Authorization method, electronic device, computer readable storage medium

Abstract

The application provides an authorization method, an electronic device and a computer readable storage medium. The method comprises the following steps: configuring multiple types of digital certificates, wherein the digital certificates comprise at least one management type digital certificate and at least one ordinary type digital certificate; issuing an authorization file to a terminal through the authority of the management type digital certificate, and backing up the authorization file; obtaining an operation request reported by the terminal; verifying the legality of a first ordinary type digital certificate through the authorization file; in the case that the first ordinary type digital certificate is legal, verifying the legality of the operation request through a first digital signature; and in the case that the operation request is legal, performing an operation corresponding to the operation request. Through the method, when the authority of the terminal needs to be changed, the authorization file needs to be reissued to the terminal through the authority of the management type digital certificate, and the identity and authority of each terminal are re-authenticated according to the updated authorization file in the authentication stage, so that the flexibility of re-authorization when the authority of the terminal is changed is greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the online authorization technical field, in particular to an authorization method, an electronic device and a computer readable storage medium. BACKGROUND

[0002] Under the current trend of digital office, enterprises and institutions often need to build relevant digital management platforms to manage complex businesses when implementing digital office. However, in the management process of large and complex digital management platforms, it is difficult for a single person to manage all businesses, and multiple people are likely to cause unclear responsibilities and multiple management chaos. It is necessary to refine tasks and set multiple roles on the digital management platform to manage different businesses. For example, shopping malls, industrial parks or public street management need multiple roles such as network administrators, monitors, fire patrol officers and the like to manage together. It is crucial to grant corresponding operation permissions to multiple roles under the premise of ensuring security and authenticating the identity of business personnel. In the prior art, a digital certificate management system based on PKI can authenticate the identity of personnel and grant corresponding operation permissions at the same time. However, the PKI (Public Key Infrastructure) mechanism needs to introduce a third-party agency for authentication, and the authorization flexibility is low when the business personnel's permissions are changed. SUMMARY

[0003] The main purpose of the embodiments of the present application is to propose an authorization method, an electronic device and a computer readable storage medium, by classifying digital certificates, so that each type of digital certificate corresponds to different operation permissions, thereby granting corresponding operation permissions to the business terminal while authenticating the identity of the business terminal, and improving the flexibility of re-authorization when the terminal's permissions are changed.

[0004] To achieve the above purpose, a first aspect of the embodiments of the present application proposes an authorization method, which comprises:

[0005] configuring multiple types of digital certificates, wherein the digital certificates at least include management type digital certificates and ordinary type digital certificates, and the management type digital certificates correspond to the permission of issuing authorization files;

[0006] issuing authorization files to at least one terminal through the permission of the management type digital certificates, and backing up the authorization files, wherein the authorization files include the ordinary type digital certificates and corresponding digital signatures;

[0007] obtaining an operation request reported by a terminal, wherein the operation request carries a first ordinary type digital certificate corresponding to the terminal and a first digital signature;

[0008] verifying the legality of the first ordinary type digital certificate through the authorization files;

[0009] verify legality of the operation request by the first digital signature in the case that the first common type digital certificate is legal;

[0010] perform an operation corresponding to the operation request in the case that the operation request is legal.

[0011] In some embodiments, the method further comprises:

[0012] configuring a preset decryption module, the preset decryption module storing at least one of a first preset private key and a first preset public key, wherein the first preset private key is used for decrypting a PCK file, and the first preset public key is used for verifying the first digital signature.

[0013] In some embodiments, the method further comprises:

[0014] verifying legality of the management type digital certificate by a preset CA certificate;

[0015] verifying legality of the first common type digital certificate by the authorization file in the case that the management type digital certificate is legal.

[0016] In some embodiments, the verifying legality of the first common type digital certificate by the authorization file comprises:

[0017] determining legality of the first common type digital certificate according to consistency of the common type digital certificate and the first common type digital certificate stored in the authorization file.

