Authorization control method and device, computer device and storage medium

Abstract

The application relates to an authorization control method and device, a computer device and a storage medium. The method comprises the following steps: obtaining a cluster identification code of a distributed system; performing decoding processing on the cluster identification code and a binary sequential coding inverse processing rule to obtain machine code contained in the cluster identification code; the cluster identification code is obtained by performing binary sequential mixed coding processing on the machine code; obtaining current machine code in the distributed system, verifying whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identification code; and maintaining authorization of the distributed system in the case that the inclusion relationship exists. The method can improve the stability of authorization control.

Description

Technical Field

[0001] This application relates to the field of computer communication technology, and in particular to an authorization control method, apparatus, computer equipment, and storage medium. Background Technology

[0002] Distributed systems present the challenge of authorizing software systems. Unauthorized software can only access certain functionalities, while authorized software can use all functionalities. A common approach to authorizing software systems in a distributed system is to leverage the hardware information of all servers within the cluster to implement authorization controls.

[0003] However, in a cluster, if a server fails or another server is removed from the cluster due to other reasons, the overall hardware information of the cluster will change. Consequently, the authorization binding all the hardware information of the server nodes will become invalid. Therefore, whenever the number of servers in the cluster changes, authorization must be re-issued to restore the use of all functions of the software system, which causes great inconvenience to the use of the cluster. Summary of the Invention

[0004] Therefore, it is necessary to provide an authorization control method, apparatus, computer device, and storage medium to address the aforementioned technical problems.

[0005] An authorization control method, the method comprising:

[0006] Obtain the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster;

[0007] Based on the binary sequential encoding inverse processing rules and the cluster identifier code, the machine code contained in the cluster identifier code is obtained through decoding.

[0008] Obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code;

[0009] In the presence of the inclusion relationship, the authorization of the distributed system is maintained.

[0010] In one embodiment, the method further includes:

[0011] Obtain the hardware information of the master node within the cluster of a distributed system;

[0012] Based on the hardware information of each master node and the preset binary bitwise mixed encoding rules, the machine code corresponding to each master node is generated.

[0013] Obtain the machine codes of at least two master nodes, and generate a cluster identifier code according to the preset binary sequential mixed encoding rules.

[0014] In one embodiment, the hardware information of each master node includes at least central processing unit identification information, motherboard identification information, and message authentication code.

[0015] In one embodiment, generating machine code corresponding to each master node based on the hardware information of each master node and a preset binary bitwise hybrid encoding rule includes:

[0016] The hardware information of each master node is encrypted according to the preset encryption algorithm to obtain the encrypted value corresponding to each hardware information.

[0017] The encrypted value is processed by binary bitwise hybrid encoding to generate a hybrid code corresponding to each piece of hardware information. The encoded data of the preset bits of the hybrid code is extracted and used as the machine code corresponding to each master node.

[0018] In one embodiment, encrypting the hardware information of each master node according to a preset encryption algorithm to obtain the encrypted value corresponding to each hardware information includes:

[0019] The hardware information of each master node is encrypted using a secure hash algorithm to obtain an initial encrypted value of the same length.

[0020] According to the Advanced Encryption Standard (AES) algorithm, the initial encryption value corresponding to each piece of hardware information is encoded and encrypted, and the encrypted value of a preset byte length after encoding and encryption is extracted as the encryption value corresponding to each piece of hardware information.

[0021] In one embodiment, obtaining the machine codes of at least two master nodes and generating a cluster identifier code according to the preset binary sequential mixed encoding rule includes:

[0022] Obtain the machine codes of at least two master nodes in the cluster, and determine the binary number value corresponding to the number of machine codes obtained;

[0023] According to the preset machine code arrangement order and the preset binary sequential mixed encoding rule, the machine codes of the at least two master nodes are sequentially encoded to obtain binary mixed encoding values;

[0024] A cluster identifier code is generated based on the binary number value, the binary mixed encoding value, and the preset encoding rules.

[0025] In one embodiment, the decoding process based on the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code includes:

[0026] The cluster identifier is decrypted, and the first preset number of bits at the beginning of the decryption sequence are removed to obtain a binary sequential encoded sequence.

[0027] Identify and read the data of the target bit in the binary ordered encoded sequence to obtain the number of machine codes contained in the cluster identifier code;

[0028] Read the binary sequential encoding sequence of the second preset number of bits adjacent to the target bit, and reverse the binary sequential encoding sequence of the second preset number of bits according to the binary sequential encoding inverse processing rule to obtain the machine code contained in the cluster identifier code.

[0029] In one embodiment, obtaining the current machine code in the distributed system and verifying whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code includes:

[0030] Obtain the current machine code of each master node in the cluster of the distributed system;

[0031] Count the number of current machine codes, and extract the verification code corresponding to each current machine code;

[0032] If the number of machine codes contained in the cluster identifier is greater than or equal to the number of verification codes, and each verification code is contained in each of the machine codes, then it is determined that the machine codes contained in the cluster identifier have an inclusion relationship with the current machine code.

