Data processing methods, apparatus, equipment, storage media and computer program products

Abstract

A data processing method, apparatus, device, storage medium, and computer program product are disclosed, applicable to various fields or scenarios such as cloud technology, artificial intelligence, blockchain, vehicle networking, smart transportation, and smart homes. The method includes: responding to an application authorization request for a target application sent by a device to be authorized; obtaining first identification information of a target product included in the device to be authorized; encrypting the first identification information using a symmetric key to obtain first ciphertext; encrypting the symmetric key using an authorization management public key to obtain second ciphertext; determining an application authorization code for the target application by the device to be authorized based on the first and second ciphertexts; and sending the application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has permission to use the target application based on the application authorization code. Using embodiments of this application, a difficult-to-crack application authorization code can be generated, effectively preventing a single application authorization code from being used by multiple devices.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, a data processing apparatus, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] To protect the intellectual property rights of software developers and prevent applications from being used without the copyright holder's consent or authorization, an increasing number of applications are adopting a licensing-before-use model. Devices can apply for an application license code from the software publisher, who then issues this code to the device. The device then uses this license code to verify its permission to use the application. Currently, application license codes are easily cracked, allowing a single code to be used on multiple devices, resulting in low security. Summary of the Invention

[0003] This application provides a data processing method, apparatus, device, storage medium, and computer program product that can generate application license codes that are difficult to crack, effectively preventing a single application license code from being used by multiple devices.

[0004] On one hand, embodiments of this application provide a data processing method, the method comprising:

[0005] In response to an application authorization request for a target application sent by a device to be authorized, obtain the first identification information of the target product included in the device to be authorized;

[0006] The first identifier information is encrypted using a symmetric key to obtain the first ciphertext;

[0007] The symmetric key is encrypted using the authorized management public key to obtain the second ciphertext;

[0008] Based on the first and second ciphertexts, determine the application authorization code for the target application for the device to be authorized;

[0009] Send an application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code.

[0010] On one hand, embodiments of this application provide a data processing method, the method comprising:

[0011] Obtain the application authorization code for the target application sent by the authorization server to the device to be authorized; the application authorization code is determined by the authorization server based on the first ciphertext and the second ciphertext. The first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using the authorization management public key.

[0012] Obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using a reference key to obtain the ciphertext to be compared;

[0013] Compare the ciphertext to be compared with the first ciphertext in the application authorization code;

[0014] If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then it is determined that the device to be authorized does not have the right to use the target application.

[0015] On one hand, embodiments of this application provide a data processing apparatus, the apparatus comprising:

[0016] The processing unit is configured to, in response to an application authorization request for a target application sent by the device to be authorized, obtain first identification information of the target product included in the device to be authorized;

[0017] The processing unit is also used to encrypt the first identification information using a symmetric key to obtain the first ciphertext;

[0018] This processing unit is also used to encrypt the symmetric key using the authorization management public key to obtain the second ciphertext;

[0019] The processing unit is also configured to determine the application authorization code of the device to be authorized for the target application based on the first ciphertext and the second ciphertext;

[0020] The transceiver unit is used to send an application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code.

[0021] On one hand, embodiments of this application provide a data processing apparatus, the apparatus comprising:

[0022] The transceiver unit is used to obtain the application authorization code for the target application of the device to be authorized sent by the authorization server. The application authorization code is determined by the authorization server based on the first ciphertext and the second ciphertext. The first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using the authorization management public key.

[0023] The processing unit is used to obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using a reference key to obtain the ciphertext to be compared;

[0024] The processing unit is also used to compare the ciphertext to be compared with the first ciphertext in the application authorization code;

[0025] The processing unit is also configured to determine that the device to be authorized does not have the right to use the target application if the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code.

[0026] On one hand, embodiments of this application provide a computer device, which includes a processor, a communication interface, and a memory. The processor, the communication interface, and the memory are interconnected. The memory stores a computer program, and the processor is used to call the computer program to execute the data processing method of any of the above possible implementations.

[0027] On one hand, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements a data processing method of any possible implementation.

[0028] Accordingly, this application also provides a computer program product, which includes a computer program or computer instructions, and the computer program or computer instructions are executed by a processor to implement the steps of the data processing method provided in this application.

[0029] Accordingly, this application also provides a computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing method provided in this application.

[0030] In this embodiment, in response to an application authorization request for a target application sent by a device to be authorized, the authorization server obtains the first identification information of the target product included in the device to be authorized, encrypts the first identification information using a symmetric key to obtain a first ciphertext, encrypts the symmetric key using an authorization management public key to obtain a second ciphertext, determines the application authorization code for the target application of the device to be authorized based on the first and second ciphertexts, and sends the application authorization code to the device to be authorized so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code. Using the above method, it can be ensured that the first identification information cannot be derived from the application authorization code without using the authorization management private key corresponding to the authorization management public key. This effectively prevents malicious parties from cracking the application authorization code generation rules based on the plaintext first identification information, thereby preventing malicious parties from forging product information of unauthorized devices based on the application authorization code generation rules, achieving the purpose of using one application authorization code on multiple devices, and providing high security. Attached Figure Description

[0031] To more clearly illustrate the technical methods of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This application provides a schematic diagram of the system architecture of a data processing system.

[0033] Figure 2 A flowchart illustrating a data processing method provided in this application embodiment. Figure 1 ;

[0034] Figure 3 A flowchart illustrating a data processing method provided in this application embodiment. Figure 2 ;

[0035] Figure 4 A flowchart illustrating a data processing method provided in this application embodiment. Figure 3 ;

[0036] Figure 5 A flowchart illustrating a data processing method provided in this application embodiment. Figure 4 ;

[0037] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0038] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0039] The technical methods in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0040] It should be noted that the terms "first," "second," etc., used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, technical features defined with "first," "second," etc., may explicitly or implicitly include at least one of those features.

[0041] This application proposes a data processing method that can generate application authorization codes that are difficult to crack, effectively preventing one application authorization code from being used by multiple devices. It can be applied to various fields or scenarios such as cloud technology, artificial intelligence, blockchain, vehicle networking, smart transportation, and smart homes.

[0042] In one embodiment, the data processing method can be implemented based on blockchain technology (cloud technology). A blockchain is a chain of linked text records (also known as blocks) that uses cryptography to connect and protect content. Each block contains the cryptographic hash of the previous block, a corresponding timestamp, and transaction data (usually represented by a hash value calculated using a Merkle tree algorithm). This design makes the block content difficult to tamper with. The distributed ledger linked by blockchain technology allows two parties to effectively record transactions and permanently verify these transactions. For example, the data required to execute the data processing method can be stored on the blockchain in the form of blocks; the data generated by executing the data processing method (e.g., application authorization codes) can be stored on the blockchain in the form of blocks; furthermore, the computer device executing the data processing method can be a node device in the blockchain network.

[0043] In feasible embodiments, this data processing method can also be implemented based on cloud technology and / or artificial intelligence technology. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology applied in the cloud computing business model. It can form a resource pool, which can be used on demand, flexibly and conveniently. Cloud computing technology will become an important support. The back-end services of technical network systems require a large amount of computing and storage resources, such as video websites, image websites, and more portal websites. With the rapid development and application of the Internet industry, in the future, every item may have its own identification mark, which will need to be transmitted to the back-end system for logical processing. Data of different levels will be processed separately, and various industry data will all require strong system support, which can only be achieved through cloud computing. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to obtain optimal results. In other words, artificial intelligence is a comprehensive technology of computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. Artificial intelligence is also the study of the design principles and implementation methods of various intelligent machines, enabling machines to have the functions of perception, reasoning, and decision-making.

