TWI866830B - System, hardware device, and method for software authorization, and computer program product implementing the method - Google Patents

Abstract

A system, a hardware device, and a method for software authorization, and a computer program product implementing the method are disclosed. The method includes: generating authorization content in response to a software authorization request from a user end; activating a hardware device having an identification serial number so that the hardware device generates a pair of secure element public key and secure element private key; obtaining the secure element public key and the identification serial number from the hardware device to store the secure element public key and the identification serial number in pairs in an internal database; causing a key storage and cryptographic operation device to generate a pair of management platform public key and management platform private key; signing the authorized content and the secure element platform public key obtained from the hardware device using the management platform private key to generate an authorization signature; and writing the authorization signature and the management platform public key to the hardware device.

Description

System, hardware device, method for software licensing, and computer program product for executing the method

This case is about software protection technology, specifically, a system, hardware device, method for software authorization, and a computer program product for executing the method.

Software, such as various programming languages, system software, and application software, can be stored on computer-readable recording media such as hard disks, optical disks, or USB flash drives. With the popularization of the Internet, software can also be directly transmitted and provided on the Internet. After the software is loaded into the computer, it can be executed on the computer. Therefore, the protection and authorization of software is very important.

The existing technology can customize the content of software files for different authorized objects. Therefore, even if the software is copied to other devices, the software files cannot be run because they are not the original authorized objects. However, this may increase the cost of software developers or providers. In addition, the existing technology can encrypt the software and transmit it to the software subscriber for decryption and installation, thereby protecting the transmission of the software. However, whether the encryption process will affect the function of the software itself remains to be discussed.

Therefore, how to provide a software authorization mechanism without special encryption protection for the software or customizing the software content is a problem that has yet to be solved.

To solve the above problems and other problems, this case discloses a system, hardware device, method and computer program product for executing the method for software authorization.

A system for software authorization includes: a management platform external module, which is used to activate a hardware device with an identification serial number so that the hardware device generates a pair of security element public key and security element private key to obtain the security element public key and the identification serial number, and in response to a software authorization application from a user end, the management platform external module generates authorization content corresponding to the software authorization application; a key storage and cryptographic calculation device, which is used to generate a pair of management platform public key and management platform private key, so as to use the management platform private key to the authorization content generated by the management platform external module and the obtained The security element public key is signed to generate a signature value; the management platform internal module encapsulates the authorization content generated by the management platform external module, the obtained security element public key, and the signature value generated by the key storage and cryptographic calculation device into an authorization signature, so that the management platform external module can write the authorization signature and the management platform public key into the hardware device; and the internal database is used for the management platform internal module to store the security element public key and the identification serial number of the hardware device obtained by the management platform external module in pairs in the internal database.

In one embodiment, in response to the user's request for an updated authorization, the management platform generates new authorization content through an external module, and obtains the identification number from the hardware device of the user. The management platform internal module obtains the public key of the security element paired with the identification number from the internal database according to the identification number, so that the key storage and cryptographic computing device can use the management platform private key to compare the public key of the security element and the new authorization. The content is signed to generate a new signature value, so that the internal module of the management platform encapsulates the new authorized content and the new signature value into a new authorized signature, and the key storage and cryptographic computing device uses the private key of the management platform and the public key of the security element to generate a security key, so as to use the security key to generate a verification code for the new authorized signature, and the external module of the management platform transmits the new authorized signature and the verification code to the hardware device of the user end.

A hardware device for software authorization includes: a key and secret key generation module, which is configured to generate a pair of security element public key and security element private key after being activated by a software authorization management platform; a data storage area, which stores an authorization signature written by the software authorization management platform and a management platform public key, wherein the authorization signature includes authorization content corresponding to a software generated by the software authorization management platform, and the software authorization management platform generates a pair of security element public key and a security element private key from the hardware device; The obtained security element public key, and the signature value generated by the software authorization management platform using the management platform private key to sign the authorization content and the security element public key; wherein, when the hardware device and the software are installed on a user end, the management platform public key built into the software verifies the authorization signature in the hardware device, so that after the authorization signature verification is successful, the software is executed on the user end according to the authorization content in the authorization signature.

