Data processing method and device

Abstract

The embodiments of this specification provide a data processing method and device, wherein the data processing method is applied to a software authorization system, which includes an authorization agent module and an authorization service module based on a trusted execution environment, wherein the authorization agent module receives an authorization data request of a target object, and generates a verification identifier based on user information and device information carried in the authorization data request; the authorization agent module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel; the authorization service module determines the authorization data of the target object when it is determined that the verification identifier satisfies a preset processing condition, and returns the authorization data to the authorization agent module.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to a data processing method. Background Art

[0002] After developing software, software development companies need to release the software or install it in the customer environment. When installing the software in the customer environment, the development company needs to restrict the use of these software products to avoid software abuse and damage to the company's interests. In order to protect the intellectual property rights and usage rights of such application software, some software authorization systems currently either rely on external devices or have limited defense capabilities and cannot prevent attackers from tampering with key content such as authorization information, which may lead to third-party customers spreading the software at will, and even the risk of reverse engineering and producing pirated software. Summary of the invention

[0003] In view of this, the embodiments of this specification provide a data processing method. One or more embodiments of this specification also relate to a data processing device, a computing device, and a computer-readable storage medium to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a data processing method is provided, which is applied to a software authorization system. The software authorization system includes an authorization agent module and an authorization service module.

[0005] The authorization proxy module receives an authorization data request from a target object, and generates a verification identifier based on user information and device information carried in the authorization data request;

[0006] The authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel;

[0007] When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0008] According to a second aspect of the embodiments of this specification, a data processing method is provided, which is applied to a software authorization system. The software authorization system includes an authorization agent module and an authorization service module.

[0009] The authorization proxy module receives an authorization data request for a target object sent by a user, displays an information input interface for the user based on the authorization data request, receives user information input by the user based on the information input interface, obtains device information of a device where the authorization proxy module is located, and generates a verification identifier based on the user information and the device information;

[0010] The authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel;

[0011] When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0012] According to a third aspect of the embodiments of this specification, a data processing method is provided, which is applied to a software authorization system, wherein the software authorization system includes an authorization agent module and an authorization service module.

[0013] The authorization proxy module receives an authorization data request for a target object sent by a user, and generates a verification identifier based on user information and device information carried in the authorization data request;

[0014] The authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel;

[0015] When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0016] According to a fourth aspect of the embodiments of this specification, a data processing device is provided, which is applied to a software authorization system. The software authorization system includes an authorization agent module and an authorization service module.

[0017] The authorization proxy module is configured to receive an authorization data request from a target object and generate a verification identifier based on user information and device information carried in the authorization data request;

[0018] The authorization proxy module is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0019] The authorization service module is configured to determine the authorization data of the target object when it is determined that the verification identifier meets a preset processing condition, and return the authorization data to the authorization proxy module.

[0020] According to a fifth aspect of the embodiments of this specification, a data processing device is provided, which is applied to a software authorization system. The software authorization system includes an authorization agent module and an authorization service module.

[0021] The authorization proxy module is configured to receive an authorization data request for a target object sent by a user, display an information input interface for the user based on the authorization data request, receive user information input by the user based on the information input interface, obtain device information of a device where the authorization proxy module is located, and generate a verification identifier based on the user information and the device information;

[0022] The authorization proxy module is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0023] The authorization service module is configured to determine the authorization data of the target object when it is determined that the verification identifier meets a preset processing condition, and return the authorization data to the authorization proxy module.

[0024] According to a sixth aspect of the embodiments of this specification, a data processing device is provided, which is applied to a software authorization system. The software authorization system includes an authorization agent module and an authorization service module.

[0025] The authorization proxy module is configured to receive an authorization data request for a target object sent by a user, and generate a verification identifier based on user information and device information carried in the authorization data request;

[0026] The authorization proxy module is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0027] The authorization service module is configured to determine the authorization data of the target object when it is determined that the verification identifier meets a preset processing condition, and return the authorization data to the authorization proxy module.

[0028] According to a seventh aspect of an embodiment of this specification, there is provided a computing device, including:

[0029] Memory and processor;

[0030] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions, wherein the processor implements the steps of the data processing method when executing the computer-executable instructions.

[0031] According to an eighth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of any one of the data processing methods are implemented.

[0032] A data processing method provided in one embodiment of the present specification is applied to a software authorization system, which includes an authorization agent module and an authorization service module based on a trusted execution environment, wherein the authorization agent module receives an authorization data request of a target object, and generates a verification identifier based on user information and device information carried in the authorization data request; the authorization agent module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel; the authorization service module determines the authorization data of the target object when it is determined that the verification identifier satisfies a preset processing condition, and returns the authorization data to the authorization agent module.

[0033] Specifically, through the authorization agent module based on the trusted execution environment in the software authorization system, the authorization service module obtains the authorization data of the application, which facilitates the subsequent use of the authorization data to decrypt and run the core code in the application. This method utilizes the security characteristics of the computer CPU hardware, generates an unforgeable verification identifier, and securely transmits the verification identifier in the trusted execution environment. After determining that the verification identifier meets the processing conditions, the authorization data of the software is obtained. Subsequent software can only run based on the authorization data. Not only can the authorization data of the software be obtained securely, but it can also improve the security of the software application and enhance the user experience of using the software. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the system structure of a data processing method provided by an embodiment of this specification applied to an authorization software system;

[0035] Figure 2 is a flow chart of a first data processing method provided by an embodiment of this specification;

[0036] Figure 3 It is a schematic diagram of a processing process of applying a data processing method provided by an embodiment of this specification to a software authorization system;

[0037] Figure 4is a flow chart of a second data processing method provided by another embodiment of this specification;

[0038] Figure 5 is a flow chart of a third data processing method provided by another embodiment of this specification;

[0039] Figure 6 is a structural schematic diagram of a first data processing device provided by an embodiment of this specification;

[0040] Figure 7 is a structural schematic diagram of a second data processing device provided by another embodiment of this specification;

[0041] Figure 8 is a structural schematic diagram of a third data processing device provided by another embodiment of this specification;

[0042] Fig. 9 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0043] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0044] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0045] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0046] First, the terms involved in one or more embodiments of this specification are explained.