[0018] In some embodiments, the authorization file further comprises a preset abstract algorithm used for generating an abstract of the common type digital certificate, and the verifying legality of the operation request by the digital signature comprises:

[0019] generating a first abstract of the first common type digital certificate by a preset abstract algorithm;

[0020] decrypting the first digital signature by a first preset public key to obtain a second abstract;

[0021] determining legality of the operation request according to consistency of the first abstract and the second abstract.

[0022] In some embodiments, the method further comprises:

[0023] sending a certificate issuance request to a security center;

[0024] receive a PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is a file obtained by encrypting a P12 digital envelope using the first preset public key;

[0025] decrypt the PCK file by using a first preset private key to obtain the P12 digital envelope, wherein the P12 digital envelope comprises at least a management class digital certificate and at least one common class digital certificate;

[0026] extract and save each type of the digital certificate from the P12 digital envelope.

[0027] In some embodiments, the digital certificate further comprises an audit class digital certificate, and the audit class digital certificate corresponds to an operation permission of viewing the terminal log information.

[0028] In some embodiments, the digital certificate comprises at least a user item or an extension item, and the method further comprises:

[0029] determining the type of the digital certificate by using the user item in the digital certificate;

[0030] or

[0031] determining the type of the digital certificate by using the extension item in the digital certificate.

[0032] A second aspect of the embodiments of the present application provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and capable of running on the processor, and characterized in that the processor implements the authorization method according to any one of the first aspect embodiments when executing the computer program.

[0033] A third aspect of the embodiments of the present application provides a computer readable storage medium, characterized in that the computer readable storage medium stores one or more programs, and the one or more programs are capable of being run by one or more processors to implement the authorization method according to any one of the first aspect embodiments.

[0034] The authorization method, the electronic device and the computer readable storage medium provided in the embodiments of the present application, the method comprises: configuring multiple types of digital certificates, wherein the digital certificates at least comprise a management type digital certificate and a common type digital certificate, the management type digital certificate corresponds to the permission of issuing an authorization file; issuing an authorization file to at least one terminal through the permission of the management type digital certificate, and backing up the authorization file, wherein the authorization file comprises the common type digital certificate and a corresponding digital signature; obtaining an operation request reported by a terminal, wherein the operation request carries a first common type digital certificate corresponding to the terminal and a first digital signature; verifying the legality of the first common type digital certificate through the authorization file; in the case that the first common type digital certificate is legal, verifying the legality of the operation request through the first digital signature; in the case that the operation request is legal, performing an operation corresponding to the operation request. In the present application, multiple types of digital certificates are pre-configured locally, including a management type digital certificate and multiple common type digital certificates, wherein the management type digital certificate corresponds to the permission of issuing an authorization file to a terminal, the terminal completes the confirmation of the identity of the terminal after obtaining the authorization file, when the terminal needs to perform an operation, the terminal reports an operation request to the system, the operation request carries a first common type digital certificate corresponding to the identity of the terminal and a corresponding first digital signature, after the system receives the operation request, the system first verifies the legality of the first common type digital certificate corresponding to the terminal through the authorization file backed up by the system, if the first common type digital certificate is legal, it means that the terminal is authorized by the system, then the legality of the operation request is verified through the first digital signature, if the verification is passed, it means that the operation request is issued by the terminal corresponding to the first common type digital certificate, and the operation request is legal and can be performed. Based on the method provided in the embodiments of the present application, when the identity of the terminal is changed and the permission of the terminal needs to be modified, the authorization file is only needed to be reissued to each terminal through the permission of the management type digital certificate, after the authorization file is reissued, the authorization file backed up locally is also updated, therefore, if a terminal reports an operation request using the first digital certificate before the update, the verification will fail, based on this, the flexibility of re-authorization when the identity of the terminal is changed is greatly improved on the premise of ensuring the credibility of the authorization trust chain. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a flowchart of an authorization method provided in an embodiment of the present application;

[0036] Figure 2 is a schematic diagram of an authorization method provided in an embodiment of the present application;

[0037] Figure 3 is a sub-flowchart of an authorization method provided in an embodiment of the present application;

[0038] Figure 4is a sub-flow chart of the authorization method provided by an embodiment of the present application;

[0039] Figure 5 is a sub-flow chart of the authorization method provided by an embodiment of the present application;

[0040] Figure 6 is a schematic diagram of the authorization method provided by an embodiment of the present application;

[0041] Figure 7 is a schematic diagram of the electronic device provided by an embodiment of the present application.

