CN101694685A - Safety product license management method based on XML encryption and digital certificate - Google Patents

Abstract

The invention relates to a safety product license management method based on XML encryption and a digital certificate, which comprises the steps of applying a license, generating the license, verifying the license and checking the license. The invention ensures the confidentiality, the non-repudiation and the tamper resistance during the software distribution based on the safety of symmetric key/public key and private key theory; a product has a certain popularity in the product inside an enterprise and can be repeatedly used by every product, thereby effectively lowering the software development cost of the enterprise, improving the efficiency of the critical development of the enterprise, and promoting the image of the product of the enterprise.

Description

Employing is based on the safety product licence managing method of XML encryption and digital certificate

Technical field

The present invention relates to a kind of method that generates and manage at the fail-safe software product license.Be specifically related to licence managing method based on XML digital signature and encryption, general-purpose attribute and dissemination system.

Background technology

Present fail-safe software is generally protected the copyright of software by the mode of software license and the user is authorized.Licence commonly used generates and way to manage is to calculate (key is built-in) by symmetric key algorithms such as DES, in case the problem of the method is to reveal encrypted secret key, then licence can be cracked very easily.Another each generation licence then dynamically generates key, but key file need be encrypted once more the back with software dispatch, and similar problem is so also arranged, be exactly encryption key leakage for the second time in a single day, then the licence of whole software also performs practically no function.A plurality of fail-safe softwares of enterprise's exploitation are at present all fought separately basically, design the licence module of oneself separately, do not have the flow process of a cover standard from apply for, examine, make, issue, destruction etc., cause managerial confusion, all there are big problem in manufacturing technology and algorithm.

The Chinese patent publication number is 200410081535.2 application case, be to utilize digital signature to carry out the authentication of user identity, guarantee to license to this user's licence, utilize simultaneously the software be installed on the client machine obtain computer fingerprint guarantee licence in official hour effectively, prevent that the client is by distorting system information and system time gets a license.This method can be protected the copyright of software to a certain extent.But have certain limitation: the one, the requirement client has digital certificate, just can carry out the digital signature of licence; The 2nd, require install software on the other side's machine, client's system is had certain invasive; The 3rd, the attribute definition of system does not possess extendability, in case need to expand the attribute of licence, system needs the amplitude changing, upgrade very big; The 4th, do not have very strong manageability, the flow process of license management is not described.

Summary of the invention

The present invention proposes a kind of safety product license management way based on XML digital signature, encryption.

The objective of the invention is 1, the copyright of protection software, provide to prevent the method for protecting software denying and distort; 2, formulated the way of a cover at license management, make this a whole set of way in the product of an enterprises, have certain versatility, the use that can be repeated by each product, thereby effectively reduce the software development cost of enterprise, improve the efficient of the crucial exploitation of enterprise, promote the image of enterprise product.

Concrete technical scheme is as follows:

The licence of software generally all comprises the information of following several aspects: product information, licence essential information and authorization message.The authorization message the inside has comprised client's title, mandate beginning and ending time section and has authorized the specific object field.

A kind of safety product licence managing method that adopts based on XML encryption and digital certificate, step comprises:

1) licensing: the client fills in application form by license management system earlier when buying or requiring evaluation software;

2) generate licence: after application is passed through, manufacturer carries out signature in the XML envelope with the private key of oneself to licence raw information (comprising product information, licence essential information, authorization message) earlier, field after being about to sign adds in the original XML content as a new field in the original XML content, then this content is encrypted with the AES/3DES Key Encryption Technology, this key can be fixed key, just prevent the observability of licence, promptly the general user can not check the content of this licence.This licence will be distributed to the client of software together with licence client end AP I.

3) checking licence: when the client started product, system at first verified the legitimacy of licence, carried out the AES/3DES deciphering headed by the verification mode earlier, and if the XML content that obtains signing can not successful decryption, then can not continue to use.Use the PKI of software vendor that licence is carried out signature verification then,, then can not continue to use if checking is not passed through, if the verification passes, then read the inspection authorization message, such as the date of authorizing whether effective, if the date is effective, then continues, otherwise can not continue to use.

4) check licence: to original XML content, extract the licence authorization message, judge whether to authorize effectively, for example obtain the out-of-service time, whether the supervision time is expired, if expired, then points out the user; Extract expansion and authorize field.