In one embodiment, when the hardware device receives a new authorization signature and verification code from the software authorization management platform, the key and key generation module generates a security key using the security element private key and the management platform public key to verify the verification code using the security key, and then replaces the authorization signature in the hardware device with the new authorization signature after the verification code is successfully verified.

In one embodiment, the software generates a random data when the user terminal executes to a critical position, wherein, when the hardware device receives the random data encrypted by the software using the security element public key in the authorization signature, it uses the security element private key of the hardware device to decrypt for verification, and after the verification is successful, the software continues to execute.

In another embodiment, the software generates a random data when the user terminal executes to a critical position, wherein, after the hardware device receives the random data transmitted by the software, it uses the private key of the secure element of the hardware device to sign and return it, so that the software can use the public key of the secure element in the authorization signature to verify, and after the verification is successful, continue to execute the software.

A method for software authorization includes: generating authorization content in response to a software authorization application from a user end; activating a hardware device with an identification serial number to cause the hardware device to generate a pair of a security element public key and a security element private key; obtaining the security element public key and the identification serial number from the hardware device; causing a key storage and cryptographic operation device to generate a pair of a management platform public key and a management platform private key; and using the management platform private key to The authorization content and the public key of the security element obtained from the hardware device are signed by the key to generate an authorization signature; the authorization signature and the public key of the management platform are written into the hardware device so that when the hardware device is installed on the user end, the software of the user end can be run on the user end according to the authorization content in the hardware device; and the public key of the security element and the identification serial number are stored in pairs in the internal database.

In one embodiment, the method for software authorization further includes: generating new authorization content in response to the user end's authorization update application; obtaining the identification serial number of the hardware device of the user end to obtain the security element public key paired with the identification serial number from the internal database according to the identification serial number; using the management platform private key to sign the new authorization content and the security element public key obtained from the internal database; The system generates a new authorization signature by using the management platform private key and the security element public key obtained from the internal database to generate a security key, and generates a verification code for the new authorization signature by using the security key; and transmits the new authorization signature and the verification code to the hardware device of the user end, so that the hardware device can verify the verification code by using the security element private key and the management platform public key in the hardware device.

In one embodiment, when the hardware device is installed on the user end, the software installed on the user end uses the management platform public key built therein to verify the authorization signature in the hardware device, and after successful verification, obtains the authorization content in the authorization signature, so that the software runs on the user end according to the authorization content.

In one embodiment, the software generates random data when the user terminal runs the key point position according to the authorization content, and then uses the random data, the security element public key in the authorization signature, and the security element private key in the hardware device for verification, so that when the verification is successful, the software continues to run.

A computer program product loaded into a computer to execute the above method.

A computer-readable recording medium stores instructions, and the computer-readable recording medium can be executed by a computing device or a computer through a processor and/or a memory to execute the above method when executing the computer-readable recording medium.

In other words, the system, hardware device, method and computer program product for executing the method used in this case for software authorization use hardware devices as verification mechanisms for the legality of software use, software authorization authentication and software authorization update. They can be applied to the verification of the legality of software use in an offline state, and to update software authorization in an online state, thereby achieving software protection and authorized use, and preventing the software from being used illegally.

In addition, when the software is running, the authorization signature obtained from the hardware device is verified to confirm the source of the software authorization and the integrity of the authorization content, so that the subsequent execution of the software can provide corresponding services according to the authorization content; when there is a need to update the software authorization, the software authorization management platform generates a verification code for the new authorization signature through the security key shared with the hardware device, and transmits the new authorization signature together with the verification code to the hardware device. After the hardware device checks the verification code and finds it correct, it can update the authorization signature.

10: User side

11: Software

20: Hardware Devices

201: Identification number

21: Key and secret key generation module

211:Secure Element Public Key

212:Secure Element Private Key

22: Data storage area

30: Software Authorization Management Platform

31: Key storage and password calculation device

311: Management platform public key

312: Management platform private key

313: Security key

314:Signature value

314’: New signature value

315: Verification code

32: Management platform internal modules

33: Internal database

34: Management platform external module

35: Authorization signature

351: Authorized content

35’: New authorization signature

351’: New licensed content

S201~S209: Steps

S301~S307: Steps

S401~S405: Steps

FIG1A is a block diagram of an embodiment of the system and hardware device used for software authorization in the present case.