[0033] If the amount of machine code data contained in the cluster identifier is less than the number of current machine codes and / or there are machine codes that are not included in the verification code, then it is determined that there is a non-inclusion relationship between the machine codes contained in the cluster identifier and the current machine codes.

[0034] An authorization control device, the device comprising:

[0035] The acquisition module is used to acquire the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster.

[0036] The decoding module is used to perform decoding based on the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code;

[0037] The verification module is used to obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code;

[0038] An authorization module is used to maintain authorization in the distributed system when the inclusion relationship exists.

[0039] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0040] Obtain the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster;

[0041] Based on the binary sequential encoding inverse processing rules and the cluster identifier code, the machine code contained in the cluster identifier code is obtained through decoding.

[0042] Obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code;

[0043] In the presence of the inclusion relationship, the authorization of the distributed system is maintained.

[0044] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0045] Obtain the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster;

[0046] Based on the binary sequential encoding inverse processing rules and the cluster identifier code, the machine code contained in the cluster identifier code is obtained through decoding.

[0047] Obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code;

[0048] In the presence of the inclusion relationship, the authorization of the distributed system is maintained.

[0049] The aforementioned authorization control method, apparatus, computer equipment, and storage medium obtain the cluster identifier code of the distributed system; perform decoding processing based on the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code; the cluster identifier code is obtained by binary sequential mixed encoding processing of the machine code; obtain the current machine code in the distributed system, and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code; if the inclusion relationship exists, maintain the authorization of the distributed system. Using this method, the cluster identifier code obtained by binary sequential mixed encoding processing of the machine code of the master node in the cluster can characterize the overall authorization status of the cluster, unaffected by the number of servers in the cluster. Even if the number of servers in the cluster increases, the authorization status can still be maintained, improving the stability of the authorization control of the distributed system. Attached Figure Description

[0050] Figure 1 This is a diagram illustrating the application environment of the authorization control method in one embodiment;

[0051] Figure 2 This is a flowchart illustrating the authorization control method in one embodiment;

[0052] Figure 3 This is a flowchart illustrating the steps for generating an identity authentication code in one embodiment;

[0053] Figure 4 This is a flowchart illustrating the steps for generating machine code in one embodiment;

[0054] Figure 5 This is a schematic diagram of the machine code generation process in one embodiment;

[0055] Figure 6 This is a flowchart illustrating the hardware information encryption steps in one embodiment;

[0056] Figure 7 This is a flowchart illustrating the steps for generating a cluster identifier code in one embodiment;

[0057] Figure 8 This is a schematic diagram of the machine code generation process and the cluster identifier code generation process in one embodiment;

[0058] Figure 9 This is a flowchart illustrating the cluster identifier code decoding and verification steps in one embodiment;

[0059] Figure 10 This is a schematic diagram of the cluster identifier code decoding process in one embodiment;

[0060] Figure 11 This is a flowchart illustrating the authorization verification steps in one embodiment;

[0061] Figure 12 This is a structural block diagram of the authorized control device in one embodiment;

[0062] Figure 13 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] The authorization control method provided in this application can be applied to, for example... Figure 1 In the distributed system 100 shown, there is at least one distributed cluster. Each distributed cluster contains multiple servers that communicate with each other via a network. Among these servers, there is a master node server that acts as the cluster's master node. Any master node server can apply the authorization control method of this application. For example, servers 102, 104, and 106 can be three master nodes in a cluster. Any master node server can obtain the cluster identifier code of the distributed system. Then, it performs decoding processing according to the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code. Next, the master node server obtains the current machine code corresponding to the cluster in the distributed system and checks whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code. If an inclusion relationship exists, the authorization of the distributed system is maintained. The cluster identifier code to be authorized and verified obtained by the master node server is obtained by binary sequential mixed encoding processing of the machine code of the master node in the cluster.

[0065] Optionally, the authorization control method for the cluster in a distributed system can also be deployed separately. That is, servers other than server 102, server 104 and server 106 can be used to execute the authorization control method for the cluster, while the master node servers 102, server 104 and server 106 only provide interfaces to obtain their hardware information. Therefore, this application does not limit the servers that execute this method.

[0066] In one embodiment, such as Figure 2 As shown, an authorization control method is provided, which is applied to... Figure 1 Taking any one of the master nodes in the system as an example, the following steps are included:

[0067] Step 201: Obtain the cluster identifier code of the distributed system.