The present invention is based on the security of symmetric key/public, private key theory, confidentiality, non repudiation and anti-tamper from the following aspects assurance software publishing process:

1) by software developer's digital certificate and digital signature, the authoritative voucher that provides software to buy;

2) guarantee the confidentiality of licence by symmetric key algorithm;

3) in use, further checking guarantees it is licence from software vendor, prevents to distort and deny;

The beneficial effect of this method is, has certain versatility in the product of an enterprises, the use that can be repeated by each product, thus effectively reduce the software development cost of enterprise, improve the efficient of the crucial exploitation of enterprise, promote the image of enterprise product.

Description of drawings

Fig. 1. the licence structural drawing;

Fig. 2. the licensing process flow diagram;

Fig. 3. generate the licence process flow diagram;

Fig. 4. checking licence process flow diagram;

Fig. 5. check the licence process flow diagram.

Embodiment

In order to further specify principle of the present invention and feature, describe below in conjunction with accompanying drawing.

A kind of safety product licence managing method that adopts based on XML encryption and digital certificate, step comprises:

1) licensing: the client fills in application form by license management system earlier when buying or requiring evaluation software;

2) generate licence: after application is passed through, manufacturer carries out signature in the XML envelope with the private key of oneself to licence raw information (comprising product information, licence essential information, authorization message) earlier, field after being about to sign adds in the original XML content as a new field in the original XML content, then this content is encrypted with the AES/3DES Key Encryption Technology, this key can be fixed key, just prevent the observability of licence, promptly the general user can not check the content of this licence.This licence will be distributed to the client of software together with licence client end AP I.

3) checking licence: when the client started product, system at first verified the legitimacy of licence, carried out the AES/3DES deciphering headed by the verification mode earlier, and if the XML content that obtains signing can not successful decryption, then can not continue to use.Use the PKI of software vendor that licence is carried out signature verification then,, then can not continue to use if checking is not passed through, if the verification passes, then read the inspection authorization message, such as the date of authorizing whether effective, if the date is effective, then continues, otherwise can not continue to use.

4) check licence: to original XML content, extract the licence authorization message, judge whether to authorize effectively, for example obtain the out-of-service time, whether the supervision time is expired, if expired, then points out the user; Extract expansion and authorize field.

In this example,

As Fig. 1, the licence that is presented to the software user comprises: product information (comprising name of product and product version etc.), license creation date, license creation user, customer name, license type (comprise formal and on probation etc.), expired time, extended attribute (comprising attribute-name and corresponding property value etc.), XML digital signature field.

As Fig. 2, the process of user applies licence comprises:

1) user proposes the licence application, fills in the licence application form;

2) after the licence application is submitted to,, continue through after examining agreement;

3) licence then uses the digital certificate of software vendor to sign by examining, and generates license file;

4) license under, simultaneously log.

As Fig. 3, the flow process that generates licence comprises:

1) generates original XML message C1;

2) use digest algorithm MD5 that C1 is carried out hash operations, obtain hashed value M;

3) use the digital certificate private key of software vendor to carry out the XML digital signature to hashed value M, signature algorithm can be (these algorithms are more common in the prior art, further do not limit at this) such as RSA, DSA or DH, generates D1;

4) signed data D1 is added to the afterbody of C1, be C2;

5) the C2 content is carried out bulk encryption, generate C3.Detailed process is as follows:

A) produce AES key;

B) produce a 3DES key, the secret key encryption of using the 3DES algorithm that the first step is produced;

C) key that used for second step produced uses aes algorithm to encrypt to document.

As Fig. 4, the flow process of checking licence comprises:

1) adopt identical algorithm that C3 is decrypted, if the energy successful decryption obtains C2 and then continues; (be decrypted with the AES/3DES algorithm, process is the inverse process of above-mentioned AES/3DES ciphering process)

2) part except digital signature of the C2 hash of making a summary is calculated, obtained hashed value M2;

3) to M2, use the PKI of software vendor to carry out digital signature, obtain signature value D2; (signature algorithm also can be RSA, DSA or DH etc.)

4) compare D1 and D2,, then continue if identical, otherwise, the failure of prompting certifying digital signature.

