WO2012149717A1

WO2012149717A1 - License dynamic management method, device and system based on tcm or tpm

Info

Publication number: WO2012149717A1
Application number: PCT/CN2011/079141
Authority: WO
Inventors: 石峰; 张羽
Original assignee: 华为技术有限公司
Priority date: 2011-08-31
Filing date: 2011-08-31
Publication date: 2012-11-08
Also published as: CN102986162A; CN102986162B

Abstract

The present invention belongs to the field of information technology, and particularly provided are a license dynamic management method, device and system based on a TCM or TPM. The method includes: receiving a function to be changed selected by a client according to a function list; generating a pair of keys according to local identification information, wherein the pair of keys includes a private key K_S2 and a public key K_P2; generating a first data packet and encrypting the same using a public key K_P1, wherein the first data packet includes the public key K_P2 and the function to be changed; sending to a server the encrypted data and the local unique identification; receiving a second data packet encrypted using the public key K_P2 and sent from the server, wherein the second data packet in particular includes a license obtained by decrypting and calculating the encrypted data using a private key K_S1; and obtaining the license by decrypting the second encrypted data packet using the private key K_S2, and completing the configuration of the function to be changed according to the license. The technical solution provided by the present invention has the advantage of high security.

Description

License dynamic management method, device and system based on TCM or TPM

Technical field

The present invention relates to the field of information technology, and in particular, to a TCM or TPM-based license dynamic management method, device and system.

Background technique

License is the permission identifier of the customer to use the product. Different customers have different functional requirements for the product. Therefore, the product manufacturer will provide different licenses for customers to choose to purchase to meet the customer's needs, but the manufacturer prevents it in order to protect its own interests. The license is cracked or stolen, and the license needs to be securely managed.

The prior art provides a method for managing a license. The specific operation of the method may be: the client requests the utility function A, the server generates a temporary enable message and sends the message to the client, and the client temporarily starts the function according to the temporary enable message. A. When determining to purchase the feature A, the client sends a message to the server to purchase the feature A. After determining that the payment is made, the server issues a start message, and the client permanently enables the feature A according to the start message.

According to the technical solutions provided by the prior art, the following technical problems are found in the prior art:

The technical solution provided by the prior art does not consider the security of the intermediate transaction when the activation of the functional component A (including temporary or purchase), so the security of the prior art technical solution is low.

technical problem

It is an object of the present invention to provide a TCM based or TPM based The dynamic management method of the license is designed to solve the problem of low security of the prior art.

The invention also provides a dynamic management support method for a license based on TCM or TPM.

The invention also provides a dynamic management device based on a TCM or TPM license.

The present invention also provides a support device for dynamic management of a license based on TCM or TPM.

The invention also provides a license management system.

Technical solution

In one aspect, the present invention provides a method for dynamically managing a license based on a TCM or a TPM, the method comprising:

Configure the public key K _P1 in the local device;

Receiving a function to be changed selected by the customer according to the function list, where the function list includes: a software and hardware function in the local device;

Generating a key pair according to the local identification information, the key pair includes: a private key K _S2 and a public key K _P2 ;

Generating a first data packet according to the public key K _P2 and the function to be changed, and encrypting the first data packet with the public key K _P1 , the first data packet includes: a public key K _P2 and a function to be changed ;

Sending the encrypted first data packet and the local unique identifier to the server; so that the server can obtain the private key K _S1 according to the local unique identifier; and decrypting the first data packet according to the private key K _S1 Public key K _P2 and function to be changed;

Receiving, by the receiving server, the second data packet encrypted by using the public key K _P2 , the second data packet specifically includes: a license calculated for the local unique identifier and the function to be changed;

The encrypted second data packet is decrypted by using the private key K _S2 to obtain a license, and the configuration of the function to be changed is completed according to the license.

In another aspect, the present invention provides a TCM based or TPM based A dynamic management support method for a license, characterized in that the method includes:

Configuring a correspondence between the private key K _S1 and the private key K _S1 and the unique identifier of the client in the server;

Receiving the unique identifier sent by the client and the first data packet encrypted by using the public key K _P1 ; the first data packet includes: a public key K _P2 and a function to be changed;

Querying the private key K _S1 from the correspondence between the private key K _S1 and the unique identifier of the client according to the unique identifier;

Decrypting the encrypted first data packet by using the private key K _S1 to obtain the public key K _{P2 in the} first data packet and the function to be changed;

Calculating the license according to the unique identifier and the function to be changed, encrypting the license with the public key K _P2 to obtain the second data packet, and transmitting the second data packet to the client.