FIG1B is a block diagram of another embodiment of the system and hardware device for software authorization in the present case.

Figure 2 is a flowchart of an embodiment of the method for software authorization in this case.

Figure 3 is a flowchart of an implementation example of the method for software authorization in this case when executing software on the user side.

Figure 4 is a flowchart of another embodiment of the method for software authorization in this case.

The following specific examples are used to illustrate the implementation of this case. People familiar with this technology can easily understand the other advantages and effects of this case from the content disclosed in this article. The structures, ratios, sizes, etc. shown in the attached figures of this manual are only used to match the content disclosed in the manual for people familiar with this technology to understand and read, and are not used to limit the conditions under which this case can be implemented. Therefore, any modification, change or adjustment should still fall within the scope of the technical content disclosed in this case without affecting the effects and purposes that can be achieved by this case.

As used herein, the terms "include", "comprising", "having", "containing" or any other variations thereof are intended to cover a non-exclusive inclusion. Unless otherwise indicated, singular forms such as "a", "an", "the" may also be used in the plural, and "or", "and/or" and the like may be used interchangeably.

Please refer to Figures 1A and 1B, which illustrate the implementation of the system and hardware device for software authorization in this case. As shown in Figures 1A and 1B, the software authorization management platform 30, which is the system for software authorization referred to in this article, includes a key storage and password calculation device 31, a management platform internal module 32, an internal database 33, and a management platform external module 34. As shown in Figures 1A and 1B, the hardware device 20 includes a key and key generation module 21 and a data storage area 22.

It should be noted that the module in the software authorization management platform 30 can be software, hardware or firmware; if it is hardware, it can be a processing unit, processor, or computer host with data processing and computing capabilities; if it is software or firmware, it can include instructions that can be executed by a processing unit, processor, computer or computer host, and can be installed on the same hardware device or distributed on different multiple hardware devices. The hardware device 20 can be, for example, a chip, a smart card or a USB Token device.

The management platform external module 34 is used to activate the hardware device 20 with the identification serial number 201, so that the key and secret key generation module 21 of the hardware device 20 generates a pair of security element public key 211 and security element private key 212. The management platform external module 34 then retrieves the security element public key 211 and the identification serial number 201 of the hardware device 20 to transmit to the management platform internal module 32. In addition, the management platform external module 34 can respond to a software authorization application of the user terminal 10 to generate authorization content 351 related to the software 11.

The key storage and cryptographic computing device 31 is used to generate a pair of management platform public key 311 and management platform private key 312, so as to use the management platform private key 312 to sign the authorization content generated by the management platform external module 34 and the obtained security element public key 211, thereby generating a signature value 314.

The management platform internal module 32 is used to encapsulate the authorization content 351 generated by the management platform external module 34, the security element public key 211 obtained by the management platform external module 34, and the signature value 314 generated by the key storage and cryptographic calculation device 31 into an authorization signature 35, so that the management platform external module 34 can write the authorization signature 35 and the management platform public key 311 into the data storage area 22 of the hardware device 20.

The internal database 33 is used for the management platform internal module 32 to store the security element public key 211 and identification serial number 201 of the hardware device 20 in pairs in the internal database 33.

When the user terminal 10 submits the first software license application, as shown in FIG1A , the management platform external module 34 generates corresponding authorization content 351 for the software license application of the user terminal 10 to allocate to the hardware device 20, and activates the hardware device 20 before allocation.

In one embodiment, the hardware device 20 is a device of any hardware form that has cryptographic functions, key generation functions, and the characteristics that the private key cannot be exported. Its built-in key and key generation module 21 can generate an asymmetric key pair, namely, a security element public key 211 and a security element private key 212, wherein the security element private key 212 is private and cannot be exported in any way.

