CN103491097B - Software Authorization System Based on Public Key Cryptosystem - Google Patents

Abstract

The invention discloses a kind of software authorization system based on public-key cryptosystem, including server end and client, wherein server end includes mechanism's certificate of authority generation module, receiver module, authentication module and user's certificate of authority generation module；User's certificate of authority generation module specifically includes: Digital Signature module, and user registers the computer hardware feature h in file with RSA private key₀It is digitally signed, generates s₀；Encryption string generation module, for the software version information v that will obtain, user profile u, licensing term ex, current time cur and s₀The hybrid operation carrying out presetting generates encryption string signB64；Certificates constructing module, for generating user's certificate of authority together by encryption string signB64 and RSA PKI.The present invention can prevent software to be illegally duplicated, and is managed concentratedly by software publishing person simultaneously, facilitates software to carry out upgrading, follows the tracks of and push personalized service etc. for user and manage after sale.

Description

Software Authorization System Based on Public Key Cryptosystem

technical field

The invention relates to a software authorization method, in particular to a software authorization system based on a public key cryptosystem.

Background technique

The existence of piracy has become an important factor restricting the development of the computer software industry. Software is easy to copy and the copy cost is low. Now companies urgently need to take technical measures to protect their copyrights. Therefore, it is of great practical significance to study and design an effective, practical and secure software authorization method.

In public key cryptography, the encryption key is different from the decryption key. Among all public key cryptosystems so far, the RSA algorithm is the most famous and widely used one. The RSA algorithm solves the problem of using the public channel transmission and distribution of the key of the symmetric encryption algorithm well. It can also use the RSA algorithm to complete the digital signature of the information to resist the denial and denial of the information. At the same time, it is easier to use the digital signature It can detect illegal tampering of information by attackers in order to protect the integrity of data information.

Commonly used software protection methods are generally divided into two types: soft encryption and hard encryption. Hard encryption mainly refers to dongles or dongles. The advantage of the hardware dongle is that authorization is issued easily and can be moved. However, as the use of the Internet becomes more and more popular, many shortcomings are also exposed: 1) It is suitable for traditional one-time permanent authorization, and trial versions and on-demand purchases cannot be realized; 2) The existence of hardware brings additional production and initialization , logistics, installation and maintenance costs; 3) installation of drivers and client components and additional hardware devices affect customer experience; 4) electronic distribution based on the Internet cannot be realized; 5) it is difficult to perform upgrades, tracking and after-sales management . Soft encryption is a protection technology for software that does not rely on special hardware. Its biggest advantage is its extremely low encryption cost. At present, there are mainly serial number schemes, license file schemes, and password table schemes. Among them, the license file authorization mechanism has been widely used gradually, and software vendors can limit that only users who have purchased the license can use the software product on a specific machine. The license file mechanism mainly has the following functions: 1) applications can create and verify licenses bound to users, systems and other entities; 2) prevent users from copying software and licenses at will; 3) licenses can be permanent or temporary; 4) The verification of the license is realized by the digital signature mechanism provided by JAVASecurityAPI, and the security is guaranteed. However, the current license file authorization mechanism still has obvious deficiencies when used in an institutional management environment. It cannot realize modular authorization by user level. The organization administrator role cannot effectively manage the authorization information of ordinary users under it.

Contents of the invention

The technical problem to be solved by the present invention is to aim at the deficiencies of the encryption technology in the prior art, to provide a convenient and applicable in the institutional environment, based on the public key cryptosystem, which can be used in the Internet environment, effective, practical and has Security-strength software licensing system.