[0047] Device fingerprint: refers to the device characteristics or unique device identifier used to identify a device.

[0048] Public key signature algorithm: generally based on a public-private key pair, the private key is used to sign the information, and the public key is used to verify whether the signature matches the information, thereby confirming that the information has not been tampered with.

[0049] Enclave: It can be understood as a trusted execution environment, which creates an encrypted inner layer. The corresponding memory is encrypted and cannot be seen by any operations or other users, i.e. software.

[0050] SGX (Software Guard Extensions): An extended instruction set for CPU chips that provides a user-level trusted execution environment. SGX technology provides hardware-level memory isolation, memory encryption, remote authentication, file sealing and other functions. SGX includes Skylake, Haswell, Sandy, Coffee Lake and Kaby Lake architectures, and machines that support SGX include desktops, notebooks, NUCs and servers.

[0051] In order to protect data confidentiality and integrity, application software based on trusted execution environment is becoming more and more popular. In order to protect the intellectual property rights and usage rights of such application software, it is necessary to design a software authorization system. At present, some software authorization systems have attempted to protect the intellectual property rights and usage rights of software, but they either rely on external devices or have limited defense capabilities and cannot prevent attackers from tampering with key content such as authorization information. With the promotion and popularization of CPU chips with security extension features (such as some CPU chips with security protection extension features (software guard extension, SGX)), software developers use this security feature to implement a variety of secure application software based on trusted execution environment, such as encrypted databases, to protect the integrity of programs, data integrity and confidentiality. For example, in the data fusion scenario, Company A and Company B need to purchase an encrypted database based on a trusted execution environment for data fusion. However, the encrypted database developer ISV cannot directly provide the encrypted database software to these third-party companies for considerations such as protecting intellectual property rights and commercial interests. Therefore, a software authorization system is needed to protect the intellectual property rights and usage rights of its encrypted database products. However, when this type of security application software needs to be delivered to third-party customers, these third-party customers may spread this type of software at will, or even reverse engineer it to produce pirated software, ultimately damaging the intellectual property rights and software copyrights of the software developer and affecting its commercial interests.

[0052] In response to the above phenomenon, in actual applications, some solutions can be based on the public key signature algorithm to achieve the generation and verification of software authorization files. However, in this type of solution, the hardware information such as the CPU serial number of the user's device is used as the hardware fingerprint. The hardware information may be forged, and it is impossible to fully detect whether the user's identity information is forged, so it is impossible to effectively restrict the right to use the software. Although the authorization file contains the user's identity information and the hardware information such as the CPU serial number of the user's device, this hardware information may be forged, so it is impossible to truly restrict the right to use the program. Other solutions are based on trusted external devices, such as USB flash drives, to authorize software. Although the hardware information of this type of solution, such as the dongle, is difficult to forge, it needs to rely on additional equipment, which is less flexible and has a limited scope of application compared to pure software design solutions. There are also some solutions that generate unforgeable machine fingerprints based on trusted hardware (such as SGX) to apply for permissions to the server. However, the focus of this solution is to limit whether the client program's access to the server is legal, and it does not protect the program deployed on the client. Therefore, it is impossible to protect the intellectual property rights and usage rights of the client program.

[0053] Based on this, the data processing method provided in the embodiment of this specification is a software authorization method based on a trusted execution environment applied to a software authorization system of the client. The client's security application is protected by encryption. At the same time, the key code can be decrypted only after the authorization file is securely parsed, thereby effectively protecting the intellectual property rights of the key code. In addition, the authorization file is encrypted and stored using a machine-related security key (such as a hardware-based sealing key in SGX). That is, only the encryption device can decrypt the authorization file, so the authorization file cannot be applied to other devices, which effectively controls the right to use the security application software. At the same time, the solution uses encryption technology to protect the intellectual property rights of the security software, uses the security features of the CPU hardware to parse the authorization file, and then decrypts and runs the security application software.

[0054] In this specification, a data processing method is provided. This specification also relates to a data processing apparatus, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0055] Figure 1 A schematic diagram of the system structure of a data processing method provided according to an embodiment of the present specification applied to an authorization software system is shown.

[0056] Figure 1A structural diagram of a software authorization system is shown, including an authorization service module 102 and an authorization agent module 104, wherein the authorization service module 102 includes an authorization verification module, an authorization registration module, an authorization issuance module and an authorization database; the authorization agent module 104 includes an authorization agent loading module and a processing module based on a trusted execution environment, wherein the processing module based on the trusted execution environment includes an identity generation module, an authorization request module and an authorization receiving module.

[0057] In actual applications, the authorization service module 102 can be deployed in the server, and the authorization proxy module 104 can be deployed in the client, wherein the processing module based on the trusted execution environment in the authorization proxy module 104 is a trusted execution environment based on hardware (such as SGX), which can prove the authenticity and integrity of the Enclave program through remote authentication; and the memory is in an encrypted state during runtime to protect the confidentiality and integrity of runtime data; and it also has a hardware sealing function, which uses the sealing key of the CPU hardware to encrypt and decrypt files. When the authorization proxy module 104 receives an authorization data request sent by the user for the application, the authorization proxy module 104 can generate a verification identifier based on the user information and device information carried in the authorization data request, and transmit the verification identifier to the authorization service module 102 through the network security channel established with the authorization service module 102. After the authorization service module 102 obtains the authorization data based on the verification identifier, the authorization data is returned to the authorization proxy module 104 through the network security channel.

[0058] The data processing method applied to the software authorization system provided in the embodiment of this specification, through the authorization agent module to obtain the user information and device information to generate the verification identifier, requests the authorization service module to obtain the authorization data based on the verification identifier, so as to facilitate the subsequent unlocking of the encryption code of the application software based on the authorization data, so as to realize the safe operation of the application software.

[0059] See also Figure 2 , Figure 2 A flow chart of a first data processing method provided in an embodiment of this specification is shown, which specifically includes the following steps.

