Authorization control method, authorization method, device and computing device

Abstract

The present invention discloses an authorization control method, including: receiving an authorization request sent by a client based on an application file, obtaining an application ciphertext, a first signature information and a first public key from the application file; verifying the first signature information based on the first public key; decrypting the application ciphertext based on a second private key to obtain a device identification of the client, and generating corresponding device information based on the device identification; associating the authorization configuration information with the device information to generate an authorization file; sending the authorization file to the client so that the client activates the application based on the authorization file; regularly obtaining the actual running time of the client, judging whether the actual running time exceeds the predetermined running time of the application, so as to determine whether the application authorization has expired. The present invention also discloses a corresponding authorization method, an authorization device and a computing device. The authorization scheme according to the present invention can be used in an intranet environment to prevent the leakage and reuse of authorization information.

Description

[0001] This application is a divisional application of invention patent 2021103106648 applied for on March 24, 2021. Technical Field

[0002] The present invention relates to the technical field of application authorization, and in particular to an authorization control method, an authorization method, an authorization device and a computing device. Background Art

[0003] With the development of Linux, Linux desktop systems have been widely used in all walks of life. At present, domestic operating systems all use the Linux kernel. There are usually the following ways to install software on domestic operating systems: installation based on source code compilation, installation based on offline packages (such as deb, rpm, etc.), installation based on software warehouse package managers (such as apt, yum, pacman, zypper, etc.), and installation based on application stores. Among them, the first two installation methods require a certain technical foundation and can solve the dependency problem of software packages. Installation based on the application store is generally executed through the command line, which is the most convenient installation method for ordinary users.

[0004] At present, the application fields of domestic operating systems include some special fields, such as public security and finance. The network environment of these special fields is usually a dedicated network isolated from the Internet, which is in an offline environment without access to the Internet. The software warehouses and application stores provided by domestic operating systems usually require Internet access to be able to access. Therefore, software warehouses and application stores deployed on the Internet cannot provide services for such users.

[0005] In the prior art, software activation and authorization solutions are implemented based on the authorization server in the Internet environment. During the activation and operation of the software, the local hardware information is uploaded to the authorization server through the Internet. The authorization server determines the running status of the software by matching records and makes authorization decisions. This authorization solution can only be implemented based on the Internet environment, but some corporate intranet environments cannot access the Internet and are in an offline environment.

[0006] Therefore, an authorization control method that can be used in an offline environment is needed to solve the problems existing in the above technical solutions. Summary of the invention

[0007] To this end, the present invention provides an authorization control method, an authorization method, an authorization device and a computing device to solve or at least alleviate the above problems.

[0008] According to one aspect of the present invention, there is provided an authorization control method, which is executed in a server, and the method comprises: receiving an authorization request for an application sent by a client based on an application document, obtaining an application ciphertext, a first signature information and a first public key from the application document; verifying the first signature information based on the first public key; if the first signature information is verified, decrypting the application ciphertext based on a second private key to obtain a device identification of the client, and generating corresponding device information based on the device identification; associating authorization configuration information with the device information to generate an authorization document; sending the authorization document to the client so that the client activates the application based on the authorization document; and periodically obtaining the actual operating time of one or more clients associated with the authorization configuration information, judging whether the actual operating time exceeds the predetermined operating time of the application, so as to determine whether the application authorization has expired.

[0009] Optionally, in the authorization control method according to the present invention, the step of determining whether the actual running time exceeds the predetermined running time of the application includes: determining the predetermined running time of the application according to the authorization configuration information in the authorization file; if it is determined that the actual running time exceeds the predetermined running time, determining that the application authorization has expired.

[0010] Optionally, in the authorization control method according to the present invention, the step of periodically obtaining the actual operating time of one or more clients associated with the authorization configuration information includes: when the authorization configuration information is associated with multiple clients, recording the operating time of multiple clients and generating a duration record; periodically querying the duration record to obtain the actual operating time of multiple clients.

[0011] Optionally, in the authorization control method according to the present invention, the step of periodically obtaining the actual running time of one or more clients associated with the authorization configuration information includes: when the authorization configuration information is associated with a client, timing statistics of the running time of the client; and periodically obtaining the timing statistics value to obtain the actual running time of the client.