In still another aspect, the present invention also provides a TCM based or TPM based Dynamic management device for the license, the device comprising:

a configuration unit, configured to configure a public key K _P1 in the local device;

a receiving unit, configured to receive a function to be changed selected by the customer according to the function list, where the function list includes: a software and hardware function in the local device;

a key generating unit, configured to generate a key pair according to the local identification information, where the key pair includes: a private key K _S2 and a public key K _P2 ;

An encryption unit, configured to generate a first data packet according to the public key K _P2 and the function to be changed, and encrypt the first data packet by using the public key K _P1 , where the first data packet includes: a public key K _P2 And the function to be changed;

a sending unit, configured to send the encrypted first data packet and the local unique identifier to the server, so that the server can obtain the private key K _S1 according to the local unique identifier; and decrypt the first key according to the private key K _S1 a public key K _P2 obtained by a data packet and a function to be changed;

The receiving unit is further configured to receive a second data packet that is encrypted by using the public key K _P2 , where the second data packet includes: a license that is calculated by a local unique identifier and a function to be changed;

The decryption configuration unit is configured to decrypt the encrypted second data packet by using the private key K _S2 to obtain a license, and complete the configuration of the function to be changed according to the license; the private key K _S1 and the public key K _P1 are a key pair.

In a further aspect, the invention further provides a TCM based or TPM A dynamic management support device for the license, the device comprising:

a configuration unit, configured to configure a correspondence between the private key K _S1 and the private key K _S1 and the unique identifier of the client in the server;

a receiving unit, configured to receive a unique identifier sent by the client and a first data packet encrypted by using a public key K _P1 , where the first data packet includes: a public key K _P2 and a function to be changed;

a decryption unit, configured to decrypt, by using the private key K _{S1 ,} the encrypted first data packet to obtain a public key K _{P2 in the} first data packet and a function to be changed;

Querying unit configured to query the corresponding relationship between the private key K _S1 and uniquely identifies the client to the private key K _S1 according to a unique identifier;

The calculation sending unit is configured to calculate a license according to the unique identifier and the function to be changed, encrypt the license with the public key K _P2 to obtain a second data packet, and send the second data packet to the client.

Finally, the present invention provides a license management system, the system comprising: a client and a server; wherein the client stores a public key K _P1 ; the server stores a private key K _S1 and a private key K _S1 Corresponding relationship with the unique identifier of the client; the private key K _S1 and the public key K _P1 are a key pair;

The client is configured to receive a function to be changed selected by the client according to the function list, and generate a key pair according to the local identification information, where the key pair includes: a private key K _S2 and a public key K _P2 ; according to the public key K _P2 and the function to be changed generate a first data packet, and encrypt the first data packet with the public key K _P1 , the first data packet includes: a public key K _P2 and a function to be changed; the function The list includes: hardware and software functions within the local device;

The client is further configured to send the encrypted first data packet and the local unique identifier to the server;

The server is configured to query the private key K _S1 from the correspondence between the private key K _S1 and the unique identifier of the client according to the unique identifier, and use the private key K _{S1 to} decrypt the encrypted first data packet to obtain the first data packet. The public key K _P2 and the function to be changed; calculate the license according to the unique identifier and the function to be changed, encrypt the license with the public key K _P2 to obtain the second data packet, and send the second data packet to the client;

The client is further configured to decrypt the second data packet by using the private key K _S2 to obtain a license, and complete the configuration of the function to be changed according to the license.

Beneficial effect

Compared with the prior art, the present invention has the beneficial effects that the present invention applies the key pair to encrypt the message in the transaction process of the functional component, so the method provided by the present invention has the advantage of high security.

DRAWINGS

1 is a flowchart of a method for dynamically managing a license based on a TCM or a TPM according to the present invention;

2 is a flowchart of a method for dynamically managing a license based on a TCM or a TPM according to the present invention;

FIG. 3 is a flowchart of a method for dynamically managing a license based on a TCM or a TPM according to an embodiment of the present invention;

FIG. 4 is a flowchart of a method for dynamically managing a license based on a TCM or a TPM according to another embodiment of the present invention;

FIG. 5 is a structural diagram of a dynamic management apparatus for a license based on a TCM or a TPM according to the present invention; FIG.

FIG. 6 is a structural diagram of a device for dynamically managing a license based on a TCM or a TPM according to the present invention.

Embodiments of the invention

The present invention provides a dynamic management method for a license based on TCM or TPM. It should be noted that the above license management method is generally based on a Trusted Cryptography Module (TCM) or a Trusted Platform Module (TPM). In the country, it is generally based on TCM. The method is shown in Figure 1. The method is completed by the client. Before performing the following method, the manufacturer needs to configure the public key K _P1 in the local device. The method includes the following steps:

S11. Receive a function to be changed selected by the customer according to the function list, where the function list includes: all software and hardware functions of the local device;

S12. Generate a key pair according to the local identification information, where the key pair includes: a private key K _S2 and a public key K _P2 ; the local identification information includes: information that can identify the local device;

S13. Generate a first data packet according to the public key K _P2 and the function to be changed, and encrypt the first data packet with the public key K _{P1 to} obtain the encrypted first data packet.