[0068] The cluster identifier (deploy id, identity) is obtained by binary-order mixed encoding of the machine code (machineid) of the master node in the cluster. Specifically, the cluster identifier is a binary sequence with a length of 146 bits. The machine code is obtained by binary-order mixed encoding of the hardware information of the master node in the cluster; the machine code is also a binary sequence with a length of 144 bits.

[0069] The binary sequential mixed encoding rule is as follows: For the value of each bit corresponding to the target output data structure, based on the arrangement order of the component information corresponding to the target output, the value of each bit in each component information is filled into the target output data structure. For example: Assuming there are two component informations, A and B (the order of component information is A first, then B), the first bit of the target output is filled with the first bit of component information A, the second bit is filled with the first bit of component information B, the third bit is filled with the second bit of component information A, the fourth bit is filled with the second bit of component information B, and so on, until the last bit of the target output is filled with the last bit of component information B.

[0070] The binary bitwise mixed encoding rule is as follows: the value of the target output bit is filled by the constituent information bit by bit in a round-robin fashion. For example: there are 3 constituent information, namely constituent information A, constituent information B and constituent information C. The first bit of the target output is filled by the first bit of constituent information A, the second bit of the target output is filled by the second bit of constituent information B, the third bit of the target output is filled by the third bit of constituent information C, and the fourth bit of the target output is filled by the fourth bit of constituent information A.

[0071] Specifically, in a distributed cluster, the cluster identifier is stored in the memory of the cluster's master node server. Any master node server can obtain the cluster identifier used to identify the cluster in the distributed system by calling the service.

[0072] Step 202 is based on the binary sequential encoding inverse processing rules and the cluster identifier code to perform decoding processing, and obtain the machine code contained in the cluster identifier code;

[0073] In practice, since the cluster identifier code is obtained by binary sequential encoding of the master node machine code, the server can restore the machine code that generated the cluster identifier code by performing decoding and other encoding sequence decoding processes based on the binary sequential encoding inverse processing rules and the cluster identifier code.

[0074] The machine code obtained in the decoding process is not a complete machine code, but a prefix encoding sequence of the machine code of the master node corresponding to the cluster identifier code. However, due to the unique encoding rules of the machine code in this application, the machine code can uniquely represent a master node server, so the prefix encoding sequence obtained by decoding can also uniquely represent the machine code of the master node.

[0075] Step 203: Obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code.

[0076] In implementation, the machine codes of all master nodes in the current cluster of the distributed system can be recalculated to obtain the machine code corresponding to each master node, which serves as the current machine code in the cluster. Then, any server can retrieve the current machine code corresponding to each master node in the distributed system by calling the headless service, and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code, in order to perform authorization verification. The inclusion relationship needs to satisfy two inclusion conditions simultaneously: quantity inclusion relationship and data value inclusion relationship, specifically:

[0077] 1. The current number of machine codes is less than or equal to the amount of machine code data contained in the cluster identifier;

[0078] 2. The binary data encoding of the machine code decoded from the cluster identifier code contains the binary data encoding sequence of the current machine code of the cluster.

[0079] Step 204: Maintain authorization in the distributed system if an inclusion relationship exists.

[0080] In practice, if the current machine code of the distributed cluster obtained by the server has an inclusion relationship with the machine code obtained by decoding the cluster identifier code, the server determines to maintain the current authorization status of the distributed cluster, and each server in the distributed cluster has the right to use the software system corresponding to the authorized function.

[0081] In the above authorization control method, the cluster identifier code of the distributed system is obtained; decoding is performed based on the binary sequential encoding inverse processing rule and the cluster identifier code to obtain the machine code contained in the cluster identifier code; the cluster identifier code is obtained from the machine code through binary sequential mixed encoding; the current machine code in the distributed system is obtained, and it is verified whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code; if an inclusion relationship exists, the authorization of the distributed system is maintained. Using this method, the cluster identifier code obtained from the machine code of the master node in the cluster through binary sequential mixed encoding can represent the overall authorization of the cluster. Furthermore, it is unaffected by the number of servers in the cluster; even if the number of servers in the cluster increases, the authorization status can still be maintained, improving the stability of the authorization control of the distributed system.

[0082] In one embodiment, such as Figure 3 As shown, the authorization control process includes not only the authorization verification process but also the generation process of the authorized identity, that is, the generation of a cluster identifier code that can be used to uniquely represent the cluster identity. Therefore, before performing authorization verification, the method for generating the cluster identifier code in this application specifically includes the following steps:

[0083] Step 301: Obtain the hardware information of the master node within the distributed system cluster.

[0084] In implementation, each master node server in the distributed cluster synchronously has machine code generation logic. Therefore, each master node server can obtain its own hardware device information through a pre-configured interface to calculate its own machine code. Each master node server includes at least three hardware identifiers that can uniquely identify it.

[0085] Step 302: Generate machine code corresponding to each master node based on the hardware information of each master node and the preset binary bitwise mixed encoding rules.

