Application authorization method, device, equipment and storage medium

Abstract

The embodiments of the present application provide an application authorization method, apparatus, device and storage medium, which relate to the field of computer technology and can be applied to various scenarios such as cloud technology, artificial intelligence, and smart transportation. The method includes: the target device sends an application authorization request for the target application to the server, and the application authorization request includes a unique identity and application deployment information. The server parses the unique identity of the target application, and when it is obtained that there is no unexpired historical authorization certificate for the corresponding unique identity, it generates a target authorization certificate and sends the target authorization certificate to the target device. The present application no longer relies on device information to apply for an authorization certificate, and effectively avoids the problem of an application obtaining additional authorization due to forged or tampered device information. The unique identity is parsed, and when it is determined that there is no unexpired historical authorization certificate, the authorization certificate is issued, and the invalid status of the authorization certificate is promptly known, thereby improving the convenience of application authorization management.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to an application authorization method, apparatus, device, and storage medium. Background Art

[0002] With the development of internet technology, a wide variety of applications have emerged. Some applications require server authorization before use. Privately deployed applications are deployed in an isolated network environment and cannot access the external internet after deployment. Therefore, during the deployment phase, these applications must apply for an authorization certificate from the server based on collected device information. The server then issues the authorization certificate to the application in a one-time manner.

[0003] Since the application cannot access the external Internet normally after deployment, the server cannot invalidate the authorization certificate in time, and cannot detect whether the authorization certificate is invalid before it expires naturally, which brings many inconveniences to application authorization management.

[0004] For example, when a privately deployed application applies for an authorization certificate from the server again based on new device information, the server will reissue the authorization certificate to the application. At this time, the originally issued authorization certificate may not have expired, allowing the application to obtain additional authorization, resulting in application authorization errors and bringing many inconveniences to application authorization management. Summary of the Invention

[0005] Embodiments of the present application provide an application authorization method, apparatus, device, and storage medium for improving the convenience of authorization management for privately deployed applications.

[0006] In one aspect, an embodiment of the present application provides an application authorization method, the method comprising:

[0007] Receiving an application authorization request for a target application sent by a target device, wherein the application authorization request includes a unique identity identifier and application deployment information of the target application, and the target application is an application deployed in a private network environment;

[0008] Parsing the unique identity of the target application to obtain a parsing result;

[0009] If the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity, generating a new target authorization certificate based on the unique identity and the application deployment information;

[0010] The target authorization certificate is sent to the target device, so that the target device runs the target application based on the target authorization certificate.

[0011] In one aspect, an embodiment of the present application provides an application authorization method, the method comprising:

[0012] Sending an application authorization request for a target application to a server, where the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application;

[0013] Receiving a target authorization certificate returned by the server, the target authorization certificate being obtained by the server by: parsing the obtained unique identity identifier of the target application to obtain a parsing result; if the parsing result indicates that no unexpired historical authorization certificate exists corresponding to the unique identity identifier, generating a new target authorization certificate based on the unique identity identifier and the application deployment information;

[0014] The target application is run based on the target authorization certificate.

[0015] In one aspect, an embodiment of the present application provides an application authorization device, the device comprising:

[0016] A first receiving module is configured to receive an application authorization request for a target application sent by a target device, wherein the application authorization request includes a unique identity identifier and application deployment information of the target application, and the target application is an application deployed in a private network environment;

[0017] A parsing module, configured to parse the unique identity of the target application and obtain a parsing result;

[0018] a certificate issuing module, configured to generate a new target authorization certificate based on the unique identity and the application deployment information if the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity;

[0019] The first sending module is configured to send the target authorization certificate to the target device, so that the target device runs the target application based on the target authorization certificate.

[0020] Optionally, the parsing module is specifically used to:

[0021] If the unique identity identifier is a legal identity identifier and no authorization certificate has been generated for the unique identity identifier, the parsing result is determined to be: there is no unexpired historical authorization certificate corresponding to the unique identity identifier.

[0022] Optionally, the application authorization request further includes a certificate release sequence code associated with the unique identity identifier, where the certificate release sequence code is generated when the target device deletes an unexpired historical authorization certificate associated with the target application in response to a certificate deletion instruction;

[0023] The parsing module is specifically used for:

[0024] If the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application;

[0025] If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

[0026] Optionally, the certificate issuing module is specifically configured to:

[0027] Determining target authorization content based on the application deployment information;

[0028] Performing hash processing on the authorization certificate identifier, the unique identity identifier, and the target authorization content to obtain a certificate issuance serial code;

[0029] Encrypting the certificate issuance serial code using the target private key to obtain a certificate signature;

[0030] The target authorization certificate is obtained based on the authorization certificate identifier, the unique identity identifier, the target authorization content, the certificate issuance serial code and the certificate signature.

[0031] Optionally, the first sending module is specifically configured to:

[0032] The target authorization certificate is sent to the target device so that the target device uses the target public key corresponding to the target private key to verify the certificate signature in the target authorization certificate. If the verification is successful, the target application is run based on the target authorization certificate.

[0033] Optionally, the first sending module is further configured to:

[0034] If the parsing result indicates that there is an unexpired historical authorization certificate corresponding to the unique identity identifier, a verification failure message is sent to the target device.

[0035] In one aspect, an embodiment of the present application provides an application authorization device, the device comprising:

[0036] A second sending module is configured to send an application authorization request for a target application to a server, wherein the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application;

[0037] a second receiving module, configured to receive a target authorization certificate returned by the server, the target authorization certificate being obtained by the server by: parsing the obtained unique identity identifier of the target application to obtain a parsing result; and if the parsing result indicates that no unexpired historical authorization certificate exists corresponding to the unique identity identifier, generating a new target authorization certificate based on the unique identity identifier and the application deployment information;

[0038] A processing module is configured to run the target application based on the target authorization certificate.