[0042] The accompanying drawings are included to provide a further understanding of the present application and constitute a part of the specification, which together with the embodiments serve to explain the technical solutions of the present application, but do not constitute a limitation on the technical solutions of the present application. DETAILED DESCRIPTION

[0043] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0045] In addition, the described features, structures or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a sufficient understanding of the embodiments of the present disclosure. However, one skilled in the art will realize that the technical solutions of the present disclosure can be practiced without one or more of the specific details, or can employ other methods, components, devices, steps, etc. In other cases, well-known methods, devices, implementations or operations are not shown or described in detail to avoid obscuring the aspects of the present disclosure.

[0046] The authorization method provided by the embodiments of the present application can be applied to a terminal, can be applied to a server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart watch, or the like; the server side can be configured as a separate physical server, can be configured as a server cluster or a distributed system formed by multiple physical servers, can also be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms; and the software can be an application that implements the authorization method, but is not limited to the above forms.

[0047] The embodiments of the present disclosure can be used in a plurality of general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote storage media including storage devices.

[0048] Reference Figure 1 , Figure 1 The authorization method provided by the embodiments of the present application includes but is not limited to the following steps S101 to S106.

[0049] Step S101, configuring multiple types of digital certificates, wherein the digital certificates at least include a management type digital certificate and at least one normal type digital certificate, the management type digital certificate corresponds to the authority of issuing an authorization file to a terminal;

[0050] Step S102, issuing an authorization file to at least one terminal through the authority of the management type digital certificate, and backing up the authorization file, wherein the authorization file includes a normal type digital certificate and a corresponding digital signature;

[0051] Step S103, obtaining an operation request reported by a terminal, wherein the operation request carries a first normal type digital certificate corresponding to the terminal and a first digital signature;

[0052] Step S104, verifying the legality of the first normal type digital certificate through the authorization file;

[0053] Step S105: If the first ordinary digital certificate is valid, verify the validity of the operation request through the first digital signature;

[0054] Step S106: If the operation request is valid, execute the operation corresponding to the operation request.

[0055] In some embodiments, multiple types of digital certificates are pre-configured on the system side, including at least administrative digital certificates and at least one general-purpose digital certificate. It is understood that each digital certificate corresponds to a different terminal role, and thus to different permissions. It should be noted that, referring to... Figure 2 Management-type digital certificates correspond to the authority to issue authorization documents to terminals. After receiving the authorization document, the terminal will determine its identity and corresponding permissions based on the authorization document.

[0056] In some embodiments, after the system determines the digital certificate to be issued based on business needs, it encapsulates the digital certificate and the corresponding digital signature into an authorization file, and then issues the authorization file to at least one terminal through the permissions of the management digital certificate. The authorization file is backed up locally on the system so that when an operation request is received from the terminal, the legality of the operation request can be verified step by step based on the authorization file.

[0057] In some embodiments, after receiving the authorization file and clarifying its own identity and corresponding permissions, the terminal will report an operation request to the system. Specifically, the operation request will carry a first ordinary digital certificate for authenticating the terminal's identity and a first digital signature for verifying whether the operation request was issued by the terminal.