[0060] It should be noted that the data processing method is applied to a software authorization system, and the software authorization system includes an authorization agent module and an authorization service module based on a trusted execution environment, wherein the trusted execution environment can be understood as a user-level trusted execution environment, such as SGX technology that provides hardware-level memory isolation, memory encryption, remote authentication, file sealing and other functions.

[0061] Step 202: The authorization proxy module receives an authorization data request from a target object, and generates a verification identifier based on user information and device information carried in the authorization data request.

[0062] The target object may be understood as application software deployed on the client, such as an encrypted database, shopping software, etc., and this embodiment does not impose any limitation on this.

[0063] The authorization data request may be understood as a request for authorization data corresponding to the application software, so as to facilitate subsequent acquisition of the authorization data corresponding to the application software based on the authorization data request.

[0064] In actual applications, in order to ensure the security of enterprise users using application software and to ensure that the developer of the application software can control the application software, it is necessary to encrypt the core code of the application software installed on the client. Therefore, after the authorization agent module is deployed on the client, the authorization agent module can be used to obtain the authorization data of the core code of the encrypted application software from the authorization service module, so as to facilitate the subsequent decryption of the core code of the application software based on the authorization data, and then run the application software; in specific implementation, the authorization agent module receives the authorization data request for the application software sent by the user, and the authorization data request carries user information and device information, wherein the user information can be understood as the user's identity certificate, or it can be a user name and password, etc., and the device information can be understood as the device information uniquely bound to the trusted CPU, and the authorization agent module can generate a corresponding verification identifier based on the user information and device information.

[0065] Furthermore, before the authorization proxy module receives the authorization data request of the target object, the application program needs to determine whether there is authorization data for decrypting the core code of the application program locally. If not, the application program needs to send the authorization data request of the target object to the authorization proxy module. Specifically, before the authorization proxy module receives the authorization data request of the target object, it also includes:

[0066] When determining that the authorization data of the target object does not exist, the application loading module of the target object sends an authorization data request of the target object to the authorization proxy module.

[0067] The authorization data can be understood as the application software code decryption key and metadata. The code decryption key is used to decrypt the packed security application software. The metadata is generally the configuration information of the security application software, such as the allowed software running time.

[0068] In actual applications, the application software starts the application loading module and checks whether there is authorization data of the application software locally. If not, the application software sends an authorization data request to the authorization agent module and starts the authorization agent module. If the authorization data of the application software exists during the check process, the core code of the application software can be decrypted based on the authorization data and the decrypted application software code can be executed.

[0069] For example, the application software is an encrypted database. When an enterprise purchases the encrypted database, it deploys the encrypted database in a client. At the same time, the enterprise also needs to deploy a corresponding authorization agent module in the client. The authorization agent module and the authorization service module deployed in the server together constitute the software authorization system. When the encrypted database is initially run, the security application loading module cannot start the encrypted database, resulting in the inability to use the encrypted database immediately. Then the security application loading module needs to check whether there is an authorization file corresponding to the encrypted database locally. If not, the application loading module sends an authorization data request for the encrypted database to the authorization agent module in the software authorization system.

[0070] The data processing method provided in the embodiments of this specification can send an authorization data request for the application software to the authorization agent module in the software authorization system when the application software determines that the authorization data corresponding to the application software does not exist locally, so as to facilitate the subsequent acquisition of the authorization data corresponding to the application software from the authorization service module based on the authorization data request, thereby ensuring the security of the operation of the application software.

[0071] After the authorization agent module in the software authorization system receives the authorization data request, the authorization agent module can generate a verification identifier corresponding to the application software accordingly, so as to facilitate the subsequent secure acquisition of the authorization data of the application software based on the verification identifier; specifically, the authorization agent module receives the authorization data request of the target object, and generates the verification identifier based on the user information and device information carried in the authorization data request, including:

[0072] The proxy loading module of the authorization proxy module receives the authorization data request of the target object, and sends the authorization data request to the identity identification generation module of the authorization proxy module;

[0073] The identity identification generation module determines the device identification based on the device information carried in the authorization data request, and generates a verification identification based on the user information and the device identification carried in the authorization data request.

[0074] During specific implementation, the proxy loading module in the authorization proxy module sends the received authorization data request to the authorization processing module, and the identity identification generation module in the authorization processing module determines the device identification based on the device information carried in the authorization data request, wherein the device information can be understood as CPU hardware information, and then determines the sealing key of the CPU hardware based on the CPU hardware information. Furthermore, the identity identification generation module generates a corresponding verification identification based on the user information and device identification in the authorization data request.

[0075] In actual applications, the authorization processing module in the authorization agent module obtains the authorization data in the authorization service module based on the trusted execution environment. In order to protect the integrity and authenticity of the authorization data and prevent malicious programs on the client from tampering with or spreading the authorization data, the authorization data is encrypted and stored by the authorization agent through the security key of the CPU hardware (such as the hardware-based sealing key in SGX). The verification identification generated by the identity generation module can be understood as the user and device fingerprints, where the user fingerprint can be a user certificate or a user name and password obtained through interaction. The device fingerprint is uniquely bound to a trusted CPU (such as a device that supports SGX features). For example, it can be generated based on the sealing key of the SGX CPU chip. At the same time, in order to bind the user fingerprint and the device fingerprint, it can be generated based on the sealing key of the SGX CPU chip and the user fingerprint. The identity generation module can then pass the user and device fingerprints to the authorization request module.

[0076] The data processing method provided in the embodiment of this specification generates a verification identifier based on user information and device information in the identity identifier generation module of the authorization proxy module, so as to facilitate the subsequent acquisition of the authorization data of the application software based on the verification identifier and ensure that the obtained authorization data is not tampered with.

[0077] Step 204: The authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel.

[0078] In actual applications, before sending the verification identifier to the authorization service module, in order to ensure remote communication between the authorization proxy module and the authorization service module, the authorization proxy module also needs to establish a network security channel with the authorization service module, and send the verification identifier to the authorization service module based on the network security channel.

[0079] Furthermore, the authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, including:

[0080] The identity identification generation module of the authorization proxy module sends the verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module;

[0081] Upon receiving the remote certification information verification result from the authorization service module, the authorization request module of the authorization proxy module establishes a network security channel of the target object with the authorization service module.

