WO2015039812A1

WO2015039812A1 - Method, device and system for distributing license revocation information for devices having a sporadic network connection or none at all

Info

Publication number: WO2015039812A1
Application number: PCT/EP2014/067203
Authority: WO
Inventors: Jens-Uwe Busser; Fabienne Waidelich
Original assignee: Siemens Aktiengesellschaft
Priority date: 2013-09-17
Filing date: 2014-08-12
Publication date: 2015-03-26
Also published as: DE102013218590A1

Abstract

Method for revoking a licence already created for a device (23), comprising the method steps of: – putting the device (23) into an expectation state, during which the device (23) expects revocation information (21d, 22d) signed with an expected signature (21e, 22e), wherein the revocation information (21d, 22d) identifies revoked licenses; – putting the device (23) into an unlicensed state if, after a prescribed period has elapsed, no revocation information (21d, 22d) signed with the expected signature (21e, 22e) is available on the device (23).

Description

description

Method, device and system for distributing license revocation information for devices with sporadic or no network connection

The present invention relates to the technical field of revocation of licenses.

Since earliest time manufacturers of products, for example manufacturers of food, tools, vehicles, machines, books, etc., make a profit through the sale. A temporary leasing and billing by time, such as letting and leasing was added. Later, there were other business models such as repair, maintenance, consulting and sales of additional consumables. Advice includes, for example, support in purchase selection, advice on use, training of users, etc. The sale of additional consumables includes, for example, blades for razors, paper and ink for printers, etc.

Interesting for manufacturers are particularly use-dependent remunerations, since here the consumers pay according to their actual consumption. For consumers with high consumption, the product is often more important than for consumers who rarely use it; therefore, the former are generally willing to pay more. If the manufacturer allows a flexible remuneration for his product, he can make more profit than when selling; moreover, the product will be accessible to more customers as it can be offered much cheaper to consumers with low consumption. Licensing with usage-based compensation is therefore particularly interesting.

A well-known example of rental with usage-based remuneration are coin-operated devices such as: Washing machines and dryers in the laundromat, which are available after inserting a corresponding number of coins for a process;

Telescopes on viewing platforms;

Payphones, telephone cards.

Even devices such as photocopiers and printers with counter have been around for decades. The use can be determined and settled on the basis of the meter reading. If the device belongs to the erector, then it is a use-dependent rental; If the device belongs to the user, then it is usage-dependent licensing.

The consumption of electrical energy, gas, water, etc., on the other hand, is not a use-dependent licensing, since you pay for the used material here and not for the use of the heating, which belongs to the homeowner and not the utility.

Usage-dependent remuneration is also known, for example, from printer cartridges with built-in chip, which deny their further service after a specified by the manufacturer application period, for example after a certain number of printing operations or after a single consumption of a certain amount of ink. Refilling with otherwise procured ink or replacement of the cartridge by the product of a competitor can be prevented.

Devices with IT technology are particularly easy to license if they connect to a server before or during use. If the connection to the server does not materialize, use is denied. This method is equally applicable to software licenses, such as floating licenses, which are dynamically assigned to a user and then "returned" to the server when the user no longer needs them. The settlement of usage-based compensation has become particularly easy in the IT age. However, a major challenge remains in creating the ability to revoke licenses, for example in the event of abuse. This is especially difficult with end devices that have only sporadic or no network connection.

A license is realized, for example, in the form of a file, which usually contains information such as information about the scope of the license, which describes what and how much is licensed, information on temporal or other restrictions, such as a validity period, validity for certain models, individual Devices, or similar, information about a serial number of the license, ID of the exhibitor, etc. A license is similar to a digital certificate, but does not contain a public key. The device or application checks the validity of the license by means of a root certificate or a list of several root certificates or corresponding public keys that are permanently stored and can not be easily exchanged by unauthorized persons, and possibly even with mostly dynamically distributed ones (Intermediate) certificates that complete the certificate path between the license file and permanently stored root certificates and / or public keys.

Instead of a server, a copy protection plug, referred to below as a hardware dongle or dongle, can be used, which must be connected when using the device or the software. This dongle can log the usage, for example count. After a fixed number of uses, the dongle then locks the application and needs to be replaced; Alternatively, the dongle can be exchanged at regular intervals and returned to the manufacturer or licensor for billing. Another way of licensing is to connect only once, for example, the first time you install the software. Then the software can be used as long as no important components such as a motherboard, a hard disk, a network card, etc. are used. be replaced. This is often done in computer games, for example. However, this is not a usage-based compensation.