[0012] Optionally, in the authorization control method according to the present invention, the authorization configuration information includes the scheduled running time and authorization deadline of the application, and the step of determining whether the application authorization has expired also includes: judging whether the current usage time exceeds the authorization deadline of the application; if it exceeds the authorization deadline, determining that the application authorization has expired.

[0013] Optionally, in the authorization control method according to the present invention, the step of generating an authorization file includes: associating the authorization configuration information with the device information to generate authorization information; encrypting the authorization information based on the first public key to generate an authorization ciphertext; signing the authorization ciphertext based on the second private key to generate second signature information; and generating an authorization file based on the authorization ciphertext, the second signature information and the second public key.

[0014] Optionally, in the authorization control method according to the present invention, the step of obtaining the application ciphertext, the first signature information and the first public key from the application document includes: decoding the application document based on a Decode method to obtain string information; obtaining the application ciphertext, the first signature information and the first public key from the string information.

[0015] According to one aspect of the present invention, there is provided an authorization method, which is executed on a client, and includes the steps of: obtaining device information of the client, and generating a corresponding device identification based on the device information; encrypting the device identification based on a second public key to generate an application ciphertext, wherein the second public key matches a second private key; generating a matching first private key and a first public key, and signing the application ciphertext based on the first private key to generate first signature information; generating an application file based on the application ciphertext, the first signature information and the first public key; sending an authorization request for an application to a server based on the application file to obtain an authorization file generated by the server; and obtaining authorization information based on the authorization file so as to activate the application based on the authorization information.

[0016] Optionally, in the authorization method according to the present invention, the step of obtaining authorization information based on the authorization file includes: obtaining the authorization ciphertext, the second signature information and the second public key from the authorization file; verifying the second signature information based on the second public key; if the second signature information is verified, decrypting the authorization ciphertext based on the first private key to obtain the authorization information.

[0017] According to one aspect of the present invention, there is provided an authorization device, which resides on a client and includes: an acquisition module, adapted to acquire device information of the client and generate a corresponding device identification based on the device information; an encryption module, adapted to encrypt the device identification based on a second public key matching a second private key to generate an application ciphertext; generate a matching first private key and a first public key, sign the application ciphertext based on the first private key to generate first signature information; a request module, adapted to generate an application file based on the application ciphertext, the first signature information and the first public key, and send an authorization request for an application to a server based on the application file to obtain an authorization file; and a decryption module, adapted to acquire authorization information based on the authorization file so as to activate the application based on the authorization information.

[0018] According to one aspect of the present invention, a computing device is provided, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the method as described above.

[0019] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the method described above.

[0020] According to the technical solution of the present invention, an authorization control method applicable to an intranet environment is provided, wherein the client performs digital signature and encryption in the process of generating an application document based on device information, and the server generates a corresponding authorization file and returns it to the client only after the application document is successfully signed and decrypted, and the device information is successfully matched. In addition, the server also performs digital signature and encryption in the process of generating the authorization file. After the client obtains the authorization file, it also needs to verify and decrypt the authorization file successfully before it can obtain the authorization information provided by the server, and then successfully obtain the authorization of the application based on the authorization information. In this way, the leakage and reuse of the authorization information can be prevented, the theft of the authorization information and the tampering of the authorization configuration information can be avoided, thereby effectively maintaining the copyright of the application.

[0021] Furthermore, the present invention can prevent users from attempting to extend the authorization expiration time by modifying the system time by periodically incrementing the stored fields to record the service running time, thereby ensuring that the authorization service is safe and reliable.

[0022] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein can be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other purposes, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout the present disclosure, the same reference numerals generally refer to the same parts or elements.

[0024] Figure 1 A schematic diagram of an application authorization system 100 according to an embodiment of the present invention is shown;

[0025] Figure 2A schematic diagram of a computing device 200 according to an embodiment of the present invention is shown;

[0026] Figure 3 A flowchart of an authorization control method 300 according to an embodiment of the present invention is shown;

[0027] Figure 4 A flowchart of an authorization method 400 according to an embodiment of the present invention is shown; and

[0028] Figure 5 FIG. 1 is a schematic diagram of an authorization device 160 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0030] Figure 1 A schematic diagram of an application authorization system 100 according to an embodiment of the present invention is shown.