[0082] In specific implementation, before establishing a network security channel, a remote authentication process is required between the authorization agent module and the authorization service module. The identity generation module of the authorization agent module sends the generated verification identifier to the authorization request module of the authorization agent module, and the authorization request module sends remote certification information to the authorization service module, wherein the remote certification information can be understood as certification information of the integrity and authenticity of the authorization agent program of the application software; further, the authorization service module verifies the remote certification information, and if the verification is successful, it is determined that the agent program sent by the authorization agent module is authentic and complete and has not been tampered with by others. The authorization service module can then notify the authorization agent module that the remote certification information verification is successful, that is, the authorization agent module can establish a network security channel for the application software with the authorization service module.

[0083] In actual applications, the purpose of remote authentication between the authorization proxy module and the authorization service module is, first, to prove that the application is indeed running on the SGX platform, that is, in a trusted execution environment. Second, to prove that the Enclave (authorization proxy module) is signed by the developer and has not been tampered with, that is, the binary file has not been tampered with. This ensures the security of communication between the authorization proxy module and the authorization service module, and also ensures the security of any data subsequently transmitted through the network security channel.

[0084] In addition, after the remote attestation is completed, the authorization service module and the authorization proxy module can exchange communication keys to determine a symmetric key, and then send the authorization data request to the authorization service module through this symmetric key, and then transmit the verification identifier through the network security channel. The network security channel can be established based on the TLS / SSL protocol. This embodiment does not impose any limitation on the method of establishing the network security channel.

[0085] In the data processing method provided in the embodiments of this specification, the authorization agent module performs remote authentication with the authorization service module. Only when the remote proof information provided by the authorization agent module is verified, the authorization agent module and the authorization service module establish a network security channel, thereby ensuring the security of subsequent data security between modules through the network security channel.

[0086] Step 206: When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0087] Among them, the preset processing conditions can be understood as the verification identifier determined by the authorization service module meeting the basic conditions for obtaining the corresponding authorization data and returning it to the authorization agent module. For example, in the scenario where the user purchases application software, the preset processing conditions can be understood as whether the user has paid the developer for the application software, verifying whether the user information matches the device information, etc.

[0088] In the data processing method provided in the embodiments of this specification, after the authorization service module determines that the received verification identifier meets the preset processing conditions, it will determine the authorization data corresponding to the application software based on the verification identifier, and return the authorization data to the authorization agent module, so that the subsequent application software can obtain the authorization data from the authorization agent module, unlock the core code of the application based on the authorization data, and obtain the use authorization of the application software.

[0089] Furthermore, the authorization service module determines the authorization data of the target object when determining that the verification identifier satisfies a preset processing condition, including:

[0090] The authorization verification module of the authorization service module receives the verification identifier sent by the authorization proxy module, and when it is determined that the verification identifier satisfies the authorization data acquisition authority, obtains the authorization data of the target object from the authorization database of the authorization service module based on the verification identifier.

[0091] During specific implementation, after the authorization agent module sends the verification identifier of the application software to the authorization service module, the authorization verification module in the authorization service module receives the verification identifier. The authorization verification module needs to determine whether the verification identifier satisfies the authorization data acquisition authority. If so, it can be searched from the authorization database in the authorization service module based on the verification identifier to determine the authorization data corresponding to the application software, where the authorization data mainly includes code decryption keys and metadata, etc.

[0092] In actual applications, the authorization verification module needs to verify whether the user and device fingerprints have the authority to apply for authorization data. If not, it can directly reply "no" to the client's authorization agent module; if so, the authorization data is transmitted to the client's authorization agent module through the network security channel.

[0093] The data processing method provided in the embodiments of this specification verifies the verification identifier through the authorization verification module in the authorization service module, and obtains the application software authorization data when it is determined that the verification identifier satisfies the authorization data acquisition permission. By verifying the verification identifier, not only the security of the authorized data transmission can be guaranteed, but also the application developer can control the application software.

[0094] In addition, when the authorization verification module of the authorization service module determines that the device identifier in the verification identifier is not registered in the authorization service module, the authorization verification module may also send the verification identifier to the authorization registration module in the authorization service module for registration, so that the subsequent authorization service module can directly obtain the corresponding authorization data based on the verification identifier; specifically, before returning the authorization data to the authorization proxy module, it also includes:

[0095] The authorization verification module of the authorization service module determines that the device where the target object is located is a new device based on the verification identifier, and then sends the verification identifier to the authorization registration module of the authorization service module. The authorization registration module registers the verification identifier and stores the registered verification identifier in the authorization database of the authorization service module.

[0096] It should be noted that the reason why the authorization verification module of the authorization service module can search the authorization database for authorization data corresponding to the verification identifier based on the verification identifier is that the verification identifier has been registered in the authorization registration module, but the device of the new client where the application software is located has not been registered in the authorization registration module. Therefore, the verification identifier of the new device needs to be registered in the authorization registration module of the authorization service module.

[0097] During specific implementation, when the authorization verification module of the authorization service module determines that the device where the application software is located is a new device based on the verification identifier of the application software, the authorization verification module sends the verification identifier to the authorization registration module of the authorization service module, and the authorization registration module registers the verification identifier. At the same time, the registered verification identifier is stored in the authorization database of the authorization service module, so that the verification identifier determined based on the authorization data request can subsequently determine the corresponding authorization data from the authorization database in the authorization service module; in actual applications, the authorization verification module checks whether the user and device fingerprints are new devices. If so, the user and device fingerprints are registered through the authorization registration module.

[0098] The data processing method provided in the embodiments of this specification registers the verification identifier generated by the device where the application software is located in the authorization registration module, so that the authorization data of the application software can be directly obtained from the authorization database in the authorization service module through the verification identifier, thereby improving the speed of obtaining the authorization data.

[0099] Furthermore, returning the authorization data to the authorization agent module includes:

[0100] The authorization verification module of the authorization service module sends the obtained authorization data of the target object to the authorization issuing module of the authorization service module;

[0101] The authorization issuing module returns the authorization data to the authorization receiving module of the authorization proxy module based on the network security channel.