[0058] Understandably, to prevent the system from executing erroneous operations after receiving operation requests from unauthorized terminals, the terminal will include a first ordinary digital certificate to prove its identity in the reported operation request. After receiving the operation request from the terminal, the system will first verify the legitimacy of the first ordinary digital certificate through the locally backed-up authorization file, thereby verifying the terminal's identity. Specifically, the backed-up authorization file stores various ordinary digital certificates issued to the terminal by the system. By comparing whether the first ordinary digital certificate is the same as the ordinary digital certificate stored in the authorization file, if they are the same, it means that the first ordinary digital certificate was issued to the terminal by the system after being certified by a management digital certificate, and the first ordinary digital certificate is legitimate; if they are different, that is, the first ordinary digital certificate has not been certified by a management digital certificate or the first management digital certificate has been tampered with, in which case the first ordinary digital certificate is illegitimate, indicating that the system has not authorized the terminal, and the terminal is an unauthorized terminal. Based on this, the system will directly refuse to execute the reported operation request.

[0059] In the case of the first normal digital certificate is legitimate, that is, the terminal is authorized via the system, it can be understood that, in order to prevent network attackers from uploading operation request messages by Trojan viruses or other means to control the terminal illegally, the terminal needs to sign the operation request message after generating the operation request message. Specifically, it can be through a preset digest algorithm to generate a digest of the first normal digital certificate, and through a preconfigured private key to encrypt the digest to generate a digital signature corresponding to the first normal digital certificate of the terminal. It can be understood that, since the network attacker cannot know the digest algorithm and the preset private key in advance, he cannot generate a correct digital signature. Based on this, after the system receives the operation request reported by the terminal and determines that the terminal is legitimate, it also needs to verify the operation request to prove that the operation request is reported by a legitimate operator through the terminal. When the above verification is passed, it can be proved that the operation request is completely legitimate, and the system can execute the operation request.

[0060] In some embodiments, the authorization file has a timestamp or a monotonic sequence number to support dynamic updating of the authorization file, and the verifier only recognizes the largest monotonic sequence number. Based on this, if the authorization file is tampered with, its timestamp or monotonic sequence number will also be updated, and the verifier will find that the authorization file is tampered with when verifying, thereby causing the verification to fail and refusing authorization. Based on this, the reliability of the trust chain is further improved.

[0061] In the embodiment of the present application, a plurality of digital certificates are pre-configured locally, including management digital certificates and a plurality of common digital certificates, wherein the management digital certificates correspond to the authority of issuing authorization files to terminals. After a terminal obtains an authorization file, the identity of the terminal is confirmed. When the terminal needs to perform an operation, an operation request is reported to the system, and the operation request carries a first common digital certificate corresponding to the identity of the terminal and a first digital signature. After receiving the operation request, the system verifies the legality of the first common digital certificate corresponding to the terminal by using the backup authorization file, and if the first common digital certificate is legal, the terminal is authorized by the system. The legality of the operation request is verified by using the first digital signature. If the verification is passed, the operation request is issued by the terminal corresponding to the first common digital certificate, and the operation request is legal and can be executed. Based on the method proposed in the embodiment of the present application, when the identity of a terminal is changed and the authority of the terminal needs to be modified, the authorization file is only needed to be reissued to each terminal by using the authority of the management digital certificate. After the authorization file is reissued, the backup authorization file is updated. Therefore, if a terminal reports an operation request by using the first digital certificate before the update, the verification fails. Based on this, when the authority of the terminal needs to be changed, the authorization file is only needed to be reissued to each terminal by using the authority of the management digital certificate, and there is no need to reissue a digital certificate to a third-party certification authority and authenticate the identity, thereby greatly improving the flexibility of re-authorization when the authority is changed.

[0062] In some embodiments, refer to Figure 3 The authorization method further includes, but is not limited to, the following steps S301 to S303.

[0063] Step S301, verifying the legality of the management digital certificate by using a preset CA certificate.

[0064] Step S302, in the case where the management digital certificate is legal, verifying the legality of the first common digital certificate by using the authorization file.