FIG. 1 shows a method for transporting a license IIb, 12b from a manufacturer 11 or from a license manufacturer 12 to an offline device 13 via USB transport 11c, 12c or the like. The manufacturer 11 has the private key IIa for a "license root certificate." In one case, the manufacturer 11 creates the license IIb directly with the private key of the license root certificate, which is permanently stored in all the devices to be licensed The license IIb is then transferred to the offline device 13 by means of a USB memory or the like, In another case the manufacturer 11 authorizes, for example via a network 15, the license maker 12 to create licenses by giving him a " License Certificate "(creator certificate llf), which connects the creator licenses with the license root certificate. With the private one

Key 12a of this creator certificate llf the license maker can then create a license 12b.

For devices 13 without or with only sporadic network connection, which are referred to below as offline devices, a secure, IT-based method for use-dependent licensing, however, is more difficult to implement: It is possible to use the license via a data carrier, such as a USB storage medium as shown in Figure 1, a barcode, a 2D barcode, a local area network, etc., transmitted to the device to increase the number of applications still to be performed. Already used licenses are then stored locally to prevent the multiple use of a license on the same device. The si- However, backing up, deleting or revoking licenses is difficult, and offline devices run the risk of multiple software licenses being used on different devices without being noticed if these are created by third parties, there is also a risk that they will illegally issue further licenses even if the manufacturer has already revoked their authorization to do so.

An example of a known technique for revoking "objects" in cryptography is the revocation of certificates issued by a certification authority, hereafter referred to as Certificate Authority or CA. Certificates are not to be kept secret because they only contain the public key of the certificate In addition, only the user has a corresponding, so-called private key, with which data is digitally signed or decrypted.As the security of such asymmetric methods is based on the secrecy of the private key, they must be correspondingly protected If a private key is lost, the CA can revoke the associated certificate so that it does not become more familiar with data signed with that key, and various revocation procedures have been developed:

• online queries using the Online Certificate Status Protocol (OCSP);

• Online queries to Certificate Revocation Lists (CRLs);

• Local search in offline / cached CRLs.

Both first techniques require a network connection; the latter is based on a locally stored list that needs to be updated regularly. This is difficult for devices that reside with customers or end users, especially when no service contract involves the intervention of service technicians or when changes to the devices result in a loss of certification, such as medical devices in the US that are under the control of the FDA.

The present invention is therefore based on the object to revoke a license on an off-line device.

This object is achieved by the solutions described in the independent claims. Advantageous embodiments of the invention are specified in the further claims.

In one aspect, the invention relates to a method for revoking a license already created for a device. The device is put into an expected state. During the expectation state, the device expects signed revocation information with an expected signature. The revocation information identifies revoked licenses. The device will be placed in an unlicensed state if, after a specified period of time, no revocation information signed with the expected signature is available on the device.

In another aspect, the invention relates to a system. The system includes means that are configured and / or adapted to perform a method as described above.

According to a further aspect, the invention relates to a device. The device includes a data store, an expectant and a revocation tool. The data store is used to store at least one license. The expectant is adapted to put the device in an expected state. During the expectation state, the device expects signed revocation information with an expected signature. The revocation information identifies revoked licenses. The revocation means is adapted to put the device in an unlicensed state if, after a predetermined period of time, no revocation information signed with the expected signature is available on the device. The invention will be explained in more detail with reference to the figures, for example. 1 shows a method according to the prior art;

Figure 2 shows a system, method and apparatus according to preferred embodiments of the invention. Figure 2 shows a method, a device 23 and a system 20 according to preferred embodiments of the invention. The system 20 comprises the device 23, a certification means 21 of a manufacturer and / or a certification means 22 of a license manufacturer. The certification means 21 comprises a private key 21a for a root certificate. The certification means 22 comprises a private key 22a for a creator certificate 21d. With the private key 21a, a creator certificate 21f can be generated matching the private key 22a and sent to the certification means 22 via a network 27.

