Virtual machine-based operating system authorization method, device, system, and computing device

Abstract

The present invention discloses a method, device, system and computing device for authorizing an operating system based on a virtual machine, wherein the method includes the following steps: when the operating system is installed in the virtual machine and started for the first time, obtaining an initial key value generated by a key value file of the operating system and obtaining initial device information of the virtual machine; sending the initial key value and initial device information to an authorization authentication server; and obtaining an authorization serial number input by a user, and sending the authorization serial number to the authorization authentication server so that the authorization authentication server binds the initial key value and initial device information with the authorization serial number and stores them to authorize the operating system installed on the virtual machine. According to the technical solution of the present invention, it is possible to accurately control the user's authorized use of the operating system installed on the virtual machine.

Description

[0001] This application is a divisional application of invention patent application 2021112927333 filed on November 3, 2021. Technical Field

[0002] The present invention relates to the technical field of virtual machines, and in particular to an operating system authorization method, an authorization device, an authorization control system and a computing device based on a virtual machine. Background Art

[0003] A virtual machine is a complete computer system emulated through software, with full hardware system functionality, running in a completely isolated environment. When you create a virtual machine on a physical computer, some of the physical computer's hardware resources, such as the hard drive, memory, and CPU, are used as independent resources for the virtual machine. Each virtual machine has its own independent disk and operating system, allowing users to operate the virtual machine just as they would on a physical computer.

[0004] KVM (Kernel-based Virtual Machine) is an open-source system virtualization module that can be integrated into all major Linux distributions. KVM uses Linux's native scheduler for management, has relatively little core source code, and is a fully hardware-based virtualization module, not a software emulation.

[0005] In the prior art, it is necessary to manage the authorization and authentication of software such as operating systems. For example, when installing operating system software in a KVM virtual environment, it is necessary to limit the use rights of the operating system software based on the user's usage. For physical computers, there are real devices in the actual physical host environment. By obtaining real device information (such as host information, motherboard information, hard disk information, etc.), the host environment where the user's operating system is deployed can be determined. By binding the user's operating system software to the host environment one by one, the user's authorized use of the operating system can be limited.

[0006] However, when installing and using an operating system in a KVM virtual environment, it's impossible to bind the operating system to the unique information corresponding to the host environment using the aforementioned authorization management method. Specifically, because the device information obtained in the virtual environment is not real physical device information and is often not unique, and there is a possibility of changes, additions, or deletions during virtual machine configuration, existing authorization management methods cannot accurately determine whether a user has obtained authorization for the operating system software.

[0007] Therefore, a virtual machine-based operating system authorization method is needed to solve the problems existing in the above technical solutions. Summary of the Invention

[0008] To this end, the present invention provides an operating system authorization method, authorization device, and authorization control system based on a virtual machine, in an effort to solve or at least alleviate the above problems.

[0009] According to one aspect of the present invention, a method for authorizing an operating system based on a virtual machine is provided, comprising the steps of: obtaining an initial key value generated by a key value file of the operating system and obtaining initial device information of the virtual machine when the operating system is first started after being installed on the virtual machine; sending the initial key value and initial device information to an authorization authentication server; and obtaining an authorization serial number input by a user, and sending the authorization serial number to the authorization authentication server, so that the authorization authentication server binds the initial key value and initial device information with the authorization serial number and stores them to authorize the operating system installed on the virtual machine.

[0010] Optionally, the virtual machine-based operating system authorization method according to the present invention further includes the steps of: obtaining a new key value generated by the key value file of the operating system during the operation of the operating system, and obtaining new device information of the virtual machine; sending the new key value and new device information to the authorization authentication server, so that the authorization authentication server compares the new key value with the initial key value to obtain a first comparison result, compares the new device information with the initial device information to obtain a second comparison result, and determines the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result; and obtains the authorization authentication result returned by the authorization authentication server.

[0011] Optionally, in the virtual machine-based operating system authorization method according to the present invention, determining the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result includes: if the first comparison result is that the new key value is the same as the initial key value, and the second comparison result is that the new device information is the same as the initial device information, then determining that the authorization authentication is successful.

[0012] Optionally, in the virtual machine-based operating system authorization method according to the present invention, determining the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result includes: if the first comparison result is that the new key value is different from the initial key value, and / or the second comparison result is that the new device information is different from the initial device information, then determining that the authorization authentication has failed.