[0039] Optionally, the application authorization request further includes a certificate release serial code associated with the unique identity identifier. The server then parses the obtained unique identity identifier of the target application to obtain a parsing result in the following manner:

[0040] When it is determined that the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application;

[0041] If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

[0042] Optionally, the processing module is further configured to:

[0043] Before sending an application authorization request for a target application to a server, in response to a certificate deletion instruction, the unexpired historical authorization certificate associated with the target application is deleted, and the certificate release serial code is generated.

[0044] Optionally, the processing module is specifically configured to:

[0045] Obtaining the historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier and the historical authorization content to obtain the certificate release serial code; or,

[0046] The certificate issuance serial code in the historical authorization certificate is used as the certificate release serial code.

[0047] Optionally, the processing module is further configured to:

[0048] Before sending an application authorization request for a target application to a server, the certificate release serial code is encrypted using a target public key. Before the server compares the certificate release serial code with the certificate issuance serial code, the method further includes:

[0049] The target private key corresponding to the target public key is used to decrypt the certificate release sequence code.

[0050] On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned application authorization method when executing the program.

[0051] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of the above-mentioned application authorization method.

[0052] On the one hand, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the above-mentioned application authorization method.

[0053] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 A schematic diagram of the structure of a certificate authorization system provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of an authorization certificate application process provided in an embodiment of the present application;

[0057] Figure 3 A schematic diagram of a license management interface provided in an embodiment of the present application;

[0058] Figure 4 A schematic diagram of a project creation interface provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram of an application initiation interface provided in an embodiment of the present application;

[0060] Figure 6 A flowchart of an application authorization method provided in an embodiment of the present application;

[0061] Figure 7 A flowchart of a method for resolving a unique identity provided in an embodiment of the present application;

[0062] Figure 8a A flowchart of an application authorization method provided in an embodiment of the present application;

[0063] Figure 8b A schematic diagram of a license management interface provided in an embodiment of the present application;

[0064] Figure 8c A schematic diagram of a My Application interface provided in an embodiment of the present application;

[0065] Figure 8d A schematic diagram of a My Application interface provided in an embodiment of the present application;

[0066] Figure 8e A schematic diagram of a My Application interface provided in an embodiment of the present application;

[0067] Figure 8f A schematic diagram of a My Application interface provided in an embodiment of the present application;

[0068] Figure 9 A schematic diagram of the structure of an application authorization device provided in an embodiment of the present application;

[0069] Figure 10 A schematic diagram of the structure of an application authorization device provided in an embodiment of the present application;

[0070] Figure 11 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solutions and beneficial effects of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0072] For ease of understanding, the terms involved in the embodiments of the present invention are explained below.

[0073] Certificate Authorization System: This system limits product usage within a private network environment based on the user's agreement. This means users are prohibited from exceeding the product usage quota. For example, if the contract stipulates that a user can only deploy one gateway cluster and use a maximum of 50 central processing unit (CPU) cores, the certificate authorization system is responsible for limiting user usage to that quota.

[0074] Privately deployed applications: This refers to software deployed and running on a user's premises. This type of software may be deployed in a private (isolated) network environment and cannot access the external internet. Therefore, this type of software cannot be authorized using traditional server-based communication methods and requires offline authorization.

[0075] UUID (Universally Unique Identifier) ​​is a software construction standard and part of the Open Software Foundation's work on distributed computing environments. Its purpose is to allow all elements in a distributed system to have unique identification information, eliminating the need for a central control center to specify identification information. UUIDs can be generated using a variety of algorithms.

[0076] Hash: Generally translated or transliterated as "hash," its function is to transform an input of any length into an output of a fixed length through a hash algorithm. This output is the hash value. There are many hash algorithms, such as MD5 and SHA. Using a highly secure hash algorithm, it is virtually impossible to obtain identical hash results when hashing two different files. Therefore, hashing is commonly used to detect text tampering.

[0077] RSA public-private key algorithm: This is one of the most widely used public-key cryptography systems. Its usage scenario: The private key is used for decryption and signing and is kept by the key generator. The public key is published by the key generator and used for encryption and signature verification for use by other parties.

[0078] For example, when a first user terminal sends a first file to a second user terminal, it signs it with a private key. When the second user terminal receives the first file, it verifies the signature using the public key disclosed by the first user terminal, thereby ensuring that the first file is sent by the first user terminal.

[0079] The second client encrypts the second file using the public key and sends the encrypted second file to the first client. The first client decrypts the second file using the private key, thereby ensuring that the second file can only be received by the first client.

[0080] SM2: An elliptic curve public key cryptography algorithm.

[0081] The following is an introduction to the design concept of the embodiments of the present application.

[0082] Some applications require server authorization before use. Privately deployed applications are deployed in an isolated network environment and cannot access the external internet after deployment. Therefore, during the deployment phase, these applications must apply for an authorization certificate from the server based on collected device information. The server will then issue the authorization certificate to the application in one go.

[0083] Since the application cannot access the external Internet normally after deployment, the server cannot invalidate the authorization certificate in time after issuing it to the application. It is also impossible to detect whether the authorization certificate is invalid before it expires naturally, which brings many inconveniences to application authorization management.

[0084] For example, when a privately deployed application applies for an authorization certificate from the server again based on new device information, the server will reissue the authorization certificate to the application. At this time, the originally issued authorization certificate may not have expired, allowing the application to obtain additional authorization, resulting in application authorization errors and bringing many inconveniences to application authorization management.

[0085] In view of this, an embodiment of the present application provides an application authorization method, which is interactively executed by a target device and a server, and includes the following steps: the target device sends an application authorization request for a target application to the server, wherein the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application.

[0086] The server resolves the target application's unique identifier and obtains a resolution result. If the resolution result indicates that no unexpired historical authorization certificate exists for the corresponding unique identifier, a new target authorization certificate is generated based on the unique identifier and the application deployment information. The target authorization certificate is then sent to the target device. The target device runs the target application based on the target authorization certificate.