The device 23 comprises a data memory 24, a root certificate, an expectation means 25 and a revocation means 26. The data memory 24 is designed to store licenses 21b, 22b, 22b ^Λ . The expectation means 25 is adapted to place the device 23 in an expected state during which the device 23 is awaiting revocation information 21d, 22d signed with an expected signature 21e, 22e. The revocation information 21d, 22d identifies revoked licenses. The revocation means 26 is adapted to put the device in an unlicensed state if, after a predetermined period of time, no revocation information 21d, 22d signed with the expected signature 21e, 22e is available on the device 23.

In order to revoke a license already stored on the device 23, according to preferred embodiments, the device 23 is in an expected state, which also intermediate state or Transition state can be called, offset. During the expectation state, the device 23 expects revoked revocation information 21d, 22d signed by an expected signature 21e, 22e of a particular publisher. The revocation information 21d, 22d identifies revoked licenses. If, after a predetermined period of time, no revocation information 21d, 22d signed with the expected signature 21e, 22e is available on the device 23, the device 23 is placed in an unlicensed state despite possibly existing unused licenses.

On the one hand, the license 21b and / or

Revocation information 21d be transported and / or transmitted by means of a suitable offline Datenentransfermitteis, such as by means of a USB stick, a CD, a DVD, etc. via a transport path 21c from the certification means 21 to the device 23 of a customer. In this case, the revocation information 21d is signed with a signature 21e of the manufacturer. The revocation information 21d can be both the licenses 21b produced by the manufacturer and the creator certificate 21f and / or licenses 22b of the license creator and / or licenses 22b ^> or

Identify creator certificates of other manufacturers. On the other hand, the license 22b and / or

Revocation information 22d be transported and / or transmitted by means of a suitable offline Datenentransfermitteis, such as by means of a USB stick, a CD, a DVD, etc. via a transport path 22c from the certification means 22 of the licensee to the device 23 of a customer. In this case, the revocation information 22d is signed with a signature 22e of the license author. The

Revocation information 22d should preferably 22b include only the licenses created by the license creator, but do not include licenses 21b of the manufacturer or licenses 22b ^Λ other license creator. In accordance with preferred embodiments, the device 23 will again be placed in a licensed state as soon as signed with the expected signature 21e, 22e

Revocation information 21d, 22d are available on the device.

In preferred embodiments, device 23 is placed in an unlicensed state if signed revocation information 21d, 22d is received by device 23 during or before the predetermined time period with expected signature 21e, 22e, and if any of the revoked revocation information 21d, 22d received on the device 23 present unused licenses 21b, 22b, 22b ^Λ .

It may therefore be that before the beginning of the expectation period revocation information come to the device, which are still valid / current at the beginning of the period. Preferably, the licenses identified by this revocation information and possibly existing on the device 23 are also revoked if they are accepted

Revocation information identifies all unused licenses on the device.

According to preferred embodiments, the licenses of the licensee are no longer accepted if the authorization is withdrawn by the manufacturer, for example by revocation of the creator certificate 21f.

According to preferred embodiments, the device 23 is an offline device and / or only temporarily online and / or online during the given time period and / or online only during the given time period.

According to preferred embodiments, the device 23 in accordance with a predefined set of rules in the expected state, for example, by the device 23 at regular intervals in the expected state and / or by the device 23 after a certain number of applications and / or by the device itself 23 on receipt a new license 21b, 22b, 22b ^Λ and / or on installation of a new license 21b, 22b, 22b ^Λ on the device 23 in the expected state.

According to preferred embodiments, the device 23 in the case of licensing by a licensee regularly expects both revocation information 22d from the licensee and - possibly at longer intervals - revocation information 21d from manufacturer. This allows only the manufacturer to revoke the license creator.

According to preferred embodiments, the device 23 does not accept new licenses 21b, 22b, 22b ^Λ and remains in the unlicensed state, even if no revocation information 21d, 22d signed with the expected signature 21e, 22e is accepted by the device 23 after the predetermined period.

According to preferred embodiments, the

Revocation information 21d, 22d designed as a list.

According to preferred embodiments, the

Revocation information 21d, 22d any selection of the following data:

Time stamp and / or version of the revocation information 21d, 22d;

Unique identifiers of subordinate license creators 22, the authorization of which has been revoked by a higher-level license creator 21, preferably with the expiration date from when the licenses 22 of the subordinate license creators 22 are no longer to be accepted;

• Unique identifications of revoked licenses, preferably multiple-use licenses or licenses whose license code has been made public or stolen licenses. In accordance with preferred embodiments, the revocation information 21d, 22d also identifies revoked licenses which have already been revoked by previous revocation information earlier than the predetermined period.