It should be noted that the foregoing first data packet may include: a public key K _P2 and a function to be changed.

S14: Send the encrypted first data packet and the local unique identifier to the server, so that the server can obtain the private key K _S1 according to the local unique identifier; and decrypt the first data packet according to the private key K _S1 The obtained public key K _P2 and the function to be changed;

S15. The second data packet that is sent by the receiving server and encrypted by using the public key K _P2 , where the second data packet includes: a license that is calculated for the local unique identifier and the function to be changed;

The license may be specifically: the server uses the K _S1 decryption to obtain the to-be-changed function of the encrypted first data packet in the S14, and calculates the function and the unique identifier to be changed to obtain a license; in addition, the private key K _S1 can uniquely identify from the query based on the corresponding relationship that uniquely identifies a private key K _S1 and pre-configured to the private key K _S1.

S16: decrypting the encrypted second data packet by using the private key K _S2 to obtain a license, and completing the configuration of the function to be changed according to the license.

It should be noted that the private key K _S2 and the public key K _P2 are key pairs; the private key K _S1 and the public key K _P1 are another key pair.

It should be additionally noted that the private key K _S1 and the private key K _S2 belong to completely different private keys, and the public key K _P1 and the public key K _P2 belong to completely different public keys; the first data packet and the second data packet It also belongs to completely different data.

It should be noted that the specific algorithm for calculating the license may be: Message Digest 5 (Message Digest) Algorithm version 5, MD5), of course, in the actual situation, you can also use other methods, for example: each function of the software has an identification (Identificatio, ID) number, this ID number can be started from 0, the order is increased, then the license Use bit field method to compare, for example, if there is a function ID number is 5, then you can use if The method of (license & (1 <<ID)==1) determines whether the fifth digit of the license is 1.

When the method provided by the present invention performs license management, all data interaction between the local (ie, the client) and the server is encrypted and decrypted by using a key pair, and all the data between them is not easy to be leaked and changed by others, all of which The method has the advantages of improving the security of the license management. In addition, since the number of functions to be changed of the method provided by the present invention can be flexibly set, it can improve the flexibility of license management.

It should be noted that the foregoing functions to be changed may specifically include: unsubscribe of functions or functions to be activated.

It should be noted that the number of the above unsubscribed or activated functions may be flexibly set, for example, a single function is activated, or multiple functions may be activated, and the present invention does not limit the specific implementation manner.

It should be noted that, the foregoing first data packet may further include: a pre-stored ciphertext, when the first data packet includes a pre-stored ciphertext, the server determines the hash value of the ciphertext and obtains according to the unique identifier. When the hash value is consistent, the second data packet with the license hash value of the private key K _S1 signature encrypted by the public key K _{P2 is} transmitted.

It should be noted that the encrypted second data packet in the foregoing S15 may further include: a license hash value obtained by using the private key K _S2 and obtained by the private key K _S2 , when the encrypted second data packet includes a license hash value, The method specifically includes the following in S16:

The private data K _{S2 is used} to decrypt the encrypted second data packet to obtain the license hash value of the license and the private key K _S1 signature, and the license hash value signed by the private key K _S1 is decrypted by the public key K _P1 to obtain the license hash value, and the decryption value is decrypted. After the license hash value is the same as the license hash value calculated by hashing the license, the configuration of the function to be changed is completed according to the license, and the operation is ended.

The above method provided by the present invention uses the public key K _P1 and the private key K _S1 to determine whether the encrypted second data packet in S15 is sent by the server, because the public key K _P1 and the private key K _S1 are a key pair, such as encryption. After the second data packet is not sent by the server, the public key K _P1 cannot decrypt the signed hash value of the signature at all, and the comparison and the confirmation cannot be performed. Therefore, the method further improves the security of the license management.

The present invention also provides a dynamic management support method for a license based on TCM or TPM, which is completed by a server. Before implementing the method, the server is configured with a correspondence between the private key K _S1 and the private key K _S1 and the unique identifier of the client. Relationship; the method is shown in Figure 2 and includes:

S21. The unique identifier sent by the receiving client and the first data packet encrypted by using the public key K _P1 ;

For the specific form of the first data packet, refer to the description in the foregoing embodiment, and details are not described herein again.

S22. Query the private key K _S1 from the correspondence between the private key K _S1 and the unique identifier of the client according to the unique identifier;

S23, using the private key K _{S1 to} decrypt the encrypted first data packet to obtain the public key K _{P2 in the} first data packet and the function to be changed;

S24. Calculate a license according to the unique identifier and the function to be changed.

S25. Encrypt the license with the public key K _P2 to obtain the encrypted second data packet.

S26. Send the encrypted second data packet to the client.

