083] Tmax duration information

[0084] VA Trust Anchor

[0085] VHC compare hash codes

Claims

1. A computer program product (CPP) comprising program instructions that, when executed by a computing device (11), cause the computing device to generate a license request (LA) suitable for transmission to a license checking device (20) corresponding to the computer program product (CPP), characterized in that, The program instructions cause the computing device (11) to: - The identification information (ID) identifying the computing device (11) and the encoded information (CI) stored in the computer program product (CPP) are combined to generate a hash code, and - Generate a hash code (HC1) associated with the identification information (ID) and the encoding information (CI), the hash code constituting a component of the license request (LA).

2. The computer program product (CPP) according to claim 1, characterized in that, The program instructions cause the computing device (11) to: - Check whether the license confirmation (LB) received from the license checking device (20) contains a hash code (HC2) that matches the hash code (HC1) previously sent to the license checking device (20), and - If the license confirmation (LB) does not contain the corresponding hash code (HC2), then the license confirmation (LB) is abandoned.

3. The computer program product (CPP) according to claim 2, characterized in that, The program instructions cause the computing device (11) to, upon receiving the license confirmation (LB): - The identification information (ID) identifying the computing device (11) and the encoded information (CI) stored in the computer program product (CPP) are subjected to additional hash code generation processing to generate a comparison hash code (VHC). - The hash code (HC2) received from the license check device (20) is compared with the comparison hash code (VHC), and - If the received hash code (HC2) does not match the comparison hash code (VHC), then the license confirmation (LB) is abandoned.

4. The computer program product (CPP) according to any one of the preceding claims, characterized in that: - The program instructions cause the computing device (11) to perform signature verification upon receiving a signed license confirmation (LB). - Wherein, the signature verification includes checking whether the signed license confirmation (LB) is signed by the license checking device (20).

5. The computer program product (CPP) according to claim 4, characterized in that, The program instructions cause the computing device (11) to, upon receiving the signed license confirmation (LB), make the functionality of the computer program product (CPP) related to enabling the license confirmation (LB) depend on: the signature verification being successful, and the received signed license confirmation (LB) containing a hash code (HC2) that matches either the hash code (HC1) previously sent to the license checking device (20) or a newly determined comparison hash code (VHC).

6. The computer program product (CPP) according to any one of the preceding claims, characterized in that, The program instructions cause the computing device (11) to enable the functionality of the computer program product (CPP) related to the license confirmation (LB) for a duration corresponding to the duration information (Tmax) already included in the license request (LA) or transmitted by the license checking device (20) with the license confirmation (LB).

7. The computer program product (CPP) according to any one of the preceding claims, characterized in that, The computer program product (CPP) has optional functional options that can be enabled individually or in a predetermined combination of options, and the program instructions cause the computing device (11) to enable those functional options defined in the option information, which is included in the license request (LA) or transmitted by the license checking device (20) with the license confirmation (LB).

8. The computer program product (CPP) according to any one of the preceding claims, characterized in that, The computer program product is designed not to transmit the identification information (ID) itself to the outside, especially to the license check device (20), or the computer program product is designed to prevent the transmission of the identification information (ID) to the outside.

9. A computing device (11), characterized in that, The computing device (11) is programmed by a computer program product (CPP) according to any one of the preceding claims.

10. An apparatus having a computing device (11) and a license checking device (20), characterized in that, - The computing device (11) is the computing device (11) according to claim 9, and - The license checking device (20) is designed to perform a license check upon receiving a license request (LA) transmitted by the computing device (11), and if the license check result is positive, to send back the hash code (HC1) contained in the license request (LA) as a license confirmation (LB) to the computing device (11), or to send back the hash code (HC1) as part of the license confirmation (LB).

11. The apparatus according to claim 10, characterized in that, The license checking device (20) is designed to sign the license confirmation (LB) and send the signed license confirmation (LB) back to the computing device (11).

12. A method for operating a computing device (11), particularly a computing device (11) according to claim 9, wherein: The computing device (11) performs hash code generation processing on the identification information (ID) that identifies the computing device (11) and the stored encoding information (CI), and generates a hash code (HC1) associated with the identification information (ID) and the encoding information (CI). The hash code constitutes a license request (LA) or a component of a license request (LA), and transmits the hash code (HC1) to the license checking device (20). - After receiving the license confirmation (LB), the computing device (11) checks whether the license confirmation contains a hash code (HC2). - Upon receiving the license confirmation (LB), the computing device (11) performs additional hash code generation processing on the identifying identification information (ID) and the encoded information (CI) stored in the computer program product (CPP) to generate a comparison hash code (VHC). The computing device (11) compares the received hash code (HC2) with the comparison hash code (VHC), and - If the received hash code (HC2) does not match the comparison hash code (VHC), the computing device (11) abandons the license confirmation (LB).

13. A method for operating an apparatus, particularly a method for operating an apparatus according to any one of claims 10 to 11, the apparatus comprising a computing device (11) and a license checking device (20) corresponding to said computing device (11), wherein in the method: - The computing device (11) performs hash code generation processing on the identification information (ID) that identifies the computing device (11) and the stored encoding information (CI), and generates a hash code (HC1) associated with the identification information (ID) and the encoding information (CI), the hash code constituting a license request (LA) or a component of a license request (LA). - Send the license request (LA) to the license checking device (20), - The license checking device (20) checks whether the license request (LA) meets preset confirmation conditions, and generates a license confirmation (LB) when the confirmation conditions are met. The license confirmation includes the received hash code (HC1) or is composed of the hash code. - The license confirmation (LB) is sent back to the computing device (11). - After receiving the license confirmation (LB), the computing device (11) performs additional hash code generation processing on the identification information (ID) identifying the computing device (11) and the stored encoding information (CI) to generate a comparison hash code (VHC). The computing device (11) compares the received hash code (HC2) with the comparison hash code (VHC), and - If the received hash code (HC2) does not match the comparison hash code (VHC), the computing device (11) abandons the license confirmation (LB).

14. The method according to claim 13, characterized in that, The license check device (20) is a programmed computing device.

15. The method according to claim 13 or 14, characterized in that, Upon receiving the license confirmation, the computing device (11) shall activate the functionality of the computing device related to the license confirmation, provided that the computing device considers the license confirmation to be valid, especially not abandoned.

Images