Afterwards, the management platform external module 34 obtains the security element public key 211 and the identification serial number 201 and transmits them together with the generated authorization content 351 to the management platform internal module 32 to request an authorization signature operation. Next, the management platform internal module 32 transmits the security element public key 211 and the authorization content 351 to the key storage and cryptographic calculation device 31, and the key storage and cryptographic calculation device 31 uses the management platform private key 312 to perform a digital signature operation on the security element public key 211 and the authorization content 351 to generate a signature value 314. The management platform internal module 32 then packages the security element public key 211, the authorization content 351 and the signature value 314 into an authorization signature 35, and the management platform external module 34 writes the authorization signature 35 and the management platform public key 311 back to the data storage area 22 in the hardware device 20. Finally, the management platform internal module 32 stores the security element public key 211 and the security element identification serial number 201 in the internal database 33.

After the hardware device 20 is written, it is sent to the user, as shown in Figure 1B. The user can download the authorized software 11 from the software authorization management platform 30 or another server, and then install the software 11 and the hardware device 20 in the user terminal 10 execution environment. When the authorized software 11 is executed, the authorized software 11 will read the authorization signature 35 in the hardware device 20 through the transmission interface, and verify the correctness of the authorization signature 35 through the management platform public key 311 built into the software 11. If the verification fails, the authorized software 11 stops running. If the verification succeeds, the corresponding service is provided through the authorization content 351 obtained by the signature.

In addition, when the user terminal 10 submits an application for updating the authorization, the management platform external module 34 can obtain the identification number 201 from the hardware device 20 of the user terminal 10 through online reading, and transmit it together with the new authorization content 351' generated for the application for updating the authorization to the management platform internal module 32 to request an authorization signature operation. Afterwards, the internal module 32 of the management platform obtains the security element public key 211 paired with the identification number 201 from the internal database 33 according to the identification number 201, and transmits the security element public key 211 and the new authorization content 351' to the key storage and cryptographic computing device 31, so that the key storage and cryptographic computing device 31 can use the management platform private key 312 to sign the security element public key 211 and the new authorization content 351' to generate a new signature value 314'. Next, the management platform internal module 32 encapsulates the new authorization content 351' and the new signature value 314' into a new authorization signature 35', and the key storage and cryptographic calculation device 31 then uses the management platform private key 312 and the security element public key 211 to derive the security key 313 shared with the hardware device 20, and uses the security key 313 to calculate the new authorization signature 35' to generate the verification code 315. Finally, the management platform external module 34 transmits the new authorization signature 35' and the verification code 315 to the hardware device 20 of the user end 10 online.

After the hardware device 20 receives the new authorization signature 35' and the verification code 315, the key and key generation module 21 uses the same algorithm as the key storage and cryptographic computing device 31 to derive the security key 213 using the security element private key 212 and the management platform public key 311 stored in the data storage area 22. This security key 213 is the same as the security key 313 derived by the key storage and cryptographic computing device 31. The hardware device 20 uses this security key 213 to check whether the verification code 315 is correct. If it is correct, the authorization signature 35 of the hardware device 20 can be updated with the new authorization signature 35'.

In addition, to prevent the authorization signature 35 from being copied and used, or the hardware device 20 from being moved to another place for use after the authorization signature 35 is successfully verified, whenever the authorized software 11 is executed to a critical point (for example, when executing a critical function or an important function), a string of random data will be randomly generated, and one of the following two methods will be used to ensure that the hardware device 20 exists and is associated with the security element public key 211 in the authorization signature 35, where the critical point position can adopt a fixed mode or a random non-fixed mode.

Method 1: Software 11 uses the secure element public key 211 in the authorization signature 35 to perform encryption calculation on random data, transmits the encrypted result to the hardware device 20 for decryption and obtains the decrypted result, and compares the random data with the decrypted result to see if they are the same; Method 2: Software 11 transmits the random data to the hardware device 20 for signature calculation using the secure element private key 212 and obtains the signature value, and then Software 11 uses the secure element public key 211 in the authorization signature 35 to verify the aforementioned signature value.