[0044] The data processing method provided in this application embodiment may specifically involve one or more of cloud technologies, such as cloud storage, cloud databases, and big data. For example, it may retrieve the data required to execute the data processing method (e.g., an authorization management public key) from a cloud database. Furthermore, the data processing method provided in this application embodiment may specifically involve one or more of fundamental artificial intelligence technologies, such as distributed storage and big data processing technologies. For example, it may store the generated application authorization code on multiple independent devices.

[0045] Please see Figure 1 , Figure 1 This application provides a schematic diagram of the system architecture of a data processing system. Figure 1 The system architecture shown can be used to implement the data processing method proposed in the embodiments of this application. For example... Figure 1 As shown, the system architecture includes: an authorization server 10 and multiple devices to be authorized 11 (three are shown as an example in the figure).

[0046] The authorized server 10 can be a server with data processing capabilities. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The device to be authorized 11 can be a smartphone, tablet, laptop, desktop computer, smart voice interaction device, smart home appliance, in-vehicle terminal, etc. Figure 1 The authorization server 10 shown is connected to the device to be authorized 11 via a network. There can be several, dozens, or more devices to be authorized. This application does not limit the number of devices to be authorized.

[0047] Figure 1 The system architecture shown can implement the data processing method provided in the embodiments of this application. The implementation process of this method generally includes:

[0048] ① The authorization server 10 responds to the application authorization request for the target application sent by the device to be authorized 11 and obtains the first identification information of the target product included in the device to be authorized 11.

[0049] ② The authorization server 10 uses the symmetric key to encrypt the first identification information to obtain the first ciphertext.

[0050] ③ The authorization server 10 uses the authorization management public key to encrypt the symmetric key to obtain the second ciphertext.

[0051] ④ The authorization server 10 determines the application authorization code of the device to be authorized 11 for the target application based on the first ciphertext and the second ciphertext.

[0052] ⑤ The authorization server 10 sends the application authorization code to the device to be authorized 11.

[0053] ⑥ The device to be authorized 11 receives the application authorization code sent by the authorization server 10, obtains the current second identification information of the target product included in the device to be authorized 11, and encrypts the second identification information using the reference key to obtain the ciphertext to be compared.

[0054] ⑦ The device to be authorized 11 compares the ciphertext to be compared with the first ciphertext in the application authorization code.

[0055] ⑧ If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then the device to be authorized 11 determines that the device to be authorized 11 does not have the right to use the target application.

[0056] Using the above method, an application authorization code that is difficult to crack can be generated. Without the use of the authorization management private key corresponding to the authorization management public key, it is impossible to deduce the first identification information based on the application authorization code. This can effectively prevent malicious parties from cracking the application authorization code generation rules based on the plaintext first identification information, thereby preventing malicious parties from forging product information of unauthorized devices based on the application authorization code generation rules. This achieves the purpose of using one application authorization code on multiple devices, resulting in high security.

[0057] It is understood that the system architecture diagrams described in the embodiments of this application are for the purpose of more clearly illustrating the technical methods of the embodiments of this application, and do not constitute a limitation on the technical methods provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture and the emergence of new business scenarios, the technical methods provided in the embodiments of this application are also applicable to similar technical problems.

[0058] The specific implementation of the data processing method provided in the embodiments of this application will be described in detail below.

[0059] Please see Figure 2 , Figure 2 A flowchart illustrating a data processing method provided in this application embodiment. Figure 1 This method can be derived from... Figure 1 The authorization server 10 in the process executes the method. The method includes the following steps S201-S205:

[0060] S201. In response to the application authorization request for the target application sent by the device to be authorized, obtain the first identification information of the target product included in the device to be authorized.

[0061] The device to be authorized is the device for which permission to use the target application is requested. The target product is one or both of the hardware and software products included in the device to be authorized. The hardware product may be the CPU (Central Processing Unit), motherboard, hard drive, etc., of the device to be authorized, and the software product may be the operating system used by the device to be authorized.

[0062] In one embodiment, first identification information of the target products included in the device to be authorized can be generated based on the identity identifiers of the target products included in the device to be authorized. The identity identifier of the target product is used to uniquely identify the target product; for example, it may be a CPUID (CPU serial number), a hard drive serial number, a motherboard serial number (Serial No., SN), a Universally Unique Identifier (UUID) of the operating system, or an operating system SN serial number. Specifically, when there is only one target product, its identity identifier can be directly used as the first identification information of the target products included in the device to be authorized; when there are multiple target products, the identity identifiers of multiple target products can be concatenated according to a set order to obtain the first identification information of the target products included in the device to be authorized.

[0063] In one embodiment, the authorization server obtains the first identification information of the target product included in the device to be authorized by at least one of the following: ① The first identification information of the target product included in the device to be authorized can be generated by the device to be authorized and carried in the application authorization request, and the authorization server can obtain the first identification information from the application authorization request. ② After receiving the application authorization request, the authorization server can send an identification generation instruction to the device to be authorized, and the device to be authorized can respond to the identification generation instruction, generate the first identification information of the target product included in the device to be authorized, and send the first identification information to the authorization server. ③ After receiving the application authorization request, the authorization server can directly obtain the identity identifier of the target product included in the device to be authorized, and generate the first identification information of the target product included in the device to be authorized based on the obtained identity identifier of the target product. ④ The identity identifier of the target product included in the device to be authorized is stored in the authorization server or in the cloud, and the authorization server can directly obtain the identity identifier of the target product included in the device to be authorized from the authorization server or from the cloud, and generate the first identification information of the target product included in the device to be authorized.

[0064] It should be noted that when the identification and primary identification information of the target product included in the authorized device are used in specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0065] In a feasible embodiment, the authorization server stores an authorization list, which includes device identifiers of authorized devices. The application authorization request carries the device identifier of the device to be authorized. When the authorization server receives the application authorization request, it can check whether the device identifier carried in the application authorization request is included in the authorization list. If the device identifier carried in the application authorization request is included in the authorization list, it executes the steps of obtaining the first identifier information of the target product included in the device to be authorized and subsequent steps. Alternatively, the application authorization request carries a payment identifier indicating that a usage fee has been paid for the target application. When the authorization server detects the payment identifier in the application authorization request, it can execute the steps of obtaining the first identifier information of the target product included in the device to be authorized and subsequent steps.

[0066] S202. Encrypt the first identification information using a symmetric key to obtain the first ciphertext.

[0067] In one embodiment, the symmetric key can be a key generated using a key generator corresponding to a symmetric key algorithm. A symmetric key algorithm refers to using the same key for both encryption and decryption. Symmetric key algorithms can include AES (Advanced Encryption Standard), the Chinese national standard SM4 algorithm, etc. The AES algorithm involves multiple rounds of encryption. For each encryption round, the encryption key is a round key generated from the encryption key (128 bits), and each round key can also be 128 bits. The Chinese national standard SM4 algorithm is a block cipher with a block length of 128 bits, and the encryption key is also 128 bits long. Both the encryption algorithm and the key expansion algorithm involved employ a 32-round nonlinear iterative structure, performing encryption operations in units of words (32 bits). Each iteration is a transformation function.

[0068] When the authorization server encrypts the first identifier information using the symmetric key, it uses the encryption processing logic of the symmetric key algorithm corresponding to the symmetric key to encrypt the first identifier, thus obtaining the first ciphertext.