[0065] It can be understood that the CA certification service provided by the third-party certification authority authenticates the legitimacy of the management class digital certificate, proves that the management class digital certificate is issued by the CA certification authority, and can reduce the risk of network attackers using a fake management class digital certificate to log in to the system to authenticate illegal first ordinary class digital certificates. Specifically, the management class digital certificate can be verified by the corresponding digital signature of the management class digital certificate. Since the digital signature is obtained by signing the management class certificate with a private key after digesting the management class certificate by a preset digest algorithm, the signature is decrypted by the public key provided by the preset CA certificate to restore the digest, and the same digest algorithm is used to generate the digest of the management class digital certificate. Since the digest generated by the same digest algorithm for the same content is exactly the same, and once the content is different, the generated digest will also change, by comparing whether the decrypted digest and the digest generated by the digest algorithm are exactly the same, it can be proved whether the management class digital certificate is tampered with, and the management class digital certificate is verified, thereby verifying the legitimacy of the management class digital certificate.

[0066] In some embodiments, with reference to Figure 4 , the authorization method further includes but is not limited to the following steps S401 to S403.

[0067] Step S401, generating a first digest of the first ordinary class digital certificate by a preset digest algorithm;

[0068] Step S402, decrypting the first digital signature by the first preset public key to obtain a second digest;

[0069] Step S403, determining the legitimacy of the operation request according to the consistency of the first digest and the second digest.

[0070] It can be understood that the authorization file also stores a preset digest algorithm, which is the digest algorithm used to generate the corresponding digital signature of the first ordinary class digital certificate. The digital signature is obtained by encrypting the first ordinary class digital certificate using a private key after generating the digest of the first ordinary class digital certificate by the preset digest algorithm. The system decrypts the first signature carried in the operation request by the public key after receiving the operation request, and obtains the corresponding second digest. Then, the second digest is compared with the first digest of the first ordinary class digital certificate generated by the preset digest algorithm. If the first digest and the second digest are exactly the same, it means that the first digital signature is legal, and the operation request is reported after terminal authentication and signature, which can be executed. If the first digest and the second digest are not the same, it means that the first digital signature is illegal, and the operation request is not authenticated by the terminal, and the system refuses to execute.

[0071] With reference to Figure 5 , in some embodiments, the authorization method further includes but is not limited to the following steps S501 to S504.

[0072] Step S501, sending a certificate issuance request to the security center;

[0073] Step S502, receiving a PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is a file obtained by encrypting a P12 digital envelope using a first preset public key;

[0074] Step S503, decrypting the PCK file by using a first preset private key to obtain a P12 digital envelope, wherein the P12 digital envelope comprises at least a management class digital certificate and at least one common class digital certificate;

[0075] Step S504, extracting and saving various digital certificates from the P12 digital envelope.

[0076] In some embodiments, the system can send the certificate issuance request through a communication channel established with the security center, such as sending the certificate issuance request to the security center by mail or a communication link established between the system and the security center for sending the certificate issuance request.

[0077] In some embodiments, after receiving the certificate issuance request from the system, the security center determines the types of digital certificates to be issued according to the certificate issuance request, encapsulates various digital certificates into a P12 digital envelope, encrypts the P12 digital envelope to obtain a PCK file, and delivers the PCK file to the system by mail or a communication link established between the system and the security center for delivering the PCK file, wherein the digital certificates comprise at least a management class digital certificate and a common class digital certificate.

[0078] In some embodiments, by pre-configuring the USB Dongle in the system and storing the first preset private key therein, after receiving the PCK file, the P12 digital envelope is obtained by decrypting the PCK file with the first preset private key. It can be understood that, in order to ensure that the P12 digital envelope is not hijacked by hackers during the process of issuing the digital certificate, and the digital certificate is not leaked or the fake digital certificate returned after the certificate issuing request is intercepted by hackers, the network attacker can use the pre-backup fake digital certificate for authorization, etc. The PCK file can be generated by encrypting the P12 digital envelope with the preset public key in the security center, and the first preset private key corresponding to the preset public key of the security center is pre-configured in the system. When the system receives the PCK file, the first preset private key is used to decrypt the PCK file, so as to restore the P12 digital envelope and obtain the digital certificate therein. Specifically, the first preset public key and the first preset private key can be generated by using the RSA algorithm or the RSA2 algorithm. The asymmetric encryption mode of encrypting in the security center by using the public key and decrypting in the system by using the private key ensures that even if the digital certificate is hijacked during the process of issuing the digital certificate, the hijacker cannot decrypt the PCK file to obtain the digital certificate due to the lack of the corresponding first preset private key, thereby ensuring the security of the process of issuing the digital certificate.