It should be noted that the foregoing first data packet may further include: a pre-stored ciphertext. When the first data packet includes a ciphertext, the foregoing method may further include: configuring a ciphertext and a ciphertext hash value in the server before the S21 In addition to the unique identifier of the client, the steps in the foregoing method may further include:

According to the unique identifier, the ciphertext hash value is queried from the correspondence between the ciphertext hash value and the client unique identifier, and the hash value of the received ciphertext is calculated to the calculated hash value; the hash value and calculation of the query are compared. If the hash value is consistent, execute S22-S26, otherwise the operation ends.

It should be noted that the foregoing S25 may further include: a license hash value obtained by performing a hash value calculation on the license, and the license hash value is encrypted by using a private key K _{S1 to} obtain a license hash value of the private key K _S1 signature, and the public key K is used. _P2 encrypts the license hash value and license of the private key K _{S1 to} obtain the encrypted second data packet.

The license management support method provided by the present invention supports the implementation of the license management method.

The embodiment of the present invention provides an embodiment. The method for managing a license is implemented between a client and a server. The method is described by taking the function to be activated as an example. The scenario is that the factory settings are made when the client leaves the factory. The specific settings can be: through TCM/TPM, generate a key pair (such as private key K _S1 , public key K _P1 ), and the public key is stored in the client's TCM/TPM. In the middle, the private key is saved by the manufacturer himself. The pair of keys is used for the signature of the manufacturer. By using the public key and the private key for encryption and decryption, it can be ensured that the relevant information is sent by the manufacturer. The key pair is only at the factory. Generated once, and each pair of key pairs is different, each factory client will save K _P1 ; the client is bound with a unique identifier (such as the client's MAC address, etc.), the identifier can be based on the client The identification of each hardware on the machine (in order to guarantee privacy, it can be its encrypted performance), or it can be a unique code defined by the manufacturer to the client. The unique identifier only serves as a cable. The function is convenient for the manufacturer to query the client for related information in its own database; the client is randomly bound with a ciphertext (the ciphertext can be a randomly generated ciphertext), which is stored in the client's TCM/TPM. At the same time, the hash value of the ciphertext is stored in the manufacturer server, and the ciphertext is another "identity card" of the client. By checking the hash value of the ciphertext, the manufacturer can determine that the relevant information is from the client. The machine sends the relevant characteristics of the hash algorithm. Here, the hash value is saved, and the identity information can be verified. The manufacturer can add a record containing the following fields to the database managed by the manufacturer through the above settings. Includes: unique identifier, ciphertext ("ID") hash value, software feature status list, hardware status list, and e-wallet amount. As shown in FIG. 3, the method provided in this embodiment may specifically include:

S31. When the client triggers a function upgrade on the client, the client displays a function list.

It should be noted that the foregoing function list may specifically include, but not limited to, all software and hardware functions, and may also be a function activated or not activated by the client. In addition, the display method of the activated or inactive function may be multiple. The method, for example, the activation function adopts a bright display, the inactive function is displayed in a dark color, and of course, the activation function is displayed in green, the inactive function is displayed in red, and the like; in addition, the function list may further include: function list.

S32. The client determines a function (which may be software and/or hardware) selected by the user to be activated and how the function is applied (for example, permanent or temporary).

It should be noted that the embodiment does not limit the number of functions, and the amount of data can be freely selected by the client, for example, 1, 2, 3 or 4, and the like.

S33. The client generates another key pair (private key K _S2 , public key K _P2 ) according to the identification information on the client (for example, the unique identifier of the hardware).

It should be noted that the identifier information may be the same as the unique identifier or unique code of the client, and may of course be different.

S34. The client generates a first data packet according to the ciphertext, K _P2, and the function to be activated, and encrypts the first data packet with K _P1 ;

It should be noted that the foregoing first data packet may include: ciphertext, K _P2, and a function to be activated. In addition, the specific manifestation of the function to be activated may be: a list of software functions that the customer needs to use at the time, and a list of hardware that the customer needs to use at the time.

S35. The client sends the encrypted first data packet and the unique identifier of the client to the server.

S36. The server searches for the K _S1 and the hash value corresponding to the unique identifier according to the unique identifier, and decrypts the encrypted first data packet by using the K _S1 to obtain the ciphertext, the K _P2, and the function to be activated in the first data packet. ;

S37. The server performs a hash operation on the ciphertext in the first data packet to obtain a hash value of the ciphertext, and compares the calculated hash value with the hash value queried according to the unique identifier, and if the same, performs the following operations, otherwise Stop the operation.

S38: After determining the payment, the server calculates a license according to the unique identifier and the function to be activated, performs a hash operation on the license to obtain a hash value of the license, and signs the hash value of the license with K _S1 , and signs the signature with K _P2 . The hash value of the license and the license are encrypted and sent to the client;

S39. The client decrypts with K _S2 to obtain the hash value and license of the signed license, and decrypts the hash value of the signed license with K _{P1 to} obtain the license hash value, and compares the decrypted license hash value and the license. The obtained license hash value is the same, and the loading and configuration of the to-be activated function is performed according to the license.