[0069] S203. Encrypt the symmetric key using the authorized management public key to obtain the second ciphertext.

[0070] The authorization management public key can be a public key generated using a key generator corresponding to an asymmetric key algorithm. Asymmetric key algorithms require a public key for encryption and a private key for decryption. Examples of asymmetric key algorithms include RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography). The security of RSA relies on the factorization of large numbers; multiplying two large prime numbers is easy, but factoring their product is very difficult. Therefore, using the product as the authorization management public key provides a high level of security. The security of ECC is primarily based on the elliptic curve discrete logarithm problem over finite fields, resulting in relatively high security.

[0071] When the authorization server encrypts the symmetric key using the authorization management public key, it uses the encryption processing logic of the asymmetric key algorithm corresponding to the authorization management public key to encrypt the symmetric key, thus obtaining the second ciphertext.

[0072] S204. Based on the first ciphertext and the second ciphertext, determine the application authorization code for the target application of the device to be authorized.

[0073] In one embodiment, the authorization server can serialize the first ciphertext and the second ciphertext to obtain the application authorization code for the target application of the device to be authorized. Specifically, the authorization server can generate a first description file according to the syntax rules of a structured representation language. The first description file includes two key-value pairs. The key of one key-value pair is an identifier corresponding to the first ciphertext, and the corresponding value is the content information of the first ciphertext. The key of the other key-value pair is an identifier corresponding to the second ciphertext, and the corresponding value is the content information of the second ciphertext. The authorization server serializes the key-value pairs in the generated first description file according to the serialization algorithm applicable to the structured representation language to obtain the application authorization code for the target application of the device to be authorized. The structured representation language can specifically be JSON (JavaScript Object Notation). JSON is a lightweight data exchange format that uses a text format completely independent of programming languages ​​to store and represent data. It is easy for humans to read and write, and also easy for machines to parse and generate.

[0074] In a feasible implementation, the authorization server can directly use the first ciphertext as the application authorization code for the target application on the device to be authorized. Alternatively, the authorization server can serialize the first ciphertext to obtain the application authorization code for the target application on the device to be authorized. Specifically, a second description file is generated according to the syntax rules of the Structured Representation Language (SRL). The second description file includes a key-value pair, where the key of the key-value pair is the identifier corresponding to the first ciphertext, and the value of the key-value pair is the content information corresponding to the first ciphertext. The authorization server serializes the key-value pairs in the generated second description file according to the serialization algorithm applicable to the SRL to obtain the application authorization code for the target application on the device to be authorized.

[0075] S205. Send an application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code.

[0076] After generating an application authorization code for the target application for the device to be authorized, the authorization server can send the application authorization code to the device. In one embodiment, the device to be authorized can automatically launch the target application upon receiving the application authorization code and verify whether it has the necessary permissions to use the target application based on the application authorization code. And / or, when the set verification period (e.g., an interval of 24 hours) arrives, it can verify whether it has the necessary permissions to use the target application based on the application authorization code. When the device to be authorized has the necessary permissions to use the target application, the target application can run normally and be used. When the device to be authorized does not have the necessary permissions to use the target application, it can directly exit the target application, and / or, display a prompt message indicating that the device to be authorized does not have the necessary permissions to use the target application.

[0077] In one embodiment, when the device to be authorized determines whether it has permission to use the target application based on the application authorization code, it can obtain the current identity identifier of the target product included in the device to be authorized, and determine the current second identification information of the target product included in the device to be authorized based on the current identity identifier of the target product included in the device to be authorized. Then, the device to be authorized encrypts the second identification information using a symmetric key to obtain the ciphertext to be compared. This symmetric key can be securely stored in the target application, so the device to be authorized can retrieve the stored symmetric key from the target application; alternatively, the authorization server can send the symmetric key to the device to be authorized.

[0078] Further, the device to be authorized obtains the first ciphertext from the application authorization code. If the authorization server directly uses the first ciphertext as the application authorization code, the device to be authorized obtains the first ciphertext by acquiring the application authorization code. If the authorization server uses serialization processing during the generation of the application authorization code, it can first deserialize the application authorization code to obtain the corresponding description file, and then look up the identifier of the first ciphertext in the corresponding description file, using the value corresponding to the identifier of the first ciphertext in the corresponding description file as the content information corresponding to the first ciphertext. The device to be authorized then compares the content information corresponding to the ciphertext to be compared with the content information corresponding to the first ciphertext. If the comparison result indicates that the content information corresponding to the ciphertext to be compared is consistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is consistent with the first ciphertext, and the device to be authorized has the right to use the target application. If the comparison result indicates that the content information corresponding to the ciphertext to be compared is inconsistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is inconsistent with the first ciphertext, and the device to be authorized does not have the right to use the target application.

[0079] Understandably, the authorization management public key corresponds to an authorization management private key, which can be a private key generated using a key generator corresponding to an asymmetric key algorithm. When the authorization management public key is used to encrypt the symmetric key to obtain the second ciphertext, the authorization management private key corresponding to the authorization management public key must be used to decrypt the second ciphertext to obtain the symmetric key. Only then can the obtained symmetric key be used to decrypt the first ciphertext to obtain the first identification information. This application, by securely storing the authorization management private key—for example, by using an encryption machine or distributed block key to securely store the authorization management private key in the authorization server—can prevent malicious parties from cracking the first ciphertext in the application authorization code based on the application authorization code. Furthermore, it can prevent malicious parties from cracking the application authorization code generation rules through the plaintext first identification information. This avoids situations where malicious parties forge the product information of unauthorized devices (such as the identity identifiers of hardware and / or software products) into the identity identifiers of the target products included in the device to be authorized, thereby granting unauthorized devices access to the target application. This effectively prevents one application authorization code from being used by multiple devices.

[0080] In this embodiment, in response to an application authorization request for a target application sent by a device to be authorized, the authorization server obtains the first identification information of the target product included in the device to be authorized, encrypts the first identification information using a symmetric key to obtain a first ciphertext, encrypts the symmetric key using an authorization management public key to obtain a second ciphertext, determines the application authorization code for the target application of the device to be authorized based on the first and second ciphertexts, and sends the application authorization code to the device to be authorized so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code. Using the above method, it can be ensured that the first identification information cannot be derived from the application authorization code without using the authorization management private key corresponding to the authorization management public key. This effectively prevents malicious parties from cracking the application authorization code generation rules based on the plaintext first identification information, thereby preventing malicious parties from forging product information of unauthorized devices based on the application authorization code generation rules, achieving the purpose of using one application authorization code on multiple devices, and providing high security.

[0081] Please see Figure 3 , Figure 3 A flowchart illustrating a data processing method provided in this application embodiment. Figure 2 This method can be derived from... Figure 1 The authorized device 11 executes the method. The method includes the following steps S301-S304:

[0082] S301. Obtain the application authorization code for the target application sent by the authorization server for the device to be authorized; the application authorization code is determined by the authorization server based on the first ciphertext and the second ciphertext. The first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using the authorization management public key.

[0083] In one embodiment, the authorization server may respond to an application authorization request sent by the device to be authorized and return an application authorization code for the target application to the device to be authorized. The detailed implementation process of S301 can be found in S201-S204, and will not be repeated in this embodiment.

[0084] S302. Obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using the reference key to obtain the ciphertext to be compared.