As Fig. 5, read the licence content and check that the process of authorizing comprises:

1) obtains C1, extract the licence authorization message, for example obtain the out-of-service time;

2) supervision time whether expired, if expired, then point out the user;

3) otherwise, extract expansion and authorize field, finish.

For example, certain corporate security gateway management system has adopted the technical scheme of this patent, concrete licence original sample:

<？xml?version＝″1.0″encoding＝″gb2312″？>

<LinkageSecurityLicence>

<Product>

＜Name〉the security gateway management system＜/Name 〉

<Version>1.0</Version>

</Product>

<CreateDate>2009-4-1015:23:10</CreateDate>

＜CreateUser〉Zhang San＜/CreateUser 〉

＜ForUser〉communication company limited of China Mobile (XX)＜/ForUser 〉

＜Type〉trial edition＜/Type 〉

<ExpireDate>2009-10-1</ExpireDate>

<Properties>

＜Property name=" the maximum management of permission resource quantity " value=" 100 "/〉

＜Property name=" the maximum management of permission primary account number quantity " value=" 200 "/〉

＜Property name=" permission maximum time token card quantity " value=" 1000 "/〉

</Properties>

</LinkageSecurityLicence>

Licence sample after signature, the encryption

<LinkageSecurityLicence?xml:enc＝″AmdcRnhWjarSYNmLOUyAfc3Dg9svjgqBAL″><xenc:EncryptedData

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″

Type＝″http://www.w3.org/2001/04/xmlenc#Content″><xenc:EncryptionMethod

Algorithm＝″http://www.w3.org/2001/04/xmlenc#aes128-cbc″

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″/><ds:KeyInfo

xmlns:ds＝″http://www.w3.org/2000/09/xmldsig#″>

<xenc:EncryptedKey?xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″><xenc:EncryptionMethod

Algorithm＝″http://www.w3.org/2001/04/xmlenc#kw-tripledes″

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″/><xenc:CipherData

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″><xenc:CipherValue

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″>K/AxKO7nJtZFbUCPscafgQClLRqTB6Xr+2V4tE92HN

0＝</xenc:CipherValue></xenc:CipherData></xenc:EncryptedKey></ds:KeyInfo><xenc:CipherData

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″><xenc:CipherValue

xmlns:xenc＝″http://www.w3.org/2001/04/xmlenc#″>7W8sCahHM2mKMyp7kX2wOHLxbE1WVQjHKTi10T+I+A

