Function management method, system, equipment and medium

Abstract

The invention discloses a function management method, system, equipment and medium, and relates to the technical field of servers, based on cooperative work of a controller and a logic device, the controller is responsible for reading and submitting corresponding encryption license information and further sending the information to the logic device, the logic device is responsible for verifying the authenticity of the encryption license information, and the function management efficiency is improved. The security is ensured through decryption at the hardware level, the corresponding license level is analyzed on the premise of ensuring the security, and the corresponding service function is dynamically started according to the license level. Through the combination of software and hardware, the security of license verification is remarkably improved, the reliability and stability of a server system are improved, and the method is suitable for various complex application scenes.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to a function management method, system, device and medium. Background Art

[0002] With the rapid development of information technology, the demand for server equipment security and functional flexibility is increasing. Traditional server management systems typically rely on baseboard management controllers for remote monitoring and management. However, this management approach often relies on software authorization to manage controller functional permissions, which poses security issues.

[0003] Therefore, a function management method with improved security is urgently needed to solve the above technical problems. Summary of the Invention

[0004] The present application provides a function management method, device, medium and product to at least solve the problems in the related art.

[0005] This application provides a function management method, which is applied to a controller, including: In response to detecting controller firmware loading, obtaining encrypted license information pre-stored in the controller; Sending encrypted license information to the logic device for security verification; The receiving logic device responds to detecting an unlocking function code fed back by the security verification; Configure server functions according to the unlock function code.

[0006] This application also provides a function management system, including: a data acquisition module, configured to acquire encrypted license information pre-stored in the controller in response to detecting controller firmware loading; A data communication module, used for sending encrypted license information to a logic device for security verification; The data communication module is further configured to receive an unlocking function code fed back by the logic device in response to detecting that the security verification has passed; The function management module is used to manage server resources according to the unlocking function code.

[0007] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any one of the above-mentioned function management methods when executing the computer program.

[0008] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above-mentioned function management methods are implemented.

[0009] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned function management methods when executed by a processor.

[0010] The function management method disclosed in this application is based on the collaborative work of a controller and a logic device. The controller is responsible for reading and submitting the corresponding encrypted license information, which is further sent to the logic device. The logic device is responsible for verifying the authenticity of the encrypted license information and ensuring security through hardware-level decryption. While ensuring security, the corresponding license level is analyzed and the corresponding service functions are dynamically enabled based on the license level. This combination of software and hardware significantly improves the security of license verification, while also increasing the reliability and stability of the server system, making it suitable for a variety of complex application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 A flow chart of a function management method provided in an embodiment of the present application; Figure 2 A functional management timing diagram provided in an embodiment of the present application; Figure 3 A flow chart of another function management method provided in an embodiment of the present application; Figure 4 Another functional management timing diagram provided in an embodiment of the present application; Figure 5 This is a diagram of the functional management system architecture provided by an embodiment of the present application; Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0013] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0014] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0015] As disclosed in the background technology, with the rapid development of information technology, the demand for security and functional flexibility of hardware equipment is increasing, and server management systems usually rely on baseboard management controllers for remote monitoring and management. However, the hierarchical authorization of service functions still mainly relies on software authorization methods, such as enabling specific functions after verifying permissions by serial numbers, encryption keys, or cloud verification methods. However, these methods have the following shortcomings: low security, traditional software authorization is easy to be cracked or tampered with, such as pirated keys or software cracking; lack of flexibility, most server function authorizations are currently static settings and cannot be dynamically adjusted according to enterprise needs; high management complexity, after purchasing a server, the enterprise needs to change the authorization, usually need to re-apply for a license or perform manual operations, resulting in increased management costs.

[0016] For example, some existing solutions use local user authentication to define user group permissions on the user management page of the baseboard management controller. Different users can be added based on different user group permissions. However, in this technical solution, the password strength depends on the user and is easily cracked by packages or dictionary attacks. Password storage is risky. Passwords are usually stored in encrypted or hashed form in the local storage medium of the baseboard management controller. However, if the password is not strengthened enough or the storage method is inappropriate, there may be a risk of leakage. Management complexity is high and user management is decentralized. Each baseboard management controller needs to manage local user accounts separately, which leads to a significant increase in management complexity when the number of devices is large. In addition, there are difficulties in permission synchronization and complex user lifecycle management. Operations such as user creation, modification, deletion, and permission modification need to be completed manually on each baseboard management controller, which is inefficient and prone to errors.