[0013] Optionally, in the virtual machine-based operating system authorization method according to the present invention, before obtaining the initial key value generated by the key value file of the operating system, the steps include: generating the key value file in the operating system and encrypting the key value file.

[0014] Optionally, in the virtual machine-based operating system authorization method according to the present invention, the device information is a UUID value, and obtaining the initial device information of the virtual machine includes: obtaining the UUID value of the virtual machine from a virtual machine configuration file.

[0015] According to one aspect of the present invention, there is provided an authorization device, which is arranged on the operating system of a virtual machine and includes: a first processing unit, adapted to obtain an initial key value generated by a key value file of the operating system and obtain initial device information of the virtual machine when the operating system is installed on the virtual machine and started for the first time, and send the initial key value and initial device information to an authorization authentication server; a second processing unit, adapted to obtain an authorization serial number input by a user and send the authorization serial number to the authorization authentication server so that the authorization authentication server binds the initial key value and initial device information with the authorization serial number and stores them to authorize the operating system installed on the virtual machine.

[0016] According to one aspect of the present invention, an authorization control system is provided, comprising: a virtual machine, wherein the virtual machine is suitable for installing an operating system, an authorization device is arranged on the operating system, and the authorization device is suitable for executing the method as described above; and an authorization authentication server, connected to the authorization device, suitable for obtaining an initial key value, initial device information and an authorization serial number sent by the authorization device, and binding the initial key value and initial device information with the authorization serial number and storing them so as to authorize the operating system installed on the virtual machine.

[0017] Optionally, in the authorization control system according to the present invention, the system includes one or more clients, and the virtual machine is deployed on the client.

[0018] According to one aspect of the present invention, a computing device is provided, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be suitable for execution by the at least one processor, and the program instructions include instructions for executing the virtual machine-based operating system authorization method as described above.

[0019] According to one aspect of the present invention, a readable storage medium storing program instructions is provided. When the program instructions are read and executed by a computing device, the computing device executes the method described above.

[0020] According to the technical solution of the present invention, a method for authorizing an operating system based on a virtual machine is provided. By generating a key value file in the operating system installed in the virtual machine, a unique key value is generated based on the key value file when the operating system is started for the first time after installation. The key value can uniquely identify the virtual machine environment. By uploading the key value and the UUID value of the virtual machine to the authorization authentication server, the authorization authentication server binds the key value and the UUID value of the virtual machine together with the authorization serial number input by the user, so that the user obtains authorization to use the operating system in the virtual machine. In this way, when authorizing the virtual machine operating system, the present invention can accurately control the user's authorized use of the operating system installed in the virtual machine by adding a key value that can uniquely identify the virtual machine.

[0021] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] To achieve the above and related purposes, certain illustrative aspects are described herein in conjunction with the following description and accompanying drawings, which indicate various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to fall within the scope of the claimed subject matter. The above and other objects, features, and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Throughout this disclosure, the same reference numerals generally refer to the same parts or elements.

[0023] Figure 1 FIG2 shows a schematic diagram of an authorization control system 100 according to an embodiment of the present invention;

[0024] Figure 2 shows a schematic diagram of a computing device 200 according to one embodiment of the present invention;

[0025] Figure 3 A flowchart of a virtual machine-based operating system authorization method 300 according to an embodiment of the present invention is shown; and

[0026] Figure 4 FIG. 4 is a schematic diagram showing an authorization device 400 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Figure 1 FIG. 1 is a schematic diagram of an authorization control system 100 according to an embodiment of the present invention.

[0029] like Figure 1 As shown, the authorization control system 100 includes an authorization authentication server 120 and one or more clients 110 connected to the authorization authentication server 120. A virtual machine 115 can be deployed in the client 110, and the virtual machine 115 is suitable for installing an operating system 114 and obtaining authorization for the operating system.

[0030] The authorization authentication server 120 is used to manage and control user authorization to use the operating system 114 installed in the virtual machine. The present invention does not limit the specific implementation of the authorization authentication server. For example, the authorization authentication server 120 can be implemented as a computing device such as a desktop computer, laptop computer, processor chip, mobile phone, tablet computer, etc., but is not limited to these. It can also be an application resident on the computing device.

[0031] In addition, the present invention does not limit the specific device type of the client 110. For example, the client 110 can be implemented as a computing device such as a desktop computer, a laptop computer, a mobile phone, or a tablet computer.