[0102] In actual applications, the authorization verification module of the authorization service module sends the obtained authorization data of the application software to the authorization issuing module of the authorization service module, and the authorization issuing module then returns the authorization data to the authorization receiving module of the authorization proxy module based on the network security channel.

[0103] The data processing method provided in the embodiment of this specification transmits the authorization data from the authorization service module to the authorization agent module through a network security channel to ensure the security of the data during the transmission process. At the same time, in a trusted execution environment, the transmission process is not perceived by the user.

[0104] In order to prevent attackers from tampering with and maliciously spreading the authorization data, the authorization data is encrypted using the key of the trusted hardware and stored locally; specifically, after returning the authorization data to the authorization agent module, it also includes:

[0105] The authorization receiving module of the authorization proxy module encrypts the authorization data based on the device identification determined by the device information, stores the encrypted authorization data, and sends the encrypted authorization data to the application loading module of the target object, wherein the authorization data includes the target object code decryption key and the metadata of the target object.

[0106] In actual applications, the authorization receiving module of the authorization agent module determines the device identification based on the device information of the client, where the device identification can be understood as a key that is uniquely bound to a trusted CPU and sealed, and uses this sealed key to encrypt the authorization data, and stores the encrypted authorization data. At the same time, the encrypted authorization data is sent to the application loading module of the application software. It should be noted that the authorization data includes not only the application software code decryption key, but also the metadata of the application software, where the code decryption key is used to decrypt the shelled security application software, and the metadata can refer to the configuration of the security application software, such as the allowed running time, etc. This information is encrypted by the authorization agent module and stored on the device, and is not stored in plain text, thereby ensuring the security of the authorization data corresponding to the application software.

[0107] It should be noted that in order to protect the integrity and authenticity of the authorization data and prevent malicious programs on the client side from tampering with or spreading the authorization data, the authorization data is encrypted and stored by the authorization proxy module using the CPU hardware's security key (such as the hardware-based sealing key in SGX). The security key can be migrated between enclaves with specific signatures (such as between enclaves signed by the same developer). Therefore, only secure application software can safely parse the authorization data, decrypt and load the secure application enclave.

[0108] In the data processing method provided in the embodiments of this specification, the authorization proxy module encrypts and stores the authorization data to ensure that the authorization data is not tampered with or maliciously spread by attackers, thereby facilitating the subsequent decryption of the core code of the application software based on the authorization data and running the application software.

[0109] After the application software receives the encrypted authorization data, it is necessary to decrypt the encrypted authorization data to obtain the application software code decryption key and the metadata of the application software in the authorization data; specifically, after returning the authorization data to the authorization agent module, it also includes:

[0110] The application loading module of the target object parses the encrypted authorization data to determine the target object code decryption key and the metadata of the target object;

[0111] The application loading module of the target object parses the application code of the target object based on the parsed target object code decryption key, and runs the parsed application code of the target object based on the metadata of the target object.

[0112] In actual applications, after the application loading module of the application software receives the authorization data encrypted by the authorization agent module, the application loading module parses the encrypted authorization data to determine the application software code decryption key and the metadata of the application software. Then, the application loading module decrypts the core code of the application software based on the application software code decryption key, and runs the decrypted core code of the application software according to the metadata of the application software.

[0113] It should be noted that after the application software receives the corresponding authorization data, it can only run normally based on two decryption operations. The first is to use the key sealed by the trusted CPU to decrypt the encrypted authorization data to obtain the application software code decryption key and the application software metadata; the second is to use the application software code decryption key to decrypt the core code locked by the application software, and then run the core program of the application software normally.

[0114] The data processing method provided in the embodiments of this specification decrypts the authorization data in the application software, thereby obtaining the key for decrypting the core code of the application software, thereby decrypting the core code of the application software, that is, the application software securely obtains the authorization of the software developer.

[0115] In summary, the data processing method provided in the embodiments of this specification is applied to the software authorization system, and the authorization agent module in the software authorization system is deployed on the client to protect the application software in the client. The authorization agent module securely obtains the untampered authorization data from the authorization service module in the trusted execution environment. The application software decrypts the core code based on the authorization data, and the application software safely completes the authorization process in the trusted execution environment, thereby effectively protecting the intellectual property rights of the key code of the application software. In addition, the authorization data is encrypted and stored by a machine-related security key (such as a hardware-based sealing key in SGX), that is, only the encryption device can decrypt the authorization data, so the authorization data cannot be applied to other devices, thereby effectively controlling the right to use the security application software.

[0116] The following combination Figure 3 Taking the data processing method provided in this specification as an example of the application of obtaining authorization for security application software on the client, the data processing method is further described. Figure 3 A schematic diagram of a processing process of applying a data processing method provided by an embodiment of the present specification to a software authorization system is shown.

[0117] Figure 3It includes two parts, the first part is the authorization server device, and the second part is the client device, wherein the authorization server device includes an authorization service, and the client device includes an authorization agent and a security application software; wherein the authorization service includes an authorization verification module, an authorization registration module, an authorization issuance module, and an authorization database, and the security application software includes a security application loading module and the core code of the security application in the Enclave, and the authorization agent is composed of the authorization agent loading module and the Enclave, and the Enclave includes an identity generation module, an authorization request module, and an authorization receiving module, and the Enclave is a hardware-based (such as SGX) trusted execution environment, which can prove the authenticity and integrity of the Enclave program through remote authentication; and the runtime memory is encrypted to protect the confidentiality and integrity of the runtime data; and it also has a hardware sealing function, which uses the sealing key of the CPU hardware to encrypt and decrypt files. Among them, the Enclave includes an identity generation module, an authorization request module, and an authorization receiving module. The security application software consists of a security application loading module and a security application Enclave, and the security application Enclave contains the core code of the security application, which is encrypted by the software developer ISV and delivered to the customer. After decryption through the authorization file, a hardware-based trusted execution environment can be created. It should be noted that the above-mentioned authorization service and authorization agent can together constitute a software authorization system. The software authorization system and the supporting security application software are deployed in the client device. That is, after the security application core code in the security application software is locked, the software authorization system can be used to obtain authorization data to unlock the security application core code so that the application software can run normally.