[0087] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process.

[0088] refer to Figure 1 , which is a system architecture diagram of a certificate authorization system applicable to an embodiment of the present application. The system architecture includes at least a target device 101 and a server 102. The number of target devices 101 can be one or more, and the number of servers 102 can also be one or more. This application does not specifically limit the number of target devices 101 and servers 102.

[0089] The target device 101 is pre-installed with a target application, where the target application is an application deployed in a private network environment, i.e., a privately deployed application. The target application can be a client application, a web application, a mini-program application, etc. The target device 101 can be, but is not limited to, a smartphone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, a smart TV, a smart car device, etc.

[0090] Server 102 is the backend server of the target application. Server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The target device 101 and server 102 can be directly or indirectly connected via wired or wireless communication, which is not limited in this application.

[0091] The target device 101 sends an application authorization request for a target application to the server 102 , wherein the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application.

[0092] Server 102 parses the target application's unique identifier and obtains a parsing result. If the parsing result indicates that no unexpired historical authorization certificate exists for the corresponding unique identifier, a new target authorization certificate is generated based on the unique identifier and the application deployment information. The target authorization certificate is then sent to target device 101. Target device 101 runs the target application based on the target authorization certificate.

[0093] In practical applications, the solution provided by the embodiment of the present application can be applied to authorization scenarios of all privately deployed applications.

[0094] For example, if Figure 2 As shown, the authorization certificate application process includes the application preparation stage and the application stage.

[0095] Application preparation stage: The deployer deploys the target application on the target device.

[0096] Application stage: Use the deployer account to log in to the authorization management portal. The deployer clicks the "License Management" module in the authorization management portal, and the target device displays the license management interface. Figure 3 As shown, the license management interface includes authorization center node information, a "Create Project" button, and a "Submit Application" button, wherein the authorization center node information includes the unique identity identifier (UUID) of the target application.

[0097] The deployer clicks the "Create Project" button in the license management interface, and the target device displays the Create Project interface, as shown below: Figure 4 As shown, the project creation interface includes project information that the deployer needs to fill in, including: user type, user name, project name, project leader, and project background. After filling in the project information and submitting it, the deployer can view or edit the completed project information.

[0098] The deployer clicks the "Initiate Application" button in the license management interface, and the target device displays the application interface. Figure 5 As shown, the application initiation interface includes the application information that the deployer needs to fill in. The application information includes deployment plan information and authorization application information. The deployment plan information includes the contact name, contact email, associated project, unique identifier (UUID), select the deployment type, and select the deployment environment. Among them, the optional deployment types include formal deployment or Proof of Concept (PoC) deployment, and the optional deployment environments include development environment, test environment, production environment, POC environment, and pre-release environment. The authorization application information includes the scope of authorization that needs to be applied for, such as the CPU parameters that need to be applied for. After filling in the application information, the deployer clicks the "Submit Application" button displayed in the application initiation interface.

[0099] In response to the authorization application operation triggered by the deployer, the target device sends an application authorization request for the target application to the server, wherein the application authorization request includes the project information and application information filled in by the deployer.

[0100] The server parses the target application's unique identifier (UUID) and obtains a resolution result. If the resolution result indicates that there is no unexpired historical authorization certificate for the corresponding unique identifier, a new target authorization certificate is generated and then sent to the contact's email address.

[0101] The deployer clicks the target authorization certificate link in the contact email, and the target device jumps to the authorization management portal. The deployer can view the application details of the certificate license and download the target authorization certificate in the "My Application" module of the authorization management portal.

[0102] After the deployer downloads the target authorization certificate, import the target authorization certificate in the "License Management" module. After importing the target authorization certificate, restart the target device to complete the application authorization.

[0103] based on Figure 1 As shown in the system architecture diagram, this embodiment of the application provides a process of an application authorization method, such as Figure 6 As shown, the process of the method is interactively executed by the target device 101 and the server 102, and includes the following steps:

[0104] Step S601: The target device sends an application authorization request for the target application to the server.

[0105] Specifically, the target application is an application deployed in a private network environment, that is, a privately deployed application. At the same time, the target application is also an application with restricted authorization, that is, an application that can only be used after obtaining an authorization certificate issued by a server.

[0106] The application authorization request includes the target application's unique identifier and application deployment information. The target application's unique identifier can be a UUID, application ID, or other identifier that uniquely represents the target application. Application deployment information includes project information, deployment plan information, and authorization application information.

[0107] Step S602: The server parses the unique identity of the target application to obtain a parsing result.

[0108] Specifically, when parsing the unique identity of the target application, at least the analysis is performed to determine whether the unique identity of the target application is a legal identity and whether there is an unexpired historical authorization certificate corresponding to the unique identity.

[0109] Step S603: If the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity, the server generates a new target authorization certificate based on the unique identity and the application deployment information.

[0110] Specifically, when it is determined that there is no unexpired historical authorization certificate corresponding to the unique identity identifier, it means that the server has not issued an authorization certificate to the unique identity identifier, or has issued an authorization certificate to the unique identity identifier before, but the previously issued authorization certificate has expired or been deleted. At this time, a new target authorization certificate can be generated for the unique identity identifier.

[0111] If the parsing result indicates that there is an unexpired historical authorization certificate for the corresponding unique identity, it means that an authorization certificate has been issued to the unique identity before, and the previously issued authorization certificate has not expired or been deleted. At this time, if a new authorization certificate is generated for the unique identity, the target application will obtain additional authorization. Therefore, the server sends a verification failure message to the target device to avoid repeatedly issuing an authorization certificate to the same application.

[0112] Step S604: The server sends the target authorization certificate to the target device.

[0113] Step S605: The target device runs the target application based on the target authorization certificate.

[0114] Specifically, the target device can receive the target authorization certificate through an email, instant messaging account, etc. After receiving the target authorization certificate, the target authorization certificate is imported into the corresponding storage area. After restarting the target device, it can run normally and use the target application.