[0031] like Figure 1 As shown, the application authorization system 100 includes one or more clients 110 and a server 120 corresponding to the application. It should be noted that the application authorization system 100 of the present invention is in an offline environment without access to the Internet, the client 110 and the server 120 are not connected to the Internet, and the client 110 and the server 120 in the system 100 are connected based on intranet communication.

[0032] The client 110 is a terminal device used by the user that is suitable for installing applications and needs to obtain permission to use the applications. It can be a personal computer such as a desktop computer or a laptop computer, or a mobile phone, tablet computer, multimedia device, smart wearable device, etc., but is not limited to these.

[0033] The server 120 is used to control the authorization of the application programs installed in the client 110. It can be implemented as a computing device such as a desktop computer, a laptop computer, a processor chip, a mobile phone, a tablet computer, etc., and can also be implemented as a system composed of multiple computing devices.

[0034] In one embodiment, the client 110 has an application to be authorized and an authorization device 160 corresponding to the application. The authorization device 160 can be used to activate the application to obtain authorization for the application. Specifically, the authorization device 160 can generate an application file and send an authorization request for the application to the server 120 based on the application file. After verifying the information in the application file of the client 110, the server 120 can generate an authorization file associated with the device information of the client 110 and return it to the client 110. The authorization device 160 in the client 110 can activate the local application based on the authorization file to obtain authorization for the application.

[0035] According to an embodiment of the present invention, the client 110 will sign and encrypt the application information during the process of generating the application file. Based on this, after the server 120 obtains the application file of the client 110, it needs to verify the signature and decrypt the application file successfully before generating the authorization file for the client. In addition, the server 120 will sign and encrypt the authorization information during the process of generating the authorization file. After the client 110 obtains the authorization file of the server 120, it also needs to verify the signature and decrypt the authorization file successfully before obtaining the authorization information provided by the server 120, and then obtain the authorization of the application based on the authorization information.

[0036] In one embodiment, the client 110 and the server 120 may generate and provide their own key pairs. The client 110 is locally adapted to generate and provide a first key pair, including a first private key and a first public key that match each other. The server 120 is locally adapted to generate and provide a second key pair, including a second private key and a second public key that match each other. The client 110 and the server 120 encrypt and sign the application information and the authorization information based on the corresponding keys.

[0037] In one embodiment, the server 120 of the present invention is suitable for executing the authorization control method 300. The server 120 processes the authorization request of the client 110 for the application by executing the authorization control method 300, so as to control the client 110 to obtain the authorization of the application. The authorization control method 300 of the present invention will be described in detail below.

[0038] In one embodiment, the client 110 of the present invention is suitable for executing the authorization method 400. The client 110 sends an authorization request by executing the authorization method 400 to request to obtain the authorization file provided by the server 120, and obtains the authorization of the application based on the authorization file. The authorization method 400 of the present invention will also be described in detail below.

[0039] In one embodiment, the server 120 and the client 110 in the present invention can be implemented as a computing device respectively, so that the authorization control method 300 and the authorization method 400 of the present invention can be executed in the computing device.

[0040] Figure 2 FIG. 2 shows a block diagram of a computing device 200 according to an embodiment of the present invention. Figure 2 As shown, in a basic configuration 202, computing device 200 typically includes a system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.

[0041] Depending on the desired configuration, the processor 204 can be any type of processing, including but not limited to: a microprocessor (UP), a microcontroller (UC), a digital information processor (DSP), or any combination thereof. The processor 204 can include one or more levels of cache such as a primary cache 210 and a secondary cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.

[0042] Depending on the desired configuration, the system memory 206 can be any type of memory, including but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. The system memory 106 may include an operating system 220, one or more applications 222, and program data 224. The application 222 is actually a plurality of program instructions, which are used to instruct the processor 204 to perform corresponding operations. In some embodiments, the application 222 can be arranged to cause the processor 204 to operate using the program data 224 on the operating system.

[0043] Computing device 200 also includes storage device 232 , which includes removable storage 236 and non-removable storage 238 .

[0044] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) to the basic configuration 202 via the bus / interface controller 230. At least a portion of the operating system 220, the application 222, and the data 224 may be stored on the removable storage 236 and / or the non-removable storage 238, and when the computing device 200 is powered on or the application 222 is to be executed, it is loaded into the system memory 206 via the storage interface bus 234 and executed by the one or more processors 204.

