WO2022133923A1 - 一种许可认证的方法、装置、电子设备、系统及存储介质 - Google Patents

一种许可认证的方法、装置、电子设备、系统及存储介质 Download PDF

Info

Publication number
WO2022133923A1
WO2022133923A1 PCT/CN2020/139087 CN2020139087W WO2022133923A1 WO 2022133923 A1 WO2022133923 A1 WO 2022133923A1 CN 2020139087 W CN2020139087 W CN 2020139087W WO 2022133923 A1 WO2022133923 A1 WO 2022133923A1
Authority
WO
WIPO (PCT)
Prior art keywords
ciphertext
license
environment
licensed
terminal
Prior art date
Application number
PCT/CN2020/139087
Other languages
English (en)
French (fr)
Inventor
闫新全
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Priority to CN202080003610.0A priority Critical patent/CN115280308A/zh
Priority to PCT/CN2020/139087 priority patent/WO2022133923A1/zh
Priority to US18/267,429 priority patent/US20240111842A1/en
Publication of WO2022133923A1 publication Critical patent/WO2022133923A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/105—Arrangements for software license management or administration, e.g. for managing licenses at corporate level
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/107—License processing; Key processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services

Definitions

  • the present disclosure relates to the field of license authentication, and in particular, to a method, apparatus, electronic device, system and storage medium for license authentication.
  • the present disclosure provides a license authentication method, apparatus, electronic device, system and storage medium, so as to solve the above technical problems existing in the prior art.
  • a method for license authentication provided by an embodiment of the present disclosure is applied to the license terminal, and the technical solution of the method is as follows:
  • the registration information includes the public key provided by the licensed terminal and the first environment ciphertext
  • the first environmental ciphertext is the current encrypted data of the licensed terminal using the private key.
  • the first environment fingerprint includes the software and hardware feature information of the environment where the licensed terminal is located;
  • license information including the first environment ciphertext, encrypt the license information with the public key, perform homomorphic encryption on the encrypted license information, and obtain the license ciphertext; wherein, the license information is used for Indicates the license scope of the to-be-licensed service for which license authentication is requested in the licensee;
  • Each of the licensed terminals determines whether to perform license authentication on the services to be licensed in the licensed terminal according to the received ciphertext of the verification result.
  • a possible implementation manner, before sending the license ciphertext to the licensee, further includes:
  • the license request carries the activation ciphertext of the to-be-licensed service; wherein, the activation ciphertext is used to identify and activate the to-be-licensed service;
  • the license ciphertext is sent to the licensee.
  • the algorithm used in the homomorphic encryption includes Paillier encryption or fully homomorphic encryption.
  • an embodiment of the present disclosure provides a method for license authentication, which is applied to a licensee, including:
  • the environment fingerprint includes the software and hardware feature information of the environment where the licensed terminal is located;
  • the license ciphertext is that the license terminal encrypts the license information containing the first environment ciphertext with the public key, and obtained by homomorphically encrypting the encrypted license information;
  • the second environment fingerprint includes software and hardware feature information of the environment where the licensed terminal is located;
  • a possible implementation is to send the registration information carrying the public key and the ciphertext of the first environment to the license terminal, including:
  • a key pair containing the public key and the private key is generated using a specified key algorithm; wherein the authentication request is based on the user's information on the service to be licensed resulting from an activation operation;
  • a possible implementation manner before receiving the license ciphertext based on the registration information provided by the license terminal, further comprising:
  • the license terminal After the license terminal passes the verification, the license ciphertext sent by the license terminal is received.
  • an embodiment of the present disclosure provides a method for license authentication, which is applied to a verification terminal, and the method includes:
  • the verification request is generated by the licensee based on the license ciphertext, the second environment ciphertext, and the public key
  • the license ciphertext is the licensee using the public key with the public key.
  • the first environment ciphertext is the first environment currently obtained by the licensed end using the private key Obtained after the fingerprint is encrypted
  • the second environment ciphertext is obtained by encrypting the currently obtained second environment fingerprint with the public key
  • the first environment fingerprint includes the software and hardware of the environment where the licensed terminal is located characteristic information
  • the license-to-be-licensed service in the terminal performs license authentication.
  • an embodiment of the present disclosure provides an apparatus for license authentication, which is applied to a license terminal, and the apparatus includes:
  • an obtaining unit configured to obtain the registration information provided by the licensed terminal; wherein, the registration information includes the public key provided by the licensed terminal and the first environment ciphertext, and the first environmental ciphertext is the licensed terminal Obtained after encrypting the currently obtained first environment fingerprint with a private key, the first environment fingerprint includes the software and hardware feature information of the environment where the licensed terminal is located;
  • an encryption unit configured to generate license information including the first environment ciphertext, encrypt the license information with the public key, and perform homomorphic encryption on the encrypted license information to obtain the license ciphertext; wherein, The license information is used to indicate the license scope of the to-be-licensed service for which license authentication is requested in the licensee;
  • a transceiver unit configured to send the license ciphertext to the licensed terminal, so that the licensed terminal determines the license ciphertext by verifying the first environment ciphertext in the license ciphertext by the verification terminal. It is true or false, and the licensed end decides whether to perform license authentication on the service to be licensed in the licensed end according to the ciphertext of the received verification result.
  • the transceiver unit is further used for:
  • the license request carries the activation ciphertext of the service to be licensed; verify whether the activation ciphertext is correct; wherein, the activation ciphertext is used to identify the activation site. describe the services to be licensed;
  • the license ciphertext is sent to the licensee.
  • the algorithm used in the homomorphic encryption includes Paillier encryption or fully homomorphic encryption.
  • an embodiment of the present disclosure provides an apparatus for license authentication, which is applied to a licensee, and the apparatus includes:
  • a transceiver unit configured to send the registration information carrying the public key and the first environment ciphertext to the license terminal; wherein, the first environment ciphertext is obtained by encrypting the currently obtained first environment fingerprint with a private key , the first environment fingerprint is the software and hardware feature information of the environment where the licensed terminal is located;
  • the transceiver unit is further configured to receive a license ciphertext generated based on the registration information provided by the license terminal; wherein, the license ciphertext is that the license terminal uses the public key pair to include the first environment
  • the license information of the ciphertext is encrypted, and the encrypted license information is homomorphically encrypted;
  • a generating unit configured to generate a verification request including the license ciphertext, the second environment ciphertext, and the public key; wherein the second environment ciphertext is the second environment fingerprint currently obtained by using the public key Obtained by encryption, the second environment fingerprint includes software and hardware feature information of the environment where the licensed end is located;
  • the transceiver unit is further configured to send the verification request to a verification terminal, so that the verification terminal verifies the first environmental ciphertext in the license ciphertext through the second environmental ciphertext to determine the license The authenticity of the ciphertext, and receive the ciphertext of the verification result sent by the verification end;
  • a processing unit configured to decrypt the ciphertext of the verification result with the public key to obtain a verification result, so as to decide whether to perform license authentication on the locally stored service to be licensed according to the verification result.
  • the transceiver unit is further used for:
  • a key pair containing the public key and the private key is generated using a specified key algorithm; wherein the authentication request is based on the user's information on the service to be licensed resulting from an activation operation;
  • the transceiver unit is further used for:
  • the license terminal After the license terminal passes the verification, the license ciphertext sent by the license terminal is received.
  • an embodiment of the present disclosure provides an apparatus for license authentication, which is applied to a verification terminal, and the apparatus includes:
  • a receiving unit configured to receive a verification request sent by the licensee; wherein, the verification request is generated by the licensee based on the license ciphertext, the second environment ciphertext, and the public key, and the license ciphertext is the license Encrypt the license information containing the first environment ciphertext with the public key, and perform homomorphic encryption on the encrypted license information, and the first environment ciphertext is obtained by the licensee using the private key to the current Obtained after encrypting the obtained first environment fingerprint, the second environment ciphertext is obtained by encrypting the currently obtained second environment fingerprint with the public key, and the first environment fingerprint includes the licensed terminal Information about the software and hardware characteristics of the environment;
  • a verification unit configured to perform homomorphic decryption on the license ciphertext, obtain the first environment ciphertext from the homomorphically decrypted license ciphertext, and verify the first environment ciphertext with the second environment ciphertext text, obtain the cipher text of the verification result;
  • the sending unit is configured to send the ciphertext of the verification result to the licensed terminal, so that the licensed terminal decrypts the ciphertext of the verification result with the public key to obtain the verification result, so as to verify the ciphertext in the licensed terminal.
  • the license-to-be-licensed service performs license authentication.
  • an embodiment of the present disclosure provides a server, which is applied to a license terminal, and the server includes the apparatus according to the fourth aspect.
  • an embodiment of the present disclosure provides an electronic device, where the electronic device includes the apparatuses described in the fifth and sixth aspects.
  • an embodiment of the present disclosure further provides an apparatus for authenticating permission, including:
  • a memory connected to the at least one processor
  • the memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the first aspect or the second aspect or the third aspect by executing the instructions stored in the memory. method.
  • an embodiment of the present disclosure further provides a readable storage medium, including:
  • the memory is used to store instructions that, when executed by the processor, cause an apparatus including the readable storage medium to perform the method as described in the first aspect or the second aspect or the third aspect above.
  • FIG. 1 is a flowchart of a license authentication method applied to a license terminal according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a license authentication method applied to a licensed terminal according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a license authentication method applied to a verification terminal according to an embodiment of the present disclosure
  • FIG. 4 is a flowchart of license authentication interaction provided by an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a license authentication apparatus applied to a license terminal according to an embodiment of the present disclosure
  • FIG. 6 is a schematic structural diagram of a license authentication apparatus applied to a licensed terminal according to an embodiment of the present disclosure
  • FIG. 7 is a schematic structural diagram of a license authentication apparatus applied to a verification end according to an embodiment of the present disclosure.
  • Embodiments of the present disclosure provide a license authentication method, apparatus, electronic device, system, and storage medium, so as to solve the above-mentioned technical problems existing in the prior art.
  • homomorphism refers to the property of some cryptosystems that enables a computerized system to perform operations by using encrypted ciphertext data that, after decryption, A plaintext result is produced that matches the result of the same operation if applied to the plaintext data. Like a cryptosystem with additive homomorphism, it enables a computer to add together two ciphertexts a and b to produce the resulting ciphertext c. When the resulting ciphertext c is decrypted, it produces a plaintext value that matches the sum of the plaintext data encrypted with a and b.
  • a computer receiving the original ciphertexts a and b can generate via direct addition of the original ciphertexts without decrypting either of the original encrypted inputs a and b or requiring access to any cryptographic keys ciphertext c.
  • Homomorphism of a cryptosystem In a cryptosystem, if the ciphertext operations (such as addition, multiplication) in the ciphertext space can be mapped to the plaintext space, then the cryptosystem is said to be homomorphic. Encryption using a homomorphic cryptosystem is called homomorphic encryption.
  • the keys in asymmetric cryptosystems include public and private keys, and asymmetric homomorphism is widely used, such as RSA algorithm, Paillier algorithm, etc.
  • Homomorphic Encryption is a cryptographic technique based on the computational complexity theory of mathematical problems. Processing the homomorphically encrypted data to obtain an output, decrypting this output yields the same output as processing the unencrypted raw data in the same way. Taking advantage of this property, encrypted data can be processed by others without revealing any of the original content. At the same time, the user who has the key decrypts the processed data and gets exactly the processed result.
  • Homomorphic encryption technology is divided into two types, semi-homomorphic (or partially homomorphic) encryption (Somewhat Homomorphic Encryption, SWHE) and fully homomorphic encryption (Fully Homomorphic Encryption, FHE).
  • the entire encryption E and decryption D is fully homomorphic encryption.
  • an embodiment of the present disclosure provides a license authentication method, which is applied to a license end, and the processing process of the method is as follows.
  • Step 101 Obtain the registration information provided by the licensee; wherein the registration information includes the public key provided by the licensee and the first environment ciphertext, and the first environment ciphertext is the first environment currently obtained by the licensee using the private key. Obtained after the fingerprint is encrypted, the first environment fingerprint includes the software and hardware feature information of the environment where the licensed terminal is located.
  • the licensing end can be a server, and the licensed end can be a piece of software in an electronic device.
  • the software can be application software, such as instant messaging software, playback software, office software, advertising machine software, etc.
  • the software can also be an operating system, such as Windows system, OS system, Android system, operating system of advertising machine, etc.
  • the licensee can use the specified key algorithm to generate a key pair including a public key and a private key, and use the private key to generate a key pair.
  • the key pair is used to encrypt the obtained first environment fingerprint to obtain the first environment ciphertext, and then generate a registration information including the public key and the first environment ciphertext and send it to the licensing terminal, wherein the first environmental fingerprint includes the environment where the licensed terminal is located software and hardware characteristics.
  • the licensed end is a video playback application in an electronic device
  • the user is currently an ordinary user of the video playback application, and at a certain time later, the user wishes to become a VIP user of the video playback application.
  • Generate an authentication request to provide a VIP service that is, a service to be licensed
  • the video playback application generates a key pair containing a public key and a private key with a specified key algorithm, and obtains the first environment fingerprint, and uses the private key to pair the first environment fingerprint.
  • Encryption is performed to obtain the first environment ciphertext, and registration information is generated according to the first environment ciphertext and the public key and sent to the server (ie, the license terminal).
  • the registration information may also include purchase information corresponding to the service to be licensed, such as what the purchased service is, what the time limit for purchasing the service corresponds to, and what level the service corresponds to.
  • purchase information corresponding to the service to be licensed, such as what the purchased service is, what the time limit for purchasing the service corresponds to, and what level the service corresponds to.
  • the service to be licensed is a VIP service
  • the level of the VIP service can be divided into gold VIP, diamond VIP, super VIP
  • the validity period can be divided into 1 month, 3 months, 6 months, 1 year, lifetime, etc.
  • these information can be used as purchase information.