[0032] When the virtual machine 115 is created in the client 110 , the virtual machine 115 may generate unique device information corresponding to the virtual machine, and the device information may be stored in a virtual machine configuration file.

[0033] In one implementation, the virtual machine may be implemented as a KVM virtual machine, and the device information is, for example, a UUID value of the virtual machine.

[0034] According to one embodiment of the present invention, an authorization device 400 is disposed on the operating system 114 installed in the virtual machine 115, and the authorization device 400 is in communication with the authorization authentication server 120. After the operating system 114 is installed in the virtual machine 115, the authorization device 400 randomly creates a key file (KEY file) within the operating system 114 of the virtual machine 115 and encrypts the key file.

[0035] When the operating system 114 installed in the virtual machine 115 is first started, the key file within the operating system 114 can generate a unique key value as the initial key value. Here, because the key file is randomly created and encrypted, the key value generated based on the key file can be guaranteed to be unique, thereby uniquely identifying the virtual machine. The authorization device 400 can obtain the initial key value generated by the key file and obtain the device information (UUID) of the virtual machine from the virtual machine configuration file. The obtained initial key value and initial device information are then sent to the authorization authentication server 120.

[0036] In addition, the authorization device 400 may also obtain the authorization serial number input by the user and send the authorization serial number to the authorization authentication server 120 .

[0037] The authorization authentication server 120 may bind the initial key value and initial device information to the authorization serial number and store them to authorize the operating system 114 installed in the virtual machine. Here, after binding the initial key value and initial device information to the authorization serial number, the authorization authentication server 120 may return a successful authorization status to the virtual machine 115 deployed on the client, so that the user obtains authorization to use the operating system 114 in the virtual machine 115.

[0038] According to one embodiment of the present invention, the operating system 114 in the virtual machine 115 automatically maintains intermittent communication with the authorization and authentication server 120 through the authorization device 400 during its operation after authorization. In addition, the authorization device 400 further performs authorization and authentication on the operating system 114 when communicating with the authorization and authentication server 120.

[0039] Specifically, during the operation of the operating system 114 in the virtual machine 115, the authorization device 400 will again obtain the key value (new key value) generated by the key value file of the operating system 114 in the virtual machine, and again obtain the device information of the virtual machine (new device information) from the virtual machine configuration file. Subsequently, the authorization device 400 sends the new key value and the new device information to the authorization authentication server 120. The authorization authentication server 120 can compare the new key value with the initial key value to obtain a first comparison result, and compare the new device information with the initial device information to obtain a second comparison result. Based on the first comparison result and the second comparison result, the authorization authentication server 120 can determine the authorization authentication result of the operating system 114 installed in the virtual machine, and return the authorization authentication result to the authorization device 400.

[0040] In one embodiment, the authorization device 400 of the client 110 is adapted to execute the virtual machine-based operating system authorization method 300 according to the present invention. The virtual machine-based operating system authorization method 300 of the present invention will be described in detail below.

[0041] In one embodiment, the client 110 and the authorization authentication server 120 can be implemented as a computing device 200 respectively, so that the virtual machine-based operating system authorization method 300 of the present invention can be executed in the computing device 200 .

[0042] Figure 2 A schematic diagram of a computing device 200 according to one embodiment of the present invention is shown.

[0043] like Figure 2 As shown, in a basic configuration 202, computing device 200 typically includes system memory 206 and one or more processors 204. A memory bus 208 may be used for communication between processor 204 and system memory 206.

[0044] Depending on the desired configuration, the processor 204 can be any type of processor, including but not limited to: a microprocessor (UP), a microcontroller (UC), a digital signal processing unit (DSP), or any combination thereof. The processor 204 can include one or more levels of cache, such as a first-level cache 210 and a second-level cache 212, a processor core 214, and registers 216. An example processor core 214 can include an arithmetic logic unit (ALU), a floating-point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 218 can be used with the processor 204, or in some implementations, the memory controller 218 can be an internal part of the processor 204.

[0045] Depending on the desired configuration, system memory 206 can be any type of memory, including, but not limited to, volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. System memory 206 can include an operating system 220, one or more applications 222, and program data 224. Applications 222 are essentially multiple program instructions that instruct processor 204 to perform corresponding operations. In some embodiments, applications 222 can be arranged to operate on the operating system so that processor 204 can utilize program data 224.