[0115] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process.

[0116] Optionally, in the above step S603, the embodiment of the present application provides at least the following implementation methods for generating the target authorization certificate:

[0117] The server determines the target authorization content based on the application deployment information. Specifically, the target authorization content may be determined based on the deployment plan information and authorization application information in the application deployment information, or based on the project information, deployment plan information, and authorization application information in the application deployment information.

[0118] The authorization certificate identifier, unique identity, and target authorization content are hashed to obtain the certificate issuance serial code. The certificate issuance serial code is then encrypted using the target private key to obtain the certificate signature. The target authorization certificate is then obtained based on the authorization certificate identifier, unique identity, target authorization content, certificate issuance serial code, and certificate signature.

[0119] Specifically, the hash algorithms used in the hash process include, but are not limited to, the MD5 algorithm and the SHA algorithm. MD5 algorithms include 16-bit MD5 algorithms, 32-bit MD5 algorithms, and 64-bit MD5 algorithms. SHA algorithms include SHA-1 algorithms, SHA-2 algorithms, and SHA-3 algorithms.

[0120] The RSA algorithm or SM2 is used to generate a target private key and a target public key corresponding to the target private key. The target private key is stored by the server, and the target public key is disclosed to the target device.

[0121] It should be noted that the embodiments of the present application are not limited to the above-mentioned method of generating a certificate release serial code. It can be a method of performing hash processing on any one or more of the authorization certificate identifier, unique identity identifier and target authorization content to obtain a certificate release serial code. This application does not make specific limitations on this.

[0122] In an embodiment of the present application, the authorization certificate not only includes the authorization certificate identifier, unique identity identifier and authorization content, but also includes a certificate release serial code obtained by hashing the authorization certificate identifier, unique identity identifier and authorization content, and a certificate signature obtained by encrypting the certificate release serial code. Among them, the certificate release serial code can be used for subsequent analysis of whether the target application contains an unexpired historical authorization certificate to avoid repeated issuance of authorization certificates, and the certificate signature in the authorization certificate can effectively prevent the authorization certificate from being maliciously tampered with, thereby ensuring the security of the authorization certificate.

[0123] Optionally, the server uses the target private key to encrypt the certificate issuance serial code to obtain a certificate signature. Then, based on the authorization certificate identifier, unique identifier, target authorization content, certificate issuance serial code, and certificate signature, the server obtains the target authorization certificate and sends it to the target device. The target device verifies the certificate signature in the target authorization certificate using the target public key. If verification succeeds, indicating that the target authorization certificate was issued by the server, the server imports the target authorization certificate and runs the target application based on the target authorization certificate.

[0124] In addition, when the target authorization certificate is imported into the target device or after a period of time, the target authorization certificate can be marked as a historical authorization certificate. Before the target authorization certificate expires naturally, the target authorization certificate can be marked as an unexpired historical authorization certificate. After the target authorization certificate expires naturally, the target authorization certificate can be marked as an expired historical authorization certificate.

[0125] In an embodiment of the present application, the server uses a hash algorithm to generate a certificate release serial code, and then uses a private key to encrypt the certificate release serial code to obtain a certificate signature. Therefore, after the server sends the authorization certificate containing the certificate signature to the target device, the target device needs to use the public key to verify the certificate signature, and only when the verification is passed can it import the authorization certificate and run the target application, thereby avoiding tampering with the authorization certificate and ensuring the security of application authorization.

[0126] Optionally, in the above step S602, the embodiment of the present application provides at least several implementation methods for parsing the unique identity of the target application to obtain the parsing result:

[0127] Implementation method 1: If the unique identity identifier is a legal identity identifier and no authorization certificate has been generated for the unique identity identifier, the parsing result is determined to be: there is no unexpired historical authorization certificate corresponding to the unique identity identifier.

[0128] Specifically, when the server issues an authorization certificate, the authorization record records the correspondence between the issued authorization certificate and the application's unique identifier. After receiving an application authorization request from the target device, the server uses the target application's unique identifier to query the authorization record. If no authorization record for the target application is found, it indicates that no authorization certificate has been generated for the target application, thus confirming the parsing result: there is no unexpired historical authorization certificate corresponding to the unique identifier.

[0129] In an embodiment of the present application, the server queries the authorization record based on the unique identity of the target application to determine whether an authorization certificate has been issued to the target application. If not, it can be directly determined that there is no unexpired historical authorization certificate for the unique identity of the corresponding target application, thereby improving the resolution speed of the unique identity.

[0130] In the second embodiment, the application authorization request also includes a certificate release serial code associated with the unique identity. Before the target device sends the application authorization request for the target application to the server, in response to the certificate deletion instruction, it deletes the unexpired historical authorization certificate associated with the target application and generates a certificate release serial code.

[0131] Specifically, the certificate release serial code is used to indicate that the historical authorization certificate that has not expired has been deleted. The certificate release serial code can be obtained by at least the following implementation methods:

[0132] The target device obtains the historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performs hash processing on the historical authorization certificate identifier, unique identity identifier, and historical authorization content to obtain the certificate release serial code. Alternatively, the target device directly uses the certificate release serial code in the historical authorization certificate as the certificate release serial code.

[0133] Specifically, the hash algorithms used in the hash process include, but are not limited to, the MD5 algorithm and the SHA algorithm. MD5 algorithms include 16-bit MD5 algorithms, 32-bit MD5 algorithms, and 64-bit MD5 algorithms. SHA algorithms include SHA-1 algorithms, SHA-2 algorithms, and SHA-3 algorithms.

[0134] The data items used by the target device to generate the certificate release serial code are the same as the data items used by the server to generate the certificate release serial code. For example, when the server performs a hash process on the authorization certificate identifier, unique identity identifier, and authorization content to obtain the certificate release serial code, the target device performs a hash process based on the historical authorization certificate identifier, unique identity identifier, and historical authorization content to obtain the certificate release serial code. For another example, when the server performs a hash process on the unique identity identifier and authorization content to obtain the certificate release serial code, the target device performs a hash process based on the unique identity identifier and historical authorization content to obtain the certificate release serial code.