[0017] Another existing solution is domain user authentication, which manages BMC users through Active Directory (AD), Lightweight Directory Access Protocol (LDAP), or Remote Authentication Dial-In User Service (RADIUS). Administrative permissions are set in AD, LDAP, or RADIUS, and different users are created with different permissions. However, this authentication method presents a single point of failure. Because BMC domain user authentication relies on an external authentication service, if the authentication service is unavailable, such as due to a network outage or server failure, the BMC will be unable to complete user authentication, paralyzing management functions. The authentication process requires communication with an external server, and network latency can result in extended authentication response times, impacting user experience. Furthermore, configuration complexity arises, requiring integration of the BMC with the domain authentication system, including domain controller address, port number, certificate, and user information binding, requiring high technical expertise from the administrator. Certificate management is complex, and if encrypted communication is used, certificate generation, deployment, and updates must be managed, increasing the operational and maintenance burden. Furthermore, there is a security risk. If the domain account credentials are leaked, attackers can use these credentials to access all baseboard management controller devices integrated with domain authentication, which will have a wide range of impacts.

[0018] Therefore, this application proposes an encryption authorization mechanism based on logic devices and controllers, which can achieve dynamic adjustment of server functions while ensuring authorization security and improving flexibility.

[0019] The embodiment of the present application provides a function management method, which uses a controller and a logic device to implement dynamic configuration management of server functions after the server is started, such as Figure 1 Shown, including: S1. In response to detecting that controller firmware is loaded, the controller obtains encrypted license information pre-stored in the controller.

[0020] Specifically, in the embodiments of the present application, the controller is preferably configured as a baseboard management controller. In some implementation scenarios, it can also be configured as a controller with similar functions to the baseboard management controller, which is not limited in this application. The present application determines whether the server is started by detecting whether the controller firmware is loaded. That is, after detecting that the controller firmware is loaded, the controller determines that the current server is started, at which point the controller is triggered to obtain the encrypted license information pre-written in the controller. The encrypted license information is usually written in a non-ceremonial memory.

[0021] S2. The controller sends the encrypted license information to the logic device for security verification.

[0022] Specifically, in the present application, the above-mentioned logic device is preferably set to a CPLD (Complex Programmable Logic Device). Of course, in some embodiments, it can also be set to a PLD (Programmable Logic Device) and an FPGA (Field Programmable Gate Array), etc. The present application does not limit the specific type of logic device, and it is set by those skilled in the art according to actual conditions; the present application pre-burns security verification and decryption implementation files for encrypted license information in the logic device.

[0023] In this application, communication between the controller and the logic device can be achieved through a variety of interfaces, including but not limited to SPI (Serial Peripheral Interface, a synchronous serial communication interface), I²C (Inter-Integrated Circuit, a serial communication protocol) and GPIO (General-Purpose Input / Output, general input and output interface).

[0024] The above security verification is performed in the logic device, specifically including: Parse the encrypted license information to obtain the license signature contained therein. It is understood that server manufacturers generate license files based on customer requirements and digitally sign them using their private keys. When the controller needs to activate the license file, it sends it to the logic device, which verifies the validity of the license signature using a pre-stored public key. If the license signature is detected as valid, the security verification is confirmed to have passed, indicating that the license file has not been modified. If the license signature is detected as invalid, the security verification is confirmed to have failed, indicating that the license file may have been modified and is not secure, and the license file is rejected.

[0025] Specifically, the encryption algorithm for generating the public and private keys preferably uses the RSA or ECC algorithm. Of course, in some special implementation scenarios, those skilled in the art may also set it based on actual circumstances, and this application does not limit this. The RSA (Rivest-Shamir-Adleman algorithm), an asymmetric encryption algorithm based on the large integer factorization problem, is widely used in various scenarios and provides high security. The ECC (Elliptic Curve Cryptography) algorithm provides the same or even higher level of security than RSA, but uses a shorter key length, which means it can perform encryption operations faster while occupying fewer resources.

[0026] This application utilizes a logic device to decrypt the license, adding security measures at the hardware level. Because the signature verification process is performed within the logic device, rather than relying on easily compromised software, the attack surface is significantly reduced, significantly improving the security of the license verification process and preventing unauthorized access and tampering. Even if an attacker gains control of the controller, they cannot forge a valid license file without physical access to reprogram the logic device or crack the public key stored within it.