Qr2Gs19MwBkn8N4u0OGDmaCAbXF7QBqxWH

vvZ69nUnNEbUlRp6DZYYKJh5p1Yfa53c7n+ya05knyEqHq3pII0jKOPrPlEUmGPKr0Un7I7F+Y2k

y6N5hMRmz08JKY34ZBPe+Wb5dO61dTCTqZIyWjoPdWQ4EJOGDszYso3iH7hQ/wlaQn7SjbqzK8oH

wvlPl5Fg7L0yfwXP+HH26gL26NbzM0CTR5WaRGAVjaCZbgE2O5YfnYOCW+8yva9coa2+098RkqnV

BBr7LuTxTPeFrQlun4c1S82aZ/t+I1XT7R+wRLObmOKjrfHbdrx72e/LjoEMYpFRWHCytOSV41EK

lIUj/RlUcvOHUIVU/WeEXxmYiTiPXm0gnTRInpF1w0lmZPk5GwYWnhpNns6349Ktj3PVtkd6MYcq

3C0n6KlvCdvdHctvJ+MwBPmdzvx43pjL6DdQHlrZh45W2hatyOLqdjvJQE9hchs4k6T76jH6afFk

YYMyYxlMX+UtnFQ4zAcHoymBWk0lcpsnnUImdzw+CP5fbrzHO2wCrAixAaHn8qlRYfxdYiMjYtEp

iFaXZHZdRb/wBNd2PIt19XlKmrMxXy5tQsp7aiIh9kUdluNY6OM5oZZbSihNx1RmfvzDWTU4jWDl

JRHHenGWaBuwxf76zye2CBb/gzivfdjkmQxpBwT8gJho+yevRyrla321/+1y6WGNOs+tZ4kgGpyi

uGn+pNgChMgpGHYPa1YKc5xyIhLyyp8UBAa7Sagj9RQ6xFeXwV8pOr3QXOJArBTQ/sKWDLVJ+r4u

iDHet2ZrT1hIVqqTh/4uPSG/P44UAXuQsDNkPekLeVULjo91XHdejluK3TBFkw6Nw3DyiNQE9rzo

wbkArddM0i2QtuA5dKIjxOV6glsyxrQunptlzHnrWhBNWlQ/XHiYzxLwU429eDP4/4Qu+ndjf4Io

3HcwCt/Kvo7KsdFaEnJvivlugO6po3iJeDkf/z6xnXiAz90vqMPtgClhcQXQLhRJSRw+VmSVmxCz

I8tHD6XosJPfoQ5zQWYa8wYsqOUUACz0//Q8Dzy21hzUspvudVnnSViJRVpwGG5XDq5AC5PJloyg

23B60ZbaVAkaLNwU4ne7/MlXWUONSJrRAP+88BbHymDBs0gRvisV1Bljq20sJ/vE+ssirODyR/rv

tvBU0AmwCGg4zBnHxIyVjiGj+G9NFPLFTUxZF/elcGt2MCSzVFgjUzK2nPiy3GOK4yGNlYDcy+hs

5Hq72J7Y+Njl+DSE6+rrSCtla7c28YgCHfhPt4j3WqQTDPYWjTW66VGqjFWq2Dost9M87+v5RLt6

AYYLt9+3nxbeYi/6t9S7LOsPDpyTxWfPHwK+UfsTItp3bZEHUK7Ik9Cw00DRo1E7mVx65LOO1Jl/

gwdnBP/HFSmbzksyBUQG0nItFU2Sstc3jTAIDEYpt6dh/w05c6VxUByGizsCr3wANtXohZIkEsj0

lAXNYD5Ul3ayp8dimlOOouInO/+vkMTS/aaf77/bPLcEkuoE/zMqQXUX5ONRXKIPv1w9HWhPMenK

gdzA7R8+PNkQ81aGUsRRDhAIlJc/v8KSvllR/XUJDCF2+UmAoflgRrG7xEogpemtKjN5ykLTEoSV

0g87uuux0cdAs/99guJ9LU5j+9RLABWUbztb+b6n+mi1FOgr0KfnGTwtnTMLXaYU56FB6zuR4qNS

wOP4pRu+fyLOocOs5TskwB2Edfhu96UEVjVipjZEYI9JPONtdgwh/poS6t1A09Wo770DE8r6preS

4uJgYxYQ6nMn2I70fpc7cBCBF+aPgzCznIgMvQw4vkkVvXGrtndngHEFIpHZ/JM2oQ7px4Q43vSG

z19L7T9/w+N1cwMNebLj6QM27giYlPytDfdtICjj65XiHOXoTpgh9UizZIhp2r1IHzVzaNwQIJrO

cTtraOKnVdqoe92Ocj91u7jbKc4yidswt1OODDqGDc57xLIRyc5KtwMYsApVLzrBO7h9bQk2QJkQ

J7beJ3fes3lhXhB3KMqvjHKWp9L3ic0eV6n8IKDPeTv3G9notzeN5lA+gZSvDSp43HnkSqMNBHj8

RZuNB5UYvdbtthWugk2CGJwX8SvVnGuaKYr94EZmxP/Mz//WHHSHi98Vn1T7Rh5nieefJqo8WWcv

rX9cisA9FtbLk+TumUaP1lKw+5L4XDgfrhsEWjORBuiY9KOupwObOOHIMb1Cyp2ugMh2DrfI78kb

lMScNFM0z9tsAfAWzobfCSAfDePt7UMDMTBpgVG/gl1jUoi84pjBVPuMPpqr9qvq+xVm+e3c5jQ7

lc6Omoi6+8QXu4UA6T6YFdBmM/8sen4hkZkR5y/spgAELSwCPsumL9q+EADSF3UWxGABaF2SDICZ

mvwGeKx/LeAPOLBkoWBhUtScXREKFFUpqVQi313/dae90KoiXM3PNM3W6BODVtYaU5Jxv1ILNg1j

PaUMBdzSKrfS9c5DXVDxkDSn968vBkFfdzzZkNIl/A5G+ZMjEOGk/96tR27urkRSUnGc+UYQ9czI

tgYTCRUvf19EzrO4t7X4itN61Xe9xPSJv4LywltQU76U+YUAqJxXfdV2SA+vQHnE7OIS89DN9zOg

tu7HGQQ1oEdTLiMZzqYVCAagEzilw1B6AjGu5BIXsAknR7NsZqEo3jury5NyFHolRrlNBPNSHfbt

fwmBWXJG3UjVcpgwzMjs9O+MXZLffq22BTWTsC9PH7epRZR5/1XbQze/jKQ0wc3WMksQfJUbWXIC

oh6oxrYtWVx/SFQy6ftnMWLblq5KZ9G8vpWR1ZQgEL+sJ/gNl1SOZ0DvEiYPjomiNVIQ3oLPAxT8

ZL8KfrM9KZqkCgrQ541P2frwYc1bojpjPHDzZvLK13mNedXItCwik60D4JDlpkwr/dNs1X5g60vE

q23ZyC2D5dKet1cuMEPiGIbOOGKRKP/kr8R7YweQJ/QHNSy7vANWY5IdHLAPOkx3ZlfSsohgr75o

wi2W+9SxQdIKEiTbIlKOJjxjxoxQriA/THn+E5DbtTajhZSVj25KiBHdpm3arzK8et0b9tiVjzX7

