Authorization method, system, electronic device and storage medium

Abstract

The embodiment of the present application discloses an authorization method, system, electronic device and storage medium, which relates to the field of data management technology and can effectively reduce the authorization management cost in various environments. The method includes: obtaining the identification of each authorized client application on two or more client platforms, the identification of each authorized instance, and the identification of the authorized server application on the server platform; the platform environment of the two or more client platforms is at least two of the cloud native environment, the containerized environment and the bare metal environment; the platform environment of the server platform is a bare metal environment; based on the identification of each authorized client application, the identification of each authorized instance, the identification of the authorized server application, and the preset authorization policy, an authorization certificate is generated; the authorization certificate is sent to the server platform so that the server platform generates a token according to the authorization certificate, and the token is sent to the corresponding client platform through each authorized client application; the authorization instance on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes a token, and the authorization instance on each client platform is also used to interact with the specified application on the corresponding client platform. The present invention is suitable for identity authentication and permission management in cloud native, containerized, and bare metal installation scenarios.

Description

Technical Field

[0001] The present application relates to the field of data management technology, and in particular to an authorization method, system, electronic device and storage medium. Background Art

[0002] With the rapid development of information technology, cloud computing, containerization technology and bare metal installation have become an important part of the daily work of enterprises and individual users. These technologies have significantly improved flexibility, scalability and resource utilization, but at the same time have brought complex challenges to authorization and management.

[0003] In the traditional installation mode, a separate authorization scheme is usually required for each environment, such as cloud native, containerized, bare metal, etc., which leads to fragmentation and inconsistency in authorization management. For example, for cloud native environments, it may be necessary to use the identity authentication and access control functions of cloud service providers, containerized environments may need to adopt the permission management mechanism provided by the container management platform, and bare metal installation methods need to consider the access control and security audit of physical servers, which makes authorization management more complex and costly, affecting management efficiency and security. Summary of the invention

[0004] In order to solve the problem of high authorization management costs in various existing environments, the present application provides an authorization method, system, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides an authorization method, comprising: obtaining identifiers of each authorized client application on two or more client platforms, identifiers of each authorized instance, and identifiers of an authorized server application on a server platform; the platform environments of the two or more client platforms are at least two of a cloud native environment, a containerized environment, and a bare metal environment; the platform environment of the server platform is a bare metal environment; generating an authorization certificate based on the identifiers of each authorized client application, the identifiers of each authorized instance, the identifier of the authorized server application, and a preset authorization policy; issuing the authorization certificate to the server platform so that the server platform generates a token according to the authorization certificate, and sends the token to the corresponding client platform through the authorized client applications; the authorization instances on each client platform send an authorization request to the server platform to apply for authorization; wherein the authorization request includes the token, and the authorization instances on each client platform are also used to interact with a specified application on the corresponding client platform.

[0006] In a specific implementation scheme, before obtaining the identifiers of each authorized client application on more than two client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform, the method includes: installing the authorized client application of each client platform and the authorized instance of each client platform on the more than two client platforms; and installing the authorized server application on the server platform.

[0007] In a specific implementation scheme, the obtaining of the identifiers of each authorized client application on more than two client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform includes: obtaining, through a certificate tool, the identifiers of each authorized client application on more than two client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform, wherein the identifier of each authorized client application is determined based on the identifier of the host machine where the platform environment of each client platform is located, and the identifier of the authorized server application is determined based on the identifier of the host machine where the platform environment of the server platform is located.

[0008] In a specific implementation scheme, the generating of the authorization certificate based on the identifiers of the respective authorized client applications, the identifiers of the respective authorized instances, the identifiers of the authorized server applications, and the preset authorization policy comprises: sending the identifiers of the respective authorized client applications, the identifiers of the respective authorized instances, the identifiers of the authorized server applications, and the preset authorization policy to an authorization agency, so that the authorization agency generates the authorization certificate based on the identifiers of the respective authorized client applications, the identifiers of the respective authorized instances, the identifiers of the authorized server applications, and the preset authorization policy.

[0009] In a specific implementation scheme, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0010] In a second aspect, an embodiment of the present invention further provides an authorization system, comprising: a client platform, the number of the client platforms is more than two, each client platform includes an authorization client application module and an authorization instance module; the platform environment of the more than two client platforms is at least two of a cloud native environment, a containerized environment, and a bare metal environment; a server platform, the server platform includes an authorization server application module; the platform environment of the server platform is a bare metal environment; an authorization agency, for generating an authorization certificate based on the identifiers of each authorization client application module, the identifiers of each authorization instance module, the identifier of the authorization server application module, and a preset authorization policy, and issuing the authorization certificate to the server platform, so that the server platform generates a token according to the authorization certificate, and sends the token to each authorization client application module, so that the authorization instance module on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes the token, and the authorization instance module on each client platform is also used to interact with a specified application on the corresponding client platform.

[0011] In a specific implementation scheme, the identifier of each authorized client application module is determined according to the host machine identifier of the platform environment of each client platform, and the identifier of the authorized server application module is determined according to the host machine identifier of the platform environment of the server platform.

[0012] In a specific implementation scheme, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservice modules, and each microservice module corresponds to an authorization instance module; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance module; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualized environment modules, and each virtualized environment module corresponds to an authorization instance module.