[0045] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include a graphics processing unit 248 and an audio processing unit 250. They can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which may be configured to facilitate communication with external devices such as input devices (e.g., keyboards, mice, pens, voice input devices, touch input devices) or other peripherals (e.g., printers, scanners, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which may be arranged to facilitate communication with one or more other computing devices 262 via a network communication link via one or more communication ports 264.

[0046] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or its changes can be performed in the signal in a manner that encodes information. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium used herein can include both storage media and communication media.

[0047] In the computing device 200 according to the present invention, the application 222 includes a plurality of program instructions for executing the authorization control method 300 or the authorization method 400, and these program instructions can respectively instruct the processor 204 to execute the authorization control method 300 and the authorization method 400 of the present invention. It should be noted that the computing device 200 can execute the authorization control method 300 of the present invention when acting as a server, and can execute the authorization method 400 of the present invention when acting as a client.

[0048] Figure 3 The flowchart of the authorization control method 300 according to one embodiment of the present invention is shown. The method 300 is suitable for being executed in the server 120 (such as the aforementioned computing device 200).

[0049] like Figure 3 As shown, the method 300 starts at step S310 .

[0050] In step S310, the authorization device of the receiving client 110 sends an authorization request for the application based on the application document, and obtains the application ciphertext, the first signature information and the first public key from the application document.

[0051] It should be noted that the authorization device of the client 110 generates an application file based on the device information before sending the authorization request. Specifically, the authorization device obtains the device information of the client 110, and generates a corresponding device identification by serializing the device information. Here, the device information of the client 110 includes, for example, a MAC address, a MAC address of an upper gateway, and hardware information in a dmi module, but is not limited thereto. Subsequently, the device identification is encrypted and calculated based on the second public key (a certificate provided by the server, built into the application), and an application ciphertext is generated after encryption. Subsequently, a matching first private key and a first public key are generated, and the application ciphertext is calculated based on the first private key and the signature algorithm SHA, that is, the application ciphertext is signed to generate a first signature information. Finally, an application file is generated based on the application ciphertext, the first signature information, and the first public key. In one embodiment, when generating an application file, the authorization device of the client 110 first serializes the application ciphertext, the first signature information, and the first public key to obtain string information, and then calls the Encode method to encode the string information into binary data to generate a binary application file. In this way, the client 110 can send the binary application file to the server 120 to request authorization for the application program.

[0052] According to one embodiment, based on the binary application file sent by the client 110, when the server 120 obtains the data in the application file in step S310, it needs to call the Decode method, decode the application file based on the Decode method, obtain the string information, and then obtain the application ciphertext, the first signature information and the first public key from the string information.

[0053] Subsequently, in step S320, the first signature information is verified based on the first public key provided by the client. If the verification of the first signature information fails, it means that the application information provided by the client has been tampered with, and the authorization file is no longer provided to the client, thereby avoiding the leakage and reuse of the authorization information. If the verification of the first signature information passes, step S330 is executed.

[0054] In step S330, the application ciphertext is decrypted based on the second local private key of the server to obtain the corresponding plaintext content, which is the device identification after the client serializes its device information. The device information before serialization is generated by decoding the device identification.

[0055] After generating the device information, the server 120 determines whether the device information obtained based on the client's application file matches the information stored locally on the server. If it does not match, it means that the client attempts to misappropriate the authorization information, and the authorization file will not be returned to the client. In this way, misappropriation of the authorization information is avoided.

[0056] If the device information matches successfully, execute step S340.

[0057] In step S340, the authorization configuration information is associated with the device information of the client 110, and an authorization file is generated based on the associated authorization configuration information and device information. Here, the authorization configuration information is configuration information related to application authorization. By establishing an association relationship between the authorization configuration information and the device information of the client 110, the authorization configuration information is bound to the client, so that the client 110 can activate its local application based on the matching authorization configuration information and obtain authorization for the application.

[0058] According to one embodiment, when generating an authorization file based on the authorization configuration information and the device information, the authorization configuration information is first associated with the device information to obtain the authorization information, and then the authorization information is encrypted and signed. Specifically, the authorization information is encrypted based on the first public key provided by the client to generate an authorization ciphertext. The authorization ciphertext is signed based on the second local private key of the server to generate second signature information. The authorization file is generated based on the authorization ciphertext, the second signature information and the second public key. Here, the binary authorization file is also generated by serializing the authorization ciphertext, the second signature information and the second public key and then encoding them.