[0118] In the specific implementation, first, the security application software starts the security application loading module, checks whether there is an authorization file locally, if not, starts the authorization agent, if yes, decrypts the security application Enclave through the authorization file, and loads the security application Enclave to execute the core code of the security application; after starting the authorization agent, the security application software sends an authorization request to the authorization agent, and then runs the authorized Enclave. The identity generation module in the Enclave generates user and device fingerprints through the user information and device information carried in the authorization request, where the user fingerprint can be a user certificate or a user name and password obtained through interaction, and the device fingerprint is uniquely bound to a trusted CPU (such as a device that supports SGX features). For example, it can be generated based on the sealing key of the SGX CPU chip. At the same time, in order to bind the user fingerprint and the device fingerprint, it can be generated based on the sealing key of the SGXCPU chip and the user fingerprint. The identity generation module passes the user and device fingerprints to the authorization request module.

[0119] Then, the authorization request module in the Enclave initiates remote attestation to the authorization service on the server side to prove the integrity and authenticity of the authorization agent program (i.e., it has not been maliciously tampered with), and then establishes a secure network channel, and then sends the user and device fingerprints to the authorization verification module of the authorization service through the network channel. The authorization verification module of the authorization service verifies whether the user and device fingerprints have the authority to apply for the authorization file. If not, it replies "no" to the client's authorization agent. If so, it transmits the authorization file to the client's authorization agent through a secure channel; in addition, the authorization verification module may check whether the user and device fingerprints are new devices. If so, the user and device fingerprints are registered through the authorization registration module.

[0120] Finally, when the authorization verification module passes the user and device fingerprint verification, the authorization file corresponding to the security application software can be obtained from the authorization database and sent to the authorization issuance module. The authorization issuance module sends the authorization file to the authorization receiving module of the authorization agent. Furthermore, in order to prevent attackers from tampering with or maliciously spreading the authorization file, the authorization file is encrypted with the key of the trusted hardware and stored locally. The authorization file will subsequently be securely parsed and decrypted by the security application software to securely apply the Enclave.

[0121] Based on this, this solution generates a hardware fingerprint based on a trusted execution environment using the sealed key of the CPU hardware. The key is uniquely bound to the CPU and cannot be accessed by any privileged / non-privileged software. Therefore, a device fingerprint that cannot be forged is determined, an authorization file is applied for, and the authorization file is securely stored, thereby encrypting and protecting the client's security application. At the same time, the key code can be decrypted and the security application software can be run only after the authorization file is securely parsed.

[0122] See also Figure 4 , Figure 4 A flow chart of a second data processing method provided in another embodiment of the present specification is shown, which specifically includes the following steps.

[0123] The data processing method can be applied to a software authorization system, which includes an authorization agent module and an authorization service module based on a trusted execution environment.

[0124] Step 402: the authorization proxy module receives an authorization data request for a target object sent by a user, displays an information input interface for the user based on the authorization data request, receives user information input by the user based on the information input interface, obtains device information of a device where the authorization proxy module is located, and generates a verification identifier based on the user information and the device information;

[0125] Step 404: the authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel;

[0126] Step 406: When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0127] It should be emphasized that the specific implementation steps of this embodiment can refer to the detailed steps of the above embodiments, and will not be elaborated here.

[0128] In summary, the data processing method provided in the embodiments of this specification is applied to the software authorization system, and the authorization agent module in the software authorization system is deployed on the client to protect the application software in the client. The authorization agent module securely obtains the untampered authorization data from the authorization service module in the trusted execution environment. The application software decrypts the core code based on the authorization data, and the application software safely completes the authorization process in the trusted execution environment, thereby effectively protecting the intellectual property rights of the key code of the application software. In addition, the authorization data is encrypted and stored by a machine-related security key (such as a hardware-based sealing key in SGX), that is, only the encryption device can decrypt the authorization data, so the authorization data cannot be applied to other devices, thereby effectively controlling the right to use the security application software.

[0129] See also Figure 5 , Figure 5 A flowchart of a third data processing method provided in another embodiment of the present specification is shown, which specifically includes the following steps.

[0130] The data processing method can be applied to a software authorization system, which includes an authorization agent module and an authorization service module based on a trusted execution environment.

[0131] Step 502: The authorization proxy module receives an authorization data request for a target object sent by a user, and generates a verification identifier based on user information and device information carried in the authorization data request;

[0132] Step 504: the authorization proxy module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel;

[0133] Step 506: When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

[0134] It should be emphasized that the specific implementation steps of this embodiment can refer to the detailed steps of the above embodiments, and will not be elaborated here.

[0135] In summary, the data processing method provided in the embodiments of this specification is applied to the software authorization system, and the authorization agent module in the software authorization system is deployed on the client to protect the application software in the client. The authorization agent module securely obtains the untampered authorization data from the authorization service module in the trusted execution environment. The application software decrypts the core code based on the authorization data, and the application software safely completes the authorization process in the trusted execution environment, thereby effectively protecting the intellectual property rights of the key code of the application software. In addition, the authorization data is encrypted and stored by a machine-related security key (such as a hardware-based sealing key in SGX), that is, only the encryption device can decrypt the authorization data, so the authorization data cannot be applied to other devices, thereby effectively controlling the right to use the security application software.

[0136] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 6 FIG. 1 shows a schematic diagram of the structure of a first data processing device provided by an embodiment of the present specification. Figure 6 As shown, the device is applied to a software authorization system, and the software authorization system includes an authorization agent module 602 based on a trusted execution environment and an authorization service module 604.

[0137] The authorization proxy module 602 is configured to receive an authorization data request from a target object and generate a verification identifier based on user information and device information carried in the authorization data request;

[0138] The authorization proxy module 602 is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0139] The authorization service module 604 is configured to determine the authorization data of the target object when it is determined that the verification identifier meets the preset processing condition, and return the authorization data to the authorization proxy module.