[0085] In one embodiment, when the device to be authorized determines whether it has permission to use the target application based on the application authorization code, it can obtain the current identity identifier of the target product included in the device to be authorized, and determine the current second identification information of the target product included in the device to be authorized based on the current identity identifier of the target product included in the device to be authorized. Specifically, when there is one target product, the current identity identifier of the target product can be used as the current second identification information of the target product included in the device to be authorized; when there are multiple target products, the current identity identifiers of the multiple target products can be concatenated according to a set order relationship to obtain the current second identification information of the target product included in the device to be authorized.

[0086] Furthermore, the device to be authorized can encrypt the second identification information using the encryption logic of the symmetric encryption algorithm corresponding to the reference key to obtain the ciphertext to be compared. The reference key can be the aforementioned symmetric key, which can be securely stored in the target application, allowing the device to be authorized to obtain the stored reference key from the target application; alternatively, the authorization server can send the reference key to the device to be authorized.

[0087] It should be noted that when the current identity and secondary identification information of the target product included in the authorized device is used in a specific product or technology, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0088] S303. Compare the ciphertext to be compared with the first ciphertext in the application authorization code.

[0089] In one implementation, if the authorization server uses the first ciphertext as the application authorization code, the device to be authorized obtains the first ciphertext by acquiring the application authorization code. If the authorization server uses serialization processing during the generation of the application authorization code, the application authorization code can be deserialized first to obtain the corresponding description file. Then, the identifier of the first ciphertext can be found in the corresponding description file, and the value corresponding to the identifier of the first ciphertext in the corresponding description file can be used as the content information of the first ciphertext. Finally, the content information corresponding to the obtained first ciphertext can be compared with the content information of the ciphertext to be compared.

[0090] S304. If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then it is determined that the device to be authorized does not have the right to use the target application.

[0091] If the comparison of the ciphertext to be compared with the content of the first ciphertext shows that the content of the ciphertext to be compared is consistent with the content of the first ciphertext, then it is determined that the ciphertext to be compared is consistent with the first ciphertext, and the device to be authorized has the right to use the target application. If the comparison result shows that the content of the ciphertext to be compared is inconsistent with the content of the first ciphertext, then it is determined that the ciphertext to be compared is inconsistent with the first ciphertext, and the device to be authorized does not have the right to use the target application.

[0092] Understandably, the authorization management public key corresponds to an authorization management private key, which can be a private key generated using a key generator corresponding to an asymmetric key algorithm. When the authorization management public key is used to encrypt the symmetric key to obtain the second ciphertext, the authorization management private key corresponding to the authorization management public key must be used to decrypt the second ciphertext to obtain the symmetric key. Only then can the obtained symmetric key be used to decrypt the first ciphertext to obtain the first identification information. This application, by securely storing the authorization management private key—for example, by using an encryption machine or distributed block key to securely store the authorization management private key in the authorization server—can prevent malicious parties from cracking the first ciphertext in the application authorization code based on the application authorization code. Furthermore, it can prevent malicious parties from cracking the application authorization code generation rules through the plaintext first identification information. This avoids situations where malicious parties forge the product information of unauthorized devices (such as the identity identifiers of hardware and / or software products) into the identity identifiers of the target products included in the device to be authorized, thereby granting unauthorized devices access to the target application. This effectively prevents one application authorization code from being used by multiple devices.

[0093] In this embodiment, the device to be authorized obtains the application authorization code for the target application sent by the authorization server, obtains the second identification information of the target product included in the device to be authorized, encrypts the second identification information using a reference key to obtain the ciphertext to be compared, and compares the ciphertext to be compared with the first ciphertext in the application authorization code. If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, it is determined that the device to be authorized does not have the right to use the target application. Using the above method, the device to be authorized can conveniently verify whether it has the right to use the target application using the returned application authorization code, which can improve the convenience of verification. Moreover, the first ciphertext in the application authorization code is difficult to crack, which can prevent malicious parties from cracking the generation rules of the application authorization code based on the plaintext first identification information, thereby avoiding malicious parties from forging product information of unauthorized devices based on the generation rules of the application authorization code, achieving the purpose of using one application authorization code on multiple devices, and thus providing high security.

[0094] Please see Figure 4 , Figure 4A flowchart illustrating a data processing method provided in this application embodiment. Figure 3 This method can be derived from... Figure 1 The authorization server 10 and the device to be authorized 11 work together to execute this method. The method includes the following steps S401-S408:

[0095] S401. The authorization server responds to the application authorization request for the target application sent by the device to be authorized and obtains the first identification information of the target product included in the device to be authorized.

[0096] In one embodiment, when the target product includes one or more, the authorization server can serialize the identity identifiers of the one or more target products to obtain the first identification information of the target products included in the device to be authorized. Specifically, the authorization server can generate a third description file according to the syntax rules of a structured representation language. This third description file includes one or more key-value pairs, where the key of each key-value pair is the identity identifier of the target product, and the value of each key-value pair is the content information corresponding to the identity identifier of the target product. The authorization server then serializes the key-value pairs in the generated third description file according to the serialization algorithm applicable to the structured representation language to obtain the first identification information of the target products included in the device to be authorized.

[0097] S402. The authorized server uses the symmetric key to encrypt the first identification information to obtain the first ciphertext.

[0098] In one embodiment, the authorization server can encode the first identification information to obtain encoded data of the first identification information. This encoding process can be hash encoding, for example, using one or more of message digest algorithms and secure hash algorithms to hash the first identification information to obtain encoded data. The authorization server then determines the symmetric key based on the encoded data of the first identification information. In this step, it is necessary to determine the key length and generation rules used by the symmetric key algorithm. For example, the SM4 algorithm uses a key length of 16 bytes (16 bytes equals 128 bits), so 16 characters can be obtained from the encoded data of the first identification information as the symmetric key.

[0099] In one specific implementation, the first 16 characters of the encoded data of the first identification information can be obtained to form a symmetric key. Then, the first identification information is encrypted according to the encryption processing logic of the national cryptographic SM4 algorithm to obtain the first ciphertext.

[0100] S403. The authorization server uses the authorization management public key to encrypt the symmetric key to obtain the second ciphertext.

[0101] In one implementation, the authorization server can use the same authorization management public key for the target application, that is, when any device requests application permissions for the target application, the authorization server uses the same authorization management public key.

[0102] S404. The authorization server determines the application authorization code for the target application of the device to be authorized based on the first ciphertext and the second ciphertext.

[0103] In one embodiment, the authorization server serializes the first ciphertext and the second ciphertext to obtain device feature information of the device to be authorized. Specifically, the authorization server can generate a first description file according to the syntax rules of a structured representation language. The first description file includes two key-value pairs. The key of one key-value pair is an identifier corresponding to the first ciphertext, and the corresponding value is the content information of the first ciphertext. The key of the other key-value pair is an identifier corresponding to the second ciphertext, and the corresponding value is the content information of the second ciphertext. The authorization server then serializes the key-value pairs in the generated first description file according to the serialization algorithm applicable to the structured representation language to obtain the device feature information of the device to be authorized.

[0104] Further, the device characteristic information of the device to be authorized is signed to obtain signature data. This signing process includes: processing the device characteristic information of the device to be authorized using a hash algorithm to obtain a digital digest; encrypting the digital digest using the authorization management private key corresponding to the authorization management public key to obtain the signature data. Based on the device characteristic information and the signature data, the authorization server determines the application authorization code for the target application of the device to be authorized. Specifically, this can be achieved by serializing the device characteristic information and the signature data to obtain the application authorization code for the target application of the device to be authorized.