  • the above purchase information may not be included in the registration information, such as some green software, government and enterprise service software (such as social security software, browsers, etc.). That is, the content included in the registration information can be freely set according to actual needs.
  • the service to be licensed may also be a specific multimedia information, including a video, a picture, and the like. If the licensed end is playing software, the service to be licensed can be a separate video resource (such as a newly released movie that requires separate payment, cloud exhibition, live broadcast, music, etc.); if the licensed end is the operating system, the service to be licensed can be It is understood as a service to apply for a license for the operating system.
  • the licensee can send the registration information to the licenser in offline, online, or other secure ways.
  • steps 102 and 103 may be executed.
  • Step 102 Generate license information including the ciphertext of the first environment, encrypt the license information with the public key, perform homomorphic encryption on the encrypted license information, and obtain the license ciphertext; The license scope of the to-be-licensed service for which license authentication is requested.
  • Step 103 Send the license ciphertext to the licensed end, so that the licensed end can verify the authenticity of the license ciphertext by verifying the first environment ciphertext in the license ciphertext, and make the licensed end according to the received verification result.
  • the ciphertext determines whether to perform license authentication on the service to be licensed in the licensee.
  • a verification terminal can be understood as a verification program, a verification plug-in, or an electronic device installed with a verification program and a verification plug-in, such as a mobile phone, a tablet computer, an advertising machine, a router, a smart speaker, a wearable equipment, etc.
  • the licensed side and the licensing side may be located in the same electronic device.
  • the license terminal After receiving the registration information, the license terminal can generate license information including the ciphertext of the first environment according to its content, and the license information can indicate the license scope of the service to be licensed. Type of device used, maximum number of devices, etc.
  • the license information not only includes the first environment ciphertext, but also includes the valid time of the VIP service (for example, 1 year), the service scope For example, you can freely watch all serials, but you cannot watch newly released movies or other movies that require separate payment, or you can freely watch all serials and movies, but do not include other movies that require separate payment, etc.
  • the licensed end is advertising machine software
  • the service to be licensed is the playback service of a certain advertisement
  • the scope of the license can be the playback period of the advertisement (such as playing at 12:00), and the playback duration is 30 seconds of uninterrupted continuous playback, etc. .
  • the license terminal can use the ciphertext information of the first environment and the attribute information of the software corresponding to the service to be licensed (that is, the terminal to be licensed), such as product identification (product ID), product series, product type, name, version, etc. (see Table 1. ), the license scope of the service to be licensed, etc. to generate license information, and encrypt the license information with the public key to obtain the encrypted license information, and at the same time, perform homomorphic encryption on the encrypted license information to obtain the license ciphertext.
  • product ID product identification
  • product series product series
  • product type name, version, etc.
  • PK is the public key provided by the licensee
  • Data is the license information
  • HE is the algorithm used in homomorphic encryption, that is, the public key (PK) is used to encrypt the license information (Data), and the encrypted license information is encrypted.
  • Homomorphic encryption is performed to obtain a homomorphic encryption result (C1), and the homomorphic encryption result is the license ciphertext described in this disclosure.
  • the algorithm of homomorphic encryption can include pailler encryption algorithm, fully homomorphic encryption algorithm (such as IBM fhe-toolkit-linux).
  • the license is transmitted in the form of cipher text, so it is the license cipher text
  • the licensee may It is also necessary to provide an activation code to the licenser (in this disclosure, the activation code is transmitted in the form of ciphertext, so it is the activation ciphertext):
  • the licenser When the licenser receives the license request sent by the licensee, it verifies whether the activation ciphertext is correct; the license request carries the activation ciphertext of the service to be licensed; when it is determined that the activation ciphertext is correct, it sends the license ciphertext to the licensee.
  • the license terminal wherein, the activation ciphertext is used to identify the service to be licensed for activation;
  • the licensed end is an operating system
  • the system when the system is initialized after the system is installed and restarted, a dialog box asking the user to enter the activation code will pop up.
  • the operating system obtains the activation code based on the user operation and encrypts it to obtain the activation ciphertext, and then According to the activation ciphertext, a license request is generated and sent to the server (license end).
  • the sending method can be offline or online.
  • the license end performs verification and calculation on the activation ciphertext (such as activation with the local storage of the license end).
  • the ciphertext is compared, or a certain algorithm is used to calculate the activation ciphertext to obtain a result), the authenticity of the activation ciphertext can be determined, and the license end sends the license ciphertext to the
  • the licensed end allows the licensed end to verify the authenticity of the license ciphertext through the authenticating end (the verification process of the authenticating end is described in detail in the corresponding method of the subsequent authenticating end), so as to decide whether to verify the pending ciphertext in the licensed end according to the verification result.
  • Licensing services perform license authentication. If the verification result is that the verification is passed, the licensed end performs license authentication on the service to be licensed, otherwise it abandons the service to be licensed for license authentication.
  • the license terminal After receiving the license ciphertext, the license terminal will generate a license request.
  • the license request carries the license ciphertext and the second environment ciphertext.
  • the second environment ciphertext is to encrypt the second environment fingerprint just obtained with the public key.
  • the license terminal sends the license request to the verification terminal to verify the first environment fingerprint in the license ciphertext, so as to determine the authenticity of the license ciphertext, such as determining whether the license ciphertext is true by verifying whether the first environment fingerprint is true,
  • the license terminal performs a homomorphic operation on the ciphertext in the first environment and the ciphertext in the second environment in an encrypted environment to determine whether the private key and the public key match to determine the ciphertext in the first environment. Authentic.
  • the licenser only needs to obtain the public key and the first environment ciphertext provided by the licensee to generate the license information including the first environment ciphertext, and perform homomorphic encryption on the license information with the public key, so that the licenser can use the public key in the future.
  • the license ciphertext can be generated, so that no one can abuse or spy on the private information (first environment fingerprint) of the licensee side on the license side, thereby improving the security of the license.
  • the security of the private information of the license side, and because the license ciphertext is obtained by homomorphic encryption it also reduces the complexity of the license side calculation, prevents the license information from being maliciously cracked during the transmission process, and improves the security of the license information. safety.
  • an embodiment of the present disclosure provides a method for license authentication, which is applied to a licensee, and the method includes:
  • Step 201 Send the registration information carrying the public key and the first environment ciphertext to the license terminal; wherein, the first environment ciphertext is obtained by encrypting the currently obtained first environment fingerprint with the private key, and the first environment ciphertext is obtained by encrypting the currently obtained first environment fingerprint.
  • the fingerprint includes the software and hardware characteristic information of the environment where the licensee is located.
  • the licensed end is an instant messaging application in an electronic device
  • the user is currently an ordinary user of the instant messaging application, and at a certain time in the future, the user wishes to become a VIP user of the instant messaging application.
  • operation generate an authentication request to provide VIP service (that is, the service to be licensed)
  • the instant messaging application uses the specified key algorithm to generate a key pair containing the public key and the private key, and obtains the fingerprint of the first environment, and uses the private key to pair the first key pair.
  • An environment fingerprint is encrypted to obtain the first environment ciphertext, and registration information is generated according to the first environment ciphertext and the public key and sent to the server (ie, the license terminal).
  • the registration information may also include purchase information corresponding to the service to be licensed, such as what the purchased service is, what the time limit for purchasing the service corresponds to, and what level the service corresponds to.
  • purchase information corresponding to the service to be licensed such as what the purchased service is, what the time limit for purchasing the service corresponds to, and what level the service corresponds to.
  • the service to be licensed is a VIP service
  • the level of the VIP service can be divided into gold VIP, platinum VIP, diamond VIP, for example, the validity period can be divided into 3 months, 6 months, 1 year, etc.
  • all of these information can be used as Purchase information.
  • the above purchase information may not be included in the registration information, such as some green software, government and enterprise service software (such as tax software, financial software, shopping software, etc.). That is, the content included in the registration information can be freely set according to actual needs.
  • the service to be licensed may also be a specific multimedia information, including a video, a picture, and the like.
  • the license-playing software is the service to be licensed, it can be a separate video resource (such as a newly released movie that requires separate payment, cloud exhibition, live broadcast, etc.); if the license-to-be is the operating system, the service to be licensed can be understood as A service that requests a license for this operating system, or an application in that operating system.
  • Sending the registration information carrying the public key and the ciphertext of the first environment to the licenser can be implemented in the following ways:
  • the specified key algorithm can be the asymmetric key generation algorithm and related bit requirements selected by users and enterprises according to their own internal policies and security policies, such as the classic RSA algorithm, elliptic curve cryptography (ECC) , Elliptic Curve Digital Signature Algorithm (ECDSA), National Secret Algorithm SM2, etc.
  • ECC elliptic curve cryptography
  • EDSA Elliptic Curve Digital Signature Algorithm
  • National Secret Algorithm SM2 National Secret Algorithm
  • the environmental fingerprint of the licensee includes:
  • SDK fingerprint Generated according to the characteristics of the SDK, such as the Android ID of Android.
  • Container fingerprint The SDK may run into a container such as Docker.
  • the container fingerprint can be the id of the container or the process ID of the Daemon.
  • System fingerprint fingerprint of the operating system, such as machine_id of Linux system, system activation code under Windows system, registry information, etc.
  • Hardware fingerprint hardware information, such as the serial number of the central processing unit (Central Processing Unit, CPU), hard disk, motherboard, graphics processing unit (Graphics Processing Unit, GPU), etc., or the read-only memory (Read-Only Memory) of the chip , ROM) information, etc.
  • CPU central processing unit
  • CPU central processing unit
  • hard disk hard disk
  • motherboard graphics processing unit
  • GPU Graphics Processing Unit
  • Read-Only Memory Read-Only Memory
  • External fingerprint information of external devices, such as dongle, hardware lock, etc.
  • Multi-factor fingerprint comprehensively consider software, hardware, system and other factors to generate relevant fusion fingerprints.
  • the above information represents the software and hardware feature information of the environment where the licensed terminal is located. Specifically, which or several kinds of fingerprints are used as environmental fingerprints can be preset by the user, and the fingerprints are obtained according to a preset method when acquiring the first environmental fingerprint information. That's it.
  • the first environment fingerprint can be encrypted with the private key to obtain the first environment ciphertext, and the first environment ciphertext and the public key can be carried in the registration information and sent to the License side.
  • the registration information may be sent to the licensor in an offline or other secure manner.
  • the private information (first environment fingerprint) of the licensee is sent to the licenser in the form of ciphertext (the first environment ciphertext), and the licenser cannot decrypt the first environment ciphertext, it can prevent the licensee from In the process of transmission, the private information may be leaked at the license end, thereby preventing the security of the license end from being threatened by malicious use of the private information of the license end, and achieving the technical effect of improving the security of the license end.
  • step 202 After sending the registration information to the licensor, step 202 can be executed.
  • Step 202 Receive the license ciphertext generated based on the registration information provided by the license terminal; wherein, the license ciphertext is that the license terminal encrypts the license information containing the first environment ciphertext with the public key, and performs the same procedure on the encrypted license information. obtained by state encryption.
  • the license is transmitted in the form of cipher text, so it is the license cipher text
  • the licensee may It is also necessary to provide an activation code to the licenser (in this disclosure, the activation code is transmitted in the form of ciphertext, so it is the activation ciphertext):
  • the licensed terminal Before receiving the license cipher text sent by the licensing terminal, if the licensed terminal is a Chinese character recognition application, when installing the Chinese character recognition application, the user is also required to input an activation code, and the Chinese character recognition application generates the corresponding activation cipher text according to the activation code; or , the Chinese character recognition application needs to restart the system after the installation is completed.
  • a dialog box of the Chinese character recognition application is provided to require the user to input an activation code, so that the Chinese character recognition application can generate the corresponding activation cipher text according to the activation code, which is
  • the license terminal Choinese character recognition application
  • the licensee receives the license ciphertext, which can be received offline or online.
  • step 203 can be executed.
  • Step 203 Generate a verification request including the license ciphertext, the second environment ciphertext, and the public key; wherein the second environment ciphertext is obtained by encrypting the currently obtained second environment fingerprint with the public key, and the second environment fingerprint includes Information about the software and hardware characteristics of the environment where the licensee is located.
  • the licensed terminal After receiving the license ciphertext, the licensed terminal obtains the current second environment fingerprint in the same way as obtaining the first environment fingerprint, and encrypts the second environment fingerprint with the public key to obtain the second environment ciphertext. And generate a verification request including the license ciphertext, the second environment ciphertext, and the public key.
  • steps 204 and 205 can be executed.
  • Step 204 Send the verification request to the verification terminal, so that the verification terminal verifies the first environment ciphertext in the license ciphertext through the second environment ciphertext to determine the authenticity of the license ciphertext, and receives the verification result ciphertext sent by the verification terminal.
  • the process of verifying the license ciphertext by the authenticating end please refer to the description in the corresponding method of the authenticating end.
  • Step 205 Decrypt the ciphertext of the verification result with the public key to obtain the verification result, so as to decide whether to perform license authentication on the locally stored service to be licensed according to the verification result.
  • the licensed end sends the verification request to the authenticating end, so that the authenticating end verifies the authenticity of the license ciphertext (for the specific verification process, please refer to the introduction in the authenticating end), the licensed end receives the ciphertext of the verification result sent by the authenticating end, and uses The public key decrypts the ciphertext of the verification result, and the verification result is obtained.
  • the licensed end performs license authentication for the licensed service according to the license information; when the verification result is that the ciphertext of the license is false, the licensee The license end discards the license ciphertext, and re-initiates a license request to the license end, and repeats the above verification process.
  • the licensed end encrypts the fingerprint of the first environment and sends it to the license end, so that the license end can use the public key provided by the license end to perform homomorphic encryption on the license information including the ciphertext of the first environment, and receive the license ciphertext, and let the verifier end