[0059] Then, in step S350 , the authorization file is sent to the client 110 , so that the client 110 activates the application based on the authorization file.

[0060] Here, since the authorization file is generated by the server 120 after encrypting and signing the authorization information, after obtaining the authorization file, the client 110 needs to verify the signature and decrypt the authorization file before obtaining the authorization information. Specifically, after decoding the binary authorization file, the authorization device in the client 110 obtains the authorization ciphertext, the second signature information and the second public key in the authorization file, and verifies the second signature information based on the second public key. If the second signature information is verified, the authorization ciphertext is decrypted based on the first private key of the client 110 to obtain the authorization information (plain text). Based on the authorization information, the application can be activated to obtain the authorization of the application.

[0061] According to an embodiment of the present invention, each piece of authorization configuration information used for application authorization can be associated with device information of one or more clients 110, so that authorization files corresponding to multiple clients 110 can be generated based on one piece of authorization configuration information. In this way, one piece of authorization configuration information can be used for multiple clients 110 to authorize the application.

[0062] It should be noted that the authorization configuration information includes but is not limited to the scheduled running time of the application, the authorization deadline, and the maximum number of devices. In an embodiment of the present invention, the total running time of one or more clients 110 associated with the authorization configuration information cannot exceed the scheduled running time.

[0063] According to one embodiment, while the client 110 is running the authorized application, the server 120 further performs step S360.

[0064] In step S360, the actual running time of one or more clients associated with the authorization configuration information (i.e., clients that obtain application authorization based on the same authorization configuration information) is obtained at regular intervals, and it is determined whether the actual running time obtained exceeds the scheduled running time of the application, so as to determine whether the authorization service of the application has expired. Specifically, the scheduled running time of the application is determined based on the authorization configuration information in the obtained authorization file, and it is determined whether the actual running time of one or more clients corresponding to the authorization configuration information exceeds the scheduled running time. When the total running time exceeds the scheduled running time, it is determined that the authorization service of the application has expired, that is, the authorization of the application in the client 110 associated with the authorization configuration information has expired. Here, the actual running time refers to the current total running time of one or more clients. After determining that the application authorization has expired, the server can generate an application expiration message and send it to the client 110 to prompt the user that the authorization service has expired.

[0065] According to an embodiment, the actual running time of the application program by one or more clients 110 associated with the authorization configuration information is obtained periodically. Specifically, the running time of the service can be recorded by periodically incrementing the stored field. If the actual running time exceeds the configured predetermined running time, it is determined that the authorization service of the application program has expired and the service is stopped. In this way, it is not dependent on the system time, thereby preventing the user from attempting to extend the authorization expiration time by modifying the system time.

[0066] In one embodiment, when the authorization configuration information is associated with multiple clients, a data storage device supporting cron is used to record the running time of multiple clients and generate a time record. In this way, the server 120 can obtain the actual running time of multiple clients for the application by regularly querying the time record. By comparing whether the actual running time of multiple clients exceeds the predetermined running time in the authorization configuration information, it is determined whether the authorization service of the application has expired.

[0067] In another embodiment, when the authorization configuration information is associated with a client, the running time of the client is timed and counted. For example, by arranging a timer in the client 110, the running of the application is timed and counted, and after the timer is interrupted, the timing statistics are incremented. The server 120 periodically obtains the timing statistics of the running of the application in the client 110 through the asynchronous detection module, that is, it periodically queries the running time of the application, so as to obtain the actual running time of the client. By comparing whether the actual running time of the client exceeds the predetermined running time in the authorization configuration information, it is determined whether the authorization service of the application has expired.

[0068] According to one embodiment, the present invention may execute the following methods in parallel to determine whether the application authorization has expired:

[0069] The authorization deadline of the application is determined according to the authorization configuration information, and it is determined whether the current usage time exceeds the authorization deadline of the application. If it exceeds the authorization deadline, it is determined that the authorization of the application has expired. A message indicating that the application has expired can then be generated to prompt the user. In addition, the maximum number of devices can also be determined according to the authorization configuration information, and it is determined whether the number of currently authorized clients exceeds the maximum number of devices. If it exceeds the maximum number of devices, the authorization service for the application is stopped.