cYcAJCRa53itK4U9WlUKofwpOYdGAm8hyJ1lHjC5tA2Cuc8haAcnviSr3wZxcZPlV0vihHe78euE

YRIXtplwilTb6tzE6qCHlJFVjBTHg0bBpe28/H/oLxL0bRxTaeNUW7Mggiu9s7ysEtkxyUjpf4FZ

qFo/0yPwxn/P3ybQeGMlIRdIFpS+E3BVFn9pcAZjxWzlOKO11yHfVeXRkAVc3nuoKyI1uzLDY8aM

oXC+DQDCSMTThubVwzVY3KE5r3vCoIjtPYqD0KpuKze0EDHgRzRJ/fCH94YjTgyZCtpNob63cFOq

q2aQUJ9CjFTswqan6C6HYGsFKX67syUA47+KmF0SNSaIXzF3KgTsnAICX3dJuPOE76QEeewBsK9/

LOeTKOb5lyPhg0bjrO/KYyAFq1fIiD2L6zHZ2NrMeGOMGAVEWEp1QUR+N5YO1tk5g9Nr57PDL8hF

JbH0WhZvb+fLopKJGf0l/hsAEtGCu/86Qw＝＝</xenc:CipherValue></xenc:CipherData></xenc:Encrypted

Data></LinkageSecurityLicence>

Claims (3)

1. an employing is encrypted based on XML and the safety product licence managing method of digital certificate, it is characterized in that step comprises:

1) licensing: the client fills in application form by license management system earlier when buying or requiring evaluation software; Application generates license file through examining agreement, is handed down to the application user;

2) generate licence: after application was passed through, manufacturer used the private key of oneself that licence raw information is carried out signature in the XML envelope earlier, and the field after being about to sign adds in the original XML content as a new field; Then this content is encrypted; The licence that generates will be distributed to the client of software together with licence client end AP I;

3) checking licence: when the client started product, system at first verified the legitimacy of licence, and verification mode is at first deciphering, and if the XML content that obtains signing can not successful decryption, then can not continue use; Use the PKI of software vendor that licence is carried out signature verification then,, then can not continue to use, if the verification passes, then read the inspection authorization message, if authorization message is effective, then continue, otherwise can not continue to use if checking is not passed through;

4) check licence: to original XML content, extract the licence authorization message, judge and whether effectively authorize,, then point out the user,, then extract expansion and authorize field if effectively if authorize invalidly.

2. employing according to claim 1 is characterized in that described step 2 based on the safety product licence managing method of XML encryption and digital certificate) in, licence raw information comprises product information, licence essential information and authorization message.

3. employing according to claim 2 is based on the safety product licence managing method of XML encryption and digital certificate, it is characterized in that described step 2) in, the content that field behind the signature adds after the original XML content is encrypted with the AES/3DES Key Encryption Technology, this key is a fixed key, prevent the observability of licence, promptly the general user can not check the content of this licence; In the described step 3), the method for deciphering is with AES/3DES secret key decryption technology.

Images