The technical solution adopted by the present invention to solve its technical problems is:

Provide a software authorization system based on public key cryptography, including server and client, wherein:

The server side includes:

The institution authorization certificate generation module is used to encrypt and generate the institution authorization certificate according to the application information of the institution user;

The receiving module is used to receive the agency authorization certificate and registration file transmitted by the client;

A verification module, configured to decrypt the received agency authorization certificate, and verify the decrypted information;

The user authorization certificate generation module is used to encrypt the registration file during verification, generate a user authorization certificate and return it to the client;

Clients include:

The registration file acquisition module is used to obtain the registration file in XML format that includes computer hardware features, user information, and software version information when the user uses the software for the first time;

The user authorization certificate storage module is used to store the user authorization certificate;

The decryption and verification module is used to decrypt and verify the user authorization certificate when the customer starts the software. If the decryption verification is successful, the software is started, otherwise, the software does not start;

Among them, the user authorization certificate generation module specifically includes:

The digital signature module digitally signs the computer hardware feature _h0 in the user registration file with the RSA private key to generate _s0 ;

The encrypted string generation module is used to generate the encrypted string signB64 by performing preset mixed operations on the obtained software version information v, user information u, authorization period ex, current time cur and _s0 ;

The certificate generation module is used to generate the user authorization certificate together with the encrypted string signB64 and the RSA public key.

In the system of the present invention, the encrypted string generating module is specifically used for:

i. Obtain the current time cur of the system, and execute the operation ex+cur to obtain the byte array b8;

ii. The server generates a 22-bit random number ran22, and combines it with b8, v, u to form a 32-bit byte array bt32;

iii. Perform operation b32 on the 8th byte b8[8] of bt32 and b8 b8[8] produces btxor32;

iv. Execute operation h ₀ btxor32 generates mixXor32;

v. Merge mixXor32 and s ₀ to generate mixFinal64;

vi. Perform Base64 encoding on mixFinal64 to generate signB64.

In the system of the present invention, the computer hardware features include BIOS number, hard disk serial number and MAC address.

In the system of the present invention, the user information includes user ID and job title.

In the system of the present invention, the server side also includes a permission setting module, which is used for inquiring or modifying the permission of individual software users under the organization when the organization user logs in to the server side.

The beneficial effects produced by the invention are: the software authorization system of the invention uses the RSA algorithm to ensure the safety and integrity of the user authorization certificate, and the user authorization certificate can be transmitted through open channels such as the Internet. Therefore, with the software authorization method of the present invention, the software can be electronically issued based on the Internet, and software trial version authorization and on-demand purchase authorization can be realized. In addition, the present invention binds the user authorization certificate with the user's computer hardware features, user information, and software version information to prevent the software from being illegally copied, and at the same time, it is centrally managed by the software issuer to facilitate software upgrades, tracking, and personalized pushes for users. Service and other after-sales management.

Furthermore, the present invention facilitates organization administrators to inquire and manage the authorization of users of different levels under them, so that users of different levels can use different modules of the software in a targeted manner.

Description of drawings

The present invention will be further described below in conjunction with accompanying drawing and embodiment, in the accompanying drawing:

Fig. 1 is the flow chart of the software authorization method based on the public key cryptosystem of the embodiment of the present invention;

Fig. 2 is a schematic diagram of a client applying for an agency authorization certificate according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of generating a user authorization certificate according to an embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The software authorization system based on the public key cryptosystem in the embodiment of the present invention, as shown in Figure 1, includes a server end and a client end, wherein:

The server side includes:

The institution authorization certificate generation module is used to encrypt and generate the institution authorization certificate according to the application information of the institution user; the institution authorization certificate is generated by the server end according to the application information of the institution user, and is provided to the institution user for management and storage, and the institution user distributes to the individual Software users, individual software users can only perform authorized operations if they upload the agency authorization certificate and registration file to the server at the same time. The content of the organization authorization certificate includes basic information such as organization information, purchased software version, and purchased authorization quantity;

The registration file is an XML format file obtained from the client when the software user uses the software for the first time, including computer hardware features, user information, and software version information. In the embodiment of the present invention, the computer hardware features include BIOS number, hard disk serial number, MAC address and the like. The user information includes user ID and job title.