[0135] In an embodiment of the present application, the rules for the target device to generate the certificate release serial code are the same as the rules for the server to generate the certificate publication serial code, thereby ensuring the comparability between the certificate release serial code and the certificate publication serial code in the application authorization stage, and thus facilitating the server to verify whether the application contains an unexpired historical authorization certificate.

[0136] After obtaining the certificate release serial code, the target device sends an application authorization request containing the unique identity of the target application, the certificate release serial code, and application deployment information to the server.

[0137] The server parses the unique identity. If the unique identity is a legitimate identity, the server compares the certificate release serial code with the certificate issuance serial code, where the certificate issuance serial code is included in the unexpired historical authorization certificate associated with the target application.

[0138] If the certificate release serial code is consistent with the certificate issuance serial code, the parsing result is determined to be: there is no unexpired historical authorization certificate corresponding to the unique identity.

[0139] Specifically, since the certificate release sequence code is generated when the target application's associated, unexpired historical authorization certificate is deleted, upon receiving the certificate release sequence code for the historical authorization certificate, the server can preliminarily determine that the historical authorization certificate has been deleted. Since the certificate release sequence code and the certificate issuance sequence code are generated using the same rules, if the certificate release sequence code is consistent with the certificate issuance sequence code, it indicates that the certificate release sequence code has not been forged or tampered with, further confirming that the historical authorization certificate has been deleted.

[0140] Optionally, to improve the security of the certificate release serial code, after generating the certificate release serial code for the historical authorization certificate, the target device encrypts the certificate release serial code using the target public key. Then, when the server receives the certificate release serial code, it needs to decrypt the certificate release serial code using the target private key corresponding to the target public key. Only after successful decryption will the decrypted certificate release serial code be compared with the certificate issuance serial code. If they match, it is determined that no unexpired historical authorization certificate exists for the corresponding unique identity, thereby further improving the accuracy and security of application authorization management.

[0141] For example, if Figure 7 As shown, the management end corresponding to the server generates an RSA private key and an RSA public key, wherein the RSA private key is stored in the management end, and the RSA public key is disclosed to the authorization server corresponding to the target device.

[0142] The management end receives an application authorization request for a target application sent by the authorization server, wherein the application authorization request includes a unique identifier (UUID) of the target application and application deployment information.

[0143] The management client parses the unique identifier and determines that no authorization certificate has been generated for it. Based on the application deployment information, it determines the target authorization content. It hashes the authorization certificate ID, unique identifier, and target authorization content to obtain a file digest, which is the certificate issuance serial number. It then encrypts the file digest using the RSA private key to obtain the certificate signature. The target authorization certificate is then obtained based on the authorization certificate ID, unique identifier, target authorization content, file digest, and certificate signature. The management client sends the target authorization certificate to the authorization server.

[0144] The authorization server uses the RSA public key to verify the certificate signature of the target authorization certificate. When the verification is successful, the target authorization certificate is imported into the storage area of ​​the target device and the target application is run based on the target authorization certificate.

[0145] When the target authorization certificate in the storage area is deleted, the authorization server obtains the certificate release serial code in the target authorization file as the certificate release serial code of the target authorization file, then encrypts the certificate release serial code using the RSA public key and sends the encrypted certificate release serial code to the management end.

[0146] The management end uses the RSA private key to decrypt the certificate release serial code and compares the decrypted certificate release serial code with the certificate release serial code in the locally saved target authorization certificate. If they are consistent, it is determined that the authorization server has deleted the target authorization certificate.

[0147] In an embodiment of the present application, when the target device deletes an unexpired historical authorization certificate, it generates a certificate release serial code. When the target device applies for an authorization certificate from the server again, it sends the certificate release serial code to the server so that the server can be promptly informed that the unexpired historical authorization certificate has been deleted, thereby realizing the recovery of the authorization certificate of the privately deployed application, avoiding the repeated issuance of authorization certificates to the target application, and bringing convenience to application authorization management.

[0148] In order to better explain the embodiment of the present application, the following describes an application authorization method provided by the embodiment of the present application in combination with a specific implementation scenario. The process of the method can be as follows: Figure 1 The target device 101 and the server 102 interact and execute the following steps: Figure 8a As shown:

[0149] Step S801: The target device sends a first application authorization request for a target application to a server.

[0150] Specifically, the user uses the user account to log in to the authorization management portal, the user clicks the "Permission Management" module in the authorization management portal, and the target device displays the permission management interface, as shown in the following example: Figure 8b As shown in the figure, the license management interface includes the target application's unique identifier, an application deployment information field, and a "Submit Application" button. After the user fills in the relevant information in the application deployment information field, they click the "Submit Application" button to submit the application authorization application 1. In response to the user's operation, the target device sends a first application authorization request for the target application to the server. The first application authorization request includes the target application's unique identifier (UUID) and application deployment information.

[0151] The user clicks on the "My Application" module in the authorization management portal, and the target device displays the "My Application" interface, such as Figure 8c The My Applications interface includes a list of applied permissions, which records Application Authorization Application 1. Users can view the details of Application Authorization Application 1 by clicking Application Authorization Application 1 in the permission list.

[0152] In step S802 , the server parses the unique identity of the target application and determines that no authorization certificate has been generated for the unique identity.

[0153] Step S803: The server generates a first authorization certificate.

[0154] Specifically, the first authorization certificate includes the authorization certificate ID, the unique identity (UUID), the target authorization content, the file summary (certificate release serial code) and the certificate signature, wherein the file summary is obtained by hashing the authorization certificate ID, the unique identity and the target authorization content using a hash algorithm, and the certificate signature is obtained by encrypting the file summary using an RSA private key.

[0155] Step S804: The server sends the first authorization certificate to the target device.