Thus, according to the above-mentioned implementation example of the system and hardware device for software authorization in conjunction with Figures 1A and 1B, the present case first establishes a corresponding relationship between the software authorization management platform 30, the hardware device 20 and the authorization signature 35, that is, the software authorization management platform 30 generates authorization content for the software authorization application from the user terminal 10 and distributes it to the hardware device 20. Before distribution, the built-in asymmetric key generation function of the hardware device is enabled, and the security element public key 211 is obtained. Finally, the software authorization management platform 30 uses the management platform private key 312 to sign the security element public key 211 and the authorization content 351 and other data to write the authorization signature 35 and the management platform public key 311 back to the hardware device 20. Afterwards, when the software 11 is executed on the user terminal 10, the corresponding relationship between the authorization signature 35 and the software authorization management platform 30 is verified, that is, the software 11 first reads the authorization signature 35 stored in the hardware device 20, and uses the management platform public key 311 in the software 11 to verify the authorization signature 35 to confirm the legitimacy of the authorization signature 35. After the verification is correct, the software 11 provides services based on the authorization content 351. In addition, when the software is executed on the user end 10, the corresponding relationship between the authorization signature 35 and the hardware device 20 is verified, that is, the security element public key 211 contained in the authorization signature 35 is used to verify the security element private key 212 stored in the hardware device 20 to confirm that the public and private keys of both parties have a paired relationship. If the hardware device 20 does not exist or the verification fails, the software operation is stopped immediately.

Please refer to Figure 2, which is a flowchart of an embodiment of the method for software authorization in this case. As shown in Figure 2, the method includes steps S301~S307, which can be executed by the software authorization management platform 30 shown in Figures 1A and 1B during specific implementation.

In step S301, in response to the software license application from the user, the license content corresponding to the software license application and corresponding to the software is generated.

In step S302, the hardware device with the identification serial number is activated to enable the hardware device to generate a pair of security element public key and security element private key.

In step S303, obtain the security element public key and identification serial number of the hardware device.

In step S304, the key storage and cryptographic calculation device generates a pair of management platform public key and management platform private key.

In step S305, the management platform private key is used to sign the security element public key and the authorization content to generate an authorization signature. In this way, the association between the software authorization management platform and the authorization signature is established.

In step S306, the authorization signature and the management platform public key are written into the hardware device. In this way, the association between the hardware device and the authorization signature is established.

In step S307, the public key and identification number of the hardware device's security element are stored in pairs in the internal database.

Please refer to Figure 3, which is a flowchart of an implementation example of the method for software authorization in this case for executing software on a user end. As shown in Figure 3, the method includes steps S201 to S209, which can be specifically implemented by the user end 10 shown in Figures 1A and 1B.

In step S201, software and hardware devices are installed on the user end.

In step S202, the software is executed to verify the authorization signature in the hardware device using the management platform public key built into the software. In this way, the association between the authorization signature and the software authorization management platform is verified.

In step S203, it is determined whether the authorization signature is successfully verified. For example, if the authorization content is tampered with, the verification result will fail; in step S204, the software is executed according to the authorization content. Among them, the authorization signature can protect the integrity of the authorization content to prevent the authorization content from being tampered with, and the authorization content is generated for the software authorization application of the user end. Therefore, after the authorization signature is successfully verified, the software can provide services according to the authorization content in the hardware device. If the verification is unsuccessful, proceed to step S209 to end the execution of the software.

In step S205, when the software is executed to the key point, random data is generated; in step S206, random data, the public key of the security element in the authorization signature, and the private key of the security element in the hardware device are used for verification. In this way, the association between the authorization signature and the hardware device can be verified to prevent the authorization signature from being copied and used.

In step S207, it is determined whether the verification is successful. In one embodiment, the software uses the public key of the security element to encrypt a random data and transmit it to the hardware device for the hardware device to decrypt and return. If the decryption result matches the random data, the verification is successful, and the process proceeds to step S208 to continue executing the software; if it does not match, the process proceeds to step S209 to terminate the execution of the software.

In one embodiment, random data is transmitted to a hardware device, which then signs the data using a private key of a security element and transmits the data back. The software then verifies the data using a public key of a security element. If the verification is successful, the software proceeds to step S208 and continues to execute the software. If the verification is unsuccessful, the software proceeds to step S209 and terminates the execution of the software.

Please refer to Figure 4, which is a flowchart of another embodiment of the method for software authorization in this case. As shown in Figure 4, the method includes steps S401~S405, which can be executed by the software authorization management platform 30 shown in Figures 1A and 1B during specific implementation.

In step S401, new authorization content is generated in response to the user's authorization update application.

In step S402, the identification serial number of the hardware device on the user side is obtained, so as to obtain the security element public key paired with it from the internal database according to the identification serial number.