[0105] In another embodiment, the authorization server can serialize the first ciphertext and the second ciphertext to obtain device characteristic information of the device to be authorized. Further, it obtains the authorization validity period, performs signature processing on the device characteristic information and the authorization validity period, and obtains signature data. This authorization validity period indicates the duration for which the device to be authorized has the right to use the target application. The signature processing includes: concatenating or serializing the device characteristic information and the authorization validity period to obtain a combined device characteristic information and authorization validity period; processing the combined device characteristic information and authorization validity period using a hash algorithm to obtain a digital digest; and encrypting the digital digest using the authorization management private key corresponding to the authorization management public key to obtain signature data. Finally, the authorization server can determine the application authorization code for the target application of the device to be authorized based on the device characteristic information, the authorization validity period, and the signature data. Specifically, this can be achieved by serializing the device characteristic information, the authorization validity period, and the signature data to obtain the application authorization code for the target application of the device to be authorized.

[0106] S405. The authorization server sends the application authorization code to the device to be authorized.

[0107] S406. The device to be authorized receives the application authorization code sent by the authorization server, obtains the current second identification information of the target product included in the device to be authorized, and encrypts the second identification information using the reference key to obtain the ciphertext to be compared.

[0108] In one embodiment, when the application authorization code is determined based on device feature information and signature data, the device to be authorized obtains the device feature information and signature data from the application authorization code. Specifically, this can involve deserializing the application authorization code to obtain a corresponding description file, and then searching for the device feature information and signature data within that description file. The device to be authorized then uses the authorization management public key to decrypt the signature data, completing the designing process and obtaining designed data. This authorization management public key can be sent to the device to be authorized by the authorization server or hard-coded in the target application. Further, the device to be authorized uses the hash algorithm used in the signature processing described above to process the device feature information, obtaining a processing result. If the data corresponding to the processing result matches the designed data, then the signature verification is confirmed to be successful. At this point, the device to be authorized confirms that the application authorization code was sent by the authorization server. When the device to be authorized confirms that the application authorization code was sent by the authorization server, it can execute steps to obtain the current second identification information of the target product included in the device to be authorized and subsequent steps.

[0109] In a feasible implementation, when the device to be authorized confirms that the application authorization code was not sent by the authorization server, the device to be authorized may not perform any processing.

[0110] In another embodiment, when the application authorization code is determined based on device feature information, authorization period, and signature data, the device to be authorized obtains the device feature information, authorization period, and signature data from the application authorization code. Specifically, this can be done by deserializing the application authorization code to obtain a corresponding description file, and then searching for the device feature information, authorization period, and signature data in that description file. Further, the signature data is decrypted using the authorization management public key to complete the designing process and obtain designed data. The device to be authorized then uses the hash algorithm used in the above signature processing to process the combined device feature information and authorization period to obtain a processing result. If the data corresponding to the processing result matches the designed data, the signature verification is considered successful. At this point, the device to be authorized confirms that the application authorization code was sent by the authorization server. When the device to be authorized confirms that the application authorization code was sent by the authorization server, it can execute the steps of obtaining the current second identification information of the target product included in the device to be authorized and subsequent steps.

[0111] In one embodiment, the device to be authorized can obtain the current identity identifier of the target product included in the device to be authorized, and perform serialization processing on one or more current identity identifiers of the target product to obtain the second identification information of the target product included in the device to be authorized. Specifically, the authorization server can generate a fourth description file according to the syntax rules of the structured representation language. The fourth description file includes one or more key-value pairs, where the key of each key-value pair is the current identity identifier of the target product, and the value of each key-value pair is the content information corresponding to the current identity identifier of the target product. The authorization server then performs serialization processing on the key-value pairs in the generated fourth description file according to the serialization algorithm applicable to the structured representation language to obtain the second identification information of the target product included in the device to be authorized.

[0112] In one implementation, the device to be authorized encodes the second identification information to obtain encoded data of the second identification information. This encoding process can be hash encoding, for example, one or more of message digest algorithms and secure hash algorithms can be used to hash-encode the second identification information to obtain encoded data of the second identification information.

[0113] Further, a reference key is determined based on the encoded data of the second identification information. The processing method is consistent with that in S402, where the authorizing server determines the symmetric key based on the encoded data of the first identification information. For example, if the first 16 characters of the encoded data of the first identification information are used to construct the symmetric key, the first 16 characters of the encoded data of the second identification information are also used to construct the reference key. The device to be authorized then determines the symmetric key algorithm used by the authorizing server to encrypt the first identification information to obtain the first ciphertext, and uses the same encryption logic of the symmetric key algorithm to encrypt the second identification information to obtain the ciphertext to be compared.

[0114] S407. The device to be authorized compares the ciphertext to be compared with the first ciphertext in the application authorization code.

[0115] In one embodiment, the device to be authorized can obtain device feature information from the application authorization code, obtain first ciphertext from the device feature information, and then compare the content information corresponding to the ciphertext to be compared with the content information corresponding to the first ciphertext.

[0116] S408. If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then the device to be authorized determines that the device to be authorized does not have the right to use the target application.

[0117] In one embodiment, when the application authorization code is determined based on signature data and device feature information, if the comparison result indicates that the content information corresponding to the ciphertext to be compared is consistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is consistent with the first ciphertext, and the device to be authorized has the right to use the target application. If the comparison result indicates that the content information corresponding to the ciphertext to be compared is inconsistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is inconsistent with the first ciphertext, and the device to be authorized does not have the right to use the target application.

[0118] In one embodiment, when the application authorization code is determined based on signature data, authorization validity period, and device characteristic information, if the comparison result indicates that the content information corresponding to the ciphertext to be compared is inconsistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is inconsistent with the first ciphertext, and the device to be authorized does not have the right to use the target application. If the comparison result indicates that the content information corresponding to the ciphertext to be compared is consistent with the content information corresponding to the first ciphertext, then it is determined that the ciphertext to be compared is consistent with the first ciphertext. Further, the authorization validity period in the application authorization code is obtained, and it is checked whether the authorization expiration time indicated by the authorization validity period has been reached. If the authorization expiration time indicated by the authorization validity period has been reached, it is determined that the device to be authorized does not have the right to use the target application; if the authorization expiration time indicated by the authorization validity period has not been reached, it is determined that the device to be authorized has the right to use the target application.

[0119] In a feasible embodiment, if the device to be authorized does not have the permission to use the target application because the authorization expiration time indicated by the authorization validity period has expired, a prompt message indicating that the authorization validity period has expired can be displayed, and the user can apply for a new authorization validity period from the authorization server based on the prompt message.

[0120] In one embodiment, if the device to be authorized determines that the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, the device to be authorized can encrypt the reference key using the authorization management public key to obtain the key ciphertext. Further, the ciphertext to be compared and the key ciphertext are serialized to obtain new device feature information. Specifically, the authorization server can generate a fifth description file according to the syntax rules of the structured representation language. This fifth description file includes two key-value pairs: one key-value pair has a key that is the identifier corresponding to the ciphertext to be compared, and a corresponding value that is the content information of the ciphertext to be compared; the other key-value pair has a key that is the identifier corresponding to the key ciphertext, and a corresponding value that is the content information of the key ciphertext. The device to be authorized then serializes the key-value pairs in the generated fifth description file according to the serialization algorithm applicable to the structured representation language to obtain new device feature information. The device to be authorized can send the new device feature information to the authorization server, and the authorization server can generate a new application authorization code for the target application based on the new device feature information. For example, the authorization server serializes the new device feature information and the authorization validity period to obtain a new application authorization code for the target application. Next, the authorization server can send a new application authorization code to the device to be authorized, allowing the device to re-determine whether it has permission to use the target application based on the new authorization code. Through this embodiment, the device to be authorized can generate new device characteristic information, and the authorization server can directly use this new device characteristic information to generate a new application authorization code, improving the efficiency and convenience of application authorization code generation.