[0156] Step S805: The target device imports the first authorization certificate.

[0157] Specifically, the target device receives the first authorization certificate through the mailbox pre-filled by the user. The user clicks the authorization certificate link in the mailbox, and the target device jumps to the authorization management portal. The user clicks the "My Application" module in the authorization management portal, and the target device displays the "My Application" interface, as shown in the following example. Figure 8c As shown. The user clicks Application Authorization Application 1 in the permission list in the My Application interface, and the details of Application Authorization Application 1 are displayed in the My Application interface, as shown Figure 8d As shown, it specifically includes: the unique identity corresponding to the application authorization application 1, the application deployment information and the application result, wherein the application result includes: the message that the application authorization application 1 has passed the approval and the first authorization certificate.

[0158] The user can click and download the first authorization certificate on the My Application interface. The target device uses the RSA public key to verify the certificate signature of the first authorization certificate. When the verification passes, the first authorization certificate is imported and the target application is run based on the first authorization certificate.

[0159] Step S806: The target device sends a second application authorization request for the target application to the server.

[0160] Specifically, the user applies for and submits application authorization application 2 in the license management interface in the same manner as above, and the applied license list records application authorization application 2. The second application authorization request includes the target application's unique identity (UUID) and application deployment information.

[0161] In step S807 , the server parses the unique identity of the target application and determines that there is an unexpired historical authorization certificate corresponding to the unique identity.

[0162] Step S808: The server sends a verification failure message to the target device.

[0163] Correspondingly, the permission list in the My Application interface displays Application Authorization Application 1 and Application Authorization Application 2. When the user clicks Application Authorization Application 2, the details of Application Authorization Application 2 are displayed in the My Application interface, such as Figure 8e As shown, it specifically includes: the unique identity corresponding to the application authorization application 2, the application deployment information and the application result, wherein the application result includes: the message that the application authorization application 2 is not approved.

[0164] Step S809: The target device deletes the first authorization certificate in response to the certificate deletion instruction, and generates a certificate release serial code.

[0165] Specifically, a hash algorithm can be used to hash the authorization certificate ID, unique identity identifier, and target authorization content to generate a certificate release serial code. Alternatively, the file digest (certificate release serial code) in the first authorization certificate can be directly used as the certificate release serial code. The certificate release serial code is then encrypted using an RSA public key.

[0166] Step S810: The target device sends a third application authorization request for the target application to the server.

[0167] Specifically, the user applies for and submits application authorization application 3 in the license management interface in the same manner as above, and the applied license list records application authorization application 3. The third application authorization request includes the target application's unique identity (UUID), certificate release serial code, and application deployment information.

[0168] In step S811, when the server determines that the unique identity is legal and the certificate release serial code is consistent with the certificate issuance serial code, it determines that there is no unexpired historical authorization certificate corresponding to the unique identity.

[0169] Specifically, the server first uses the RSA private key to decrypt the certificate release serial code, and then compares the certificate release serial code with the certificate issuance serial code to see if they are consistent.

[0170] Step S812: The server generates a new second authorization certificate.

[0171] In step S813, the server sends the second authorization certificate to the target device.

[0172] Step S814: The target device imports the second authorization certificate.

[0173] Accordingly, the permission list in the My Application interface displays Application Authorization Application 1, Application Authorization Application 2, and Application Authorization Application 3. When the user clicks Application Authorization Application 3, the details of Application Authorization Application 3 are displayed in the My Application interface, such as Figure 8f As shown, it specifically includes: the unique identity corresponding to application authorization application 3, application deployment information, and application results. The application results include: a message that application authorization application 3 has been approved and a second authorization certificate. The user can click and download the second authorization certificate on the My Application interface. The target device uses the RSA public key to verify the certificate signature of the second authorization certificate. If the verification is successful, the second authorization certificate is imported and the target application is run based on the second authorization certificate.

[0174] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process.

[0175] Based on the same technical concept, the embodiment of the present application provides a structural diagram of an application authorization device, such as Figure 9 As shown, the apparatus 900 includes:

[0176] A first receiving module 901 is configured to receive an application authorization request for a target application sent by a target device, wherein the application authorization request includes a unique identity identifier and application deployment information of the target application, and the target application is an application deployed in a private network environment;

[0177] The parsing module 902 is used to parse the unique identity of the target application and obtain a parsing result;

[0178] The certificate issuing module 903 is configured to generate a new target authorization certificate based on the unique identity and the application deployment information if the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity;

[0179] The first sending module 904 is configured to send the target authorization certificate to the target device, so that the target device runs the target application based on the target authorization certificate.

[0180] Optionally, the parsing module 902 is specifically configured to:

[0181] If the unique identity identifier is a legal identity identifier and no authorization certificate has been generated for the unique identity identifier, the parsing result is determined to be: there is no unexpired historical authorization certificate corresponding to the unique identity identifier.

[0182] Optionally, the application authorization request further includes a certificate release sequence code associated with the unique identity identifier, where the certificate release sequence code is generated when the target device deletes an unexpired historical authorization certificate associated with the target application in response to a certificate deletion instruction;

[0183] The analysis module 902 is specifically used for:

[0184] If the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application;

[0185] If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

[0186] Optionally, the certificate issuing module 903 is specifically configured to:

[0187] Determining target authorization content based on the application deployment information;

[0188] Performing hash processing on the authorization certificate identifier, the unique identity identifier, and the target authorization content to obtain a certificate issuance serial code;

[0189] Encrypting the certificate issuance serial code using the target private key to obtain a certificate signature;

[0190] The target authorization certificate is obtained based on the authorization certificate identifier, the unique identity identifier, the target authorization content, the certificate issuance serial code and the certificate signature.

[0191] Optionally, the first sending module 904 is specifically configured to:

[0192] The target authorization certificate is sent to the target device so that the target device uses the target public key corresponding to the target private key to verify the certificate signature in the target authorization certificate. If the verification is successful, the target application is run based on the target authorization certificate.