  • the authenticity of the license ciphertext is determined by verifying the first environment ciphertext in the license ciphertext through the second environment ciphertext. In the whole process, neither the licensee nor the licensee can obtain the private information (first environment fingerprint) of the licensee. It enables the users of the licensed end to flexibly reuse their own security key system and strategy, and the private key is saved by the licensed end, thereby improving the security of the licensed end.
  • this method puts more security controllability on the verification side and the license side as much as possible, which is naturally friendly to the hierarchical protection rules and reduces the cost of implementing the hierarchical protection evaluation of the product.
  • an embodiment of the present disclosure provides a method for license authentication, which is applied to a verification end, and the method includes:
  • Step 301 Receive the verification request sent by the licensee; wherein, the verification request is generated by the licensee based on the license ciphertext, the second environment ciphertext, and the public key, and the license ciphertext is the licenser using the public key to contain the first environment.
  • the license information of the ciphertext is encrypted, and the encrypted license information is homomorphically encrypted.
  • the first environment ciphertext is obtained after the licensee uses the private key to encrypt the currently obtained first environment fingerprint.
  • the environment ciphertext is obtained by encrypting the currently obtained second environment fingerprint with the public key, and the first environment fingerprint includes the software and hardware characteristic information of the environment where the licensed end is located.
  • Both the first environment fingerprint and the second environment fingerprint include the software and hardware feature information of the environment where the licensee is located, but the time of acquiring the software and hardware feature information is different.
  • Step 302 Homomorphically decrypt the license ciphertext, obtain the first environment ciphertext from the homomorphically decrypted license ciphertext, verify the first environment ciphertext with the second environment ciphertext, and obtain the verification result ciphertext.
  • a verification terminal can be understood as a verification program, a verification plug-in, or an electronic device installed with a verification program or a verification plug-in, such as a mobile phone, a tablet computer, an advertising machine, a router, and the like.
  • the licensed side and the licensing side may be located in the same electronic device.
  • the homomorphic decryption of the license ciphertext by the verification end means that the license ciphertext is decrypted in an encrypted environment, which makes the verification end unable to actually know the specific content of the license ciphertext.
  • the purpose is to In order to determine whether the public key and private key used by them match, and then determine the authenticity of the first environment ciphertext, if the matching determines that the first environment ciphertext is true, the corresponding indication that the license ciphertext has not been tampered with, that is, the license ciphertext If it is true, otherwise it is false, so that the verification result in the encrypted environment can be obtained (because the verification result is in the encrypted environment at the verification end, so the output of the verification end is also output in the form of ciphertext, that is, this ciphertext of the verification results described in the publication).
  • This verification process can be called homomorphic verification.
  • Step 303 Send the ciphertext of the verification result to the licensed terminal, so that the licensed terminal decrypts the ciphertext of the verification result with the public key to obtain the verification result, so as to decide whether to perform license authentication on the service to be licensed in the licensed terminal according to the verification result .
  • the licensed terminal After the verification end sends the ciphertext of the verification result to the licensed terminal, the licensed terminal decrypts the ciphertext of the verification result with the public key to obtain the decryption result, and then determines the authenticity of the licensed ciphertext.
  • the license information obtained after the license ciphertext is used for license authentication of the license service; if the license ciphertext is determined to be false according to the decryption result, the license ciphertext is discarded, and a new license ciphertext is applied to the license terminal again.
  • the entire verification process is zero-decrypted, all verification operations are performed on the ciphertext, and the result is also returned in the form of ciphertext, so that the private information of the licensed end cannot be obtained at the verification end. (environmental fingerprint), and the license information of the license terminal, thereby improving the security of the license terminal and the license ciphertext. Since the whole verification process does not need to be decrypted, the complexity of multi-dimensional and multi-round encryption and decryption is greatly reduced, and the verification is improved. efficiency.
  • FIG. 4 a flowchart of license authentication interaction provided in an embodiment of the present disclosure.
  • the licensed end is a video application
  • the service to be licensed is watching a newly released movie A
  • the licensing end is a server
  • the authenticating end is a verification application.
  • Step 401 The licensed terminal generates registration information carrying the public key and the ciphertext of the first environment.
  • the user found a newly released movie A (licensed service) while using the video application (licensed end), and the user wanted to watch the movie A, so he performed a purchase operation on the movie in the video application, according to the
  • the purchase operation generates an authentication request for the movie A, which is used to request activation of the movie A.
  • the video application generates a key pair including a public key and a private key with a specified key algorithm, and stores it locally.
  • the first environment fingerprint of the environment where the video application is located is obtained, the first environment fingerprint is encrypted with the private key to obtain the first environment ciphertext, and the registration information is generated according to the first environment ciphertext and the public key.
  • Step 402 The licensed terminal sends registration information to the licensing terminal. That is, the video application sends registration information to the server.
  • Step 403 The license terminal generates license information including the ciphertext corresponding to the first environment, encrypts the license information with the public key, performs homomorphic encryption on the encrypted license information, and obtains the license ciphertext.
  • the server After the server (license end) receives the registration information, it obtains the first environment ciphertext and public key, and based on the attributes of the video application, purchase scope, etc. (these are also carried in the registration information, or if the video application corresponds to the server In this case, there is no need to carry the attributes of the video application), and the license information containing the first environment ciphertext is generated.
  • the scope of the license is determined to be Movie A, and the number of viewing times is one or unlimited, and screen projection can be performed. Watch, and only on one phone, one tablet, one desktop computer at the same time.
  • the server (license end) encrypts the license information with the public key, and also performs homomorphic encryption on the encrypted license information, and finally obtains the license ciphertext.
  • Step 404 The licensee generates a license request carrying the activation ciphertext.
  • step 403 and step 404 may also be interchanged, that is, step 404 may be performed first and then step 403 may be performed.
  • the server sends a corresponding activation code to the user's mobile phone after generating the license ciphertext
  • the video application obtains the activation code input by the user
  • the video application encrypts the activation code, obtains the activation ciphertext, and generates Permission request carrying the activation ciphertext.
  • Step 405 The licensee sends a license request to the licenser.
  • Step 406 The license terminal verifies whether the activation ciphertext is correct.
  • the result obtained is that the activation ciphertext is correct.
  • Step 407 When the licensor determines that the activation ciphertext is correct, it sends the license ciphertext to the licensee.
  • Step 408 The licensee generates a verification request including the public key, the license ciphertext, and the second environment ciphertext.
  • Step 409 The licensee sends a verification request to the verification terminal.
  • Step 410 The verification end performs homomorphic decryption on the license ciphertext, obtains the first environment ciphertext, and verifies the authenticity of the first environment ciphertext with the second environment ciphertext to obtain the verification result ciphertext.
  • Step 411 The authenticating end sends the ciphertext of the authentication result to the licensed end.
  • Step 412 The licensed terminal decrypts the ciphertext of the verification result with the public key, obtains the verification result, and determines whether to perform license authentication for the service to be licensed.
  • the video application decrypts the verification result with the locally stored private key, and obtains that the verification result is true, and accordingly decides to use the license ciphertext to perform license authentication for movie A.
  • an embodiment of the present disclosure provides a license authentication device, which is applied to the license terminal.
  • the license authentication method of the device please refer to the description of the method embodiment of the license terminal, and the repetition will not be repeated.
  • the device includes:
  • the obtaining unit 501 is configured to obtain registration information provided by the licensed terminal; wherein, the registration information includes the public key and the first environment ciphertext provided by the licensed terminal, and the first environmental ciphertext is the licensed terminal. obtained after the terminal encrypts the currently obtained first environment fingerprint with a private key, and the first environment fingerprint includes the software and hardware feature information of the environment where the licensed terminal is located;
  • An encryption unit 502 configured to generate license information including the first environment ciphertext, encrypt the license information with the public key, and perform homomorphic encryption on the encrypted license information to obtain the license ciphertext; wherein , the license information is used to indicate the license scope of the to-be-licensed service for which license authentication is requested in the licensee;
  • Transceiving unit 503 configured to send the license ciphertext to the licensed terminal, so that the licensed terminal determines the license ciphertext by verifying the first environment ciphertext in the license ciphertext by the verification terminal the authenticity of the license, and make the licensed terminal decide whether to perform license authentication on the service to be licensed in the licensed terminal according to the ciphertext of the received verification result.
  • the transceiver unit 503 is further configured to:
  • the license request carries the activation ciphertext of the to-be-licensed service; wherein, the activation ciphertext is used to identify and activate the to-be-licensed service;
  • the license ciphertext is sent to the licensee.
  • the algorithm used in the homomorphic encryption includes Paillier encryption or fully homomorphic encryption.
  • an embodiment of the present disclosure provides a license authentication apparatus, which is applied to a licensee.
  • a license authentication apparatus for the specific implementation of the license authentication method of the apparatus, please refer to the description of the method embodiment of the licensee, and the repetitions are repeated.
  • the device includes:
  • the transceiver unit 601 is used to send the registration information carrying the public key and the first environment ciphertext to the license terminal; wherein, the first environment ciphertext is obtained by encrypting the currently obtained first environment fingerprint with a private key , the first environment fingerprint is the software and hardware feature information of the environment where the licensed terminal is located;
  • the transceiver unit 601 is further configured to receive the license ciphertext generated based on the registration information provided by the license terminal; wherein, the license ciphertext is that the license terminal uses the public key pair to include the first
  • the license information of the environmental ciphertext is encrypted, and the encrypted license information is homomorphically encrypted;
  • a generating unit 602 configured to generate a verification request including the license ciphertext, the second environment ciphertext, and the public key; wherein the second environment ciphertext is to use the public key to pair the currently acquired second environment Obtained by encrypting the fingerprint, the second environment fingerprint includes the software and hardware feature information of the environment where the licensed end is located;
  • the transceiver unit 601 is further configured to send the verification request to a verification terminal, so that the verification terminal verifies the first environmental ciphertext in the permission ciphertext through the second environmental ciphertext to determine the License the authenticity of the ciphertext, and receive the ciphertext of the verification result sent by the verification end;
  • the processing unit 603 is configured to decrypt the ciphertext of the verification result with the public key to obtain the verification result, so as to decide whether to perform license authentication on the locally stored service to be licensed according to the verification result.
  • the transceiver unit 601 is further configured to:
  • a key pair containing the public key and the private key is generated using a specified key algorithm; wherein the authentication request is based on the user's information on the service to be licensed resulting from an activation operation;
  • the transceiver unit 601 is further configured to:
  • the license terminal After the license terminal passes the verification, the license ciphertext sent by the license terminal is received.
  • an embodiment of the present disclosure provides a license authentication apparatus, which is applied to a verification end.
  • the license authentication method of the apparatus please refer to the description of the method embodiment of the verification terminal, and the repetition will not be repeated.
  • the device includes:
  • a receiving unit 701 configured to receive a verification request sent by a licensee; wherein, the verification request is generated by the licensee based on a license ciphertext, a second environment ciphertext, and a public key, and the license ciphertext is a license
  • the terminal encrypts the license information containing the first environment ciphertext with the public key, and performs homomorphic encryption on the encrypted license information, and the first environment ciphertext is obtained by the licensed terminal using the private key pair Obtained by encrypting the currently obtained first environment fingerprint, the second environment ciphertext is obtained by encrypting the currently obtained second environment fingerprint using the public key by the licensed terminal, and the first environment fingerprint includes Software and hardware feature information of the environment where the licensed terminal is located;
  • a verification unit 702 configured to perform homomorphic decryption on the license ciphertext, obtain the first environment ciphertext from the homomorphically decrypted license ciphertext, and verify the first environment with the second environment ciphertext Ciphertext, obtain the ciphertext of the verification result;
  • the sending unit 703 is configured to send the ciphertext of the verification result to the licensed terminal, so that the licensed terminal decrypts the ciphertext of the verification result with the public key to obtain the verification result, so that the licensed terminal can obtain the verification result by decrypting the ciphertext of the verification result with the public key.
  • the service to be licensed in the license is authenticated.
  • an embodiment of the present disclosure provides a server, where the server includes a license authentication device corresponding to the license terminal as described above.
  • an embodiment of the present disclosure provides an electronic device, where the electronic device includes the above-mentioned apparatuses for license authentication corresponding to a licensed end and a verification end.
  • the electronic device can be a display terminal such as an advertisement publishing machine, an art screen product, a mobile phone, a tablet device, etc., and can be used to publish multimedia information (text, pictures, videos, etc.).
  • the electronic device can also be applied to industries such as new media and smart retail.
  • an embodiment of the present disclosure provides a system for license authentication, where the system includes the above-mentioned device for license authentication.
  • an embodiment of the present disclosure provides an apparatus for license authentication, including: at least one processor, and
  • a memory connected to the at least one processor
  • the memory stores instructions executable by the at least one processor, and the at least one processor executes the above-mentioned license authentication method by executing the instructions stored in the memory.
  • an embodiment of the present disclosure also provides a readable storage medium, including:
  • the memory is used to store instructions that, when executed by the processor, cause an apparatus including the readable storage medium to complete the method of license authentication as described above.
  • embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, embodiments of the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, CD-ROM, optical storage, and the like.
  • Embodiments of the present disclosure are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.
  • These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions
  • the apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Technology Law (AREA)
  • Multimedia (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Abstract