[0086] In practice, the server generates machine code corresponding to the master node, which contains the hardware information, based on its own hardware information and the preset binary bitwise mixed encoding rules.

[0087] The machine code format satisfies the following regular expression: ([1-9a-km-zA-HJ-NP-Z]{5}-){4}[1-9a-km-zA-HJ-NP-Z]{5}, where [1-9] indicates that the data in the machine code can be numbers from 1 to 9, and [a-km-zA-HJ-NP-Z] indicates that the data in the machine code can also be letters from a to k, m to z, A to H, J to N, and P to Z (i.e., following the rule of excluding lowercase letters l and uppercase letters from the alphabet). The BASE58 encoding rules for the letter I and uppercase O are as follows: {4} indicates that the interval in the data encoding sequence is 4, the first {5} indicates that each data segment in the data sequence is 5 bits, and the second {5} indicates that the data encoding sequence contains 5 data segments. Specifically, the encoding sequence of the machine code corresponding to each master node is in the form of: XXXXX-XXXXX-XXXXX-XXXXX-XXXXX, where X is the data that satisfies the above range of numbers and letters (i.e., the BASE58 encoding rules).

[0088] Step 303: Obtain the machine codes of at least two master nodes and generate a cluster identifier code according to the preset binary sequential mixed encoding rules.

[0089] In implementation, the machine codes of at least two master nodes are obtained from any master node server in the distributed cluster. A cluster identifier code is generated according to a preset binary sequential mixed encoding rule. This binary sequential mixed encoding rule requires arranging the machine codes of at least two master nodes in the cluster in a predefined order. Then, for each master node's machine code, each bit of data is read, and the read bits are sequentially encoded to generate a cluster identifier code, which is used to uniquely verify the authorization status of the cluster.

[0090] Optionally, in a distributed cluster, the master node server whose machine code is obtained is tagged to identify the machine code corresponding to the cluster identifier. Then, when performing authorization verification of the cluster identifier, the machine code corresponding to the master node server with the tag is obtained for authorization authentication.

[0091] In this embodiment, the hardware information of the master node server is processed according to the binary bitwise mixed encoding rule to generate a machine code that can uniquely identify the master node. Then, the machine codes of at least two master nodes in the cluster generate a cluster identifier code that can uniquely identify the entire cluster. The machine code and the cluster identifier code realize the identity authentication of the master node and the cluster.

[0092] In one embodiment, any of the aforementioned master node servers can obtain its own hardware information through a preset interface. This hardware information may include CPU ID, motherboard ID, and Message Authentication Code (MAC). Specifically, the hardware information obtained by each master node server includes at least CPU ID, motherboard ID, and MAC. When generating the machine code corresponding to that master node, these three pieces of hardware information can be used to generate the master node machine code.

[0093] In one embodiment, such as Figure 4 As shown, the specific process of each master node generating its own machine code based on its hardware information in step 302 includes:

[0094] Step 401: Encrypt the hardware information of each master node according to the preset encryption algorithm to obtain the encrypted value corresponding to each hardware information.

[0095] In practice, the server encrypts the hardware information obtained by each master node according to a preset encryption algorithm, and obtains the encrypted encoded value corresponding to each hardware information.

[0096] Step 402: Perform binary bitwise mixed encoding on the encrypted value to generate mixed encoding corresponding to each hardware information, and extract the encoded data of the preset bits of the mixed encoding as the machine code corresponding to each master node.

[0097] In implementation, the server performs binary bitwise mixed encoding on each encrypted value to generate mixed codes corresponding to each piece of hardware information of the master node. Specifically, the binary bitwise mixed encoding process is as follows: Figure 5 As shown, there are three encrypted values ​​for the hardware information: the CPU ID, BOARD ID, and MAC address, which are obtained through encryption. Then, the hardware information is arranged in a preset order. Figure 5 The CPU ID, BOARD ID, and MAC are sequentially processed. Each piece of hardware information is extracted bit by bit. The first bit of the CPU ID encrypted value is extracted and filled into the first bit of the hybrid encoding sequence (target output). The second bit of the BOARD ID encrypted value is extracted and filled into the second bit of the hybrid encoding sequence. The third bit of the MAC encrypted value is extracted and filled into the third bit of the hybrid encoding sequence. This results in a hybrid encoding sequence that is a mixture of the encrypted values ​​of the three hardware information. The server extracts the prefix data of this hybrid encoding sequence, that is, the encoded data of the preset bits (i.e., the first 144 bits), which is used as the machine code corresponding to each master node.

[0098] In one embodiment, such as Figure 6 As shown, the specific process of encrypting the hardware information of each master node according to the preset encryption algorithm in step 401 includes:

[0099] Step 601: Encrypt the hardware information of each master node according to the secure hash algorithm to obtain an initial encrypted value with the same length.