In step S403, the management platform private key is used to sign the security element public key and the new authorization content.

In step S404, a security key is generated using the management platform private key and the security element public key, and a verification code is generated for the new authorization signature using the security key. In this regard, the verification code can prevent the authorization signature from being arbitrarily altered or replaced.

In step S405, the new authorization signature and verification code are sent to the user's hardware device.

On the user side, after the hardware device receives the new authorization signature and verification code, it uses the private key of the security element and the public key of the management platform to derive the security key, and uses this security key to check whether the verification code is correct. If it is correct, the new authorization signature can be updated. In this way, the hardware device uses the same algorithm as the software authorization platform to derive the same security key as the software authorization platform to verify the verification code. Since the verification code is related to the hardware device, there is no need to worry about the authorization signature and verification code being copied or tampered with.

In addition, this case provides a computer program product, which executes one or more of the above methods after the program is loaded into the computer, such as steps S301~S307, S401~S405. In addition to being stored in a recording medium, the computer program (product) can also be directly transmitted and provided on the Internet, that is, the computer program (product) is a thing that carries a computer-readable program and is not limited to an external form. The computer includes but is not limited to an electronic device with a processor.

In addition, the present invention also provides a computer-readable recording medium, which is applied to a computing device or a computer having a processor and/or a memory, and the computer-readable recording medium stores instructions, and can be used to execute the computer-readable recording medium through the processor and/or the memory by the computing device or the computer, so as to execute the above-mentioned method and/or content when executing the computer-readable recording medium. The computer-readable recording medium (such as a hard disk, a floppy disk, an optical disk, a USB flash drive) stores the computer program (product). In one embodiment, the computer-readable recording medium is a non-transitory computer-readable recording storage medium.

In summary, the system, hardware device, method and computer program product for executing the method used in this case for software authorization provide the hardware device of the software user through the software authorization management platform to ensure the legality of the software. When the software is executed, the authorization signature is obtained from the hardware device, and the authorization signature is verified with the public key of the authorization management platform built into the software to confirm the source of the software authorization and the integrity of the authorization content, so that the software can provide users with relative services according to the authorization content, without the need to customize the software functions according to different users.

In addition, when the software authorization management platform receives an authorization update request from an existing user, the software authorization management platform uses its own management platform private key and the hardware device's security element public key to derive a security key shared with the hardware device. This security key is used to generate a verification code for the new authorization signature and is sent to the hardware device. The hardware device then uses its own security element private key and the software authorization management platform's management platform public key to derive the same security key as the software authorization management platform. After checking the verification code with this security key and confirming that it is correct, the new authorization signature can be updated.

Therefore, through the correspondence between the software authorization management platform, hardware devices and authorization signatures, and the fact that the private key of the security element cannot be copied, even if someone copies the authorization signature, the software cannot be used without the corresponding hardware device. Therefore, the legal use of the software can be effectively protected, and the software itself does not need to be specially encrypted for protection.

The above embodiments are only illustrative of the effects of this case, and are not intended to limit this case. Anyone familiar with this technology can modify and change the above embodiments without violating the spirit and scope of this case. Therefore, the scope of protection of this case should be as listed in the scope of the patent application described below.

S301~S307: Steps

Claims (11)