[0070] Figure 4 The flowchart of the authorization method 400 according to one embodiment of the present invention is shown. The method 400 is suitable for being executed in the client 110 (such as the aforementioned computing device 200).

[0071] Specifically, the client 110 resides with an application to be authorized and an authorization device 160 corresponding to the application to be authorized. The authorization device 160 is suitable for executing the authorization method 400 of the present invention. By executing the authorization method 400 of the present invention, the application in the client 110 can be activated and authorization of the application can be obtained.

[0072] like Figure 4 As shown, the method 400 starts at step S410 .

[0073] In step S410, the device information of the client 110 is obtained, and the corresponding device identification is generated by serializing the device information. Here, the device information of the client 110 includes, for example, a MAC address, a MAC address of an upper gateway, and hardware information in a DMI module, but is not limited thereto.

[0074] Subsequently, in step S420, the device identification is encrypted based on the second public key (the certificate provided by the server, built into the application), and the application ciphertext is generated after encryption. It should be noted that the second public key and the second private key are a pair of keys provided by the server 120, and the second public key matches the second private key.

[0075] Subsequently, in step S430, a matching first private key and a first public key are generated, and the application ciphertext is calculated based on the first private key and the signature algorithm SHA, that is, the application ciphertext is signed based on the first private key and the signature algorithm SHA to generate first signature information.

[0076] Subsequently, in step S440, an application file is generated based on the application ciphertext, the first signature information, and the first public key. In one embodiment, when generating an application file, the client first serializes the application ciphertext, the first signature information, and the first public key to obtain string information. Then, the Encode method is called to encode the string information into binary data to generate a binary application file. After the application file is generated, step S450 can be executed to request authorization for the application.

[0077] In step S450, an authorization request for the application is sent to the server 120 based on the application file to request the server 120 to generate the authorization file based on the authorization configuration information and the device information. Here, the specific method for the server 120 to generate the authorization file based on the authorization configuration information and the device information is as described in the method 300 above, and will not be repeated here.

[0078] Finally, in step S460, authorization information is obtained based on the authorization file, so as to activate the application based on the authorization information and obtain authorization for the application.

[0079] As mentioned above, the authorization file is generated by the server 120 after encrypting and signing the authorization information. Based on this, after obtaining the authorization file, the client 110 needs to verify the signature and decrypt the authorization file before obtaining the authorization information. Specifically, after decoding the binary authorization file, the authorization device in the client 110 obtains the authorization ciphertext, the second signature information and the second public key in the authorization file, verifies the second signature information based on the second public key, and if the second signature information is verified, the authorization ciphertext is decrypted based on the first private key of the client 110 to obtain the authorization information (plain text). Based on the authorization information, the application can be activated to obtain the authorization of the application. Here, after decrypting the authorization information, the device information in the authorization information is also matched with the actual device information of the client 110. If the match is successful, the authorization of the application can be successfully obtained based on the authorization information. If the match fails, it means that the authorization information may be leaked and reused, and the client 110 cannot obtain the authorization of the application.

[0080] Figure 5 FIG. 1 is a flowchart of the authorization device 160 according to an embodiment of the present invention.

[0081] like Figure 5As shown, the authorization device 160 includes an acquisition module 161, an encryption module 162 and a request module 163 which are connected in sequence. Among them, the acquisition module 161 is suitable for acquiring the device information of the client and generating a corresponding device identification based on the device information. The encryption module 162 is suitable for encrypting the device identification based on the second public key matching the second private key to generate an application ciphertext; generating a matching first private key and a first public key, signing the application ciphertext based on the first private key, and generating a first signature information. The request module 163 is suitable for generating an application document based on the application ciphertext, the first signature information and the first public key, and sending an authorization request for the application to the server based on the application document to obtain an authorization document. The decryption module 164 is suitable for obtaining authorization information based on the authorization document, so as to activate the application based on the authorization information and obtain authorization for the application.