It should be noted that the method for loading and configuring the to-be-activated function according to the license may be: storing the license in the TCM/TPM of the client; after the client restarts, from the trusted metric root (Core) Root of Trust Measurement , CTRM) began to build a trusted platform, and finally in the trusted platform to configure the software and hardware functions (to be activated) according to the license.

In the method provided by the embodiment, each message needs to be encrypted and decrypted by a key pair during function configuration and loading, so that it has the advantage of improving the security of the license management. In addition, in the embodiment, when performing encryption, The client is re-authenticated by using the hash value of the random ciphertext, which further improves the security, so that it has the advantage of higher security. In addition, the method provided by the embodiment can flexibly configure the to-be activated according to the needs of the client. The function is more in line with the customer's needs, so it has the advantage that the customer can flexibly choose the client configuration.

The embodiment of the present invention further provides another embodiment. The present embodiment provides a license management method, which is described by taking the unsubscribe function as an example. The method is the same as the technical scenario of an embodiment, and the specific operation of the method is The process is shown in Figure 4 and includes:

S40. When the client triggers unsubscription on the client, the client displays a function list.

S41. The client determines a function (which may be software and/or hardware) selected by the user to be unsubscribed.

It should be noted that the embodiment does not limit the number of functions, and the amount of data can be freely selected by the client, for example, 1, 2, 3 or 4, etc., in addition, in principle, permanent functions and basic functions (ie, no such Features that the feature client cannot run) cannot be unsubscribed.

S42. The client generates another key pair (private key K _S3 , public key K _P3 ) according to the identification information on the client (for example, the unique identifier of the hardware).

S43. The client generates a first data packet according to the ciphertext, K _P3, and the function to be unsubscribed, and encrypts the first data packet by using the public key K _P1 .

It should be noted that the foregoing first data packet may include: a ciphertext, a private key K _P3, and a function to be unsubscribed. In addition, the specific manifestation of the function to be unsubscribed may be: a list of software functions that the customer needs to unsubscribe at the moment, and a list of hardware that the customer needs to unsubscribe at the moment.

S44. The client sends the encrypted data and the unique identifier of the client to the server.

S45. The server searches for the private key K _S1 and the hash value corresponding to the unique identifier according to the unique identifier, and decrypts the encrypted first data packet with the private key K _S1 to obtain the ciphertext and the private key K in the first data packet. _P3 and the function to be unsubscribed;

S46: The server performs a hash operation on the ciphertext in the first data packet to obtain a hash value of the ciphertext, and compares the calculated hash value with the hash value queried according to the unique identifier, and if the same, performs the following operations, otherwise Stop the operation.

S47. The server calculates a license according to the unique identifier and the function to be unsubscribed, performs a hash operation on the license to obtain a hash value of the license, and uses the private key K _S1 to sign the hash value of the license, and then signs the signature with the public key K _P3 . The hash value of the subsequent license is encrypted and sent to the client;

S48. The client decrypts with K _S3 to obtain the hash value and license of the signed license, and decrypts the hash value of the signed license with K _{P1 to} obtain the license hash value, and compares the decrypted license hash value and the license. If the obtained license hash value is the same, the unsubscribe function is unsubscribed according to the license, and after the unsubscribe is successful, an unsubscribe success message is generated to the server;

S49. The server calculates a residual value of the unsubscribe function, and returns the remaining value to the client.

There are various ways to return to the client, such as directly refunding the amount to the e-wallet, and of course, directly returning the e-coupon to the client.

The method for unsubscribing the function to be unsubscribed according to the license may be: storing the license in the TCM/TPM of the client; after the client restarts, establishing a trusted platform from the CTRM, and finally The configuration of the software and hardware functions (to be unsubscribed) according to the license in the trusted platform.

The method provided in this embodiment provides a function unsubscribe mechanism, which expands the function of the license. In addition, the method needs to perform strict encryption and decryption operations when performing function unsubscription, so it also has high security. advantage.