[0140] Optionally, the device further comprises:

[0141] The authorization receiving module of the authorization agent module is configured to encrypt the authorization data based on the device identification determined by the device information, store the encrypted authorization data, and send the encrypted authorization data to the application loading module of the target object, wherein the authorization data includes the target object code decryption key and the metadata of the target object.

[0142] Optionally, the device further comprises:

[0143] The application loading module of the target object is configured to parse the encrypted authorization data and determine the target object code decryption key and the metadata of the target object;

[0144] The target object application loading module is further configured to parse the target object application code based on the parsed target object code decryption key, and run the parsed target object application code based on the target object metadata.

[0145] The application loading module of the target object is further configured to send an authorization data request for the target object to the authorization proxy module when it is determined that the authorization data of the target object does not exist.

[0146] Optionally, the authorization agent module 602 is further configured to:

[0147] The proxy loading module of the authorization proxy module is configured to receive an authorization data request of a target object and send the authorization data request to the identity identification generation module of the authorization proxy module;

[0148] The identity identification generation module is configured to determine the device identification based on the device information carried in the authorization data request, and to generate a verification identification based on the user information and the device identification carried in the authorization data request.

[0149] The identity identification generation module of the authorization proxy module is further configured to send the verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module;

[0150] The authorization request module of the authorization proxy module is configured to establish a network security channel of the target object with the authorization service module when receiving a determination from the authorization service module that the remote certification information verification is successful.

[0151] Optionally, the authorization service module 604 is further configured to:

[0152] The authorization verification module of the authorization service module is configured to receive the verification identifier sent by the authorization proxy module, and when it is determined that the verification identifier satisfies the authorization data acquisition authority, obtain the authorization data of the target object from the authorization database of the authorization service module based on the verification identifier.

[0153] Optionally, the device further comprises:

[0154] The authorization verification module of the authorization service module is configured to send the verification identifier to the authorization registration module of the authorization service module based on the verification identifier when it is determined that the device where the target object is located is a new device. The authorization registration module registers the verification identifier and stores the registered verification identifier in the authorization database of the authorization service module.

[0155] The authorization verification module of the authorization service module is further configured to send the acquired authorization data of the target object to the authorization issuing module of the authorization service module;

[0156] The authorization issuing module is configured to return the authorization data to the authorization receiving module of the authorization proxy module based on the network security channel.

[0157] The data processing device provided in the embodiment of this specification obtains the authorization data of the application from the authorization service module through the authorization agent module based on the trusted execution environment in the software authorization system, so as to facilitate the subsequent use of the authorization data to decrypt and run the core code in the application. This method utilizes the security characteristics of the computer CPU hardware to generate an unforgeable verification identifier, and securely transmits the verification identifier in the trusted execution environment. After determining that the verification identifier meets the processing conditions, the authorization data of the software is obtained, and the subsequent software can only be run based on the authorization data. Not only can the authorization data of the software be securely obtained, but the security of the software application can also be improved.

[0158] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 7 FIG. 2 shows a schematic diagram of the structure of a second data processing device provided by an embodiment of the present specification. Figure 7 As shown, the device is applied to a software authorization system, which includes an authorization agent module 702 based on a trusted execution environment and an authorization service module 704.

[0159] The authorization proxy module 702 is configured to receive an authorization data request for a target object sent by a user, display an information input interface for the user based on the authorization data request, receive user information input by the user based on the information input interface, obtain device information of the device where the authorization proxy module is located, and generate a verification identifier based on the user information and the device information;

[0160] The authorization proxy module 702 is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0161] The authorization service module 704 is configured to determine the authorization data of the target object when it is determined that the verification identifier meets the preset processing condition, and return the authorization data to the authorization proxy module.

[0162] The data processing device provided in the embodiment of this specification obtains the authorization data of the application from the authorization service module through the authorization agent module based on the trusted execution environment in the software authorization system, so as to facilitate the subsequent use of the authorization data to decrypt and run the core code in the application. This method utilizes the security characteristics of the computer CPU hardware to generate an unforgeable verification identifier, and securely transmits the verification identifier in the trusted execution environment. After determining that the verification identifier meets the processing conditions, the authorization data of the software is obtained, and the subsequent software can only be run based on the authorization data. Not only can the authorization data of the software be securely obtained, but the security of the software application can also be improved.

[0163] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 8 FIG. 2 shows a schematic diagram of the structure of a third data processing device provided by an embodiment of this specification. Figure 8 As shown, the device is applied to a software authorization system, and the software authorization system includes an authorization agent module 802 based on a trusted execution environment and an authorization service module 804.

[0164] The authorization proxy module 802 is configured to receive an authorization data request for a target object sent by a user, and generate a verification identifier based on user information and device information carried in the authorization data request;

[0165] The authorization proxy module 802 is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier, and send the verification identifier to the authorization service module based on the network security channel;

[0166] The authorization service module 804 is configured to determine the authorization data of the target object when it is determined that the verification identifier meets the preset processing condition, and return the authorization data to the authorization proxy module.

[0167] The data processing device provided in the embodiment of this specification obtains the authorization data of the application from the authorization service module through the authorization agent module based on the trusted execution environment in the software authorization system, so as to facilitate the subsequent use of the authorization data to decrypt and run the core code in the application. This method utilizes the security characteristics of the computer CPU hardware to generate an unforgeable verification identifier, and securely transmits the verification identifier in the trusted execution environment. After determining that the verification identifier meets the processing conditions, the authorization data of the software is obtained, and the subsequent software can only be run based on the authorization data. Not only can the authorization data of the software be securely obtained, but the security of the software application can also be improved.

[0168] The above is a schematic scheme of a data processing device of this embodiment. It should be noted that the technical scheme of the data processing device and the technical scheme of the above data processing method belong to the same concept, and the details of the technical scheme of the data processing device that are not described in detail can be referred to the description of the technical scheme of the above data processing method.

[0169] Fig. 9 The structure block diagram of a computing device 900 provided according to an embodiment of the present specification is shown. The components of the computing device 900 include but are not limited to a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0170] The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0171] In one embodiment of the present specification, the above components of the computing device 900 and Fig. 9 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig. 9The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0172] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 900 may also be a mobile or stationary server.