[0100] In implementation, since each master node server contains multiple pieces of hardware information, such as CPU ID, MAC, and BOARD ID, and the string lengths corresponding to different hardware information are not the same, the server pre-encrypts its own hardware information using a secure hash algorithm (SHA1). Based on the unique encryption properties of the secure hash algorithm, encrypted values ​​of each piece of hardware information with the same length (160 bits) can be obtained.

[0101] Step 602: Encode and encrypt the initial encryption value corresponding to each hardware information according to the Advanced Encryption Standard (AES) algorithm, and extract the encrypted value of the preset byte length after encoding and encryption as the encryption value corresponding to each hardware information.

[0102] In implementation, the server uses a key that meets the AES256 standard to further encode and encrypt each encrypted value of the same length after SHA1 encryption, according to the Advanced Encryption Standard (AES256). Then, it extracts the first 144 bits of encrypted data after AES256 encryption as the final encrypted value to ensure the security of the machine code generated by the final encrypted value.

[0103] In the AES256 encryption algorithm, 256 represents the key length. The 256-bit key in this application is a proprietary key generated based on the hardware information of the master node. This proprietary key is used for data encryption to enhance machine code security. Specifically, the AES256 key generation process includes two steps: Step 1: Extracting the target fields from the strings corresponding to each hardware information to obtain the target strings for each hardware information, assembling the extracted target strings into a key string, and then encrypting the key string using SHA256 to obtain the encrypted key string. Step 2: Encrypting the encrypted key string using BASE58, and extracting the first 32 bytes (256 bits) of the BASE58 encrypted value as the final AES256 generated key.

[0104] In one embodiment, such as Figure 7As shown, the specific processing procedure for step 303 is as follows:

[0105] Step 701: Obtain the machine codes of at least two master nodes in the cluster, and determine the binary number value corresponding to the number of machine codes obtained.

[0106] In implementation, each master node in the distributed cluster has a unique machine code that identifies its own device. The server obtains the machine codes of at least two master nodes in the cluster and counts the number of machine codes obtained. Then, it converts the obtained machine code count data (decimal data) into binary format to obtain a binary value. For example, when the number of master node machine codes obtained is 2 (decimal data), the decimal data is converted into binary to obtain the corresponding binary value 00000010. The length of the binary value occupies 2 bits.

[0107] Step 702: According to the preset machine code arrangement order and the preset binary sequential mixed encoding rule, the machine codes of at least two master nodes are sequentially encoded to obtain binary mixed encoding values.

[0108] In implementation, the server converts the encrypted machine code corresponding to each master node into binary format, arranges the converted binary encrypted machine code in ascending lexicographical order to obtain the arrangement order of the master node machine codes, and encodes the machine code in order according to the determined arrangement order of the master node machine codes and the preset binary sequential mixed encoding rules to obtain the sequential mixed encoding sequence. The prefix preset bit data (first 144 bits) of the sequential mixed encoding sequence is extracted to obtain the binary mixed encoding value of each machine code.

[0109] Specifically, such as Figure 8 As shown, Figure 8 The upper middle diagram illustrates the sequential mixed encoding of three machine codes. The machine codes of the three master nodes are ordered from smallest to largest using a lexicographical sorting algorithm. This ascending order is achieved by bitwise comparison; in binary, 0 is less than 1, and the sequence containing the first 1 is considered the largest, thus determining the order of the three machine codes. Figure 7 The machine code is displayed as 01011010 only to indicate that it is a binary data sequence, not that all machine codes are the same. Then, the machine codes of the three master nodes are read in order of their positions and each bit value in the machine code is mixed and encoded in binary order to obtain a binary mixed encoding sequence corresponding to the three machine codes. Figure 8The lower figure is a schematic diagram of the binary sequential mixed encoding of two obtained machine codes. The machine codes of the two master nodes have been sorted from smallest to largest according to the dictionary sorting method. Then, they are mixed and encoded according to the sorting order of the two machine codes and the binary sequential mixed encoding rules. The specific encoding process is the same as the process of the three machine codes mentioned above, and will not be repeated in the embodiments of this application.

[0110] Step 703: Generate a cluster identifier code based on the binary number value, the binary mixed encoding value, and the preset encoding rules.

[0111] In implementation, the server uses the binary number value (occupying 2 bits) as the header and the binary mixed encoding value (occupying 144 bits) as the tail to obtain a 146-bit encoding sequence. The 146-bit encoding sequence is then BASE58 encoded, and the encoding sequence is formatted by adding "-" separators to groups of five encoded data to generate a cluster identifier code.

[0112] In this embodiment, a cluster identifier code that can guarantee the overall cluster is generated by using the machine codes of at least two master nodes and binary sequential mixed encoding rules. The cluster identifier code generation process includes encryption of the encoding sequence and mixed encoding to ensure the complexity of the cluster code and guarantee the security of the cluster identifier code.