A specific embodiment of the present invention also provides a TCM based or TPM The dynamic management device of the license, as shown in Figure 5, includes:

The configuration unit 56 is configured to configure the public key K _P1 in the local device;

The receiving unit 51 is configured to receive a function to be changed selected by the customer according to the function list, where the function list includes: all software and hardware functions in the local device;

The key generating unit 52 is configured to generate a key pair according to the local identification information, where the key pair includes: a private key K _S2 and a public key K _P2 , wherein the identification information is: information that can identify the local device;

The encryption unit 53 is configured to generate a first data packet according to the public key K _P2 and the function to be changed, and encrypt the first data packet with the public key K _P1 ; the first data packet includes: a public key K _P2 and the function to be changed;

The sending unit 54 is configured to send the encrypted first data packet and the local unique identifier to the server, so that the server can obtain the private key K _S1 according to the local unique identifier, and decrypt the public key K _S1 according to the private key K _S1 The public key K _P2 obtained by the first data packet and the function to be changed;

The receiving unit 51 is further configured to receive the second data packet encrypted by using the public key K _P2 , where the second data packet specifically includes: a license obtained by decrypting and calculating the encrypted data by using the private key K _S1 ;

The decryption configuration unit 55 is configured to decrypt the encrypted second data packet by using the private key K _S2 to obtain a license, and complete the configuration of the function to be changed according to the license;

The private key K _S1 and the public key K _P1 are a key pair.

Optionally, the functions to be changed include:

Unsubscribe or feature to be activated.

Optionally, the encrypted second data packet may further comprise: a public key K _P2 license signature hash value, when the license includes a public key hash value K _P2 signature, decryption unit 55 is further arranged for using a private key K _S2 decrypts the encrypted second data packet to obtain the license hash value of the license and the private key K _S1 signature, and uses the public key K _P1 to decrypt the license hash value signed by the private key K _{S1 to} obtain the license hash value, and compares the decrypted license hash. The value is the same as the license hash value calculated for the license, and the configuration of the function to be changed is completed according to the license.

When the device provided by the present invention performs license management, all data interaction between the local (ie, the license management device, specifically the client) and the server is encrypted and decrypted by using a key pair, and the data between them is not easy. Leaked and changed by others, all of the devices have the advantage of improving license management security.

Embodiments of the present invention also provide a TCM based or TPM The dynamic management support device of the license, as shown in FIG. 6, includes:

The configuration unit 66 is configured to configure a correspondence between the private key K _S1 and the private key K _S1 and the unique identifier of the client in the server;

The receiving unit 61 is configured to receive the unique identifier sent by the client and the first data packet encrypted by using the public key K _P1 , where the first data packet includes: a public key K _P2 and a function to be changed;

The query unit 62 is configured to query the private key K _S1 from the pre-configured private key K _S1 and the uniquely identified correspondence according to the unique identifier;

The decrypting unit 63 is configured to decrypt the data sent by the client by using the private key K _{S1 to} obtain the public key K _P2 and the function to be changed;

The calculation sending unit 64 is configured to calculate a license according to the unique identifier and the function to be changed, encrypt the license with the public key K _P2 to obtain a second data packet, and send the second data packet to the client.

Optionally, the foregoing functions to be changed include:

Unsubscribe or feature to be activated.

Optionally, the foregoing first data packet further includes: a ciphertext, where the configuration unit 66 is further configured to configure a correspondence between the ciphertext and the ciphertext hash value and the unique identifier of the client, where the apparatus further includes:

The hash value verification unit 65 is configured to query the key hash value from the correspondence between the ciphertext hash value and the client unique identifier according to the unique identifier, and compare the queryed hash value with the received ciphertext hash value, such as The trigger inquiry unit 62, the decryption unit 63, and the calculation transmission unit 64 perform operations.

Optionally, the calculating sending unit 64 specifically includes:

The calculation module 641 is configured to calculate a license according to the unique identifier and the function to be changed, and perform a hash value of the license value calculated by the hash value of the license;

The signature module 642 is configured to encrypt the license hash value by using a private key K _{S1 to} obtain a license hash value of the private key K _S1 signature.

Transmitting encryption module 643, license for using encrypted hash value and the license of the private key of the public key K _P2 K _S1 signature is encrypted second data packet, sends the packet to the second client.

The support device for license management provided by the present invention supports the implementation of the management method of the above license.

A specific embodiment of the present invention further provides a management system for a license, the system comprising: a client and a server; wherein the client stores a public key K _P1 ; the server stores a private key K _S1 and a private key K a correspondence between _S1 and a unique identifier of the client; the private key K _S1 and the public key K _P1 are a key pair;

a client, configured to receive a function to be changed selected by the client according to the function list, and generate a key pair according to the local identification information, the key pair includes: a private key K _S2 and a public key K _P2 ; according to the public key K _P2 and The function to be changed generates a first data packet, and encrypts the first data packet with a public key K _P1 ; the first data packet includes: a public key K _P2 and a function to be changed; the function list includes: local Software and hardware functions within the device;

a server, configured to query the private key K _S1 from the correspondence between the private key K _S1 and the client unique identifier according to the unique identifier, and use the private key K _{S1 to} decrypt the encrypted first data packet to obtain the public information in the first data packet. Key K _P2 and the function to be changed; calculate the license according to the unique identifier and the function to be changed, encrypt the license with the public key K _P2 to obtain the second data packet, and send the second data packet to the client;

The client and the server in the system provided by the present invention use the encryption and decryption method to exchange information when interacting, so it has the advantage of improving the security of the intermediate data.