[0082] It should be noted that the acquisition module 161 is used to execute the method in step S410 of the authorization method 400, the encryption module 162 is used to execute the method in steps S420 to S440 of the authorization method 400, the request module 163 is used to execute the method in step S450 of the authorization method 400, and the decryption module 164 is used to execute the method in step S460 of the authorization method 400. Here, the specific execution logic of the acquisition module 161, the encryption module 162, the request module 163 and the decryption module 164 will not be described in detail.

[0083] In summary, according to the authorization scheme of the present invention, the client performs digital signature and encryption in the process of generating an application document based on the device information. The server will generate a corresponding authorization file and return it to the client only after the application document is successfully verified and decrypted, and the device information is successfully matched. In addition, the server also performs digital signature and encryption in the process of generating the authorization file. After the client obtains the authorization file, it also needs to verify and decrypt the authorization file successfully before it can obtain the authorization information provided by the server, and then successfully obtain the authorization of the application based on the authorization information. In this way, the leakage and reuse of the authorization information can be prevented, and the theft of the authorization information and the tampering of the authorization configuration information can be avoided. In addition, the present invention can prevent users from attempting to extend the authorization expiration time by modifying the system time by periodically incrementing the stored fields to record the running time of the service, thereby ensuring that the authorization service is safe and reliable.

[0084] The various techniques described herein may be implemented in conjunction with hardware or application programs, or a combination thereof. Thus, the method and apparatus of the present invention, or some aspects or portions of the method and apparatus of the present invention may be in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes a device for practicing the present invention.

[0085] In the case where the program code is executed on a programmable computer, the mobile terminal generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code; the processor is configured to execute the application authorization method of the present invention according to the instructions in the program code stored in the memory.

[0086] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media stores information such as computer readable instructions, data structures, program modules or other data. Communication media generally embody computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and include any information transfer medium. Any combination of the above is also included within the scope of readable media.

[0087] In the description provided herein, algorithms and displays are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the examples of the present invention. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to implement the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0088] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0089] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0090] Those skilled in the art will appreciate that the modules or units or components of the devices in the examples disclosed herein may be arranged in the devices described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or may be divided into multiple submodules.

[0091] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0092] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0093] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions. Therefore, a processor with necessary instructions for implementing the method or method elements forms a device for implementing the method or method elements. In addition, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0094] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved, and is not intended to imply that the objects so described must have a given order in time, space, order, or in any other manner.

[0095] Although the present invention has been described according to a limited number of embodiments, it will be apparent to those skilled in the art, with the benefit of the above description, that other embodiments may be envisioned within the scope of the invention thus described. In addition, it should be noted that the language used in this specification is selected primarily for readability and teaching purposes, rather than for explaining or defining the subject matter of the present invention. Therefore, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is illustrative and not restrictive with respect to the scope of the present invention, and the scope of the present invention is defined by the appended claims.

Claims

1. An authorization control method is executed in a server, wherein the server is connected to a client based on an intranet communication, wherein the client is adapted to generate and provide a first key pair, the first key pair comprising a first private key and a first public key that match each other, and the server is adapted to generate and provide a second key pair, the second key pair comprising a second private key and a second public key that match each other, the method comprising: Receive an authorization request for the application sent by the client based on the application file, call a Decode method to decode the application file to obtain string information, and obtain the application ciphertext, the first signature information, and the first public key from the string information; Verifying the first signature information based on the first public key; If the first signature information is verified, the application ciphertext is decrypted based on the second private key to obtain the device identification of the client, and corresponding device information is generated based on the device identification; Associating the authorization configuration information with the device information to generate authorization information, encrypting the authorization information based on the first public key to generate authorization ciphertext, signing the authorization ciphertext based on the second private key to generate second signature information, and generating an authorization file based on the authorization ciphertext, the second signature information and the second public key; Sending the authorization file to the client, so that the client obtains the authorization ciphertext, the second signature information and the second public key based on the authorization file, verifies the second signature information based on the second public key, decrypts the authorization ciphertext based on the first private key if the second signature information verification passes, obtains the authorization information, and activates the application based on the authorization information; as well as The actual running time of one or more clients associated with the authorization configuration information is obtained periodically, the scheduled running time of the application is determined according to the authorization configuration information, and it is judged whether the actual running time exceeds the scheduled running time of the application to determine whether the application authorization has expired.

2. The method of claim 1, wherein: The step of determining whether the actual running time exceeds the scheduled running time of the application program includes: If it is determined that the actual running time exceeds the predetermined running time, it is determined that the application authorization has expired.