[0027] S3. The controller receives an unlocking function code fed back by the logic device in response to detecting that the security verification has passed, and configures the server function according to the unlocking function code.

[0028] Furthermore, after confirming that security verification has passed, the logic device must also perform the following steps: parsing the license file level in the encrypted license information, determining the unlocking function code based on the license level and a pre-stored mapping table that stores the correspondence between license file levels and function codes; and sending the unlocking function code to the controller. If the controller detects that security verification has failed, it receives an abnormality alarm from the logic device and, based on the abnormality alarm, interrupts the controller firmware loading process, preventing the controller firmware from being successfully burned.

[0029] Specifically, the above-mentioned license file level defines the level of functions that users can obtain. In the specific implementation scenario, if it is set to three levels; the first level corresponds to the personal version license, and the corresponding functions are query function and configuration function; the second level corresponds to the small business version license, and the corresponding functions are general configuration function, power control function, remote media function, remote KVM function, query function and configuration function; the third level corresponds to the enterprise version license, and the corresponding functions are user configuration function, general configuration function, power control function, remote media function, remote KVM function, security configuration function, debugging and diagnosis function, query function, and configuration function. It can be understood that the setting of the license file level is not limited to the setting in the specific scenario mentioned above, and can also be customized according to different permission requirements. This application does not limit this. Consistent with the above-mentioned disclosure, the above-mentioned levels and corresponding functions pre-define a mapping relationship table and save it in a readable storage medium for logical devices to read and parse. Through the above steps, the available functions can be dynamically started in the logical device according to the license level, the server function can be dynamically adjusted, and the flexibility of the server function configuration can be further improved.

[0030] Of course, in some implementation scenarios, instruction sequences corresponding to specific functions for each license level can be directly embedded in the logic design of the logic device. Thus, upon receiving and parsing the encrypted license information and obtaining the corresponding license level, the logic device automatically executes the corresponding instruction sequence to enable the corresponding function. The function code corresponding to the enabled function is then sent to the controller for subsequent resource allocation.

[0031] The logic device uses a preconfigured public key to verify the digital signature of the encrypted license information, ensuring the license file has not been tampered with. It then extracts the license level from the encrypted license information. It then determines the decrypted function code by querying a mapping table, activates the corresponding function, and finally sends the function code to the controller. The controller then dynamically allocates the resources required for each server function based on the decrypted unlocking function code received, enabling the configuration of the unlocked server function.

[0032] like Figure 2 As shown in the timing diagram, this application is based on the collaborative work of the controller and the logic device. The controller is responsible for reading and submitting the corresponding encrypted license information, which is further sent to the logic device. The logic device is responsible for verifying the authenticity of the encrypted license information and ensuring security by decrypting it at the hardware level. On the premise of ensuring security, the corresponding license level is parsed and the corresponding service function is dynamically enabled according to the license level.

[0033] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0034] The embodiment of the present application also provides a function management method, which uses a controller and a logic device to implement dynamic configuration management of server functions after the server is started, such as Figure 3 Shown, including: X1. In response to receiving a server authorization change request, the controller parses the license information to be updated contained in the server authorization change request.

[0035] Specifically, the client submits a server authorization change request, and the controller responds to the server authorization change request, parses the license information to be changed contained therein, and sends it to the cloud authorization server later.

[0036] X2. The controller generates a license update instruction based on the license information to be updated and sends it to the cloud authorization server to verify the legitimacy of the license information to be updated.

[0037] The cloud authorization server and the controller typically communicate via an encrypted channel, such as https, to send the generated license update instructions to the cloud authorization server. Alternatively, mutual TLS (Transport Layer Security) can be used, where the controller possesses the cloud authorization server's certificate to verify its identity before communication. If the controller's identity is abnormal, a malicious change warning is displayed, alerting the user that the controller is currently abnormal. Of course, in other implementation scenarios, other communication methods can also be used to achieve communication between the cloud authorization server and the controller.

[0038] In some implementation scenarios, the above-mentioned cloud authorization server disclosed in the embodiments of the present application is also seamlessly integrated with the central management system, wherein the central management system can provide a management interface to the administrator for viewing, managing and updating the license files stored in the entire cloud authorization server. Specifically, when a new server is online, the controller sends a license activation request to the cloud authorization server, which includes a server identifier. The cloud server responds to the license activation request, feeds back the corresponding license file to the controller and writes it. The central management system regularly generates management reports, displaying the license status of all servers recorded in the cloud server, including validity period and enabled functions, etc., and provides detailed log records to help managers track any suspicious activities or errors. Through the integration of the above-mentioned cloud authorization server and the central management system, enterprises can realize centralized management of license information of multiple servers, greatly simplifying the management process and improving management efficiency.