一种许可认证的方法、装置、电子设备、系统及存储介质，方法包括：获取被许可端提供的注册信息；其中，注册信息包括被许可端提供的公钥和第一环境密文，第一环境密文是被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，第一环境指纹包括被许可端所在环境的软硬件特征信息(101)；生成包含第一环境密文的许可信息，并用公钥对许可信息进行加密，对加密后的许可信息进行同态加密，获得指示被许可端中请求许可认证的待许可服务许可范围的许可密文(102)；将许可密文发送给被许可端，使被许可端通过验证端验证第一环境密文来确定许可密文的真伪，并使被许可端据接收到的验证结果密文决定是否对待许可服务进行许可认证(103)。

Description

一种许可认证的方法、装置、电子设备、系统及存储介质 技术领域
本公开涉及许可认证领域，尤其是涉及一种许可认证的方法、装置、电子设备、系统及存储介质。
背景技术
在现有技术中，软件服务商在向用户提供软件服务时，为了保护软件版权，通常通过软件许可证的方式向用户提供其软件许可的范围、使用期限等。
然而在服务商向用户提供软件许可证前，通常需要先收集用户信息、用户所用设备的环境信息等，这些敏感的用户私有信息在传输给服务商时常常是以明文的方式传输的，且服务商在获取到这是用户私有信息后通常也是以明文的形式存储的，当用户的这些用户私有信息被盗用后，将给用户造成极大的损失。
发明内容
本公开提供一种许可认证的方法、装置、电子设备、系统及存储介质，用以解决现有技术中存在的上述技术问题。
第一方面，为解决上述技术问题，本公开实施例提供的一种许可认证的方法，应用于许可端，该方法的技术方案如下：
获取被许可端提供的注册信息；其中，所述注册信息包括所述被许可端提供的公钥和第一环境密文，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
生成包含所述第一环境密文的许可信息，并用所述公钥对所述许可信息进行加密，对加密后的许可信息进行同态加密，获得许可密文；其中，所述许可信息用于指示所述被许可端中请求许可认证的待许可服务的许可范围；
将所述许可密文发送给所述被许可端，使所述被许可端通过验证端验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并使所述被许可端各根据接收到的验证结果密文决定是否对所述被许可端中的待许可服务进行许可认证。
一种可能的实施方式，将所述许可密文发送所述被许可端之前，还包括：
接收所述被许可端发送的许可请求；其中，所述许可请求中携带所述待许可服务的激活密文；其中，所述激活密文用于标识激活所述待许可服务；
验证所述激活密文是否正确；
在确定所述激活密文正确时，将所述许可密文发送给所述被许可端。
一种可能的实施方式，所述同态加密使用的算法包括Paillier加密或全同态加密。
第二方面，本公开实施例提供了一种许可认证的方法，应用于被许可端，包括：
将携带有公钥和第一环境密文的注册信息发送给许可端；其中，所述第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
接收所述许可端提供的基于所述注册信息生成的许可密文；其中，所述许可密文是所述许可端用所述公钥对包含所述第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的；
生成包含所述许可密文、第二环境密文、所述公钥的验证请求；其中，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第二环境指纹包括所述被许可端所在环境的软硬件特征信息；
将所述验证请求发送给验证端，使所述验证端对用所述第二环境密文验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并接收所述验证端发送的验证结果密文；
用所述公钥对所述验证结果密文进行解密，获得验证结果，以便根据所述验证结果决定是否对本地存储的待许可服务进行许可认证。
一种可能的实施方式，将携带有公钥和第一环境密文的注册信息发送给许可端，包括：
在接收到所述待许可服务的认证请求时，用指定密钥算法生成包含所述公钥和所述私钥的密钥对；其中，所述认证请求是基于用户对所述待许可服务的激活操作产生的；
获取所述第一环境指纹，并用所述私钥对所述第一环境指纹进行加密，获得所述第一环境密文；
将携带有所述公钥和所述第一环境密文的所述注册信息发送给所述许可端。
一种可能的实施方式，接收所述许可端提供的基于所述注册信息的许可密文之前，还包括：
将携带有激活密文的许可请求发送给所述许可端，使所述许可端对所述激活密文的真实性进行验证；其中，所述激活密文用于标识激活所述待许可服务；
在所述许可端验证通过后，接收所述许可端发送的所述许可密文。
第三方面，本公开实施例提供了一种许可认证的方法，应用于验证端，该方法包括：
接收被许可端发送的验证请求；其中，所述验证请求是所述被许可端基于许可密文、第二环境密文、公钥生成的，所述许可密文是许可端用所述公钥对包含第一环境密文的许可信息进行加密，并对加密后的许可信息进行同态加密得到的，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
对所述许可密文进行同态解密，并从同态解密后的许可密文中获取所述第一环境密文，用所述第二环境密文验证所述第一环境密文，获得验证结果密文；
将所述验证结果密文发送给所述被许可端，使所述被许可端用公钥对所述验证结果密文进行解密得到验证结果，以便根据所述验证结果决定是否对所述被许可端中的待许可服务进行许可认证。
第四方面，本公开实施例提供了一种许可认证的装置，应用于许可端，该装置包括：
获取单元，用于获取被许可端提供的注册信息；其中，所述注册信息包括所述被许可端提供的公钥和第一环境密文，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
加密单元，用于生成包含所述第一环境密文的许可信息，并用所述公钥对所述许可信息进行加密，以及对加密后的许可信息进行同态加密，获得许可密文；其中，所述许可信息用于指示所述被许可端中请求许可认证的待许可服务的许可范围；
收发单元，用于将所述许可密文发送给所述被许可端，使所述被许可端通过验证端验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并使所述被许可端根据接收到的验证结果密文决定是否对所述被许可端中的待许可服务进行许可认证。
一种可能的实施方式，所述收发单元还用于：
接收所述被许可端发送的许可请求；其中，所述许可请求中携带所述待许可服务的激活密文；验证所述激活密文是否正确；其中，所述激活密文用于标识激活所述待许可服务；
在确定所述激活密文正确时，将所述许可密文发送给所述被许可端。
一种可能的实施方式，所述同态加密使用的算法包括Paillier加密或全同态加密。
第五方面，本公开实施例提供了一种许可认证的装置，应用于被许可端，该装置包括：
收发单元，用于将携带有公钥和第一环境密文的注册信息发送给许可端； 其中，所述第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹为所述被许可端所在环境的软硬件特征信息；
所述收发单元，还用于接收所述许可端提供的基于所述注册信息生成的许可密文；其中，所述许可密文是所述许可端用所述公钥对包含所述第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的；
生成单元，用于生成包含所述许可密文、第二环境密文、所述公钥的验证请求；其中，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第二环境指纹包括所述被许可端所在环境的软硬件特征信息；
所述收发单元，还用于将所述验证请求发送给验证端，使所述验证端通过所述第二环境密文验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并接收所述验证端发送的验证结果密文；
处理单元，用于用所述公钥对所述验证结果密文进行解密，获得验证结果，以便根据所述验证结果决定是否对本地存储的待许可服务进行许可认证。
一种可能的实施方式，所述收发单元还用于：
在接收到所述待许可服务的认证请求时，用指定密钥算法生成包含所述公钥和所述私钥的密钥对；其中，所述认证请求是基于用户对所述待许可服务的激活操作产生的；
获取所述第一环境指纹，并用所述私钥对所述第一环境指纹进行加密，获得所述第一环境密文；
将携带有所述公钥和所述第一环境密文的所述注册信息发送给所述许可端。
一种可能的实施方式，所述收发单元还用于：
将携带有激活密文的许可请求发送给所述许可端，使所述许可端对所述激活密文的真实性进行验证；其中，所述激活密文用于标识激活所述待许可服务；
在所述许可端验证通过后，接收所述许可端发送的所述许可密文。
第六方面，本公开实施例提供了一种许可认证的装置，应用于验证端，该装置包括：
接收单元，用于接收被许可端发送的验证请求；其中，所述验证请求是所述被许可端基于许可密文、第二环境密文、公钥生成的，所述许可密文是许可端用所述公钥对包含第一环境密文的许可信息进行加密，并对加密后的许可信息进行同态加密得到的，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
验证单元，用于对所述许可密文进行同态解密，并从同态解密后的许可密文中获取所述第一环境密文，用所述第二环境密文验证所述第一环境密文，获得验证结果密文；
发送单元，用于将所述验证结果密文发送给所述被许可端，使所述被许可端用公钥对所述验证结果密文进行解密得到验证结果，以便对所述被许可端中的待许可服务进行许可认证。
第七方面，本公开实施例提供了一种服务器，应用于许可端，该服务器包括如第四方面所述的装置。
第八方面，本公开实施例提供了一种电子设备，该电子设备包括如第五方面和第六方面所述的装置。
第九方面，本公开实施例还提供一种认证许可的装置，包括：
至少一个处理器，以及
与所述至少一个处理器连接的存储器；
其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如第一方面或第二方面或第三方面所述的方法。
第十方面，本公开实施例还提供一种可读存储介质，包括：
存储器，
所述存储器用于存储指令，当所述指令被处理器执行时，使得包括所述可读存储介质的装置完成如上述第一方面或第二方面或第三方面所述的方法。
附图说明
图1为本公开实施例提供的一种应用于许可端的许可认证方法的流程图；
图2为本公开实施例提供的一种应用于被许可端的许可认证方法的流程图；
图3为本公开实施例提供的一种应用于验证端的许可认证方法的流程图；
图4为本公开实施例提供的许可认证交互流程图；
图5为本公开实施例提供的一种应用于许可端的许可认证装置的结构示意图；
图6为本公开实施例提供的一种应用于被许可端的许可认证装置的结构示意图；
图7为本公开实施例提供的一种应用于验证端的许可认证装置的结构示意图。
具体实施方式
本公开实施列提供一种许可认证的方法、装置、电子设备、系统及存储介质，以解决现有技术中存在的上述技术问题。