The receiving module is used to receive the agency authorization certificate and registration file transmitted by the client;

The verification module is used to decrypt the received agency authorization certificate, and verify the decrypted information; in one embodiment of the present invention, the verification of the decrypted information is as follows: first, the server checks whether the database contains There is an organization ID sent by the client. If it exists, it is judged whether the authorized number of organizations is sufficient; otherwise, exit the verification. Secondly, the server judges whether the machine code that can represent the characteristics of the computer hardware transmitted by the client is unique in the database record. If so, it determines whether the official version or the trial version of the user authorization certificate returned to the client is based on whether the authorized quantity remains. , if not, judge whether the user authorization certificate corresponding to the machine code application in the library has expired, if so, exit the verification, otherwise pass the verification.

The user authorization certificate generation module is used to encrypt the registration file during verification, generate a user authorization certificate and return it to the client;

Clients include:

The registration file acquisition module is used to obtain the registration file in XML format that includes computer hardware features, user information, and software version information when the user uses the software for the first time;

The user authorization certificate storage module is used to store the user authorization certificate;

The decryption and verification module is used to decrypt and verify the user authorization certificate when the customer starts the software. If the decryption verification is successful, the software is started, otherwise, the software does not start;

Among them, the user authorization certificate generation module specifically includes:

The digital signature module digitally signs the computer hardware feature _h0 in the user registration file with the RSA private key to generate _s0 ;

The encrypted string generation module is used to generate the encrypted string signB64 by performing preset mixed operations on the obtained software version information v, user information u, authorization period ex, current time cur and _s0 ;

The certificate generation module is used to generate the user authorization certificate together with the encrypted string signB64 and the RSA public key.

In one embodiment of the present invention, the encrypted string generation module is specifically used for:

i. Obtain the current time cur of the system, and execute the operation ex+cur to obtain the byte array b8;

ii. The server generates a 22-bit random number ran22, and combines it with b8, v, u to form a 32-bit byte array bt32;

iii. Perform operation b32 on the 8th byte b8[8] of bt32 and b8 b8[8] produces btxor32;

iv. Execute operation h ₀ btxor32 generates mixXor32;

v. Merge mixXor32 and s ₀ to generate mixFinal64;

vi. Perform Base64 encoding on mixFinal64 to generate signB64.

In another embodiment of the present invention, another mixed operation can be selected, specifically:

1. Execute ex+cur to get the byte array b8;

2. The server generates a 20-bit random number ran20, and combines it with b8, v, u, p (2 bytes) to generate a 32-bit byte array bt32;

3. Execute modulo operation: h ₀ modbt32, generate sign32;

4. Execute XOR operation: the eighth byte b8[8] of b8 sign32 generates btxor32;

5. Execute XOR operation: h ₀ btxor32 generates mixXor32;

6. Merge mixXor32 and s ₀ to generate mixFinal64;

7. Perform Base64 encoding on mixFinal64 to generate signB64.

In the embodiment of the present invention, the server end further includes an authority setting module, which is used for inquiring or modifying the authority of individual software users under the organization when the organization user logs in to the server end.

As shown in Figure 2, in one embodiment of the present invention, the steps for the client to apply for an organization authorization certificate specifically include: the server receives basic information such as organization information, purchased software version, purchased authorization quantity, etc. The information is encrypted to generate an organization authorization certificate, and the organization's basic information and organization authorization information are saved in the database, and then the organization authorization certificate is returned to the client.

Institutional users can log in to the server to query or modify the permissions of individual software users under their organization, so that users at different levels can use different modules of the software in a targeted manner.