[0113] In one embodiment, such as Figure 9 As shown, authorization verification of the cluster identifier code requires decoding the cluster identifier code. The specific processing procedure of step 202 is as follows:

[0114] Step 901: Decrypt the cluster identifier code, remove the first preset number of bits from the beginning of the decryption sequence, and obtain the binary sequential encoded sequence.

[0115] In implementation, because the BASE58 encoding rule requires that the data be in whole bytes (1 byte = 8 bits), for a 146-bit binary sequential encoding sequence, the server automatically adds 6 0 bits to complete it into a 152-bit (i.e., 19-byte) sequence for BASE58 encoding. Therefore, after the server decrypts the cluster identifier code of the distributed cluster using BASE58, it needs to remove the first preset number of 0 bits (6 bits) from the beginning of the decrypted data sequence to obtain a binary sequential encoding sequence that meets the preset number of bits (146 bits), which is also the binary sequential encoding sequence corresponding to each machine code.

[0116] Step 902: Identify and read the data of the target bit in the binary sequentially encoded sequence to obtain the number of machine codes contained in the cluster identifier code.

[0117] In implementation, the server identifies and reads the target bit (i.e., the first 2 bits) of the binary sequentially encoded sequence. This target bit corresponds to the machine code data contained in the cluster identifier, thus allowing the decoding to determine the number of machine codes contained in the cluster identifier. For example... Figure 10 As shown, after the 6 0 bits, there are 2 bits of data and the corresponding number of machine codes.

[0118] Step 903: Read the binary sequential encoding sequence of the second preset number of bits adjacent to the target bit, and reverse the binary sequential encoding sequence of the second preset number of bits according to the binary sequential encoding inverse processing rule to obtain the machine code contained in the cluster identifier code.

[0119] In implementation, the server reads the binary sequentially encoded sequence of the second preset number of bits following the target bit, such as... Figure 10 As shown, after reading the number of bits of the machine code, the adjacent data is the binary sequential encoding sequence of the corresponding machine code. According to the binary sequential encoding inverse processing rule, the 144-bit binary sequential encoding sequence is inversely processed to restore the prefix data of the machine code contained in the cluster identifier code. Since this prefix data can also uniquely correspond to a machine code, the prefix data of the machine code is also called the machine code.

[0120] In one embodiment, such as Figure 11 As shown, the cluster identifier code to be verified needs to meet the preset authorization verification conditions during authorization verification. The specific processing procedure of step 203 is as follows:

[0121] Step 1101: Obtain the current machine code of each master node in the distributed system cluster.

[0122] In implementation, the server obtains the current machine code corresponding to the master node in the cluster of the distributed system to be authorized and verified. Specifically, since the master node server corresponding to the machine code that generates the cluster identifier is tagged when the cluster identifier is generated, the current machine code corresponding to the tagged master node server is also obtained for authorization and authentication during the authorization verification of the cluster identifier to maintain the consistency of the machine code corresponding to the cluster identifier.

[0123] Step 1102: Count the number of current machine codes and extract the verification code corresponding to each current machine code.

[0124] In practice, since the machine code obtained by decoding the cluster identifier is not a complete machine code, but only the prefix data of the machine code, the server counts the number of current machine codes obtained. At the same time, it is also necessary to extract the prefix data of the preset bits (the same number of bits as the machine code that generated the cluster identifier) ​​in each current machine code to obtain the verification code that can be used for authorization verification for each current machine code.

[0125] Step 1103: If the number of machine codes contained in the cluster identifier is greater than or equal to the number of verification codes and each verification code is contained in each machine code, then it is determined that there is an inclusion relationship between the machine codes contained in the cluster identifier and the verification codes.

[0126] In implementation, if the number of machine codes contained in the cluster identifier is greater than or equal to the number of verification codes, and it is guaranteed that the verification codes extracted from each current machine code can be found in each machine code contained in the cluster identifier, then it is determined that there is an inclusion relationship between the machine codes contained in the cluster identifier and the current machine code (or verification code). That is, it satisfies both the quantity inclusion relationship and the data inclusion relationship.

[0127] Step 1104: If the amount of machine code data contained in the cluster identifier is less than the number of verification codes and / or there are verification codes not included in the machine code, then it is determined that there is a non-inclusion relationship between the machine code contained in the cluster identifier and the current machine code.

[0128] In practice, if only one of the two inclusion conditions in the inclusion relationship is met, or if neither condition is met, then it is determined that there is no inclusion relationship. Specifically, if at least one of the two conditions is met, namely, the amount of machine code data contained in the cluster identifier code is less than the number of current machine codes (i.e., verification codes), or there is a verification code that is not contained in the machine code, then it is determined that there is no inclusion relationship between the machine code obtained by decoding the cluster identifier code and the current machine code.