如公开中所使用的术语“同态”，是指一些密码系统的性质，其使得计算机化的系统能够通过使用经加密的密文数据来执行操作，所述经加密的密文数据在解密之后产生明文结果，所述明文结果与相同操作如果被应用到明文数据的结果相匹配。如具有加法同态的密码系统，其使得计算机能够将两个密文a和b加在一起以产生结果密文c。当结果密文c被解密后产生明文值，该明文值与以a和b加密的明文数据的总和相匹配。例如，如果a和b是分别对值2和3进行加密的密文，那么结果密文c当被解密的时候产生值5(2+3＝5)。接收原始密文a和b的计算机可以在未曾对原始经加密的输入a和b中 的任一个进行解密或不要求对任何密码密钥的访问的情况下、经由原始密文的直接加法来产生密文c。
密码系统的同态性：在一种密码系统中，如果密文空间中的密文操作(如加、乘)可以映射到明文空间中，那么称该密码系统具有同态性。利用同态密码系统进行加密，我们称之为同态加密。
在非对称型密码系统的密钥包括公钥和私钥，非对称型的同态性应用极为广泛，如RSA算法、Paillier算法等。
也就是说，同态加密(Homomorphic Encryption，HE)是基于数学难题的计算复杂性理论的密码学技术。对经过同态加密的数据进行处理得到一个输出，将这一输出进行解密，其结果与用同一方法处理未加密的原始数据得到的输出结果是一样的。利用此性质，其他人可以对加密数据进行处理，但是处理过程不会泄露任何原始内容。同时，拥有密钥的用户对处理过的数据进行解密后，得到的正好是处理后的结果。
同态加密技术分为两种类型，半同态(或称为部分同态)加密(Somewhat Homomorphic Encryption，SWHE)和全同态加密(Fully Homomorphic Encryption，FHE)。
其中，全同态加密能在密文空间中完成任意复杂度函数的计算，但计算成本高、性能极差、原理复杂，比如典型的BGV算法。半同态加密只支持一些特定的操作函数。尽管SWHE方案稍弱，但也意味着计算开销会变得较小，容易实现，现在已经可以在实际中使用。
同态的数学含义：假设有个加密函数(定义为E)满足：
E(a)+E(b)＝E(a+b)；
E(a)*E(b)＝E(a*b)；
如上述两个方程都满足就叫全同态，满足其中之一就是半同态。
假设存在操作函数F，
如果F(a)＝x D(x)＝a；
整个加密E和解密D就是全同态加密。
为了更好的理解上述技术方案，下面通过附图以及具体实施例对本公开技术方案做详细的说明，应当理解本公开实施例以及实施例中的具体特征是对本公开技术方案的详细的说明，而不是对本公开技术方案的限定，在不冲突的情况下，本公开实施例以及实施例中的技术特征可以相互组合。
请参考图1，本公开实施例提供一种许可认证的方法，应用于许可端，该方法的处理过程如下。
步骤101：获取被许可端提供的注册信息；其中，注册信息包括被许可端提供的公钥和第一环境密文，第一环境密文是被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，第一环境指纹包括被许可端所在环境的软硬件特征信息。
许可端可以是服务器，被许可端可以是电子设备中的一个软件，该软件可以是应用软件，如即时通讯软件、播放软件、办公软件、广告机软件等，该软件还可以是操作系统，如windows系统、OS系统、安卓系统、广告机的操作系统等。
当用户需要使用被许可端中的某个服务，而该服务尚未授权前称之为待许可服务，被许可端会可以采用指定密钥算法生成包括公钥和私钥的密钥对，并用私钥对获取的第一环境指纹进行加密，得到第一环境密文，进而生成一个包括公钥和第一环境密文的注册信息发送给许可端，其中，第一环境指纹包括被许可端所在环境的软硬件特征信息。
例如，被许可端为电子设备中的一个视频播放应用，用户当前为该视频播放应用的普通用户，在之后某个时间，用户希望成为该视频播放应用的VIP用户，此时根据用户的操作，产生一个提供VIP服务(即待许可服务)的认证请求，视频播放应用拥指定密钥算法生成包含公钥和私钥的密钥对，并获取第一环境指纹，用私钥对第一环境指纹进行加密得到第一环境密文，根据 第一环境密文和公钥生成注册信息发送给服务器(即许可端)。
在注册信息中还可以包括待许可服务对应的购买信息，如购买的服务是什么、购买该服务的时效对应的是什么、该服务对应的是什么等级。如待许可服务为VIP服务时，而VIP服务的等级例如可以分为黄金VIP、钻石VIP、超级VIP，有效时间例如可以分为1个月、3个月、6个月、1年、终身等，这些信息都可以作为购买信息。当然，根据被许可端、待许可服务的类型不同，注册信息中也可以不包括上述购买信息，如一些绿色软件、政企服务类软件(如社保类软件、浏览器等)。即在注册信息中包括的内容可以根据实际需要自由设置。
需要说明的是，待许可服务还可以是一个具体的多媒体信息，包括视频、图片等。如被许可端为播放软件是待许可服务可以是一个单独的视频资源(如一部新上映需要单独付费的影片、云展览、直播、音乐等)；若待许可端为操作系统，待许可服务可以理解为申请该操作系统的许可证的服务。
被许可端可以通过离线、在线的方式，或其它安全的方式将注册信息发送给许可端。
许可端接收到被许可端发送的注册信息后，便可执行步骤102和步骤103。
步骤102：生成包含第一环境密文的许可信息，并用公钥对许可信息进行加密，对加密后的许可信息进行同态加密，获得许可密文；其中，许可信息用于指示被许可端中请求许可认证的待许可服务的许可范围。
步骤103：将许可密文发送给被许可端，使被许可端通过验证端验证许可密文中的第一环境密文来确定许可密文的真伪，并使被许可端根据接收到的验证结果密文决定是否对被许可端中的待许可服务进行许可认证。
由于同态加密中引入了随机的噪声，所以加密结果的逆向工程理论存在可能性，最大限度保证了在传输链路的安全。
在本公开中，验证端可以理解为一个验证程序、验证插件，或者安装有验证程序、验证插件的电子设备，该电子设备例如可以为手机、平板电脑、广告机、路由器、智能音箱、可穿戴设备等。被许可端和许可端可以位于同 一电子设备中。
许可端接收到注册信息后，根据其内容可以生成包含第一环境密文的许可信息，该许可信息可以表明待许可服务的许可范围，许可范围例如可以包括许可的时长、服务的具体内容，允许使用的设备类型、设备的最大数量等。
例如，仍然以被许可端为视频播放软件、待许可服务为VIP服务为例，许可信息中除了包括第一环境密文外，还包括该VIP服务的有效时间(如为1年)，服务范围如可以自由观看所有连续剧、但不能观看新上映的电影或其它需要单独付费的影片，或者可以自由观看所有连续剧和电影，但不包括其它需要单独付费的影片等。
又如，被许可端为广告机软件，待许可服务为某条广告的播放服务，许可范围可以为该条广告的播放时段(如在12点播放)、播放时长为30秒不间断连续播放等。
许可端可以根据第一环境密文信息、待许可服务对应软件(即待许可端)的属性信息，如产品标识(产品ID)、产品的系列、产品类型、名字、版本等(请参见表1)、待许可服务的许可范围等生成许可信息，并用公钥对许可信息进行加密，得到加密后的许可信息，同时对加密后的许可信息进行同态加密，获得许可密文。
表1
属性键 属性值
许可ID license01
产品ID sku-001-1001
产品类型 retail-order-promising
… …
同态加密的公式可以采用如下的表达方式：
C1＝HE(PK，Data)；
其中，PK为被许可端提供的公钥，Data为许可信息，HE为同态加密使用的算法，即用公钥(PK)对许可信息(Data)进行加密，并对加密后的许 可信息进行同态加密，得到同态加密结果(C1)，该同态加密结果即为本公开中所述的许可密文。
同态加密的算法可以包括pailler加密算法，全同态加密算法(如IBM fhe-toolkit-linux)。
对于一些应用(如操作系统或工具类应用)而言，要得到待许可服务的许可证(本公开中传递许可证是以密文的形式传递的，因此为许可密文)，被许可端可能还需要向许可端提供激活码(本公开中传递激活码是以密文的形式传递的，因此为激活密文)：
当许可端接收到被许可端发送的许可请求后，验证激活密文是否正确；其中，许可请求中携带待许可服务的激活密文；在确定激活密文正确时，将许可密文发送给被许可端；其中，激活密文用于标识激活待许可服务；。
例如，被许可端为操作系统时，安装完该系统重启后进行系统初始化时，弹出要求用户输入激活码的对话框，操作系统基于用户操作获取激活码并对其进行加密得到激活密文，进而根据该激活密文生成许可请求并发送给服务器(许可端)，发送方式可以是离线发送，也可以是在线发送，许可端通过对该激活密文进行验证计算(如与许可端本地存储的激活密文进行比较，或采用某种算法对该激活密文进行计算得到一个结果)，可以确定该激活密文的真伪，许可端在确定激活密文为正确的时，将许可密文发送给被许可端，使被许可端可以通过验证端验证许可密文的真伪(验证端的验证过程在后续验证端对应的方法中进行详细介绍)，以便根据验证结果决定是否对被许可端中的待许可服务进行许可认证。若验证结果为验证通过，则被许可端对待许可服务进行许可认证，否则放弃待许可服务进行许可认证。
许可端在接收到许可密文后会生成一个许可请求，该许可请求中携带许可密文及第二环境密文，该第二环境密文是用公钥对刚获取的第二环境指纹进行加密后得到的，许可端将许可请求发送给验证端验证许可密文中第一环境指纹，以确定许可密文的真伪，如通过验证第一环境指纹是否为真来确定许可密文是否为真，许可端验证第一环境密文的真伪是在加密环境下对第一 环境密文和第二环境密文进行同态运算，以确定私钥和公钥是否匹配来确定第一环境密文的真伪的。
许可端仅需获取被许可端提供的公钥和第一环境密文，便能生成包含第一环境密文的许可信息，并通过用公钥对许可信息进行同态加密，让许可端在未获取到第一环境密文中第一环境指纹的情况下，便能生成许可密文，使得任何人在许可端都无法越权滥用或窥探被许可端的私有信息(第一环境指纹)，从而提高了被许可端私有信息的安全性，并且由于许可密文是通过同态加密得到的，因此还减小了许可端计算的复杂性，防止许可信息在传输的过程中被恶意破解，提高了许可信息的安全性。
在从许可端侧介绍了许可认证的方法后，下面将从被许可端所在侧介绍在其中使用的许可认证方法。
请参见图2，基于同一发明构思，本公开一实施例中提供一种许可认证的方法，应用于被许可端，该方法包括：
步骤201：将携带有公钥和第一环境密文的注册信息发送给许可端；其中，第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，第一环境指纹包括被许可端所在环境的软硬件特征信息。
例如，被许可端为电子设备中的一个即时通讯类应用，用户当前为即时通讯类应用的普通用户，在之后某个时间，用户希望成为该即时通讯类应用的VIP用户，此时根据用户的操作，产生一个提供VIP服务(即待许可服务)的认证请求，即时通讯类应用用指定密钥算法生成包含公钥和私钥的密钥对，并获取第一环境指纹，用私钥对第一环境指纹进行加密得到第一环境密文，根据第一环境密文和公钥生成注册信息发送给服务器(即许可端)。
在注册信息中还可以包括待许可服务对应的购买信息，如购买的服务是什么、购买该服务的时效对应的是什么、该服务对应的是什么等级。如待许可服务为VIP服务时，而VIP服务的等级例如可以分为黄金VIP、白金VIP、钻石VIP，有效时间例如可以分为3个月、6个月、1年等，这些信息都可以作为购买信息。当然，根据被许可端、待许可服务的类型不同，注册信息中 也可以不包括上述购买信息，如一些绿色软件、政企服务类软件(如税务软件、金融类软件、购物软件等)。即在注册信息中包括的内容可以根据实际需要自由设置。
需要说明的是，待许可服务还可以是一个具体的多媒体信息，包括视频、图片等。如被许可端为播放软件是待许可服务可以是一个单独的视频资源(如一部新上映需要单独付费的影片、云展览、直播等)；若待许可端为操作系统，待许可服务可以理解为申请该操作系统的许可证的服务，或者该操作系统中的某个应用。
将携带有公钥和第一环境密文的注册信息发送给许可端，可以通过下列方式实现：