[0121] In one implementation, when the authorization server detects that the device to be authorized does not have permission to use the target application, specifically because the ciphertext to be compared is inconsistent with the first ciphertext, the server obtains the first and second ciphertexts from the application authorization code. Using the authorization management private key corresponding to the authorization management public key, the server decrypts the second ciphertext to obtain a symmetric key. The server then uses the decrypted symmetric key to decrypt the first ciphertext to obtain first identification information. Further, the server obtains the current second identification information of the target product included in the device to be authorized. Based on the second identification information and the decrypted first identification information, the server determines the reason why the device to be authorized does not have permission to use the target application. This authorization management private key can be securely stored by the authorization server, for example, using an encryption machine or distributed block key, to prevent malicious parties from obtaining the authorization management private key.

[0122] Specifically, the authorization server compares the second identification information with the decrypted first identification information. If the comparison result indicates that the first identification information and the second identification information are inconsistent, it is determined that the reason why the device to be authorized does not have the right to use the target application is that the target products included in the device to be authorized have changed. The changed target products can be one or more. For example, if the motherboard SN serial number included in the first identification information is xxxx, and the motherboard SN serial number included in the second identification information is yyyy, it is determined that the application authorization code is invalid because the motherboard of the device to be authorized has changed. At this time, the authorization server can send the reason why the device to be authorized does not have the right to use the target application to the device to be authorized, so that the user can perform self-checks. For example, the user can check whether the application authorization code is invalid because the motherboard has been replaced or the identity of the motherboard of the device to be authorized has been illegally tampered with. Through this embodiment, when the application authorization code is invalid, the first identification information can be restored, and the authorization server can use the first identification information to locate and analyze the specific reason for the application authorization code failure.

[0123] In one implementation, when the comparison result indicates that the first identification information and the second identification information are inconsistent, the authorization server can generate a new application authorization code for the target application for the device to be authorized based on the second identification information. Specifically, the authorization server can detect whether the device to be authorized meets the conditions for re-authorization. If the device to be authorized meets the conditions for re-authorization, it generates a new application authorization code for the target application based on the second identification information. For example, if the device to be authorized receives a message from the authorization server that the reason it does not have permission to use the target application is a change in the motherboard, and it is determined that the change in the motherboard is a normal motherboard replacement operation, it can report this to the authorization server and send the second identification information to the authorization server. The authorization server then reassigns a new application authorization code to the device to be authorized based on the second identification information. Next, the authorization server can send the new application authorization code to the device to be authorized, and the device to be authorized can re-determine whether it has permission to use the target application based on the new application authorization code. Through this embodiment, the authorization server does not need to re-obtain the current identity identifier of the target product included in the device to be authorized; it can directly generate the application authorization code using the second identification information, which improves the efficiency and convenience of application authorization code generation.

[0124] Through the embodiments of this application, application authorization codes that are difficult to crack can be generated, preventing malicious parties from cracking the application authorization code generation rules based on the plaintext first identification information. This avoids malicious parties from forging product information of unauthorized devices based on the application authorization code generation rules, achieving the purpose of using one application authorization code on multiple devices, thus providing high security. At the same time, the authorization server can deduce the first identification information using the securely stored authorization management private key, and use the first identification information to locate and analyze the specific reasons for the application authorization code failure. Furthermore, the authorization server can reassign new application authorization codes to the devices to be authorized using the second identification information or new device characteristic information, which can improve the efficiency and convenience of application authorization code generation.

[0125] Please see Figure 5 , Figure 5 This is a flowchart illustrating a data processing method provided in an embodiment of this application. Figure 4 The authorization server can be the software publisher of the target application. The software publisher can issue an application license code for the target application to the device to be authorized, allowing the target application to run on the device. This method includes the following steps:

[0126] S501. The device to be authorized uses the identifier generation module to generate device characteristic information. Specifically, when the device to be authorized needs to apply for an application authorization code for a target application, the identifier generation module can run on the device to be authorized. The identifier generation module can be included in the target application. After obtaining permission from the device to be authorized, the identifier generation module can obtain the identity identifier of the target product included in the device to be authorized, generate first identifier information of the target product included in the device to be authorized based on the identity identifier of the target product included in the device to be authorized, and use the first identifier information to generate device characteristic information of the device to be authorized.

[0127] S502. The authorization server can obtain the device characteristic information generated by the identifier generation module, generate an application authorization code for the target application for the device to be authorized based on the authorization validity period, signature data, and device characteristic information, and send the generated application authorization code to the device to be authorized. The authorization validity period may involve the validity period of using some or all functions of the target application.

[0128] S503. After obtaining the application authorization code for the target application, the device to be authorized can call the target application's startup module to launch the target application and use the obtained application authorization code to verify whether the device to be authorized has the right to use the target application. Specifically, after confirming that the signature verification is successful based on the signature data in the application authorization code, the first identification information in the application authorization code is compared with the current second identification information of the target product included in the device to be authorized. If the comparison result indicates that the first identification information and the second identification information are consistent, the authorization validity period in the application authorization code is obtained, and it is determined whether the authorization expiration time indicated by the authorization validity period has arrived. If the authorization expiration time indicated by the authorization validity period has not arrived, the target application can run normally on the device to be authorized. If the authorization expiration time indicated by the authorization validity period has arrived, the target application cannot run normally on the device to be authorized. If the comparison result indicates that the first identification information and the second identification information are inconsistent, the target application can be exited directly, and the second identification information is sent to the authorization server. The authorization server uses the second identification information and the first identification information to locate the reason why the device to be authorized does not have the right to use the target application.

[0129] S504. When the verification period arrives, the device to be authorized can verify again whether it has the right to use the target application based on the application authorization code.

[0130] Through this embodiment, software publishers can generate application license codes that are difficult to crack, preventing malicious parties from using a single application license code on multiple devices by fabricating the identity of software and / or hardware products on unauthorized devices. This helps protect the intellectual property rights of software publishers.

[0131] It is understood that in the specific embodiments of this application, the identification data of the target product included in the device to be authorized is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0132] The methods of the embodiments of this application have been described in detail above. To facilitate better implementation of the methods of the embodiments of this application, the apparatus of the embodiments of this application is provided below. Please refer to... Figure 6 , Figure 6 This is a schematic diagram of a data processing device provided in an embodiment of this application. The device may correspond to the authorization server described above. The data processing device 60 may include:

[0133] The processing unit 601 is configured to, in response to an application authorization request for a target application sent by the device to be authorized, obtain first identification information of the target product included in the device to be authorized;

[0134] The processing unit 601 is further configured to encrypt the first identification information using a symmetric key to obtain the first ciphertext;

[0135] The processing unit 601 is further configured to encrypt the symmetric key using the authorization management public key to obtain the second ciphertext;

[0136] The processing unit 601 is further configured to determine the application authorization code of the device to be authorized for the target application based on the first ciphertext and the second ciphertext;

[0137] The transceiver unit 602 is used to send an application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code.