[0129] When there is no inclusion relationship, it can be determined that the cluster to which the current machine code belongs is not the cluster to which the authorization verification cluster identifier code belongs. Therefore, it is determined that the authorization verification of the cluster identifier code fails. Furthermore, based on the failure of authorization verification, a prompt message indicating that the verification failed can be sent to the user.

[0130] In this embodiment, a cluster identifier code is obtained by granting overall authorization to the distributed cluster. Then, cluster authorization verification is performed based on the inclusion relationship between the machine code contained in the cluster identifier code and the current machine code. This ensures that even if the number of master node servers used to generate the cluster identifier code is reduced, the authorization of the cluster can still be maintained, thus improving the stability of cluster authorization.

[0131] It should be understood that, although Figures 2 to 4 , Figure 7 , Figure 9 , Figure 11 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2 to 4 , Figure 7 , Figure 9 , Figure 11 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0132] In one embodiment, such as Figure 12 As shown, an authorization control device 1200 is provided, including: an acquisition module 1210, a decoding module 1220, a verification module 1230, and an authorization module 1240, wherein:

[0133] The acquisition module 1210 is used to acquire the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster.

[0134] The decoding module 1220 is used to perform decoding processing according to the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code;

[0135] Verification module 1230 is used to obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code;

[0136] The authorization module 1240 is used to maintain authorization in a distributed system when there is an inclusion relationship.

[0137] In this embodiment, the cluster identifier code, obtained by processing the machine code of the master node in the cluster through binary sequential mixed encoding, can represent the overall authorization of the cluster. At the same time, it is not affected by the number of servers in the cluster. Even if the number of servers in the cluster increases, the authorization status can still be maintained, thus improving the authorization control stability of the distributed system.

[0138] In one embodiment, the device 1200 further includes:

[0139] The first acquisition module is used to acquire the hardware information of the master node within the cluster of the distributed system;

[0140] The generation module is used to generate the machine code corresponding to each master node based on the hardware information of each master node and the preset binary bitwise mixed encoding rules.

[0141] The second acquisition module is used to acquire the machine codes of at least two master nodes and generate a cluster identifier code according to a preset binary sequential mixed encoding rule.

[0142] In one embodiment, the hardware information of each master node includes at least central processing unit identification information, motherboard identification information, and message authentication code.

[0143] In one embodiment, the generation module is used to encrypt the hardware information of each master node according to a preset encryption algorithm to obtain the encrypted value corresponding to each hardware information.

[0144] The encrypted value is processed by binary bitwise mixed encoding to generate mixed codes corresponding to each hardware information. The encoded data of the preset bits of the mixed code is extracted as the machine code corresponding to each master node.

[0145] In one embodiment, the generation module is further configured to encrypt the hardware information of each master node according to a secure hash algorithm to obtain an initial encrypted value of consistent length.

[0146] Based on the Advanced Encryption Standard (AES) algorithm, the initial encryption value corresponding to each hardware information is encoded and encrypted, and the encrypted value of the preset byte length after encoding and encryption is extracted as the encryption value corresponding to each hardware information.

[0147] In one embodiment, the second acquisition module is used to acquire the machine codes of at least two master nodes in the cluster and determine the binary number value corresponding to the number of acquired machine codes.

[0148] According to the preset machine code arrangement order and the preset binary sequential mixed encoding rules, the machine codes of at least two master nodes are encoded bit by bit to obtain the binary mixed encoding value.

[0149] Generate a cluster identifier code based on the binary numerical value, the binary mixed encoding value, and the preset encoding rules.

[0150] In one embodiment, the decoding module 1220 is used to decrypt the cluster identifier code, remove a first preset number of bits from the beginning of the decryption sequence, and obtain a binary sequential encoded sequence.

[0151] Identify and read the data of the target bit in the binary ordered encoded sequence to obtain the number of machine codes contained in the cluster identifier code;

[0152] Read the binary sequential encoding sequence of the second preset number of bits adjacent to the target bit, and reverse the binary sequential encoding sequence of the second preset number of bits according to the binary sequential encoding inverse processing rule to obtain the machine code contained in the cluster identifier code.

[0153] In one embodiment, the verification module 1230 is used to obtain the current machine code of each master node in the cluster of the distributed system;

[0154] Count the number of current machine codes, and extract the verification code corresponding to each current machine code;

[0155] If the number of machine codes contained in the cluster identifier is greater than or equal to the number of verification codes, and each verification code is contained in each machine code, then it is determined that the machine codes contained in the cluster identifier have an inclusion relationship with the current machine code.