在接收到待许可服务的认证请求时，用指定密钥算法生成包含公钥和私钥的密钥对；获取第一环境指纹，并用私钥对第一环境指纹进行加密，获得第一环境密文；将携带有公钥和第一环境密文的注册信息发送给许可端。
指定密钥算法可以是用户、企业根据自己内部的政策和安全策略，选择的非对称密钥生产算法和相关的位数要求，如经典的RSA算法、椭圆曲线密码学(elliptic curve cryptography，ECC)、椭圆曲线数字签名算法(Elliptic Curve Digital Signature Algorithm，ECDSA)、国密算法SM2等。
例如，典型的RSA 2048位的公私钥的密钥对PEM(Privacy Enhanced Mail)格式的样例：
公钥：
----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzB5DdsN4x+HdgSxYgFkx
tITcIlAyivoGaoRkQMCAtJORhxtu5HZI5x4t67nJSh6uq8YVzdqYulu2Zzx5UMrmjjSjICXcZ3Kn/I+We45+IKDswkMrDq3p6nfsoQvLH9hNPsnkWz7+fiDvQGWECtko
aRBxB4u5AR63vLgf6o1AcePPX97VaHMF1l8ESqBcirgiZBTTNizSB4kVGk+ak kjk
lOEzARWnoBYHItl8Jq5Uwh2Bk2EhHI6FOyuz9rRDgJGhh4SYgpRfsvuOfUgCCDoF
jAiKPEdtL+KIR1zizxrP9ZWOzWSU7ypNCmfkqc7kswzKwGIW1iUu6KczYovz62k+
BQIDAQAB-----END PUBLIC KEY-----
私钥：
----BEGIN PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQDMHkN2w3jH4d2B
LFiAWTG0hNwiUDKK+gZqhGRAwIC0k5GHG27kdkjnHi3ruclKHq6rxhXN2pi6W7Zn
PHlQyuaONKMgJdxncqf8j5Z7jn4goOzCQysOrenqd+yhC8sf2E0+yeRbPv5+IO9A
ZYQK2ShpEHEHi7kBHre8uB/qjUBx489f3tVocwXWXwRKoFyKuCJkFNM2LNIHiRUa
T5qSSOSU4TMBFaegFgci2XwmrlTCHYGTYSEcjoU7K7P2tEOAkaGHhJiClF+y+459
SAIIOgWMCIo8R20v4ohHXOLPGs/1lY7NZJTvKk0KZ+SpzuSzDMrAYhbWJS7opzNi
i/PraT4FAgMBAAECggEBAK4Buqd7GfLkBI3C/StlXi8y9+q0jXHWlTOm60QcF1xZ
VL1l0JIomBuWqbUDq6ppH6TF9/6GNJ7h4kx9zDnozsU58DpOrGbv4m83BSUNo04z
gcJVulYIQpokY/AieqYKIke9mtOCjzd84hj2sasB1yZB4ul43l0rD51tJaAxjFfJQ9Z3J6zwpZA0ePgp/DHG50KzZNXZcRL+qPAenE7iXBn2vfDh88GKFm1pekQ203jJ
Of/MXXnFEUcRVn95jB9TcL/BnmglnEJkzKLM/7HSHS89R9EjTAcHzL+crjb/cWKx
PPAC3Gco2zWfr/w4rup6DGYqkoD8B7hFDEktC0ENX10CgYEA8Ietek7mCSq0 RzVL
NA41GHtJSa6GHeS/FNzpw8FBbcDh1HV2QtA6nd9gxPX4m3c6IM5LStBZnQwAONQ4
RETj8hw9zu5b1UTWDISnHhEtguUAaDjI+sTrgkwXV3OvMxACCuV0UJ/YV8r64TRP
SNh+1HF5ewJmmEfrPBAK9c3NA58CgYEA2T8RDj9iUNO0oXM3axpMNDfX4QsPsweT
sGWc4L+TyIkVsHwuaKr4tHtXlDdV0PmPoGI6dy0fm+LkgWnBP7RbHCljXGa3KXVQ
DrDXdisfC406QbhefYOorvNvKQQ7mp0/rpZrIXG2alHF8hRNsLTTRuAKA5nemJZw
cMtCodleu9sCgYEArffkIEd6l/y8IZjJSOBRxOA+1L0XIf31urhBl6VqlmBgtlMy8wY6rz8Gdc7WPlPQxjOPP5BMkItCidfszmvpVo7YoZfC8hD0pF85pESWX0sUrU0N
CFtvX3F7nHP+rvcQEyN8qmfCiVU1ebdk9PIpYaylSbQl0lSKLooH81sjwk8CgYEA
u65aY76qhz1+bYSGOgcMEoiz/f16YKaJFvmSIDAh0jtr+34s8cvS9MkiDjAH+XPA
e0ShUdgv2JKZ6puckhaUJ64x4t/yGOT6dtacLcBvH6Gw1JodN74IeqxgOkUn4Rk8
rO3SO6BrgUqIAe08eQ6fADoJLLc/sP82wJs5Q23xA8UCgYEA10cRaeoksBFTME7i
qiC61ESgbgsOoqvOyGCvoOWTJqV0telwP0LLxk12D29995SKnPWpSipb6C8ARWsZ
Df3QFM77+slAW+pDqrzv6sDvyDvpalMaIDi5bTS+fqdn7DLkGl6PzoYcOljlGViP
0RFwybAnyj/ulI47NoL3jZKq+hI＝
-----END PRIVATE KEY-----
被许可端的环境指纹包括：
软件开发工具包(Software Development Kit，SDK)指纹：根据SDK的 特点，比如Android的Android ID生成。
容器指纹：SDK可能运行到Docker等容器里，容器指纹可以采用容器的id，或者Daemon的进程ID。
系统指纹：操作系统的指纹，比如Linux系统的machine_id，Windows系统下的系统激活码，注册表信息等。
硬件指纹：硬件的信息，比如中央处理器(Central Processing Unit，CPU)、硬盘、主板、图形处理器(Graphics Processing Unit，GPU)等的序列号，或者是芯片的只读存储器(Read-Only Memory，ROM)信息等。
外置指纹：外置设备的信息，比如加密狗，硬件锁等。
多因素指纹：综合考虑软件，硬件，系统等因素，生成相关的融合指纹。
上述这些信息表征被许可端所在环境的软硬件特征信息，具体由上述哪种或几种指纹作为环境指纹可以由用户预先设定，在获取第一环境指纹信息时根据预先设定的方式获取指纹即可。
通过上述方式获得密钥对以及第一环境指纹后，便可用私钥对第一环境指纹进行加密，获得第一环境密文，并将第一环境密文以及公钥携带在注册信息中发送给许可端。该注册信息可以离线或其它安全的方式发送给许可端。
由于被许可端的私有信息(第一环境指纹)是以密文(第一环境密文)的形式发送给许可端的，且许可端不能对该第一环境密文进行解密，从而能够防止被许可端的私有信息在传输的过程中，或在许可端被泄露，进而防止通过恶意使用被许可端的私有信息威胁被许可端的安全，实现提高被许可端安全性的技术效果。
在发送注册信息给许可端之后，便可执行步骤202。
步骤202：接收许可端提供的基于注册信息生成的许可密文；其中，许可密文是许可端用公钥对包含第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的。
对于一些应用(如操作系统或工具类应用)而言，要得到待许可服务的许可证(本公开中传递许可证是以密文的形式传递的，因此为许可密文)，被 许可端可能还需要向许可端提供激活码(本公开中传递激活码是以密文的形式传递的，因此为激活密文)：
在接收许可端发送的许可密文之前，如被许可端为汉字识别应用，在安装该汉字识别应用时，还需要用户输入激活码，汉字识别应用根据该激活码生成对应的激活密文；或者，该汉字识别应用在安装完成后需要重启系统，在重启系统进行系统初始化时，提供汉字识别应用的对话框要求用户输入激活码，使汉字识别应用根据该激活码生成对应的激活密文，被许可端(汉字识别应用)可以将携带有激活密文的许可请求发送给许可端，使许可端对激活密文的真实性进行验证(如与许可端本地存储的激活密文进行比较，或采用某种算法对该激活密文进行计算得到一个结果)；其中，激活密文用于标识激活待许可服务；在许可端验证通过后，接收许可端发送的许可密文。
被许可端接收许可密文，可以用离线或在线的方式接收。
在接收到许可密文之后，便可执行步骤203。
步骤203：生成包含许可密文、第二环境密文、公钥的验证请求；其中，第二环境密文是用公钥对当前获取的第二环境指纹进行加密得到的，第二环境指纹包括被许可端所在环境的软硬件特征信息。
被许可端在接收到许可密文后，用获取第一环境指纹相同的方式，获取当前的第二环境指纹，并用公钥对第二环境指纹进行加密得到第二环境密文。并生成包含许可密文、第二环境密文、公钥的验证请求。
在生成验证请求后，便可执行步骤204和步骤205。
步骤204：将验证请求发送给验证端，使验证端通过第二环境密文验证许可密文中的第一环境密文来确定许可密文的真伪，并接收验证端发送的验证结果密文。验证端验证许可密文的过程请参见后续验证端对应方法中的描述。
步骤205：用公钥对验证结果密文进行解密，获得验证结果，以便根据验证结果决定是否对本地存储的待许可服务进行许可认证。
被许可端将验证请求发送给验证端，使验证端对许可密文的真伪进行验证(具体验证过程请参见验证端中的介绍)，被许可端接收验证端发送的验证 结果密文，并用公钥对验证结果密文进行解密，得到验证结果，当验证结果为许可密文为真时，被许可端根据许可信息对待许可服务进行许可认证；当验证结果为许可密文为假时，被许可端丢弃许可密文，并重新向许可端发起许可请求，重复完成上述验证过程。
被许可端通过将第一环境指纹进行加密发送给许可端，让许可端可以用其提供的公钥对包含第一环境密文的许可信息进行同态加密，并接收许可密文，让验证端通过第二环境密文验证许可密文中的第一环境密文来确定许可密文的真伪，整个过程不管是许可端还是被许可端都无法获取被许可端的私有信息(第一环境指纹)，使得被许可端的用户可以灵活复用自己的安全密钥体系和策略，私钥由被许可端保存成，从而提高了被许可端的安全性。并且，该方法将更多的安全可控性尽量前置到验证端和被许可端，天然对等级保护规则友好，降低了产品实施等级保护评测的成本。
在从许可端侧和被许可端侧介绍了许可认证的方法后，下面将从验证端所在侧介绍在其中使用的许可认证方法。
请参见图3，基于同一发明构思，本公开一实施例中提供一种许可认证的方法，应用于验证端，该方法包括：
步骤301：接收被许可端发送的验证请求；其中，验证请求是被许可端基于许可密文、第二环境密文、公钥生成的，许可密文是许可端用公钥对包含第一环境密文的许可信息进行加密，并对加密后的许可信息进行同态加密得到的，第一环境密文是被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，第二环境密文是用公钥对当前获取的第二环境指纹进行加密得到的，第一环境指纹包括被许可端所在环境的软硬件特征信息。
第一环境指纹和第二环境指纹都包括被许可端所在环境的软硬件特征信息，只是它们获取的软硬件特征信息的时间不同。