3. The method of claim 1, wherein: The step of periodically obtaining the actual running time of one or more clients associated with the authorization configuration information includes: When the authorization configuration information is associated with multiple clients, the running time of multiple clients is recorded to generate a time record; Periodically query duration records to obtain the actual running duration of multiple clients.

4. The method of claim 1, wherein: The step of periodically obtaining the actual running time of one or more clients associated with the authorization configuration information includes: When the authorization configuration information is associated with a client, the running time of the client is counted; Get timing statistics regularly to get the actual running time of the client.

5. The method according to any one of claims 1 to 4, wherein: The authorization configuration information includes the scheduled running time of the application and the authorization deadline, and the step of determining whether the application authorization has expired also includes: It is determined whether the current usage time exceeds the authorization deadline of the application program. If the authorization deadline is exceeded, it is determined that the application program authorization has expired.

6. An authorization method, executed on a client, wherein the client is connected to a server based on an intranet communication, wherein the client is adapted to generate and provide a first key pair, the first key pair comprising a first private key and a first public key that match each other, and the server is adapted to generate and provide a second key pair, the second key pair comprising a second private key and a second public key that match each other, the method comprising the steps of: Obtain the client's device information and generate a corresponding device identifier based on the device information; Encrypting the device identification based on the second public key to generate an application ciphertext, wherein the second public key matches the second private key; Generate a matching first private key and a first public key, sign the application ciphertext based on the first private key, and generate first signature information; Generate an application document based on the application ciphertext, the first signature information and the first public key; Sending an authorization request for the application to the server based on the application document to obtain an authorization file generated by the server, wherein the server is suitable for associating the authorization configuration information with the device information to generate authorization information, encrypting the authorization information based on the first public key to generate an authorization ciphertext, signing the authorization ciphertext based on the second private key to generate second signature information, generating an authorization file based on the authorization ciphertext, the second signature information and the second public key, and being suitable for periodically obtaining the actual running time of one or more clients associated with the authorization configuration information, determining the scheduled running time of the application according to the authorization configuration information, and judging whether the actual running time exceeds the scheduled running time of the application to determine whether the application authorization has expired; Obtain the authorization ciphertext, the second signature information and the second public key based on the authorization file, verify the second signature information based on the second public key, and if the second signature information verification passes, decrypt the authorization ciphertext based on the first private key to obtain the authorization information, so as to activate the application based on the authorization information.

7. An authorization device, resident on a client, wherein the client is connected to a server based on an intranet communication, wherein the client is adapted to generate and provide a first key pair, the first key pair comprising a first private key and a first public key that match each other, and the server is adapted to generate and provide a second key pair, the second key pair comprising a second private key and a second public key that match each other, the device comprising: An acquisition module, adapted to acquire device information of a client and generate a corresponding device identifier based on the device information; An encryption module, adapted to encrypt the device identification based on a second public key matching the second private key to generate an application ciphertext; generate a matching first private key and a first public key, sign the application ciphertext based on the first private key, and generate first signature information; A request module, adapted to generate an application file based on the application ciphertext, the first signature information and the first public key, and to send an authorization request for the application to the server based on the application file to obtain an authorization file generated by the server, wherein the server is adapted to associate the authorization configuration information with the device information to generate authorization information, encrypt the authorization information based on the first public key to generate an authorization ciphertext, sign the authorization ciphertext based on the second private key to generate second signature information, generate an authorization file based on the authorization ciphertext, the second signature information and the second public key, and is adapted to periodically obtain the actual running time of one or more clients associated with the authorization configuration information, determine the scheduled running time of the application according to the authorization configuration information, and judge whether the actual running time exceeds the scheduled running time of the application to determine whether the application authorization has expired; as well as The decryption module is suitable for obtaining the authorization ciphertext, the second signature information and the second public key based on the authorization file, verifying the second signature information based on the second public key, and if the second signature information is verified, decrypting the authorization ciphertext based on the first private key to obtain the authorization information, so as to activate the application based on the authorization information.

8. A computing device comprising: at least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 5.

9. A readable storage medium storing program instructions, when the program instructions are read and executed by a computing device, the computing device executes the method according to any one of claims 1 to 5.

Images