The technical solution provided by the invention has the advantage of high safety.

In the above unit and system embodiment, each module or unit included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding function can be implemented; in addition, the specific name of each functional module is also They are only used to facilitate mutual differentiation and are not intended to limit the scope of the present invention.

It can be understood by those skilled in the art that all or part of the steps of the nonlinear tolerance compensation method provided by the embodiments of the present invention can be completed by hardware related to program instructions. For example, it can be done by computer running. The program can be stored in a readable storage medium such as a random access memory, a magnetic disk, an optical disk, or the like.

Claims

A method for dynamically managing a license based on a TCM or a TPM, the method comprising:

Configure the public key K P1 in the local device;

Receiving a function to be changed selected by the customer according to the function list, where the function list includes: a software and hardware function in the local device;

Generating a key pair according to the local identification information, the key pair includes: a private key K S2 and a public key K P2 ;

Generating a first data packet according to the public key K P2 and the function to be changed, and encrypting the first data packet with the public key K P1 , the first data packet includes: a public key K P2 and a function to be changed ;

Sending the encrypted first data packet and the local unique identifier to the server; so that the server can obtain the private key K S1 according to the local unique identifier; and decrypting the first data packet according to the private key K S1 Public key K P2 and function to be changed;

Receiving, by the receiving server, the second data packet encrypted by using the public key K P2 , the second data packet specifically includes: a license calculated for the local unique identifier and the function to be changed;

The encrypted second data packet is decrypted by using the private key K S2 to obtain a license, and the configuration of the function to be changed is completed according to the license.
The method according to claim 1, wherein the function to be changed comprises a function of unsubscribing or a function to be activated.
The method according to claim 1, wherein the method further configures a ciphertext on the local device when the local device configures the public key K P1 ; and after the ciphertext is configured, the public key K P2 and The function to be changed generates a first data packet, and encrypting the first data packet with the public key K P1 specifically includes:

Generating a first data packet according to the public key K P2 , the function to be changed, and the ciphertext, and encrypting the first data packet with the public key K P1 , the first data packet public key K P2 , to be changed The function and the ciphertext.
The method according to claim 1, wherein the encrypted second data packet further comprises: license hash value signed public key K P2, and the second data packet includes the public key of the signature of the license signature K P2 When the hash value is used, the private key K S2 decrypts the encrypted second data packet to obtain a license, and the configuration of the function to be changed according to the license includes:

The private data K S2 is used to decrypt the encrypted second data packet to obtain the license hash value of the license and the private key K S1 signature, and the license hash value signed by the private key K S1 is decrypted by the public key K P1 to obtain the license hash value, and the decryption value is decrypted. After the license hash value is the same as the license hash value calculated for the license, the configuration of the function to be changed is completed according to the license.
A dynamic management support method for a license based on a TCM or a TPM, the method comprising:

Configuring a correspondence between the private key K S1 and the private key K S1 and the unique identifier of the client in the server;

Receiving the unique identifier sent by the client and the first data packet encrypted by using the public key K P1 ; the first data packet includes: a public key K P2 and a function to be changed;

Querying the private key K S1 from the correspondence between the private key K S1 and the unique identifier of the client according to the unique identifier;

Decrypting the encrypted first data packet by using the private key K S1 to obtain the public key K P2 in the first data packet and the function to be changed;

Calculating the license according to the unique identifier and the function to be changed, encrypting the license with the public key K P2 to obtain the second data packet, and transmitting the second data packet to the client.
The method according to claim 5, wherein the function to be changed comprises a function of unsubscribing or a function to be activated.
The method according to claim 5, wherein the first data packet further comprises: a ciphertext, when the first data packet includes a ciphertext, the method further comprises: configuring a ciphertext hash value in the server Correspondence with the unique identifier of the client;

The method further includes: querying the private key K S1 from the correspondence between the private key K S1 and the unique identifier of the client according to the unique identifier:

Query the ciphertext hash value corresponding to the unique identifier from the correspondence between the ciphertext hash value and the client unique identifier according to the unique identifier, and compare the hash value of the query with the hash value of the received ciphertext, such as The subsequent operation of querying the private key K S1 from the pre-configured private key K S1 and the uniquely identified correspondence relationship is uniquely identified.
The method according to claim 5, wherein the encrypting the license to obtain the second data packet by using the public key K P2 comprises: a license hash value obtained by calculating a hash value of the license, and adopting the license hash value of the license K S1 private secret key encrypted license K S1 signed hash value using a hash of license and license encrypted public key to the private key K S1 K P2 signature is encrypted second data packet.
A dynamic management device for a license based on a TCM or TPM, characterized in that the device comprises:

a configuration unit, configured to configure a public key K P1 in the local device;

a receiving unit, configured to receive a function to be changed selected by the customer according to the function list, where the function list includes: a software and hardware function in the local device;

a key generating unit, configured to generate a key pair according to the local identification information, where the key pair includes: a private key K S2 and a public key K P2 ;