As shown in Figure 3, in a preferred embodiment of the present invention, the software authorization method of the software authorization system based on the public key cryptosystem specifically includes:

(1) The software issuer uses the RSA algorithm to generate a pair of keys (public key P and private key S), S is kept secret by the software issuer, and P can be downloaded publicly;

(2) When the software user uses the software for the first time, the software generates a registration file in XML format with the user's computer hardware features, user information, software version and other information, and the user submits the registration file (License-A.dat) to the software issuer;

(3) The software publisher uses the SHA1 algorithm to digitally sign the computer hardware features in the License-A.dat file in (2) with S in (1);

(4) The software issuer performs a specific mixed operation with information such as software version information, authorization period, and current time (it has been described in detail in the above-mentioned embodiments and will not be repeated here);

(5) The software issuer generates a user authorization certificate (License-B.dat) together with the encrypted information in (3), the mixed information in (4) and P in (1), and returns it to the software user;

(6) The software uses P in (1) to decrypt and verify the encrypted information in (3), and obtain authorization information such as the authorization period through the inverse operation of the mixed operation in (4); if the verification is passed and the authorization period is valid, then The software starts running normally, otherwise the software stops running.

The software authorization system based on the public key cryptosystem of the present invention uses the RSA algorithm and the SHA1 algorithm to ensure the security and integrity of the user authorization certificate, and the user authorization certificate can be transmitted through open channels such as the Internet. Therefore, the present invention can realize Internet-based electronic distribution, and can realize software trial version authorization and on-demand purchase authorization.

The invention binds the user authorization certificate with the user's computer hardware features, user information, and software version information to prevent the software from being illegally copied, and at the same time, it is managed centrally by the software issuer to facilitate software upgrades, tracking, and personalized services for users. After-sales management.

It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should belong to the protection scope of the appended claims of the present invention.

Claims (5)

1. the software authorization system based on public-key cryptosystem, it is characterised in that include server end and client, wherein:

Server end includes:

Mechanism's certificate of authority generation module, encrypts the generating mechanism certificate of authority for the application information according to organization user；

Receiver module, for receiving the mechanism's certificate of authority transmitted by client and registration file；

Authentication module, for the mechanism's certificate of authority received is decrypted, and is verified the information after deciphering；

User's certificate of authority generation module, for when checking, being encrypted registration file, generate user's certificate of authority and return to client；

Client includes:

Registration file acquisition module, for when user uses software for the first time, obtaining the registration file of the XML format comprising computer hardware feature, user profile, software version information；

User's authorization certificate storage module, is used for storing user's certificate of authority；

Deciphering and authentication module, when starting software for client, be decrypted user's certificate of authority and verify, if decryption verification success, then starts software, and otherwise, software does not start；

Wherein, user's certificate of authority generation module specifically includes:

Digital Signature module, registers the computer hardware feature h in file with RSA private key to user₀It is digitally signed, generates s₀；

Encryption string generation module, for the software version information v that will obtain, user profile u, licensing term ex, current time cur and s₀The COMPLEX MIXED computing carrying out presetting generates encryption string signB64；

Certificates constructing module, for generating user's certificate of authority together by encryption string signB64 and RSA PKI.

2. system according to claim 1, it is characterised in that when described encryption string generation module carries out the COMPLEX MIXED computing preset specifically for:

I. obtain current time in system cur, and perform operation ex+cur after obtain byte arrays b8；

Ii. server end generates 22 random number ran22, and is combined into 32 bit byte array bt32 with b8, v, u；

Iii. the 8th of bt32 and b8 the byte b8 [8] is performed operationProduce btxor32；

Iv. operation is performedProduce mixXor32；

V. mixXor32 and s is merged₀Produce mixFinal64；

Vi. mixFinal64 is carried out Base64 coding and produces signB64.

3. system according to claim 1, it is characterised in that described computer hardware feature includes BIOS numbering, hard disk serial number and MAC Address.

4. system according to claim 1, it is characterised in that described user profile includes ID and academic title.

5. system according to claim 1, it is characterised in that server end also includes priority assignation module, inquires about or revises the authority of individual software users under its mechanism during for organization user's login service device end.