According to preferred embodiments, the

Revocation information 21d signed with a private key 21a associated with a root certificate.

According to further preferred embodiments, the revocation information 22d is signed with a private key 22a of a certificate derived from the root certificate.

According to preferred embodiments of the invention, methods are proposed with which already created licenses can still be revoked even with offline devices. Furthermore, an already granted authorization of third parties to create licenses can be revoked. For this purpose, the device expects at each new license 21b, 22b, 22b ^Λ and at regular intervals in addition to a signed by the manufacturer current list 21d, 22d withdrawn authorizations and invalidated licenses. Lists 21d and 22d may be identical. Affected licenses will no longer be accepted in the future and may already be marked as invalid immediately.

The manufacturer or a third party commissioned by the manufacturer creates license files for the devices it produces or distributes 23. These are files that contain, for example, the following data:

• Scope of the licensed service: what, how much,

• Validity for device or software type or version;

• validity for certain individual devices;

• Validity for devices with specific configuration;

• beginning and end of a validity period; • Unique identification of the license, eg serial serial number;

• Unique identification of the license manufacturer;

• Digital signature on the above data or part of it;

• digital certificate to verify the signature; This certificate is derived from the root certificate of the manufacturer, which is firmly anchored in the device or in the software.

Usually, the digital signature 22e is not generated directly with the private key of the root certificate, especially if there are other licensing creators besides or instead of the manufacturer; Instead, further sub-certificates 21f, which are also called end certificates, are created, with the private key 22a of which licenses 22b are then generated. These endcertificates or the entire certification paths can be transferred with the license or separately.

According to preferred embodiments of the invention, when loading or installing a new license 21b, 22b, an offline device 23 checks whether there is also a revocation list for licenses and license-generating authorizations configured as revocation information 21d, 22d in the following. If not, no new licenses 21b, 22b are accepted anymore or only if the already existing revocation list 21d, 22d is not too old. Typically, a revocation list 21d, 22d is too old, for example, after a few months. However, this depends heavily on the application. Acquires a user's licenses 22b, ^22b> of different license preparers, a laid-off and thus revoked license creator is locked in a step 29, upon obtaining a license and a revocation list from another creator. And even in the case that a user obtains his licenses 22b only from one, namely the terminated license manufacturer and this deletes the list and by a äl- If it has not yet been registered, it will only be possible to use it for a certain period of time specified by the manufacturer. This reliably prevents a user from continuing to use cheap licenses from a license manufacturer whose authorization has already been revoked.

The new list will then also be loaded and / or installed. Licenses of creators whose authorization has been revoked will no longer be accepted as of now or as of a certain date, as well as the revoked licenses.

For example, a revocation list 21d, 22d contains the following data:

• timestamp and / or version of the list;

• Unique identifiers of the license manufacturers whose authorization has been revoked by the manufacturer, possibly with the expiry date from which the licenses of this creator should no longer be accepted;

• Unique identifications of revoked licenses. For example, licenses that have already been used multiple times, such as licenses whose "license code" has been made public, and stolen licenses can also be revoked.

If no authorizations or licenses are to be revoked, the list according to preferred exemplary embodiments is lee and contains only a timestamp and / or a version. Preferably, each list also contains the identifications from previous lists, unless a revocation has become unnecessary because the revoked licenses and / or authorizations have expired anyway and thus become invalid without revocation.

This list is preferably signed by the manufacturer with the private key 21a associated with the root certificate or a private key 22a of a certificate derived therefrom. The revocation lists, for example, using removable media such as USB storage media, CD, DVD, or similar. be recorded. The revocation lists for devices that have a barcode reader can also be imported using 2D barcodes. The revocation lists can also be imported in accordance with preferred embodiments by means of a service laptop or by means of a temporary network connection via the Internet, corporate LAN, laboratory network, etc.