[0046] Computing device 200 also includes storage 232 , which includes removable storage 236 and non-removable storage 238 .

[0047] The computing device 200 may also include a storage interface bus 234. The storage interface bus 234 enables communication from storage devices 232 (e.g., removable storage 236 and non-removable storage 238) via the bus / interface controller 230 to the basic configuration 202. At least a portion of the operating system 220, applications 222, and data 224 may be stored on the removable storage 236 and / or the non-removable storage 238 and loaded into the system memory 206 via the storage interface bus 234 when the computing device 200 is powered on or when an application 222 is to be executed, and executed by the one or more processors 204.

[0048] The computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (e.g., output devices 242, peripheral interfaces 244, and communication devices 246) to the basic configuration 202 via the bus / interface controller 230. Example output devices 242 include an image processing unit 248 and an audio processing unit 250. These can be configured to facilitate communication with various external devices such as a display or speakers via one or more A / V ports 252. Example peripheral interfaces 244 may include a serial interface controller 254 and a parallel interface controller 256, which can be configured to facilitate communication with external devices such as input devices (e.g., a keyboard, mouse, pen, voice input device, touch input device) or other peripherals (e.g., a printer, scanner, etc.) via one or more I / O ports 258. Example communication devices 246 may include a network controller 260, which can be arranged to facilitate communication with one or more other computing devices 262 via a network communication link via one or more communication ports 264.

[0049] A network communication link can be an example of a communication medium. Communication media can generally be embodied as computer-readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium. A "modulated data signal" can be a signal in which one or more of its data sets or changes thereto can be carried out in the signal in a manner that encodes information. As non-limiting examples, communication media can include wired media such as a wired network or a dedicated line network, and various wireless media such as sound, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer-readable medium as used herein can include both storage media and communication media.

[0050] In an embodiment of the present invention, a computing device 200 is configured to execute a virtual machine-based operating system authorization method 300 according to the present invention. The application of the computing device 200 includes multiple program instructions for executing the virtual machine-based operating system authorization method 300 according to the present invention. These program instructions can instruct a processor to execute the virtual machine-based operating system authorization method 300 according to the present invention, so that the computing device 200 can obtain an authorized use license for the operating system installed in the virtual machine by executing the virtual machine-based operating system authorization method 300 according to the present invention.

[0051] According to one embodiment of the present invention, a virtual machine 115 is deployed in a computing device 200, in which an operating system 114 can be installed. Furthermore, an authorization device 400 is disposed on the operating system 114 installed in the virtual machine. The authorization device 400 includes a plurality of program instructions for executing the virtual machine-based operating system authorization method 300 of the present invention, so that the virtual machine-based operating system authorization method 300 of the present invention can be executed in the authorization device 400. By executing the virtual machine-based operating system authorization method 300 of the present invention, the authorization device 400 can authorize the operating system 114 installed in the virtual machine.

[0052] Figure 3 A flowchart of a virtual machine-based operating system authorization method 300 according to one embodiment of the present invention is shown. The virtual machine-based operating system authorization method 300 can be executed in an authorization device 400 of a client 110 (e.g., the aforementioned computing device 200). The authorization device 400 can be in communication with the authorization authentication server 120.

[0053] In one embodiment, the virtual machine can be implemented as a KVM virtual machine. The operating system 114 installed in the virtual machine can be implemented as a Linux operating system, but it should be noted that the present invention is not limited to the specific type of virtual machine and its installed operating system.

[0054] Figure 3 As shown, the method 300 begins at step S310 .

[0055] In step S310, after the operating system is installed in the virtual machine, when the operating system is started for the first time, the initial key value generated by the key value file in the operating system is obtained, and the initial device information of the virtual machine is obtained.

[0056] It should be noted that before executing method 300, a virtual machine is pre-created in computing device 200. When a virtual machine is created in computing device 200, unique device information corresponding to the virtual machine is generated. This device information can be stored in a virtual machine configuration file. In one implementation, the device information is, for example, the virtual machine's UUID value. Thus, the virtual machine's UUID value can be obtained from the virtual machine configuration file and used as the virtual machine's initial device information.

[0057] In one embodiment, after installing an operating system in a virtual machine, a key file (KEY file) is first randomly created within the virtual machine's operating system and encrypted. This key file can generate a unique key value, i.e., an initial key value, for identifying the virtual machine when the operating system is first started. Here, since the key file is randomly created and encrypted, the key value generated based on the key file can be guaranteed to be unique, thereby uniquely identifying the virtual machine environment, avoiding the situation where multiple virtual machine operating systems create key files and generate key values based on the key files.