[0193] Optionally, the first sending module 904 is further configured to:

[0194] If the parsing result indicates that there is an unexpired historical authorization certificate corresponding to the unique identity identifier, a verification failure message is sent to the target device.

[0195] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process.

[0196] Based on the same technical concept, the embodiment of the present application provides a structural diagram of an application authorization device, such as Figure 10 As shown, the device 1000 includes:

[0197] The second sending module 1001 is configured to send an application authorization request for a target application to a server, where the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application;

[0198] The second receiving module 1002 is configured to receive a target authorization certificate returned by the server, where the target authorization certificate is obtained by the server by parsing the obtained unique identity of the target application to obtain a parsing result; if the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity, generating a new target authorization certificate based on the unique identity and the application deployment information;

[0199] The processing module 1003 is configured to run the target application based on the target authorization certificate.

[0200] Optionally, the application authorization request further includes a certificate release serial code associated with the unique identity identifier. The server then parses the obtained unique identity identifier of the target application to obtain a parsing result in the following manner:

[0201] When it is determined that the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application;

[0202] If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

[0203] Optionally, the processing module 1003 is further configured to:

[0204] Before sending an application authorization request for a target application to a server, in response to a certificate deletion instruction, the unexpired historical authorization certificate associated with the target application is deleted, and the certificate release serial code is generated.

[0205] Optionally, the processing module 1003 is specifically configured to:

[0206] Obtaining the historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier and the historical authorization content to obtain the certificate release serial code; or,

[0207] The certificate issuance serial code in the historical authorization certificate is used as the certificate release serial code.

[0208] Optionally, the processing module 1003 is further configured to:

[0209] Before sending an application authorization request for a target application to a server, the certificate release serial code is encrypted using a target public key. Before the server compares the certificate release serial code with the certificate issuance serial code, the method further includes:

[0210] The target private key corresponding to the target public key is used to decrypt the certificate release sequence code.

[0211] In the embodiment of the present application, an authorization certificate is applied for from the server based on the unique identity of the target application itself, and physical device information is no longer relied upon, thereby effectively avoiding the problem of the application obtaining additional authorization due to forged or tampered device information. Since the application for the authorization certificate no longer relies on physical device information, even for a container environment that does not have corresponding physical device information, an authorization certificate can be applied for based on the unique identity of the target application, so that the target application can be deployed in the container environment, thereby increasing the scope of application of the target application. In addition, the unique identity of the target application is first parsed, and the target authorization certificate is issued only after it is determined that there is no unexpired historical authorization certificate for the corresponding unique identity, so that the invalid status of the historical authorization certificate is promptly known, and repeated issuance of authorization certificates is avoided, thereby improving the convenience of application authorization management and the security of the application authorization process.

[0212] Based on the same technical concept, the embodiment of the present application provides a computer device, which can be Figure 1The target device and / or server shown, such as Figure 11 As shown, it includes at least one processor 1101 and a memory 1102 connected to the at least one processor. The specific connection medium between the processor 1101 and the memory 1102 is not limited in the embodiment of the present application. Figure 11 For example, the processor 1101 and the memory 1102 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, and the like.

[0213] In an embodiment of the present application, the memory 1102 stores instructions that can be executed by at least one processor 1101. The at least one processor 1101 can execute the steps of the above-mentioned application authorization method by executing the instructions stored in the memory 1102.

[0214] The processor 1101 is the control center of the computer device and can connect various parts of the computer device using various interfaces and lines. It can implement application authorization by running or executing instructions stored in the memory 1102 and calling data stored in the memory 1102. Optionally, the processor 1101 may include one or more processing units. The processor 1101 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs, while the modem processor mainly processes wireless communications. It is understood that the modem processor may not be integrated into the processor 1101. In some embodiments, the processor 1101 and the memory 1102 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0215] The processor 1101 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0216] Memory 1102 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1102 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Memory 1102 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1102 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0217] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned application authorization method.

[0218] Based on the same inventive concept, an embodiment of the present application provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the above-mentioned application authorization method.

[0219] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0220] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0221] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0222] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0223] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0224] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. An application authorization method, characterized in that: include: Receiving an application authorization request for a target application sent by a target device, the application authorization request including a unique identity identifier and application deployment information of the target application, wherein the target application is an application deployed in a private network environment; wherein the unique identity identifier is an application-level identifier and is decoupled from physical device information; Parsing the unique identity of the target application to obtain a parsing result; If the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity, generating a new target authorization certificate based on the unique identity and the application deployment information; Sending the target authorization certificate to the target device, so that the target device runs the target application based on the target authorization certificate; The application authorization request also includes a certificate release sequence code associated with the unique identity identifier, and the certificate release sequence code is generated when the target device deletes the unexpired historical authorization certificate associated with the target application in response to the certificate deletion instruction; wherein the target device generates the certificate release sequence code by: obtaining a historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier, and the historical authorization content to obtain the certificate release sequence code; or using the certificate release sequence code in the historical authorization certificate as the certificate release sequence code; the certificate release sequence code is generated by hashing the target authorization certificate identifier, the unique identity identifier, and the target authorization content corresponding to the application deployment information; The step of parsing the unique identity of the target application to obtain a parsing result includes: If the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application; If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

2. The method according to claim 1, wherein The generating a new target authorization certificate based on the unique identity and the application deployment information includes: Determining target authorization content based on the application deployment information; Performing hash processing on the authorization certificate identifier, the unique identity identifier, and the target authorization content to obtain a certificate issuance serial code; Encrypting the certificate issuance serial code using the target private key to obtain a certificate signature; The target authorization certificate is obtained based on the authorization certificate identifier, the unique identity identifier, the target authorization content, the certificate issuance serial code and the certificate signature.