According to preferred embodiments, when new licenses are transferred to offline devices 23 by means of removable media such as USB storage medium, CD, DVD, or the like; for devices that have a barcode reader via 2D barcodes, service laptop or temporary network connection, for example via the Internet, corporate LAN, laboratory network, etc. also requires the transfer of an up-to-date, signed list of invalidated licenses and license issuance rights, and keep them up-to-date.

The concept is similar to that used in Certification Revocation Lists (CRLs).

Preferred embodiments of the invention lead to the following advantages:

• The procedure described above provides more security even for usage-based billing, that is, for licensing offline devices.

• Issued licenses can be revoked retrospectively.

• Third-party license authorizations may be revoked retroactively.

Claims

claims

1. A method for revoking a license already created for a device (23), comprising the method steps: - placing the device (23) in an expected state, during which the device (23) has revocation information signed with an expected signature (21e, 22e) ( 21d, 22d), wherein the revocation information (21d, 22d) identifies revoked licenses;

- placing the device (23) in an unlicensed state, if after the expiration of a given period of time, none signed with the expected signature (21e, 22e)

Revocation information (21d, 22d) is available on the device (23).

The method of claim 1, wherein the device (23) is placed in a licensed state as soon as signed revocation information (21d, 22d) with the expected signature (21e, 22e) is available on the device.

3. The method according to any one of the preceding claims, comprising the method step:

Placing the device (23) in an unlicensed state if signed with the expected signature (21e, 22e) during or before the specified time period

Revocation information (21d, 22d) are received by the device (23) and if they are accepted

Revocation information (21d, 22d) identify all unused licenses (21b, 22b, 22b) present on the device (23).

4. The method according to any one of the preceding claims, wherein the device (23) is an offline device and / or only temporarily online and / or online during the predetermined period and / or online only during the predetermined period.

5. The method according to any one of the preceding claims, wherein the device (23) according to a predefined set of rules in the expected state.

6. The method according to any one of the preceding claims, wherein the device (23) at regular intervals in the expected state.

7. The method according to any one of the preceding claims, wherein the device (23) upon receipt of a new license (21b, 22b) and / or installation of a new license (21b, 22b) is placed on the device (23) in the expected state.

8. The method according to any one of the preceding claims, wherein the device (23) no new licenses (21b, 22b) accepted and remains in the unlicensed state, even if after the given period no with the expected signature (21e, 22e) signed revocation information ( 21d, 22d) are received by the device (23).

9. The method according to any one of the preceding claims, wherein the revocation information (21d, 22d) is preferably configured as a list and / or preferably comprises an arbitrary selection of the following data:

• Timestamp and / or version of the

Revocation information (21d, 22d);

• Unique identifiers of subordinate license creators (22) whose authorization has been revoked by a superordinate license creator (21), preferably with expiration date, from when the licenses (22b) of the subordinate license creators (22) are no longer to be accepted;

• Unique identifications of revoked licenses, preferably multiple-use licenses or licenses whose license code has been made public or stolen licenses.

10. The method according to any one of the preceding claims, wherein the revocation information (21d, 22d) also revoked Lizen- identify those already earlier than the given period by previous ones

Revoked revocation information.

A method according to any one of the preceding claims, wherein the revocation information (21d) is signed with a private key (21a) associated with a root certificate, or wherein the revocation information (22d) is provided with a private key (22a) of one of Root certificate of derived certificate.

12. The method according to any one of the preceding claims, wherein the device (23) expects both revocation information (22d) from a license manufacturer, as well as revocation information (21d) from a manufacturer, preferably the

Revocation information (21d) expected by the manufacturer at greater intervals than the

Revocation information (22d) from the licensee.

13. Device (23) comprising:

a data memory (24) for storing at least one license (21b, 22b, 22b ^> );

an expectation means (25) adapted to put the device (23) into an expected state during which the device (23) expects signed revocation information (21d, 22d) with an expected signature (21e, 22e), the revocation information ( 21d, 22d) identify revoked licenses;

a revocation means (26) which is adapted to place the device in an unlicensed state if, after a predetermined period of time, no revocation information (21d, 22d) signed with the expected signature (21e, 22d) is present on the device (23) Are available.

14. Apparatus (23) according to claim 13, comprising means (24, 25,

26) which are designed and / or adapted to perform a method according to any one of claims 1-12.

15. System (20) comprising means (21, 22, 23) which are designed and / or adapted to perform a method according to one of the claims 1-12.