验证请求、第一环境密文的生成方式参见被许可端中的相关介绍，许可密文的生成方式参见许可端中的相关介绍，在此不再赘述。
步骤302：对许可密文进行同态解密，并从同态解密后的许可密文中获取 第一环境密文，用第二环境密文验证第一环境密文，获得验证结果密文。
在本公开中，验证端可以理解为一个验证程序、验证插件，或者安装有验证程序、验证插件的电子设备，该电子设备例如可以为手机、平板电脑、广告机、路由器等。被许可端和许可端可以位于同一电子设备中。
验证端对许可密文进行同态解密也就是在加密环境下对许可密文进行解密，这使得验证端实际并不能获知许可密文的具体内容。
进而从同态解密后的许可密文中获取第一环境密文，用第二环境密文验证第一环境密文可以采用对第一环境密文和第二环境密文进行同态运算，目的是为了确定它们使用的公钥和私钥是否匹配，进而确定第一环境密文的真伪，若匹配确定第一环境密文为真，相应的说明许可密文未被篡改过，即许可密文为真，反之则为假，这样便能得到加密环境下的验证结果(由于该验证结果在验证端是处于加密环境中的，因此验证端输出是也是以密文的形式输出的，也就是本公开中所述的验证结果密文)。这个验证过程可以称之为同态验证。
步骤303：将验证结果密文发送给被许可端，使被许可端用公钥对验证结果密文进行解密得到验证结果，以便根据验证结果决定是否对被许可端中的待许可服务进行许可认证。
验证端将验证结果密文发送给被许可端后，被许可端用公钥对验证结果密文进行解密，得到解密结果，进而确定许可密文的真伪，若许可密文为真则用解密许可密文后得到的许可信息对待许可服务进行许可认证；若根据解密结果确定许可密文为假，则丢弃该许可密文，重新向许可端申请新的许可密文。
由于验证端对许可密文进行同态验证时，整个验证过程零解密，全部在密文上进行验证运算，并且结果也是以密文的形式返回，使得在验证端也无法获得被许可端的私有信息(环境指纹)，以及许可端的许可信息，从而提高了被许可端、许可密文的安全性，由于整个验证过程无需解密，因此极大减少了多维多轮加、解密的复杂性，提高了验证效率。
为了使本领域的技术人员能充分理解上述技术方案，请参见图4为本公开实施例提供的许可认证交互流程图。以被许可端为视频应用、待许可服务为观看一部新上映的电影A，许可端为服务器、验证端为一验证应用为例。
步骤401：被许可端生成携带公钥和第一环境密文的注册信息。
用户在使用视频应用(被许可端)时发现了一部新上映的电影A(待许可服务)，用户希望观看该部电影A，于是在视频应用对该部电影中执行了一个购买操作，根据该购买操作产生了一个该电影A的认证请求，用于请求激活该电影A，视频应用根据该认证请求，用指定密钥算法生成包含公钥和私钥的密钥对，并存储在本地。同时，获取视频应用所在环境的第一环境指纹，并用私钥对第一环境指纹进行加密得到第一环境密文，根据第一环境密文和公钥生成注册信息。
步骤402：被许可端向许可端发送注册信息。即视频应用向服务器发送注册信息。
步骤403：许可端生成包含第一环境密文对应的许可信息，并用公钥对许可信息进行加密，对加密后的许可信息进行同态加密，获得许可密文。
服务器(许可端)接收到注册信息后，从中获取第一环境密文和公钥，并基于视频应用的属性、购买范围等(这些也是携带在注册信息中的，或者在视频应用为服务器对应的情况下则不需携带视频应用的属性)，生成包含第一环境密文的许可信息，在该许可信息中确定了许可的范围为电影A，其观看次数为一次或无限次，可以进行投屏观看，同时只能在一部手机、一部平板电脑、一台台式电脑上观看。
之后，服务器(许可端)用公钥对该许可信息进行加密，并且还有对加密后的许可信息进行同态加密，最终得到许可密文。
需要说明的是，在本实施例中，实际并不需要执行步骤404-步骤407，服务器就可以将许可密文直接发送给视频应用，但为了展现还可能使用到激活密文的方案，在此假设视频应用需要使用激活密文才能获取许可密文。
步骤404：被许可端生成携带激活密文的许可请求。
需要说明的是步骤403和步骤404的顺序也可以互换，即也可以先执行步骤404再执行步骤403。
假设服务器在生成许可密文后，向用户的手机发送了与之对应的一条激活码，视频应用获取到用户输入的该激活码，视频应用对该激活码进行加密，得到激活密文，并生成携带该激活密文的许可请求。
步骤405：被许可端向许可端发送许可请求。
步骤406：许可端验证激活密文是否正确。
如对激活密文进行某种运算，得到的结果为该激活密文是正确的。
步骤407：许可端在确定激活密文正确时，发送许可密文给被许可端。
步骤408：被许可端生成包含公钥、许可密文、第二环境密文的验证请求。
步骤409：被许可端向验证端发送验证请求。
步骤410：验证端对许可密文进行同态解密，获取其中的第一环境密文，并用第二环境密文验证第一环境密文的真伪，获得验证结果密文。
假设第一环境密文与第二环境密文相同，则确定许可密文为真，该许可密文为真的结果是以密文的形式存在的，即得到验证结果密文。
步骤411：验证端向被许可端发送验证结果密文。
步骤412：被许可端用公钥对验证结果密文进行解密，获得验证结果，并据此决定是否对待许可服务进行许可认证。
视频应用(被许可端)用本地存储的私钥对验证结果进行解密，得到验证结果为真，据此决定用许可密文对电影A进行许可认证。
基于同一发明构思，本公开一实施例中提供一种许可认证的装置，应用于许可端，该装置的许可认证方法的具体实施方式可参见许可端的方法实施例部分的描述，重复之处不再赘述，请参见图5，该装置包括：
获取单元501，用于获取被许可端提供的注册信息；其中，所述注册信息包括所述被许可端提供的公钥和第一环境密文，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
加密单元502，用于生成包含所述第一环境密文的许可信息，并用所述公钥对所述许可信息进行加密，以及对加密后的许可信息进行同态加密，获得许可密文；其中，所述许可信息用于指示所述被许可端中请求许可认证的待许可服务的许可范围；
收发单元503，用于将所述许可密文发送给所述被许可端，使所述被许可端通过验证端验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并使所述被许可端根据接收到的验证结果密文决定是否对所述被许可端中的待许可服务进行许可认证。
一种可能的实施方式，所述收发单元503还用于：
接收所述被许可端发送的许可请求；其中，所述许可请求中携带所述待许可服务的激活密文；其中，所述激活密文用于标识激活所述待许可服务；
验证所述激活密文是否正确；
在确定所述激活密文正确时，将所述许可密文发送给所述被许可端。
一种可能的实施方式，所述同态加密使用的算法包括Paillier加密或全同态加密。
基于同一发明构思，本公开一实施例中提供一种许可认证的装置，应用于被许可端，该装置的许可认证方法的具体实施方式可参见被许可端的方法实施例部分的描述，重复之处不再赘述，请参见图6，该装置包括：
收发单元601，用于将携带有公钥和第一环境密文的注册信息发送给许可端；其中，所述第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹为所述被许可端所在环境的软硬件特征信息；
所述收发单元601，还用于接收所述许可端提供的基于所述注册信息生成的许可密文；其中，所述许可密文是所述许可端用所述公钥对包含所述第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的；
生成单元602，用于生成包含所述许可密文、第二环境密文、所述公钥的验证请求；其中，所述第二环境密文是用所述公钥对当前获取的第二环境指 纹进行加密得到的，所述第二环境指纹包括所述被许可端所在环境的软硬件特征信息；
所述收发单元601，还用于将所述验证请求发送给验证端，使所述验证端通过所述第二环境密文验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并接收所述验证端发送的验证结果密文；
处理单元603，用于用所述公钥对所述验证结果密文进行解密，获得验证结果，以便根据所述验证结果决定是否对本地存储的待许可服务进行许可认证。
一种可能的实施方式，所述收发单元601还用于：
在接收到所述待许可服务的认证请求时，用指定密钥算法生成包含所述公钥和所述私钥的密钥对；其中，所述认证请求是基于用户对所述待许可服务的激活操作产生的；
获取所述第一环境指纹，并用所述私钥对所述第一环境指纹进行加密，获得所述第一环境密文；
将携带有所述公钥和所述第一环境密文的所述注册信息发送给所述许可端。
一种可能的实施方式，所述收发单元601还用于：
将携带有激活密文的许可请求发送给所述许可端，使所述许可端对所述激活密文的真实性进行验证；其中，所述激活密文用于标识激活所述待许可服务；
在所述许可端验证通过后，接收所述许可端发送的所述许可密文。
基于同一发明构思，本公开一实施例中提供一种许可认证的装置，应用于验证端，该装置的许可认证方法的具体实施方式可参见验证端的方法实施例部分的描述，重复之处不再赘述，请参见图7，该装置包括：
接收单元701，用于接收被许可端发送的验证请求；其中，所述验证请求是所述被许可端基于许可密文、第二环境密文、公钥生成的，所述许可密文是许可端用所述公钥对包含第一环境密文的许可信息进行加密，并对加密后 的许可信息进行同态加密得到的，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第二环境密文是所述被许可端使用公钥对当前获取的第二环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
验证单元702，用于对所述许可密文进行同态解密，并从同态解密后的许可密文中获取所述第一环境密文，用所述第二环境密文验证所述第一环境密文，获得验证结果密文；
发送单元703，用于将所述验证结果密文发送给所述被许可端，使所述被许可端用公钥对所述验证结果密文进行解密得到验证结果，以便对所述被许可端中的待许可服务进行许可认证。
基于同一发明构思，本公开一实施例中提供一种服务器，该服务器包括如上所述许可端对应的许可认证的装置。
基于同一发明构思，本公开一实施例中提供一种电子设备，该电子设备包括如上所述的被许可端和验证端对应的许可认证的装置。
该电子设备可以为广告发布机，艺术画屏产品、手机、平板设备等显示终端，可以用于进行多媒体信息(文字，图片，视频等)的信息的发布。该电子设备还可以应用于新媒体、智慧零售等行业。
基于同一发明构思，本公开一实施例中提供一种许可认证的系统，该系统包括如上所述的许可认证的装置。
基于同一发明构思，本公开实施例中提供了一种许可认证的装置，包括：至少一个处理器，以及
与所述至少一个处理器连接的存储器；
其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如上所述的许可认证的方法。
基于同一发明构思，本公开实施例还提一种可读存储介质，包括：
存储器，
所述存储器用于存储指令，当所述指令被处理器执行时，使得包括所述可读存储介质的装置完成如上所述的许可认证的方法。
本领域内的技术人员应明白，本公开实施例可提供为方法、系统、或计算机程序产品。因此，本公开实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本公开实施例是参照根据本公开实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开的精神和范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开也意图包含这些改动和变型在内。