An encryption unit, configured to generate a first data packet according to the public key K P2 and the function to be changed, and encrypt the first data packet by using the public key K P1 , where the first data packet includes: a public key K P2 And the function to be changed;

a sending unit, configured to send the encrypted first data packet and the local unique identifier to the server, so that the server can obtain the private key K S1 according to the local unique identifier; and decrypt the first key according to the private key K S1 a public key K P2 obtained by a data packet and a function to be changed;

The receiving unit is further configured to receive a second data packet that is encrypted by using the public key K P2 , where the second data packet includes: a license that is calculated by a local unique identifier and a function to be changed;

The decryption configuration unit is configured to decrypt the encrypted second data packet by using the private key K S2 to obtain a license, and complete the configuration of the function to be changed according to the license; the private key K S1 and the public key K P1 are a key pair.
The device according to claim 9, wherein the function to be changed comprises a function of unsubscribing or a function to be activated.
The apparatus according to claim 9, wherein the encrypted second data packet further comprises: a license hash value signed by the public key K P2 , the decryption configuration unit further configured to encrypt the encrypted key K S2 The second data packet is decrypted to obtain the license hash value of the license and the private key K S1 signature, and the license hash value of the private key K S1 signature is decrypted by the public key K P1 to obtain the license hash value, and the decrypted license hash value and the license are compared. The license hash value obtained by the calculation is the same, and the configuration of the function to be changed is completed according to the license.
A device for dynamically managing a license based on a TCM or TPM, characterized in that the device comprises:

a configuration unit, configured to configure a correspondence between the private key K S1 and the private key K S1 and the unique identifier of the client in the server;

a receiving unit, configured to receive a unique identifier sent by the client and a first data packet encrypted by using a public key K P1 , where the first data packet includes: a public key K P2 and a function to be changed;

a decryption unit, configured to decrypt, by using the private key K S1 , the encrypted first data packet to obtain a public key K P2 in the first data packet and a function to be changed;

Querying unit configured to query the corresponding relationship between the private key K S1 and uniquely identifies the client to the private key K S1 according to a unique identifier;

The calculation sending unit is configured to calculate a license according to the unique identifier and the function to be changed, encrypt the license with the public key K P2 to obtain a second data packet, and send the second data packet to the client.
The device according to claim 12, wherein the function to be changed comprises a function of unsubscribing or a function to be activated.
The apparatus according to claim 12, wherein the first data packet further comprises: a ciphertext, wherein the configuration unit is further configured to configure a correspondence between the ciphertext hash value and the client unique identifier in the server;

The device further includes: a hash value verification unit, configured to query, according to the unique identifier, a key hash value corresponding to the unique identifier from a correspondence between the ciphertext hash value and the client unique identifier, and compare the queried value and the received query The received ciphertext hash value, if consistent, triggers the query unit, the decryption unit, and the computing sending unit to perform operations.
The device according to claim 12, wherein the calculating and transmitting unit specifically comprises:

a calculation module, configured to calculate a license according to the unique identifier and the function to be changed, and perform a hash value of the license value calculated by the hash value of the license;

a signature module, configured to encrypt the license hash value by using a private key K S1 to obtain a license hash value of the private key K S1 signature,

Transmitting encryption module configured to use license and license encrypted hash value of the public key K P2 signature private key K S1 is encrypted second data packet, the second data packet to the client.
A license management system, characterized in that the system comprises: a client and a server; wherein the client stores a public key K P1 ; the server stores a private key K S1 and a private key K S1 and a correspondence uniquely identified by the client; the private key K S1 and the public key K P1 are a key pair;

The client is configured to receive a function to be changed selected by the client according to the function list, and generate a key pair according to the local identification information, where the key pair includes: a private key K S2 and a public key K P2 ; according to the public key K P2 and the function to be changed generate a first data packet, and encrypt the first data packet with the public key K P1 , the first data packet includes: a public key K P2 and a function to be changed; the function The list includes: hardware and software functions within the local device;

The client is further configured to send the encrypted first data packet and the local unique identifier to the server;

The server is configured to query the private key K S1 from the correspondence between the private key K S1 and the unique identifier of the client according to the unique identifier, and use the private key K S1 to decrypt the encrypted first data packet to obtain the first data packet. The public key K P2 and the function to be changed; calculate the license according to the unique identifier and the function to be changed, encrypt the license with the public key K P2 to obtain the second data packet, and send the second data packet to the client;

The client is further configured to decrypt the second data packet by using the private key K S2 to obtain a license, and complete the configuration of the function to be changed according to the license.
The system according to claim 16, wherein the function to be changed comprises a function of unsubscribing or a function to be activated.