[0156] If the amount of machine code data contained in the cluster identifier is less than the number of verification codes and / or there are verification codes not included in the machine code, then it is determined that there is a non-inclusion relationship between the machine code contained in the cluster identifier and the current machine code.

[0157] Specific limitations regarding the authorization control device can be found in the limitations of the authorization control method above, and will not be repeated here. Each module in the aforementioned authorization control device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0158] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 13 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores cluster identifiers, machine code, encryption keys, and other related data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements an authorization control method.

[0159] Those skilled in the art will understand that Figure 13The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0160] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0161] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0162] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0163] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0164] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An authorization control method, characterized in that, The method includes: Obtain the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster; Based on the binary sequential encoding inverse processing rules and the cluster identifier code, the machine code contained in the cluster identifier code is obtained through decoding. Obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code; In the presence of the inclusion relationship, the authorization of the distributed system is maintained.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the hardware information of the master node within the cluster of a distributed system; Based on the hardware information of each master node and the preset binary bitwise mixed encoding rules, the machine code corresponding to each master node is generated. Obtain the machine codes of at least two master nodes, and generate a cluster identifier code according to the preset binary sequential mixed encoding rules.

3. The method according to claim 2, characterized in that, The hardware information of each master node includes at least the central processing unit identification information, motherboard identification information, and message authentication code.

4. The method according to claim 2, characterized in that, The step of generating machine code corresponding to each master node based on the hardware information of each master node and a preset binary bitwise mixed encoding rule includes: The hardware information of each master node is encrypted according to the preset encryption algorithm to obtain the encrypted value corresponding to each hardware information. The encrypted value is processed by binary bitwise hybrid encoding to generate a hybrid code corresponding to each piece of hardware information. The encoded data of the preset bits of the hybrid code is extracted and used as the machine code corresponding to each master node.

5. The method according to claim 4, characterized in that, The step of encrypting each piece of hardware information of each master node according to a preset encryption algorithm to obtain the encrypted value corresponding to each piece of hardware information includes: The hardware information of each master node is encrypted using a secure hash algorithm to obtain an initial encrypted value of the same length. According to the Advanced Encryption Standard (AES) algorithm, the initial encryption value corresponding to each piece of hardware information is encoded and encrypted, and the encrypted value of a preset byte length after encoding and encryption is extracted as the encryption value corresponding to each piece of hardware information.

6. The method according to claim 2, characterized in that, The step of obtaining the machine codes of at least two master nodes and generating a cluster identifier code according to the preset binary sequential mixed encoding rule includes: Obtain the machine codes of at least two master nodes in the cluster, and determine the binary number value corresponding to the number of machine codes obtained; According to the preset machine code arrangement order and the preset binary sequential mixed encoding rule, the machine codes of the at least two master nodes are sequentially encoded to obtain binary mixed encoding values; A cluster identifier code is generated based on the binary number value, the binary mixed encoding value, and the preset encoding rules.

7. The method according to claim 1, characterized in that, The decoding process based on the binary sequential encoding inverse processing rules and the cluster identifier code yields the machine code contained in the cluster identifier code, including: The cluster identifier is decrypted, and the first preset number of bits at the beginning of the decryption sequence are removed to obtain a binary sequential encoded sequence. Identify and read the data of the target bit in the binary ordered encoded sequence to obtain the number of machine codes contained in the cluster identifier code; Read the binary sequential encoding sequence of the second preset number of bits adjacent to the target bit, and reverse the binary sequential encoding sequence of the second preset number of bits according to the binary sequential encoding inverse processing rule to obtain the machine code contained in the cluster identifier code.

8. The method according to claim 1, characterized in that, The step of obtaining the current machine code in the distributed system and verifying whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code includes: Obtain the current machine code of each master node in the cluster of the distributed system; Count the number of current machine codes, and extract the verification code corresponding to each current machine code; If the number of machine codes contained in the cluster identifier is greater than or equal to the number of verification codes, and each verification code is contained in each of the machine codes, then it is determined that the machine codes contained in the cluster identifier have an inclusion relationship with the current machine code. If the amount of machine code data contained in the cluster identifier is less than the number of verification codes and / or there are verification codes that are not included in the machine code, then it is determined that there is a non-inclusion relationship between the machine code contained in the cluster identifier and the current machine code.

9. An authorization control device, characterized in that, The device includes: The acquisition module is used to acquire the cluster identifier code of the distributed system; the cluster identifier code is obtained by binary sequential mixed encoding of the machine code of the master node in the cluster. The decoding module is used to perform decoding based on the binary sequential encoding inverse processing rules and the cluster identifier code to obtain the machine code contained in the cluster identifier code; The verification module is used to obtain the current machine code in the distributed system and verify whether there is an inclusion relationship between the current machine code and the machine code contained in the cluster identifier code; An authorization module is used to maintain authorization in the distributed system when the inclusion relationship exists.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images