[0079] In the embodiments of the present application, the certificate issuing request is reported to the security center, and the PCK file fed back by the security center based on the certificate issuing request is received. In this process, the digital certificate is encapsulated into a P12 digital envelope in the security center, and then the P12 digital envelope is encrypted by the first preset public key to generate the PCK file and issued to the system. The system decrypts the PCK file by using the first preset private key pre-configured in the system corresponding to the first preset public key after receiving the PCK file. Based on the asymmetric encryption form, it is ensured that the digital certificate is not leaked even if it is hijacked when the digital certificate is issued from the security center to the system, thereby ensuring the security of the process of issuing the digital certificate.

[0080] In some embodiments, a third party agency is introduced as a security center to provide CA (electronic authentication service, which refers to the activity of verifying the authenticity and reliability of each party related to electronic signature) authentication service, thereby obtaining the CA private key and issuing various digital certificates through the CA private key. After that, various digital certificates are saved locally in the system. In subsequent issuance of digital certificates, CA authentication service does not need to be requested from the third party agency, but only needs to encapsulate various digital certificates and digital signatures into an authorization file and issue it to each terminal. Thus, one-time deployment and multiple uses are realized, the cost is reduced, and the flexibility of authorization is greatly improved.

[0081] It can be understood that in some embodiments, a preset decryption module can be pre-configured at the system, the preset decryption module storing at least one of the first preset public key and the first preset private key, the first preset private key being used for decrypting the PCK file to restore the PCK file into the P12 digital envelope, and the first preset public key being used for verifying the digital signature. By pre-configuring the preset decryption module storing the first preset private key and the first preset public key at the system, in the certificate issuing process, the security center encapsulates the issued digital certificate into the P12 digital envelope, and then encrypts the digital envelope using the public key to obtain the PCK file. After the system receives the PCK file, the first preset private key is used for decryption to restore the PCK file into the P12 digital envelope. In this process, even if the PCK file is hijacked by a network attacker during transmission, the network attacker cannot decrypt and restore the PCK file into the P12 envelope because the network attacker does not have the first preset private key. Based on this, the use of the public key encryption and the private key decryption in the certificate issuing process ensures the security of the certificate issuing. In the authorization verification process, the terminal reports the operation request with the corresponding digital signature. Based on the asymmetric encryption form, the first preset private key is used for signing when the terminal transmits the operation request, and the first preset public key is used for verification at the system side. Since the network attacker does not have the first preset private key, it cannot sign the request message using the first preset private key when it forges the operation request. Based on this, the network attacker can be effectively prevented from forging the operation request, and the security of the terminal reporting request can be ensured.

[0082] In some embodiments, with reference to Figure 2 The digital certificate further includes an audit type digital certificate corresponding to an operation permission of viewing system log information. Based on this, the external management type terminal is set to audit the system through the audit type digital certificate, thereby constructing a more perfect trust chain.

[0083] In some embodiments, the digital certificate at least includes a user item or an extension item. The type of the digital certificate is determined through the user item in the digital certificate, or the type of the digital certificate is determined through the extension item in the digital certificate.

[0084] With reference to Figure 6 The following is an embodiment of an authorization method based on the embodiments of the present application, taking a public large screen display management system as an example. The business requirement is to limit the public large screen to only play legal materials that have been audited. Based on this requirement, four types of business terminal roles can be set, which are uploading terminals, auditing terminals, management type terminals, and audit terminals.