[0058] It should be noted that the present invention is not limited to a specific encryption method for encrypting a key-value file, and all encryption methods in the prior art are within the protection scope of the present invention.

[0059] In one implementation, the length of the key value generated based on the key-value file may be 32 bits, so as to further reduce the possibility of duplication when generating the key value based on the key-value file.

[0060] Then, in step S320 , the initial key value and initial device information acquired in step S310 are sent to the authorization authentication server 120 .

[0061] Finally, in step S330, the authorization serial number entered by the user is obtained and sent to the authorization authentication server 120. The authorization authentication server 120 may bind the initial key value and initial device information with the authorization serial number and store them to authorize the operating system installed in the virtual machine. After binding the initial key value and initial device information with the authorization serial number, the authorization authentication server 120 may return a successful authorization status to the virtual machine, allowing the user to obtain authorization to use the operating system in the virtual machine.

[0062] According to one embodiment of the present invention, after executing steps S310 to S330, authorization for the operating system installed in the virtual machine is obtained. Subsequently, while the operating system in the virtual machine is running, it automatically and intermittently communicates with the authorization authentication server 120 via the authorization device 400. Furthermore, while communicating with the authorization authentication server 120, the authorization device 400 further authenticates the operating system.

[0063] Specifically, while the operating system in the virtual machine is running, the authorization device 400 will again obtain the key value (new key value) generated by the key value file of the operating system in the virtual machine, and again obtain the device information of the virtual machine (new device information) from the virtual machine configuration file. Here, in order to distinguish them from the key value and device information mentioned above, the key value obtained again will be referred to as the "new key value", and the device information obtained again will be referred to as the "new device information".

[0064] Next, the new key value and the new device information are sent to the authorization authentication server 120. The authorization authentication server 120 compares the new key value with the initial key value to obtain a first comparison result, and compares the new device information with the initial device information to obtain a second comparison result. Subsequently, the authorization authentication server 120 can determine the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result, and return the authorization authentication result to the authorization device 400, so that the authorization device 400 can obtain the authorization authentication result returned by the authorization authentication server 120 during the operation of the operating system and present the authorization authentication result to the user.

[0065] It is understood that the first comparison result is the result of whether the new key value is the same as the initial key value, and the second comparison result is the result of whether the new device information is the same as the initial device information. The authorization and authentication result is the result of whether the authorization and authentication succeeds or fails.

[0066] The specific judgment basis for determining the authorization authentication result of the operating system installed in the virtual machine based on the first comparison result and the second comparison result is as follows: If the first comparison result shows that the new key value is the same as the initial key value, and the second comparison result shows that the new device information is the same as the initial device information, the authorization authentication server 120 can determine that the authorization authentication is successful and can return a status of successful authorization authentication to the authorization device 400 in the virtual machine. If the first comparison result shows that the new key value is different from the initial key value, and / or the second comparison result shows that the new device information is different from the initial device information, the authorization authentication server 120 can determine that the authorization authentication failed and can return a status of failed authorization authentication to the authorization device in the virtual machine.

[0067] It should be noted that when the new key value is the same as the initial key value and the new device information is the same as the initial device information, it can be determined that the operating system running in the virtual machine is used after normal authorization, and thus the authorization authentication of the operating system is passed.

[0068] The first comparison result is that the new key value is different from the initial key value, and / or the second comparison result is that the new device information is different from the initial device information. Specifically, there are three situations:

[0069] (1) The new key value is different from the initial key value, and the new device information is the same as the initial device information. In this case, the operating system may have been reinstalled or the system files may have been damaged. Therefore, the status of failed authorization authentication for the operating system will be returned. The user can reinstall the operating system on the virtual machine or reauthorize the operating system installed on the virtual machine by executing steps S310 to S330 when first authorizing the operating system.

[0070] (2) The new key value is the same as the initial key value, and the new device information is different from the initial device information. In this case, it is possible that the operating system image installed on the virtual machine was copied and used on another device, or the key value file in the operating system was copied and used in another operating system impersonating an authorized user. Therefore, the status of failed authentication of the operating system will be returned.