Claims (15)

  1. 一种许可认证的方法，应用于许可端，其中，包括：
    获取被许可端提供的注册信息；其中，所述注册信息包括所述被许可端提供的公钥和第一环境密文，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
    生成包含所述第一环境密文的许可信息，并用所述公钥对所述许可信息进行加密，以及对加密后的许可信息进行同态加密，获得许可密文；其中，所述许可信息用于指示所述被许可端中请求许可认证的待许可服务的许可范围；
    将所述许可密文发送给所述被许可端，使所述被许可端通过验证端验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并使所述被许可端根据接收到的验证结果密文决定是否对所述被许可端中的待许可服务进行许可认证。
  2. 如权利要求1所述的方法，其中，将所述许可密文发送所述被许可端之前，还包括：
    接收所述被许可端发送的许可请求；其中，所述许可请求中携带所述待许可服务的激活密文；其中，所述激活密文用于标识激活所述待许可服务；
    验证所述激活密文是否正确；
    在确定所述激活密文正确时，将所述许可密文发送给所述被许可端。
  3. 如权利要求1或2所述的方法，其中，所述同态加密使用的算法包括Paillier加密或全同态加密。
  4. 一种许可认证的方法，应用于被许可端，其中，包括：
    将携带有公钥和第一环境密文的注册信息发送给许可端；其中，所述第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
    接收所述许可端提供的基于所述注册信息生成的许可密文；其中，所述许可密文是所述许可端用所述公钥对包含所述第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的；
    生成包含所述许可密文、第二环境密文、所述公钥的验证请求；其中，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第二环境指纹包括所述被许可端所在环境的软硬件特征信息；
    将所述验证请求发送给验证端，使所述验证端通过所述第二环境密文验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并接收所述验证端发送的验证结果密文；
    用所述公钥对所述验证结果密文进行解密，获得验证结果，以便根据所述验证结果决定是否对本地存储的待许可服务进行许可认证。
  5. 如权利要求4所述的方法，其中，将携带有公钥和第一环境密文的注册信息发送给许可端，包括：
    在接收到所述待许可服务的认证请求时，用指定密钥算法生成包含所述公钥和所述私钥的密钥对；其中，所述认证请求是基于用户对所述待许可服务的激活操作产生的；
    获取所述第一环境指纹，并用所述私钥对所述第一环境指纹进行加密，获得所述第一环境密文；
    将携带有所述公钥和所述第一环境密文的所述注册信息发送给所述许可端。
  6. 如权利要求4所述的方法，其中，接收所述许可端提供的基于所述注册信息的许可密文之前，还包括：
    将携带有激活密文的许可请求发送给所述许可端，使所述许可端对所述激活密文的真实性进行验证；其中，所述激活密文用于标识激活所述待许可服务；
    在所述许可端验证通过后，接收所述许可端发送的所述许可密文。
  7. 一种许可认证的方法，应用于验证端，其中，包括：
    接收被许可端发送的验证请求；其中，所述验证请求是所述被许可端基于许可密文、第二环境密文、公钥生成的，所述许可密文是许可端用所述公钥对包含第一环境密文的许可信息进行加密，并对加密后的许可信息进行同态加密得到的，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
    对所述许可密文进行同态解密，并从同态解密后的许可密文中获取所述第一环境密文，用所述第二环境密文验证所述第一环境密文，获得验证结果密文；
    将所述验证结果密文发送给所述被许可端，使所述被许可端用公钥对所述验证结果密文进行解密得到验证结果，以便根据所述验证结果决定是否对所述被许可端中的待许可服务进行许可认证。
  8. 一种许可认证的装置，应用于许可端，其中，包括：
    获取单元，用于获取被许可端提供的注册信息；其中，所述注册信息包括所述被许可端提供的公钥和第一环境密文，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
    加密单元，用于生成包含所述第一环境密文的许可信息，并用所述公钥对所述许可信息进行加密，以及对加密后的许可信息进行同态加密，获得许可密文；其中，所述许可信息用于指示所述被许可端中请求许可认证的待许可服务的许可范围；
    收发单元，用于将所述许可密文发送给所述被许可端，使所述被许可端通过验证端验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并使所述被许可端根据接收到的验证结果密文决定是否对所述被许可端中的待许可服务进行许可认证。
  9. 一种许可认证的装置，应用于被许可端，其中，包括：
    发送单元，用于将携带有公钥和第一环境密文的注册信息发送给许可端；其中，所述第一环境密文是使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第一环境指纹为所述被许可端所在环境的软硬件特征信息；
    收发单元，用于接收所述许可端提供的基于所述注册信息生成的许可密文；其中，所述许可密文是所述许可端用所述公钥对包含所述第一环境密文的许可信息进行加密，以及对加密后的许可信息进行同态加密得到的；
    生成单元，用于生成包含所述许可密文、第二环境密文、所述公钥的验证请求；其中，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第二环境指纹包括所述被许可端所在环境的软硬件特征信息；
    所述发送单元，还用于将所述验证请求发送给验证端，使所述验证端通过所述第二环境密文验证所述许可密文中的所述第一环境密文来确定所述许可密文的真伪，并接收所述验证端发送的验证结果密文；
    处理单元，用于用所述公钥对所述验证结果密文进行解密，获得验证结果，以便根据所述验证结果决定是否对本地存储的待许可服务进行许可认证。
  10. 一种许可认证的装置，应用于验证端，其中，包括：
    接收单元，用于接收被许可端发送的验证请求；其中，所述验证请求是所述被许可端基于许可密文、第二环境密文、公钥生成的，所述许可密文是许可端用所述公钥对包含第一环境密文的许可信息进行加密，并对加密后的许可信息进行同态加密得到的，所述第一环境密文是所述被许可端使用私钥对当前获取的第一环境指纹进行加密后得到的，所述第二环境密文是用所述公钥对当前获取的第二环境指纹进行加密得到的，所述第一环境指纹包括所述被许可端所在环境的软硬件特征信息；
    验证单元，用于对所述许可密文进行同态解密，并从同态解密后的许可密文中获取所述第一环境密文，用所述第二环境密文验证所述第一环境密文，获得验证结果密文；
    发送单元，用于将所述验证结果密文发送给所述被许可端，使所述被许 可端用公钥对所述验证结果密文进行解密得到验证结果，以便对所述被许可端中的待许可服务进行许可认证。
  11. 一种服务器，应用于许可端，其中，包括如权利要求8所述的装置。
  12. 一种电子设备，其中，包括如权利要求9和10所述的装置。
  13. 一种许可认证的系统，其中，包括如权利要求8-10任一项所述的装置。
  14. 一种许可认证的装置，其中，包括：
    至少一个处理器，以及
    与所述至少一个处理器连接的存储器；
    其中，所述存储器存储有可被所述至少一个处理器执行的指令，所述至少一个处理器通过执行所述存储器存储的指令，执行如权利要求1-7任一项所述的方法。
  15. 一种可读存储介质，其中，包括存储器，
    所述存储器用于存储指令，当所述指令被处理器执行时，使得包括所述可读存储介质的装置完成如权利要求1～7中任一项所述的方法。
PCT/CN2020/139087 2020-12-24 2020-12-24 一种许可认证的方法、装置、电子设备、系统及存储介质 WO2022133923A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN202080003610.0A CN115280308A (zh) 2020-12-24 2020-12-24 一种许可认证的方法、装置、电子设备、系统及存储介质
PCT/CN2020/139087 WO2022133923A1 (zh) 2020-12-24 2020-12-24 一种许可认证的方法、装置、电子设备、系统及存储介质
US18/267,429 US20240111842A1 (en) 2020-12-24 2020-12-24 License authentication method and apparatus, electronic device, system, and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/139087 WO2022133923A1 (zh) 2020-12-24 2020-12-24 一种许可认证的方法、装置、电子设备、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2022133923A1 true WO2022133923A1 (zh) 2022-06-30

Family

ID=82157233

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/139087 WO2022133923A1 (zh) 2020-12-24 2020-12-24 一种许可认证的方法、装置、电子设备、系统及存储介质

Country Status (3)

Country Link
US (1) US20240111842A1 (zh)
CN (1) CN115280308A (zh)
WO (1) WO2022133923A1 (zh)

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103198241A (zh) * 2013-03-21 2013-07-10 汉柏科技有限公司 一种软件许可安全管理方法
US20170277870A1 (en) * 2009-06-19 2017-09-28 Uniloc Luxembourg S.A. Modular software protection
CN107623671A (zh) * 2016-12-05 2018-01-23 上海辉冠信息科技有限公司 一种软件许可服务实现方法
CN109376506A (zh) * 2018-10-29 2019-02-22 北京京航计算通讯研究所 基于j2ee技术体系的应用软件许可认证系统
CN110096849A (zh) * 2019-04-02 2019-08-06 深圳市中博科创信息技术有限公司 一种License授权认证方法、装置、设备及可读存储介质
US20190318063A1 (en) * 2018-04-11 2019-10-17 Microsoft Technology Licensing, Llc Software license distribution and validation using a distributed immutable data store
CN111367532A (zh) * 2020-02-13 2020-07-03 深圳壹账通智能科技有限公司 软件许可本地部署方法、装置、设备及存储介质
CN111784337A (zh) * 2019-04-04 2020-10-16 华控清交信息科技(北京)有限公司 权限验证方法及系统
CN111797367A (zh) * 2019-04-08 2020-10-20 中移(苏州)软件技术有限公司 软件认证方法及装置、处理节点及存储介质

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170277870A1 (en) * 2009-06-19 2017-09-28 Uniloc Luxembourg S.A. Modular software protection
CN103198241A (zh) * 2013-03-21 2013-07-10 汉柏科技有限公司 一种软件许可安全管理方法
CN107623671A (zh) * 2016-12-05 2018-01-23 上海辉冠信息科技有限公司 一种软件许可服务实现方法
US20190318063A1 (en) * 2018-04-11 2019-10-17 Microsoft Technology Licensing, Llc Software license distribution and validation using a distributed immutable data store
CN109376506A (zh) * 2018-10-29 2019-02-22 北京京航计算通讯研究所 基于j2ee技术体系的应用软件许可认证系统
CN110096849A (zh) * 2019-04-02 2019-08-06 深圳市中博科创信息技术有限公司 一种License授权认证方法、装置、设备及可读存储介质
CN111784337A (zh) * 2019-04-04 2020-10-16 华控清交信息科技(北京)有限公司 权限验证方法及系统
CN111797367A (zh) * 2019-04-08 2020-10-20 中移(苏州)软件技术有限公司 软件认证方法及装置、处理节点及存储介质
CN111367532A (zh) * 2020-02-13 2020-07-03 深圳壹账通智能科技有限公司 软件许可本地部署方法、装置、设备及存储介质

Also Published As

Publication number Publication date
US20240111842A1 (en) 2024-04-04
CN115280308A (zh) 2022-11-01

Similar Documents

Publication Publication Date Title
EP1942430B1 (en) Token Passing Technique for Media Playback Devices
WO2020119258A1 (zh) 一种数据处理方法和装置
WO2019020051A1 (zh) 一种安全认证的方法及装置
CN106487765B (zh) 授权访问方法以及使用该方法的设备
CN101977190B (zh) 数字内容加密传送方法以及服务器端
CN109905360B (zh) 数据验证方法及终端设备
CN103237010B (zh) 以加密方式提供数字内容的服务器端
WO2019226622A1 (en) User-protected license
CN114547648A (zh) 一种数据匿踪查询方法及系统
CN110737905B (zh) 数据授权方法、数据授权装置及计算机存储介质
TWI734729B (zh) 實現電子簽章的方法、裝置及簽章伺服器
CN115242553A (zh) 一种支持安全多方计算的数据交换方法及系统
US20230418911A1 (en) Systems and methods for securely processing content
CN110708155B (zh) 版权信息保护方法、系统、确权方法、装置、设备和介质
US8706635B2 (en) Use of licensed content without identification thereof
CN111314059B (zh) 账户权限代理的处理方法、装置、设备及可读存储介质
WO2020048290A1 (zh) 用于发行证书的系统和方法
KR20140071775A (ko) 암호키 관리 시스템 및 방법
CN116204903A (zh) 一种财务数据安全管理方法、装置、电子设备及存储介质
WO2022133923A1 (zh) 一种许可认证的方法、装置、电子设备、系统及存储介质
TWI611316B (zh) 安全輸入法之文本處理方法、文本處理裝置及文本處理系統
US20070130071A1 (en) Information management system, information management method, and program product therefor
US20180218357A1 (en) Export high value material based on ring 1 evidence of ownership
KR20090024482A (ko) 컨텐츠를 이용하기 위한 키 관리 시스템 및 그 방법
EP4016921A1 (en) Certificate management method and apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20966495

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 20.10.2023)