[0085] First, configure the decryption USB dongle (hardware password module with USB interface, configured with a public-private key pair, which can encrypt and decrypt data and sign and verify signatures) in the system and security center respectively, and configure the issuing USB dongle in the security center which stores the CA private key. It can be understood that this step is only required when the first authorization is performed. After the first authorization is completed, the issuing USB dongle and the decryption USB dongle are configured, and can be reused multiple times.

[0086] The system sends a certificate issuance request for four types of digital certificates, namely, audit type, review type, management type, and upload type, to the security center. The review type and upload type digital certificates are both ordinary type digital certificates. After receiving the request, the security center issues various types of digital certificates through the CA private key, and encapsulates them into P12 digital envelopes. Then, the P12 digital envelopes are encrypted by the first preset public key stored in the decryption USB dongle to generate PCK files, and the PCK files are issued to the system. After receiving the PCK files, the system decrypts the PCK files by the first preset private key stored in the USB dongle, restores them into P12 digital envelopes, and saves them locally. The management type digital certificate holder, i.e., the management type terminal, distributes various types of digital certificates to corresponding business terminals, thereby completing the process of distributing digital certificates. It can be understood that the above embodiment is an example of using the system for the first time to authorize and sending a certificate issuance request to the security center.

[0087] After receiving the above digital certificates issued by the security center, the system issues authorization files to the review terminal and the upload terminal through the management type digital certificate. Specifically, the upload terminal is issued an authorization file for uploading material permissions, and the review terminal is issued an authorization file for reviewing material permissions. After the upload terminal uploads the business material, the review terminal reviews the business material. After the review is passed, the review terminal uses the private key corresponding to the review terminal digital certificate to digitally sign the material data, and the reviewed business material and the first ordinary type digital certificate corresponding to the review terminal are encapsulated into an operation request message and submitted to the system. After receiving the material, the system first verifies the legality of the management type terminal digital certificate through the CA root certificate, then verifies the legality of the review terminal digital certificate according to the authorization file, and finally verifies the business material according to the digital signature corresponding to the review terminal digital certificate. If all the above verifications are passed, it means that the management type terminal is certified by the CA certificate, the review terminal is certified by the management type terminal, and the material is reviewed by the review terminal, which can be played. Based on this, a complete trust chain is built, and when the identity of the review terminal changes, only the authorization file constituted by other types of ordinary type digital certificates needs to be reissued to the review terminal through the management type digital certificate, which improves the flexibility of re-authorization when the permission changes while ensuring the security and reliability of the trust chain.

[0088] The embodiment of the present application also discloses an electronic device 700.

[0089] Specifically, the electronic device 700 comprises a memory 710 and one or more processors 720, Figure 7 In an example, the processor 720 and the memory 710 are connected through a bus 730 or other means, Figure 7 In an example, the processor 720 and the memory 710 are connected through a bus 730 or other means,

[0090] The memory 710 is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs, such as the authorization method in the above embodiment of the present application. The processor 720 realizes the authorization method in the above embodiment of the present application by running the non-transitory software programs and programs stored in the memory 710. For example, the processor 720 executes the steps S101 to S106 in the above embodiment of the present application, Figure 1 the steps S301 to S302 in the above embodiment of the present application, Figure 3 the steps S401 to S403 in the above embodiment of the present application, Figure 4 the steps S501 to S504 in the above embodiment of the present application. Figure 5

[0091] The memory 710 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data required by the authorization method in the above embodiment of the present application, etc. In addition, the memory 710 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged with respect to the processor, and these remote memories can be connected to the electronic device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0092] The non-transitory software programs and programs required to realize the authorization method in the above embodiment of the present application are stored in the memory 710, and when executed by one or more processors, the authorization method in the above embodiment of the present application is executed.