[0071] (3) The new key value is different from the initial key value, and the new device information is different from the initial device information. In this case, it may be that the operating system newly installed in the virtual machine has not yet executed the above steps S310-S330 for authorization. Alternatively, it may be a combination of the problems in the above situations (1) and (2).

[0072] Figure 4 FIG2 shows a schematic diagram of an authorization apparatus 400 according to an embodiment of the present invention. The authorization apparatus 400 is arranged on an operating system of a virtual machine deployed in the computing device 100 and is suitable for executing the virtual machine-based operating system authorization method 300 of the present invention.

[0073] like Figure 4As shown, the authorization device 400 includes a first processing unit 410 and a second processing unit 420. When the operating system is installed on a virtual machine and started for the first time, the first processing unit 410 obtains the initial key value generated by the key value file of the operating system and obtains the initial device information of the virtual machine, and then sends the initial key value and initial device information to the authorization authentication server 120. The second processing unit 420 can obtain the authorization serial number entered by the user and send the authorization serial number to the authorization authentication server 120 so that the authorization authentication server 120 can bind the initial key value and initial device information with the authorization serial number and store them, thereby authorizing the operating system installed on the virtual machine.

[0074] It should be noted that the first processing unit 410 is used to execute the aforementioned steps S310 and S320, and the second processing unit 420 is used to execute the aforementioned step S330. Here, the specific execution logic of the first processing unit 410 and the second processing unit 420 can be found in the description of steps S310 to S330 in the above method 300, which will not be repeated here.

[0075] According to the authorization scheme of the virtual machine-based operating system of the present invention, a key value file is generated in the operating system installed in the virtual machine. When the operating system is started for the first time after installation, a unique key value is generated based on the key value file, and the key value can uniquely identify the virtual machine environment. By uploading the key value and the UUID value of the virtual machine to the authorization authentication server, the authorization authentication server binds the key value and the UUID value of the virtual machine together with the authorization serial number entered by the user, so that the user obtains authorization to use the operating system in the virtual machine. In this way, when the present invention authorizes the virtual machine operating system, by adding a key value that can uniquely identify the virtual machine, it can achieve accurate control of the user's authorized use of the operating system installed in the virtual machine.

[0076] The various techniques described herein may be implemented in conjunction with hardware or software, or a combination thereof. Thus, the methods and apparatus of the present invention, or certain aspects or portions of the methods and apparatus of the present invention, may be implemented in the form of program codes (i.e., instructions) embedded in a tangible medium, such as a removable hard disk, a USB flash drive, a floppy disk, a CD-ROM, or any other machine-readable storage medium, wherein when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for practicing the present invention.

[0077] When program code is executed on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device. The memory is configured to store the program code, and the processor is configured to execute the virtual machine-based operating system authorization method of the present invention according to instructions in the program code stored in the memory.

[0078] By way of example and not limitation, readable media include readable storage media and communication media. Readable storage media store information such as computer-readable instructions, data structures, program modules, or other data. Communication media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and include any information delivery medium. Combinations of any of the above are also included within the scope of readable media.

[0079] In the description provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used in conjunction with the examples of the present invention. Based on the above description, it is apparent that the structure required for constructing such systems is well understood. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages may be utilized to implement the present invention described herein, and the description of specific languages above is provided for the purpose of disclosing the preferred embodiment of the present invention.

[0080] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0081] Similarly, it should be understood that in order to streamline the present disclosure and aid understanding of one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this method of disclosure should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Accordingly, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the present invention.

[0082] Those skilled in the art will appreciate that the modules, units, or components of the devices in the examples disclosed herein may be arranged in the device described in the embodiment, or alternatively may be located in one or more devices different from the devices in the examples. The modules in the foregoing examples may be combined into one module or further divided into multiple submodules.

[0083] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0084] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features and not other features included in other embodiments, the combination of features from different embodiments is intended to be within the scope of the invention and to form different embodiments.

[0085] In addition, some of the embodiments are described herein as methods or combinations of method elements that can be implemented by a processor of a computer system or by other devices that perform the functions described. Thus, a processor having the necessary instructions for implementing the method or method element forms a device for implementing the method or method element. Furthermore, the elements described herein of the device embodiments are examples of devices for implementing the functions performed by the elements for the purpose of implementing the invention.

[0086] As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe common objects merely indicates that different instances of similar objects are involved and are not intended to imply that the objects so described must have a given order in time, space, ranking, or in any other manner.