A system for software licensing, comprising: The management platform external module is used to activate a hardware device with an identification serial number to enable the hardware device to generate a pair of security element public key and security element private key to obtain the security element public key and the identification serial number, and respond to a software authorization application from a user end, so that the management platform external module generates authorization content corresponding to the software authorization application; The key storage and cryptographic operation device is used to generate a pair of management platform public keys and management platform private keys, so as to use the management platform private key to sign the authorization content generated by the management platform external module and the obtained security element public key, thereby generating a signature value; The management platform internal module encapsulates the authorization content generated by the management platform external module, the obtained security element public key, and the signature value generated by the key storage and cryptographic operation device into an authorization signature, so that the management platform external module can write the authorization signature and the management platform public key into the hardware device; and The internal database is used for the internal module of the management platform to store the public key of the security element and the identification serial number of the hardware device obtained by the external module of the management platform in pairs in the internal database. The system as described in claim 1, wherein, in response to the user's request for an updated authorization, the management platform external module generates new authorization content and obtains the identification serial number from the hardware device of the user, and then the management platform internal module obtains the security element public key paired with the identification serial number from the internal database according to the identification serial number, so that the key storage and cryptographic computing device uses the management platform private key to compare the security element public key and the security element public key. The new authorization content is signed to generate a new signature value, and the internal module of the management platform encapsulates the new authorization content and the new signature value into a new authorization signature, so that the key storage and cryptographic computing device uses the private key of the management platform and the public key of the security element to generate a security key, so as to use the security key to generate a verification code for the new authorization signature, and then the external module of the management platform transmits the new authorization signature and the verification code to the hardware device of the user end. A hardware device for software authorization includes: The key and secret key generation module is composed of a pair of security element public key and security element private key generated by a software authorization management platform; The data storage area stores the authorization signature written by the software authorization management platform and the management platform public key, wherein the authorization signature includes the authorization content corresponding to a software authorization application generated by the software authorization management platform, the security element public key obtained by the software authorization management platform from the hardware device, and the signature value generated by the software authorization management platform using the management platform private key to sign the authorization content and the security element public key; When the hardware device and the software are installed on a user terminal, the management platform public key built into the software verifies the authorization signature in the hardware device, so that after the authorization signature is successfully verified, the software is executed on the user terminal according to the authorization content in the authorization signature. The hardware device as described in claim 3, wherein when the hardware device receives a new authorization signature and a verification code transmitted by the software authorization management platform, the key and key generation module generates a security key using the security element private key and the management platform public key, and uses the security key to verify the verification code, and then replaces the authorization signature in the hardware device with the new authorization signature after the verification code is successfully verified. The hardware device as described in claim 3, wherein the software generates a random data when the user terminal executes to a critical position, wherein when the hardware device receives the random data encrypted by the software using the security element public key in the authorization signature, the security element private key of the hardware device is used to decrypt the data for verification, and the software continues to execute after the verification is successful. The hardware device as described in claim 3, wherein the software generates a random data when the software is executed at the critical position on the user end, wherein when the hardware device receives the random data transmitted by the software, the hardware device signs the data with the private key of the security element of the hardware device and transmits the signature back, so that the software can use the public key of the security element in the authorization signature for verification, and continue to execute the software after the verification is successful. A method for software licensing comprises: Respond to the software license application from the user and generate the license content; Activate a hardware device with an identification serial number to enable the hardware device to generate a pair of a security element public key and a security element private key; Obtain the security element public key and the identification serial number from the hardware device; The key storage and password calculation device generates a pair of management platform public key and management platform private key; Use the management platform private key to sign the authorization content and the security element public key obtained from the hardware device to generate an authorization signature; Writing the authorization signature and the management platform public key into the hardware device so that when the hardware device is installed on the user end, the software on the user end can run on the user end according to the authorization content in the hardware device; and The security element public key and the identification serial number are stored in pairs in the internal database. The method as described in claim 7 further includes: In response to the user's request for updated authorization, new authorization content is generated; Obtain the identification serial number of the hardware device of the user end, and obtain the security element public key paired with the identification serial number from the internal database according to the identification serial number; Use the management platform private key to sign the new authorization content and the security element public key obtained from the internal database to generate a new authorization signature; Generate a security key using the management platform private key and the security element public key obtained from the internal database, and use the security key to generate a verification code for the new authorization signature; and The new authorization signature and the verification code are transmitted to the hardware device of the user end, so that the hardware device can verify the verification code using the private key of the security element and the public key of the management platform in the hardware device. The method as described in claim 7, wherein when the hardware device is installed on the user terminal, the software installed by the user terminal uses the management platform public key built therein to verify the authorization signature in the hardware device, and after successful verification, obtains the authorization content in the authorization signature, so that the software can run on the user terminal according to the authorization content. The method as described in claim 9, wherein the software generates random data when the user terminal runs the key point according to the authorization content, and then uses the random data, the security element public key in the authorization signature, and the security element private key in the hardware device for verification, so as to continue to execute the software when the verification is successful. A computer program product which, when loaded into a computer, executes the method as described in claim 7.

Images