[0039] Specifically, the license update instruction includes the license information to be updated and the target server identifier. After receiving the license update instruction sent by the controller, the cloud authorization server performs a legitimacy verification, specifically including: Parse the license information to be updated to obtain the license signature and license file in the updated license information; verify the validity of the license signature based on the pre-stored public key; wherein, the method of verifying the validity of the license signature in the cloud server is consistent with that of verifying the validity of the license signature in the logic device, and this application will not repeat them here.

[0040] In response to detecting that the license signature is valid, querying the validity period of the license file; in response to detecting that the license file is within the validity period, verifying the uniqueness of the license file; if the license file is not within the validity period, determining that the license file is not legal; in response to detecting that the license file is unique, determining that the license information to be updated is legal.

[0041] Specifically, verifying the uniqueness of the license file involves querying whether a historical server identifier matching the license file exists. Specifically, the cloud-based authorization server queries its internal database for a historical server identifier matching the license file. It will be appreciated that when a license file is first activated, an initial binding is typically required. During this initial binding, the controller sends the license file and the corresponding bound server identifier to the cloud-based authorization server. Therefore, the uniqueness of the license file can be determined by checking whether the corresponding server identifier exists in the cloud-based authorization server.

[0042] In response to the fact that the historical server identifier is not detected, it is determined that the license information to be updated is legitimate, that is, the license file is activated for the first time. In response to the fact that the historical server identifier is detected, it is verified whether the historical server identifier is consistent with the target server identifier; in response to the fact that the historical server identifier is detected to be consistent with the target server identifier, it is determined that the license information to be updated is legitimate, that is, although the license file is not activated for the first time, the bound devices are the same and are unique; in response to the fact that the historical server identifier is detected to be inconsistent with the target server identifier, it is determined that the license information to be updated is not legitimate, that is, the target server to which the license file is currently to be bound is different from the historical server to which it has been bound, and is not unique. If the cloud authorization server determines that the above-mentioned license file is not legitimate, it directly generates an exception alarm to notify the server management user of the license exception of the target server. The license file authentication mechanism based on the above-mentioned verification prevents unauthorized users from abusing server resources and prevents exceptions caused by the use of license files after being attacked, thereby further improving the stability of the server.

[0043] X3. The controller receives the license information to be updated from the cloud authorization server after confirming that the license information to be updated is legal, and sends it to the logic device for security verification.

[0044] That is, after verifying the legitimacy of the license information to be updated, the controller sends the license information to the logic device, which then performs security verification on the license information and determines the matching unlocking function code to be changed. The process of performing security verification and changing the unlocking function code in the logic device is consistent with the aforementioned process and will not be further described in this application.

[0045] X4. The controller receives the unlock function code to be changed fed back by the logic device in response to detecting that the security verification has passed and reconfigures the server function according to the unlock function code to be changed.

[0046] like Figure 4 As shown in the timing diagram, this application responds to server authorization changes through the controller, verifies the legitimacy of the license file to be updated by interacting with the cloud authorization server, and then completes the startup of the server function and resource configuration based on the license information to be updated. This application achieves the process of updating the license file and adjusting the function without restarting the server, thereby improving the availability of the server.

[0047] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0048] Based on the method disclosed in the above embodiment, the embodiment of the present application further provides a function management system, such as Figure 5 As shown, specifically including: a data acquisition module 510 for acquiring encrypted license information pre-stored in the controller in response to detecting controller firmware loading; Data communication module 520, used to send encrypted license information to the logic device for security verification; The data communication module 520 is further configured to receive an unlocking function code fed back by the logic device in response to detecting that the security verification has passed; The function management module 530 is used to manage server resources according to the unlocking function code.