[0087] Although the present invention has been described with respect to a limited number of embodiments, it will be apparent to those skilled in the art, having benefit of the foregoing description, that other embodiments are contemplated within the scope of the invention thus described. Furthermore, it should be noted that the language used in this specification has been selected primarily for readability and didactic purposes, rather than for the purpose of explaining or limiting the subject matter of the present invention. Consequently, many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the appended claims. The disclosure of the present invention is intended to be illustrative rather than restrictive of the scope of the invention, which is defined by the appended claims.

Claims

1. A method for authorizing an operating system based on a virtual machine, comprising the steps of: After the operating system is installed in the virtual machine, a key-value file is randomly generated in the operating system, and the key-value file is encrypted. When the operating system is started for the first time, an initial key value generated by the key-value file and used to identify the virtual machine is obtained, and initial device information of the virtual machine is obtained; Sending the initial key value and initial device information to the authorization authentication server; Obtaining an authorization serial number input by the user, and sending the authorization serial number to the authorization authentication server, so that the authorization authentication server binds the initial key value and initial device information with the authorization serial number and stores them to authorize the operating system installed on the virtual machine; During the operation of the operating system, obtaining a new key value generated by a key value file of the operating system and obtaining new device information of the virtual machine; The new key value and the new device information are sent to the authorization authentication server, so that the authorization authentication server compares the new key value with the initial key value to obtain a first comparison result, compares the new device information with the initial device information to obtain a second comparison result, and determines the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result.

2. The method according to claim 1, wherein Also includes the steps: Obtain the authorization and authentication result returned by the authorization and authentication server.

3. The method according to claim 1, wherein Determining the authorization authentication result of the operating system installed on the virtual machine according to the first comparison result and the second comparison result includes: If the first comparison result is that the new key value is the same as the initial key value, and the second comparison result is that the new device information is the same as the initial device information, it is determined that the authorization authentication is successful.

4. The method according to claim 1, wherein Determining the authorization authentication result of the operating system installed on the virtual machine according to the first comparison result and the second comparison result includes: If the first comparison result is that the new key value is different from the initial key value, and / or the second comparison result is that the new device information is different from the initial device information, it is determined that the authorization authentication has failed.

5. The method according to any one of claims 1 to 4, wherein The device information is a UUID value, and obtaining the initial device information of the virtual machine includes: Get the UUID value of the virtual machine from the virtual machine configuration file.

6. An authorization device, arranged on an operating system of a virtual machine, comprising: a first processing unit adapted to randomly generate a key file in the operating system after the operating system is installed in the virtual machine, encrypt the key file, obtain an initial key value generated by the key file for identifying the virtual machine when the operating system is started for the first time, obtain initial device information of the virtual machine, and send the initial key value and initial device information to an authorization authentication server; and, during operation of the operating system, obtaining a new key value generated by a key value file of the operating system and obtaining new device information of the virtual machine, and sending the new key value and the new device information to an authorization authentication server, so that the authorization authentication server compares the new key value with the initial key value to obtain a first comparison result, compares the new device information with the initial device information to obtain a second comparison result, and determines an authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result; The second processing unit is adapted to obtain the authorization serial number input by the user and send the authorization serial number to the authorization authentication server so that the authorization authentication server binds the initial key value and initial device information with the authorization serial number and stores them to authorize the operating system installed on the virtual machine.

7. An authorization control system comprising: A virtual machine, wherein the virtual machine is suitable for installing an operating system, an authorization device is arranged on the operating system, and the authorization device is suitable for executing the method according to any one of claims 1 to 5; as well as An authorization authentication server is connected to the authorization device and is suitable for obtaining the initial key value, initial device information and authorization serial number sent by the authorization device, and binding the initial key value and initial device information with the authorization serial number and storing them so as to authorize the operating system installed on the virtual machine; and is suitable for obtaining a new key value and new device information sent by the authorization device, comparing the new key value with the initial key value to obtain a first comparison result, comparing the new device information with the initial device information to obtain a second comparison result, and determining the authorization authentication result of the operating system installed on the virtual machine based on the first comparison result and the second comparison result.

8. A computing device comprising: at least one processor; as well as A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for executing the method according to any one of claims 1 to 5.

9. A readable storage medium storing program instructions, wherein when the program instructions are read and executed by a computing device, the computing device is caused to execute the method according to any one of claims 1 to 5.

Images