[0093] In addition, the embodiment of the present application also provides a computer readable storage medium, which stores a computer executable program, and the computer executable program is executed by one or more control processors, for example, the steps S101 to S106 in the above embodiment of the present application, Figure 1 the steps S301 to S302 in the above embodiment of the present application, Figure 3 the steps S401 to S403 in the above embodiment of the present application, Figure 4 ​Steps S401 to S403 in FIG. 4, Figure 5 Steps S501 to S504 in FIG. 5.

[0094] The block diagrams shown in the drawings are merely functional entities, and do not necessarily have to correspond to physically independent entities. That is, the functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0095] The embodiments described in the present application are for more clearly illustrating the technical solutions of the present application, and do not constitute a limitation on the technical solutions provided by the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the present application are also applicable to similar technical problems.

[0096] Those skilled in the art can understand that, Figures 1 to 7 The technical solutions shown in the drawings do not constitute a limitation on the present application, and can include more or fewer components than shown, or combine certain components, or different components.

[0097] It should be understood that, in the present application, "at least one" means one or more, and "multiple" means two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can mean: only A, only B, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally represents that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c, can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0098] The preferred embodiments of the present application are described above with reference to the accompanying drawings, which do not limit the scope of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the present application shall be within the scope of the present application.

Claims

1. An authorization method, characterized by, The method comprises: sending a certificate issuance request to a security center; receiving a PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is a file obtained by encrypting a P12 digital envelope using a first preset public key, the first preset public key is stored by a preset decryption module and used for verifying a first digital signature, and the preset decryption module also stores a first preset private key; decrypting the PCK file by using the first preset private key to obtain the P12 digital envelope, wherein the P12 digital envelope comprises at least a management type digital certificate and at least one common type digital certificate, and the management type digital certificate corresponds to an authority of issuing an authorization file to a terminal; extracting and saving various digital certificates from the P12 digital envelope; issuing an authorization file to at least one terminal by using the authority of the management type digital certificate, and backing up the authorization file, wherein the authorization file comprises the common type digital certificate and a corresponding digital signature; obtaining an operation request reported by a terminal, wherein the operation request carries a first common type digital certificate corresponding to the terminal and the first digital signature; verifying the legality of the first common type digital certificate by using the authorization file; in the case that the first common type digital certificate is legal, verifying the legality of the operation request by using the first digital signature; in the case that the operation request is legal, performing an operation corresponding to the operation request.

2. The method of claim 1, wherein, The method further comprises: configuring the preset decryption module.

3. The method of claim 1, wherein, The method further comprises: verifying the legality of the management type digital certificate by using a preset CA certificate; in the case that the management type digital certificate is legal, verifying the legality of the first common type digital certificate by using the authorization file.

4. The method of claim 3, wherein, The verifying of the legality of the first common type digital certificate by using the authorization file comprises: determining the legality of the first common type digital certificate according to consistency between the common type digital certificate and the first common type digital certificate stored in the authorization file.

5. The method of claim 2, wherein, The authorization file further comprises a preset digest algorithm, the preset digest algorithm is used for generating a digest of the common type digital certificate, and the verifying of the legality of the operation request by using the first digital signature comprises: generating a first digest of the first common type digital certificate by using a preset digest algorithm; decrypting the first digital signature by using the first preset public key to obtain a second digest; determining the legality of the operation request according to consistency between the first digest and the second digest.

6. The method according to any one of claims 1 to 5, characterized in that, The digital certificate further comprises an audit type digital certificate, and the audit type digital certificate corresponds to an operation authority of viewing log information of the terminal.

7. The method according to any one of claims 1 to 5, wherein the digital certificate comprises at least a user item or an extension item, and the method further comprises: determining the type of the digital certificate by using the user item in the digital certificate; or determining the type of the digital certificate by using the extension item in the digital certificate. ​ 8. An electronic device comprising: A memory, a processor, and a computer program stored on the memory and runtable on the processor, characterized in that the processor, when running the computer program, implements the authorization method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores one or more programs, and the one or more programs are run by one or more processors to implement the authorization method according to any one of claims 1 to 7.

Images