[0173] The processor 920 is used to execute the following computer executable instructions, which implement the steps of the above data processing method when executed by the processor.

[0174] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above data processing method.

[0175] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above-mentioned data processing method when executed by a processor.

[0176] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above data processing method.

[0177] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0178] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0179] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0180] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0181] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data processing method, applied to a software authorization system, the software authorization system comprising an authorization agent module and an authorization service module based on a trusted execution environment, The authorization proxy module receives an authorization data request from a target object, and generates a verification identifier based on user information and device information carried in the authorization data request; The identity identification generation module of the authorization proxy module sends the generated verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module, wherein: The remote certification information is the certification information of the integrity and authenticity of the authorization agent program of the application software; When the authorization agent module receives the remote certification information verification confirmation from the authorization service module, the authorization agent module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel; When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

2. The data processing method according to claim 1, after returning the authorization data to the authorization agent module, further comprising: The authorization receiving module of the authorization proxy module encrypts the authorization data based on the device identification determined by the device information, stores the encrypted authorization data, and sends the encrypted authorization data to the application loading module of the target object, wherein the authorization data includes the target object code decryption key and the metadata of the target object.

3. The data processing method according to claim 2, after returning the authorization data to the authorization agent module, further comprising: The application loading module of the target object parses the encrypted authorization data to determine the target object code decryption key and the metadata of the target object; The application loading module of the target object parses the application code of the target object based on the parsed target object code decryption key, and runs the parsed application code of the target object based on the metadata of the target object.

4. The data processing method according to any one of claims 1 to 3, before the authorization proxy module receives the authorization data request of the target object, further comprising: When determining that the authorization data of the target object does not exist, the application loading module of the target object sends an authorization data request of the target object to the authorization proxy module.

5. The data processing method according to claim 4, wherein the authorization proxy module receives the authorization data request of the target object and generates a verification identifier based on the user information and device information carried in the authorization data request, comprising: The proxy loading module of the authorization proxy module receives the authorization data request of the target object, and sends the authorization data request to the identity identification generation module of the authorization proxy module; The identity identification generation module determines the device identification based on the device information carried in the authorization data request, and generates a verification identification based on the user information and the device identification carried in the authorization data request.

6. The data processing method according to claim 1, wherein the authorization agent module, upon receiving the remote certification information verification confirmation from the authorization service module, establishes a network security channel of the target object with the authorization service module based on the verification identifier, comprising: Upon receiving the remote certification information verification result from the authorization service module, the authorization request module of the authorization proxy module establishes a network security channel of the target object with the authorization service module.

7. The data processing method according to claim 6, wherein the authorization service module determines the authorization data of the target object when determining that the verification identifier satisfies a preset processing condition, comprising: The authorization verification module of the authorization service module receives the verification identifier sent by the authorization proxy module, and when it is determined that the verification identifier satisfies the authorization data acquisition authority, obtains the authorization data of the target object from the authorization database of the authorization service module based on the verification identifier.

8. The data processing method according to claim 7, before returning the authorization data to the authorization proxy module, further comprising: The authorization verification module of the authorization service module determines that the device where the target object is located is a new device based on the verification identifier, and then sends the verification identifier to the authorization registration module of the authorization service module. The authorization registration module registers the verification identifier and stores the registered verification identifier in the authorization database of the authorization service module.

9. The data processing method according to claim 8, wherein returning the authorization data to the authorization agent module comprises: The authorization verification module of the authorization service module sends the obtained authorization data of the target object to the authorization issuing module of the authorization service module; The authorization issuing module returns the authorization data to the authorization receiving module of the authorization proxy module based on the network security channel.

10. A data processing method, applied to a software authorization system, the software authorization system comprising an authorization agent module and an authorization service module based on a trusted execution environment, The authorization proxy module receives an authorization data request for a target object sent by a user, displays an information input interface for the user based on the authorization data request, receives user information input by the user based on the information input interface, obtains device information of a device where the authorization proxy module is located, and generates a verification identifier based on the user information and the device information; The identity identification generation module of the authorization proxy module sends the generated verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module, wherein: The remote certification information is the certification information of the integrity and authenticity of the authorization agent program of the application software; When the authorization agent module receives the remote certification information verification confirmation from the authorization service module, the authorization agent module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel; When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

11. A data processing method, applied to a software authorization system, the software authorization system comprising an authorization agent module and an authorization service module based on a trusted execution environment, The authorization proxy module receives an authorization data request for a target object sent by a user, and generates a verification identifier based on user information and device information carried in the authorization data request; The identity identification generation module of the authorization proxy module sends the generated verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module, wherein: The remote certification information is the certification information of the integrity and authenticity of the authorization agent program of the application software; When the authorization agent module receives the remote certification information verification confirmation from the authorization service module, the authorization agent module establishes a network security channel of the target object with the authorization service module based on the verification identifier, and sends the verification identifier to the authorization service module based on the network security channel; When determining that the verification identifier satisfies a preset processing condition, the authorization service module determines the authorization data of the target object and returns the authorization data to the authorization proxy module.

12. A data processing device, applied to a software authorization system, the software authorization system comprising an authorization agent module and an authorization service module based on a trusted execution environment, The authorization proxy module is configured to receive an authorization data request from a target object and generate a verification identifier based on user information and device information carried in the authorization data request; The identity identification generation module of the authorization proxy module is further configured to send the verification identification to the authorization request module of the authorization proxy module, and the authorization request module sends remote certification information to the authorization service module; The authorization proxy module is further configured to establish a network security channel of the target object with the authorization service module based on the verification identifier upon receiving the remote certification information verification success determined by the authorization service module, and send the verification identifier to the authorization service module based on the network security channel; The authorization service module is configured to determine the authorization data of the target object when it is determined that the verification identifier meets a preset processing condition, and return the authorization data to the authorization proxy module.

13. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the data processing method described in any one of claims 1-9 or 10 or 11 are implemented.

14. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the data processing method described in any one of claims 1 to 9 or 10 or 11.

Images