[0138] In one embodiment, the processing unit 601 is specifically configured to: serialize the first ciphertext and the second ciphertext to obtain device feature information of the device to be authorized; perform signature processing on the device feature information to obtain signature data; and determine the application authorization code of the device to be authorized for the target application based on the device feature information and the signature data.

[0139] In one embodiment, the processing unit 601 is specifically configured to: when it is detected that the device to be authorized does not have the permission to use the target application, obtain the first ciphertext and the second ciphertext in the application authorization code; use the authorization management private key corresponding to the authorization management public key to decrypt the second ciphertext to obtain the symmetric key; use the decrypted symmetric key to decrypt the first ciphertext to obtain the first identification information; obtain the current second identification information of the target product included in the device to be authorized, and determine the reason why the device to be authorized does not have the permission to use the target application based on the second identification information and the decrypted first identification information.

[0140] In one embodiment, the processing unit 601 is specifically used to: compare the second identification information with the decrypted first identification information; if the comparison result indicates that the first identification information and the second identification information are inconsistent, then determine that the reason why the device to be authorized does not have the right to use the target application is that the target product included in the device to be authorized has changed.

[0141] In one embodiment, the processing unit 601 is specifically configured to: when the comparison result indicates that the first identification information and the second identification information are inconsistent, generate a new application authorization code for the target application for the device to be authorized based on the second identification information;

[0142] The transceiver unit 602 is specifically used to: send the new application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the new application authorization code.

[0143] In one embodiment, the processing unit 601 is specifically used to: encode the first identification information to obtain encoded data of the first identification information; and determine the symmetric key based on the encoded data of the first identification information.

[0144] In feasible embodiments, the data processing apparatus 60 provided in this application may correspond to the unlicensed device described above, and the data processing apparatus 60 may include:

[0145] The transceiver unit 602 is used to obtain the application authorization code for the target application of the device to be authorized sent by the authorization server; the application authorization code is determined by the authorization server based on the first ciphertext and the second ciphertext. The first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using the authorization management public key.

[0146] The processing unit 601 is used to obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using a reference key to obtain the ciphertext to be compared;

[0147] The processing unit 601 is further configured to compare the ciphertext to be compared with the first ciphertext in the application authorization code;

[0148] The processing unit 601 is further configured to determine that the device to be authorized does not have the right to use the target application if the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code.

[0149] In one embodiment, the application authorization code is determined by the authorization server based on device feature information and signature data. The device feature information is obtained by serializing the first ciphertext and the second ciphertext, and the signature data is obtained by signing the device feature information. The processing unit 601 is specifically used to: obtain the device feature information and the signature data from the application authorization code; perform designing processing on the signature data to obtain designed data; if the signature verification is determined to be successful based on the designed data and the device feature information, then execute the step of obtaining the current second identification information of the target product included in the device to be authorized.

[0150] In one embodiment, the processing unit 601 is specifically configured to: if the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then encrypt the reference key using the authorization management public key to obtain the key ciphertext; and perform serialization processing on the ciphertext to be compared and the key ciphertext to obtain new device feature information;

[0151] The transceiver unit 602 is specifically used to: send the new device feature information to the authorization server, so that the authorization server can generate a new application authorization code for the target application of the device to be authorized based on the new device feature information.

[0152] In one embodiment, the processing unit 601 is specifically used to: encode the second identification information to obtain encoded data of the second identification information; and determine the reference key based on the encoded data of the second identification information.

[0153] It is understood that the functions of each functional unit of the data processing device described in the embodiments of this application can be specifically implemented according to the methods in the above method embodiments, and the specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0154] In this embodiment, in response to an application authorization request for a target application sent by a device to be authorized, the authorization server obtains first identification information of the target product included in the device to be authorized, encrypts the first identification information using a symmetric key to obtain first ciphertext, and encrypts the symmetric key using an authorization management public key to obtain second ciphertext. Based on the first and second ciphertexts, the server determines the application authorization code for the target application for the device to be authorized, and sends the application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code. Using this embodiment, a difficult-to-crack application authorization code can be generated, effectively preventing a single application authorization code from being used by multiple devices.

[0155] like Figure 7 As shown, Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The internal structure of the computer device 70 is as follows: Figure 7 As shown, it includes: one or more processors 701, a memory 702, and a communication interface 703. The processors 701, memory 702, and communication interface 703 can be connected via a bus 704 or other means. This embodiment of the application takes the connection via a bus 704 as an example.

[0156] The processor 701 (or CPU, Central Processing Unit) is the computing and control core of the computer device 70. It can parse various instructions within the computer device 70 and process various data. For example, the CPU can parse power-on / off commands sent by the user to the computer device 70 and control the computer device 70 to perform power-on / off operations; it can also transmit various interactive data between internal structures of the computer device 70, and so on. The communication interface 703 may optionally include standard wired interfaces or wireless interfaces (such as Wi-Fi, mobile communication interfaces, etc.), and is controlled by the processor 701 for sending and receiving data. The memory 702 is a storage device in the computer device 70 used to store computer programs and data. It is understood that the memory 702 here can include the computer device 70's built-in memory, or it can include extended memory supported by the computer device 70. The memory 702 provides storage space for the computer device 70's operating system, which may include, but is not limited to, Windows, Linux, Android, iOS, etc., and this application does not limit this.

[0157] In one embodiment, when the computer device is an authorization server, the processor 701 performs the following operations by running a computer program stored in the memory 702:

[0158] In response to an application authorization request for a target application sent by a device to be authorized, first identification information of the target product included in the device to be authorized is obtained;

[0159] The first identification information is encrypted using a symmetric key to obtain the first ciphertext;

[0160] The symmetric key is encrypted using the authorization management public key to obtain the second ciphertext;

[0161] Based on the first ciphertext and the second ciphertext, the application authorization code for the target application of the device to be authorized is determined;

[0162] The application authorization code is sent to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code.

[0163] In one embodiment, the processor 701 is specifically configured to: serialize the first ciphertext and the second ciphertext to obtain device feature information of the device to be authorized; perform signature processing on the device feature information to obtain signature data; and determine the application authorization code of the device to be authorized for the target application based on the device feature information and the signature data.

[0164] In one embodiment, the processor 701 is specifically configured to: when it is detected that the device to be authorized does not have the permission to use the target application, obtain the first ciphertext and the second ciphertext in the application authorization code; use the authorization management private key corresponding to the authorization management public key to decrypt the second ciphertext to obtain the symmetric key; use the decrypted symmetric key to decrypt the first ciphertext to obtain the first identification information; obtain the current second identification information of the target product included in the device to be authorized, and determine the reason why the device to be authorized does not have the permission to use the target application based on the second identification information and the decrypted first identification information.

[0165] In one embodiment, the processor 701 is specifically configured to: compare the second identification information with the decrypted first identification information; if the comparison result indicates that the first identification information and the second identification information are inconsistent, then determine that the reason why the device to be authorized does not have the right to use the target application is that the target product included in the device to be authorized has changed.

[0166] In one embodiment, the processor 701 is specifically configured to: when the comparison result indicates that the first identification information and the second identification information are inconsistent, generate a new application authorization code for the target application for the device to be authorized based on the second identification information; and send the new application authorization code to the device to be authorized so that the device to be authorized can determine whether it has the right to use the target application based on the new application authorization code.

[0167] In one embodiment, the processor 701 is specifically configured to: encode the first identification information to obtain encoded data of the first identification information; and determine the symmetric key based on the encoded data of the first identification information.