[0049] In some implementation scenarios, the data acquisition module 510 is further configured to, in response to receiving the server authorization change request, parse the license information to be updated contained in the server authorization change request; The data communication module 520 is further configured to generate a license update instruction based on the license information to be updated and transmit it to the cloud authorization server to verify the legitimacy of the license information to be updated. The license update instruction includes the license information to be updated and a target server identifier. The data communication module 520 is further configured to receive the license information to be updated fed back by the cloud authorization server after the cloud authorization server determines that the license information to be updated is legal, and send the received license information to the logic device for security verification; The data communication module 520 is further configured to receive the unlocking function code to be changed fed back by the logic device in response to detecting that the security verification has passed; The function management module 530 is further configured to reconfigure the server function according to the unlocked function code to be changed.

[0050] An embodiment of the present application further provides an electronic device, comprising: one or more processors; and a memory associated with the one or more processors, the memory being configured to store program instructions. When the program instructions are read and executed by the one or more processors, the program instructions perform the following operations: In response to detecting controller firmware loading, obtaining encrypted license information pre-stored in the controller; Sending encrypted license information to the logic device for security verification; The receiving logic device responds to detecting an unlocking function code fed back by the security verification; Configure server functions according to the unlock function code.

[0051] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: In response to receiving the server authorization change request, parsing the license information to be updated contained in the server authorization change request; Generate a license update instruction based on the license information to be updated and send it to the cloud authorization server to verify the legitimacy of the license information to be updated. The license update instruction includes the license information to be updated and the target server identifier; Receive the license information to be updated fed back by the cloud authorization server after confirming that the license information to be updated is legal and send it to the logic device for security verification; The receiving logic device responds to the detection of the unlocking function code to be changed fed back by the security verification; Reconfigure the server function according to the unlocked function code to be changed.

[0052] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: In response to detecting that the security verification fails, receiving an abnormality alarm fed back by the logic device; Interrupt controller firmware loading based on abnormal alarms.

[0053] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: Parsing the encrypted license information to obtain a license signature in the encrypted license information; Verify the validity of the license signature based on the pre-stored public key; In response to detecting that the license signature is valid, confirming that the security verification is passed; In response to detecting that the license signature is invalid, it is determined that the security verification has failed.

[0054] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: Parse the license file level from the encrypted license information; Determine the unlocking function code according to the license level and a pre-stored mapping relationship table, wherein the mapping relationship table stores the corresponding relationship between the license file level and the function code; Send the unlock function code to the controller.

[0055] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: Parsing the license information to be updated to obtain the license signature and license file in the license information to be updated; Verify the validity of the license signature based on the pre-stored public key; In response to detecting that the license signature is valid, querying the validity period of the license file; In response to detecting that the license file is within the validity period, verifying the uniqueness of the license file; In response to detecting that the license file is unique, it is determined that the license information to be updated is legitimate.

[0056] In some implementation scenarios, when the program instructions are read and executed by one or more processors, the program instructions further perform the following operations: Check whether there is a history server ID that matches the license file; In response to not detecting the history server identifier, determining that the license information to be updated is legitimate; In response to detecting the existence of the historical server identifier, verifying whether the historical server identifier is consistent with the target server identifier; In response to detecting that the historical server identifier is consistent with the target server identifier, determining that the license information to be updated is legitimate; In response to detecting that the historical server identifier is inconsistent with the target server identifier, it is determined that the license information to be updated is not legitimate.

[0057] in, Figure 6The electronic device architecture is shown as an example, and may include a processor 610, a video display adapter 611, a disk drive 612, an input / output interface 613, a network interface 614, and a memory 620. The processor 610, the video display adapter 611, the disk drive 612, the input / output interface 613, the network interface 614, and the memory 620 may be communicatively connected via a bus 630.

[0058] Among them, the processor 610 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in this application.

[0059] The memory 620 can be implemented in the form of ROM (Read Only Memory, programmable memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, etc. The memory 620 can store an operating system 621 for controlling the execution of the electronic device 600, and a basic input and output system (BIOS) 622 for controlling the low-level operations of the electronic device 600. In addition, a web browser 623, a data storage management system 624, and an icon font processing system 625, etc. can also be stored. The above-mentioned icon font processing system 625 can be an application program that specifically implements the operations of the aforementioned steps in the embodiment of the present application. In short, when the technical solution provided by the present application is implemented by software or firmware, the relevant program code is stored in the memory 620 and is called and executed by the processor 610.

[0060] The input / output interface 613 is used to connect to input / output modules to enable information input and output. The input / output modules can be configured as components within the device (not shown) or externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, and various sensors, while output devices may include a display, speaker, vibrator, indicator light, and the like.

[0061] The network interface 614 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.).