3. The method according to claim 2, wherein The sending the target authorization certificate to the target device so that the target device runs the target application based on the target authorization certificate includes: The target authorization certificate is sent to the target device so that the target device uses the target public key corresponding to the target private key to verify the certificate signature in the target authorization certificate. If the verification is successful, the target application is run based on the target authorization certificate.

4. The method according to any one of claims 1 to 3, characterized in that Also includes: If the parsing result indicates that there is an unexpired historical authorization certificate corresponding to the unique identity identifier, a verification failure message is sent to the target device.

5. An application authorization method, characterized in that: include: Sending an application authorization request for a target application to a server, where the target application is an application deployed in a private network environment, the application authorization request including a unique identity identifier and application deployment information of the target application; wherein the unique identity identifier is an application-level identifier and is decoupled from physical device information; Receiving a target authorization certificate returned by the server, the target authorization certificate being obtained by the server by: parsing the obtained unique identity identifier of the target application to obtain a parsing result; if the parsing result indicates that no unexpired historical authorization certificate exists corresponding to the unique identity identifier, generating a new target authorization certificate based on the unique identity identifier and the application deployment information; running the target application based on the target authorization certificate; The application authorization request also includes a certificate release sequence code associated with the unique identity identifier. The server then parses the obtained unique identity identifier of the target application to obtain a parsing result in the following manner: When it is determined that the unique identity identifier is a legitimate identity identifier, the certificate release serial code is compared with a certificate issuance serial code, wherein the certificate issuance serial code is contained in an unexpired historical authorization certificate associated with the target application; the certificate issuance serial code is generated by hashing the target authorization certificate identifier, the unique identity identifier, and the target authorization content corresponding to the application deployment information; If the certificate release serial code is consistent with the certificate issuance serial code, determining that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity; Before sending the application authorization request for the target application to the server, the method further includes: In response to the certificate deletion instruction, deleting the unexpired historical authorization certificate associated with the target application and generating the certificate release serial code; The generating of the certificate release serial code comprises: Obtaining the historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier and the historical authorization content to obtain the certificate release serial code; or, The certificate issuance serial code in the historical authorization certificate is used as the certificate release serial code.

6. The method according to claim 5, wherein Before sending the application authorization request for the target application to the server, the method further includes: The certificate release serial code is encrypted using a target public key, and before the server compares the certificate release serial code with the certificate issuance serial code, the method further includes: The target private key corresponding to the target public key is used to decrypt the certificate release sequence code.

7. An application authorization device, characterized in that: include: A first receiving module is configured to receive an application authorization request for a target application sent by a target device, wherein the application authorization request includes a unique identity identifier and application deployment information of the target application, wherein the target application is an application deployed in a private network environment; wherein the unique identity identifier is an application-level identifier and is decoupled from physical device information; A parsing module, configured to parse the unique identity of the target application and obtain a parsing result; a certificate issuing module, configured to generate a new target authorization certificate based on the unique identity and the application deployment information if the parsing result indicates that there is no unexpired historical authorization certificate corresponding to the unique identity; A first sending module, configured to send the target authorization certificate to the target device, so that the target device runs the target application based on the target authorization certificate; The application authorization request also includes a certificate release sequence code associated with the unique identity identifier, and the certificate release sequence code is generated when the target device deletes the unexpired historical authorization certificate associated with the target application in response to the certificate deletion instruction; wherein the target device generates the certificate release sequence code by: obtaining a historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier, and the historical authorization content to obtain the certificate release sequence code; or using the certificate release sequence code in the historical authorization certificate as the certificate release sequence code; the certificate release sequence code is generated by hashing the target authorization certificate identifier, the unique identity identifier, and the target authorization content corresponding to the application deployment information; The parsing module is specifically used for: If the unique identity identifier is a legal identity identifier, comparing the certificate release serial code with a certificate issuance serial code, wherein the certificate issuance serial code is included in an unexpired historical authorization certificate associated with the target application; If the certificate release serial code is consistent with the certificate issuance serial code, it is determined that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity.

8. An application authorization device, characterized in that: include: a second sending module, configured to send an application authorization request for a target application to the server, wherein the target application is an application deployed in a private network environment, and the application authorization request includes a unique identity identifier and application deployment information of the target application; wherein the unique identity identifier is an application-level identifier and is decoupled from physical device information; a second receiving module, configured to receive a target authorization certificate returned by the server, the target authorization certificate being obtained by the server by: parsing the obtained unique identity identifier of the target application to obtain a parsing result; and if the parsing result indicates that no unexpired historical authorization certificate exists corresponding to the unique identity identifier, generating a new target authorization certificate based on the unique identity identifier and the application deployment information; a processing module, configured to run the target application based on the target authorization certificate; The application authorization request also includes a certificate release serial code associated with the unique identity identifier. The server then parses the obtained unique identity identifier of the target application to obtain a parsing result in the following manner: When it is determined that the unique identity identifier is a legitimate identity identifier, the certificate release serial code is compared with a certificate issuance serial code, wherein the certificate issuance serial code is contained in an unexpired historical authorization certificate associated with the target application; the certificate issuance serial code is generated by hashing the target authorization certificate identifier, the unique identity identifier, and the target authorization content corresponding to the application deployment information; If the certificate release serial code is consistent with the certificate issuance serial code, determining that the parsing result is: there is no unexpired historical authorization certificate corresponding to the unique identity; The processing module is further configured to: Before sending an application authorization request for a target application to a server, in response to a certificate deletion instruction, deleting an unexpired historical authorization certificate associated with the target application and generating a certificate release serial code; The processing module is specifically used for: Obtaining the historical authorization certificate identifier and historical authorization content in the historical authorization certificate, and performing hash processing on the historical authorization certificate identifier, the unique identity identifier and the historical authorization content to obtain the certificate release serial code; or, The certificate issuance serial code in the historical authorization certificate is used as the certificate release serial code.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that It stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of any one of the methods according to claims 1 to 6.

11. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer is caused to perform the steps of the method according to any one of claims 1 to 6.

Images