[0168] In a feasible embodiment, when the computer device is an unlicensed device, the processor 701 performs the following operations by running the computer program stored in the memory 702:

[0169] Obtain the application authorization code for the target application sent by the authorization server for the device to be authorized; the application authorization code is determined by the authorization server based on a first ciphertext and a second ciphertext, wherein the first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using an authorization management public key;

[0170] Obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using a reference key to obtain the ciphertext to be compared;

[0171] Compare the ciphertext to be compared with the first ciphertext in the application authorization code;

[0172] If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then it is determined that the device to be authorized does not have the right to use the target application.

[0173] In one embodiment, the application authorization code is determined by the authorization server based on device feature information and signature data. The device feature information is obtained by serializing the first ciphertext and the second ciphertext, and the signature data is obtained by signing the device feature information. The processor 701 is specifically configured to: obtain the device feature information and the signature data from the application authorization code; perform designing processing on the signature data to obtain designed data; if the signature verification is determined to be successful based on the designed data and the device feature information, then execute the step of obtaining the current second identification information of the target product included in the device to be authorized.

[0174] In one embodiment, the processor 701 is specifically configured to: if the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, encrypt the reference key using the authorization management public key to obtain key ciphertext; serialize the ciphertext to be compared and the key ciphertext to obtain new device feature information; and send the new device feature information to the authorization server so that the authorization server generates a new application authorization code for the target application for the device to be authorized based on the new device feature information.

[0175] In one embodiment, the processor 701 is specifically configured to: encode the second identification information to obtain encoded data of the second identification information; and determine the reference key based on the encoded data of the second identification information.

[0176] In specific implementations, the processor 701, memory 702, and communication interface 703 described in the embodiments of this application can execute the implementation method described in the data processing method provided in the embodiments of this application, or the implementation method described in the data processing device provided in the embodiments of this application, which will not be repeated here.

[0177] In this embodiment, in response to an application authorization request for a target application sent by a device to be authorized, the authorization server obtains first identification information of the target product included in the device to be authorized, encrypts the first identification information using a symmetric key to obtain first ciphertext, and encrypts the symmetric key using an authorization management public key to obtain second ciphertext. Based on the first and second ciphertexts, the server determines the application authorization code for the target application for the device to be authorized, and sends the application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code. Using this embodiment, a difficult-to-crack application authorization code can be generated, effectively preventing a single application authorization code from being used by multiple devices.

[0178] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer device, causes the computer device to perform the data processing method described in any of the possible implementations above. Specific implementations are described above and will not be repeated here.

[0179] This application also provides a computer program product, which includes a computer program or computer instructions. When executed by a processor, the computer program or computer instructions implement the steps of the data processing method provided in this application. The specific implementation method can be found in the foregoing description and will not be repeated here.

[0180] This application also provides a computer program comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing method provided in this application. Specific implementation details are provided above and will not be repeated here.

[0181] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0182] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0183] The above-disclosed embodiments are only some of the embodiments of this application, and should not be construed as limiting the scope of this application. Therefore, any equivalent changes made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, The method includes: In response to an application authorization request for a target application sent by a device to be authorized, first identification information of the target product included in the device to be authorized is obtained; The first identification information is encrypted using a symmetric key to obtain the first ciphertext; The symmetric key is encrypted using the authorization management public key to obtain the second ciphertext; Based on the first ciphertext and the second ciphertext, the application authorization code for the target application of the device to be authorized is determined; Send the application authorization code to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the application authorization code; When it is detected that the device to be authorized does not have the permission to use the target application, the first ciphertext and the second ciphertext in the application authorization code are obtained; The symmetric key is obtained by decrypting the second ciphertext using the authorization management private key corresponding to the authorization management public key; The first ciphertext is decrypted using the symmetric key obtained from the decryption process to obtain the first identification information; Obtain the current second identification information of the target product included in the device to be authorized, and determine the reason why the device to be authorized does not have the right to use the target application based on the second identification information and the decrypted first identification information.

2. The method according to claim 1, characterized in that, The step of determining the application authorization code for the target application of the device to be authorized based on the first ciphertext and the second ciphertext includes: The first ciphertext and the second ciphertext are serialized to obtain the device feature information of the device to be authorized. The device feature information is signed to obtain signature data; Based on the device feature information and the signature data, the application authorization code for the target application of the device to be authorized is determined.

3. The method according to claim 1, characterized in that, The step of determining the reason why the device to be authorized does not have the right to use the target application based on the second identification information and the decrypted first identification information includes: Compare the second identification information with the decrypted first identification information; If the comparison result indicates that the first identification information and the second identification information are inconsistent, it is determined that the reason why the device to be authorized does not have the right to use the target application is that the target product included in the device to be authorized has changed.

4. The method according to claim 3, characterized in that, The method further includes: When the comparison result indicates that the first identification information and the second identification information are inconsistent, a new application authorization code for the target application is generated for the device to be authorized based on the second identification information. The new application authorization code is sent to the device to be authorized, so that the device to be authorized can determine whether it has the right to use the target application based on the new application authorization code.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: The first identification information is encoded to obtain the encoded data of the first identification information; The symmetric key is determined based on the encoded data of the first identification information.

6. A data processing method, characterized in that, The method includes: Obtain the application authorization code for the target application sent by the authorization server for the device to be authorized; the application authorization code is determined by the authorization server based on a first ciphertext and a second ciphertext, wherein the first ciphertext is obtained by encrypting the first identification information of the target product included in the device to be authorized using a symmetric key, and the second ciphertext is obtained by encrypting the symmetric key using an authorization management public key; Obtain the current second identification information of the target product included in the device to be authorized, and encrypt the second identification information using a reference key to obtain the ciphertext to be compared; Compare the ciphertext to be compared with the first ciphertext in the application authorization code; If the comparison result indicates that the ciphertext to be compared is inconsistent with the first ciphertext in the application authorization code, then it is determined that the device to be authorized does not have the right to use the target application; The reference key is encrypted using the authorization management public key to obtain the key ciphertext; The ciphertext to be compared and the key ciphertext are serialized to obtain new device feature information; The new device feature information is sent to the authorization server so that the authorization server can generate a new application authorization code for the target application for the device to be authorized based on the new device feature information.

7. The method according to claim 6, characterized in that, The application authorization code is determined by the authorization server based on device feature information and signature data. The device feature information is obtained by serializing the first ciphertext and the second ciphertext, and the signature data is obtained by signing the device feature information. The method further includes: Obtain the device feature information and the signature data from the application authorization code; The signature data is designed to obtain designed data; If the signature verification is determined to be successful based on the designing data and the device feature information, then the step of obtaining the current second identification information of the target product included in the device to be authorized is executed.

8. The method according to any one of claims 6-7, characterized in that, The method further includes: The second identification information is encoded to obtain the encoded data of the second identification information; The reference key is determined based on the encoded data of the second identification information.

9. A data processing apparatus, characterized in that, It includes units for implementing the data processing method as described in any one of claims 1-5, or includes units for implementing the data processing method as described in any one of claims 6-8.

10. A computer device, characterized in that, The computer device includes a memory, a communication interface, and a processor, wherein the memory, the communication interface, and the processor are interconnected; the memory stores a computer program, and the processor calls the computer program stored in the memory to implement the data processing method as described in any one of claims 1-5, or to implement the data processing method as described in any one of claims 6-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the data processing method as described in any one of claims 1-5, or implements the data processing method as described in any one of claims 6-8.

12. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, implement the data processing method as described in any one of claims 1-5, or implement the data processing method as described in any one of claims 6-8.

Images