[0062] The bus 630 comprises a pathway for transmitting information between the various components of the device (eg, the processor 610 , the video display adapter 611 , the disk drive 612 , the input / output interface 613 , the network interface 614 , and the memory 620 ).

[0063] In addition, the electronic device 600 can also obtain information on specific collection conditions from the virtual resource object collection condition information database for use in condition judgment.

[0064] It should be noted that although the above device only shows a processor 610, a video display adapter 611, a disk drive 612, an input / output interface 613, a network interface 614, a memory 620, a bus 630, etc., in a specific implementation, the device may also include other components necessary for normal execution. In addition, it will be understood by those skilled in the art that the above device may also include only the components necessary to implement the solution of the present application, and does not necessarily include all the components shown in the figure.

[0065] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above-mentioned resource management method embodiments when running.

[0066] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0067] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above-mentioned function management method embodiments are implemented.

[0068] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned function management method embodiments are implemented.

[0069] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0070] The above is a detailed introduction to a function management method provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A function management method, characterized in that: Applied to a controller, the method includes: In response to detecting controller firmware loading, obtaining encrypted license information pre-stored in the controller; sending the encrypted license information to a logic device for security verification; receiving an unlocking function code fed back by the logic device in response to detecting that the security verification passes; The server function is configured according to the unlock function code.

2. The method according to claim 1, characterized in that Applied to the controller, after the server is started, the method includes: In response to receiving the server authorization change request, parsing the license information to be updated contained in the server authorization change request; Generate a license update instruction based on the license information to be updated and send it to the cloud authorization server to verify the legitimacy of the license information to be updated, wherein the license update instruction includes the license information to be updated and a target server identifier; receiving the license information to be updated fed back by the cloud authorization server after determining that the license information to be updated is legal, and sending the information to the logic device for security verification; receiving an unlocking function code to be changed fed back by the logic device in response to detecting that the security verification passes; Reconfigure the server function according to the unlocking function code to be changed.

3. The method according to claim 1, characterized in that After sending the encrypted license information to the logic device for security verification, the method further includes: In response to detecting that the security verification fails, receiving an abnormality alarm fed back by the logic device; According to the abnormal alarm, the controller firmware loading is interrupted.

4. The method according to claim 1 or 2, characterized in that Applied to the logic device, the security verification includes: parsing the encrypted license information to obtain a license signature in the encrypted license information; Verifying the validity of the license signature based on a pre-stored public key; In response to detecting that the license signature is valid, confirming that the security verification is passed; In response to detecting that the license signature is invalid, confirming that the security verification has failed.

5. The method according to claim 4, characterized in that Applied to the logic device, after the confirmation safety verification passes, the method further includes: parsing the license file level in the encrypted license information; Determining an unlocking function code according to the license file level and a pre-stored mapping relationship table, wherein the mapping relationship table stores a correspondence between the license file level and the function code; Sending the unlock function code to the controller.

6. The method according to claim 2, characterized in that Applied to a cloud authorization server, the verification of the legitimacy of the license information to be updated includes: Parsing the license information to be updated to obtain the license signature and license file in the license information to be updated; Verifying the validity of the license signature based on a pre-stored public key; In response to detecting that the license signature is valid, querying the validity period of the license file; In response to detecting that the license file is within the validity period, verifying the uniqueness of the license file; In response to detecting that the license file is unique, it is determined that the license information to be updated is legitimate.

7. The method according to claim 6, characterized in that Applied to the cloud authorization server, the verification of the uniqueness of the license file includes: Query whether there is a history server identifier that matches the license file; In response to not detecting the history server identifier, determining that the license information to be updated is legitimate; In response to detecting the existence of the historical server identifier, verifying whether the historical server identifier is consistent with the target server identifier; In response to detecting that the historical server identifier is consistent with the target server identifier, determining that the license information to be updated is legitimate; In response to detecting that the historical server identifier is inconsistent with the target server identifier, it is determined that the to-be-updated license information is not legitimate.

8. A function management system, characterized in that: The system comprises: a data acquisition module, configured to acquire encrypted license information pre-stored in the controller in response to detecting controller firmware loading; A data communication module, configured to send the encrypted license information to a logic device for security verification; The data communication module is further configured to receive an unlocking function code fed back by the logic device in response to detecting that the security verification has passed; The function management module is used to manage server resources according to the unlocking function code.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the function management method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the function management method according to any one of claims 1 to 7.

Images