[0013] In a specific implementation scheme, the server platform includes: a certificate library for storing the authorization certificate; a state machine for updating the status of the certificate, wherein the status of the certificate includes at least one of the following: addition, deletion, modification and time information of the certificate; a heartbeat server module for periodically communicating with each authorized client application module, sending a token to each authorized client application module, reading the authorization certificate from the certificate library, and verifying the token sent by each authorized client application module; an authorization server module for reading the authorization certificate from the certificate library, and based on the authorization certificate and the authorization request sent by the authorization instance module on each client platform, determining whether to authorize the authorization instance module on each client platform, so that the authorization instance module on each client platform interacts with the designated application on the corresponding client platform according to the authorization.

[0014] In the third aspect, an embodiment of the present invention also provides an authorization method, which is applied to a server platform, wherein the server platform includes an authorized server application; the platform environment of the server platform is a bare metal environment, and the authorization method includes: obtaining an authorization certificate issued by an authorization agency; generating a token based on the authorization certificate, and sending the token to authorized client applications of two or more client platforms; the platform environment of the two or more client platforms is at least two of a cloud native environment, a containerized environment, and a bare metal environment; receiving an authorization request sent by an authorization instance on the two or more client platforms, wherein the authorization request includes the token; verifying the token to determine whether to authorize the authorization instance, so that the authorization instance interacts with a specified application on the corresponding client platform according to the authorization.

[0015] In a specific implementation scheme, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0016] In a fourth aspect, an embodiment of the present invention also provides an authorization method, which is applied to a client platform, and the platform environment of the client platform is a cloud-native environment, a containerized environment, or a bare metal environment; the authorization method includes: authorizing a client application to obtain a token from a server platform; an authorization instance sends an authorization request to the server platform, and the authorization request includes the token; receiving an authorization result returned by the server platform; if the authorization result is authorization, the authorization instance interacts with a specified application.

[0017] In a specific implementation scheme, the authorization instance sends an authorization request to the server platform, including: the first authorization instance of the client platform sends a first authorization request to the server platform, wherein the first authorization request includes the token; the platform environment of the client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; or the second authorization instance of the client platform sends a second authorization request to the server platform, wherein the second authorization request includes the token; the platform environment of the client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; or the third authorization instance of the client platform sends a third authorization request to the server platform, wherein the third authorization request includes the token; the platform environment of the client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0018] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; a power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute any one of the authorization methods provided by the embodiments of the present invention.

[0019] In a sixth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any authorization method provided by an embodiment of the present invention.

[0020] The authorization method, system, electronic device and storage medium provided by the embodiments of the present invention first obtain the identification of each authorized client application on two or more client platforms, the identification of each authorized instance, and the identification of the authorized server application on the server platform; wherein the platform environment of the two or more client platforms is at least two of the cloud native environment, the containerized environment and the bare metal environment; the platform environment of the server platform is a bare metal environment; then based on the identification of each authorized client application, the identification of each authorized instance, the identification of the authorized server application, and the preset authorization policy, an authorization certificate is generated; then the authorization certificate is sent to the server platform so that the server platform generates a token according to the authorization certificate, and the token is sent to the corresponding client platform through each authorized client application; in this way, the authorization instance on each client platform can send an authorization request to the server platform to apply for authorization; wherein the authorization request includes a token, and the authorization instance on each client platform is also used to interact with the specified application on the corresponding client platform. This method can be used for identity authentication and permission management in cloud native, containerized, and bare metal environments, effectively reducing the authorization management cost in various environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A flowchart of an authorization method provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of an authorization system provided in an embodiment of the present application;

[0024] Figure 3 A specific schematic diagram of an authorization system provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of another authorization method provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of another authorization method provided in an embodiment of the present application;

[0027] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0029] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] In the traditional installation model, a separate authorization solution is usually required for each environment, such as cloud native, containerized, bare metal, etc. This leads to fragmentation and inconsistency in authorization management, making authorization management more complex and costly, and affecting management efficiency and security. Figure 1 As shown, an embodiment of the present invention provides an authorization method, which may include:

[0031] S11. Obtain the identifier of each authorized client application on two or more client platforms, the identifier of each authorized instance, and the identifier of the authorized server application on the server platform; the platform environment of the two or more client platforms is at least two of a cloud native environment, a containerized environment, and a bare metal environment; the platform environment of the server platform is a bare metal environment.

[0032] In this embodiment, the platform environment of the client platform can be any one of a cloud native environment, a containerized environment, and a bare metal environment, that is, the platform environment of the client platform can be specifically a microservice application running in a cloud native environment, or a container cluster installed in a containerized environment, or a virtualized environment running on a bare metal server. First, obtain the identifier of the authorized client application of the client platform, the identifier of each authorized instance, and the identifier of the authorized server application of the server platform, wherein the identifier of each authorized client application, the identifier of each authorized instance, and the identifier of the authorized server application can be determined based on security rules, for example, the identifier of the authorized client application can be a unique identification code representing the client platform, and the corresponding client platform can be determined according to the identifier of the authorized client application; the identifier of the authorized instance can be a unique identification code representing the authorized instance, and the corresponding authorized instance can be determined according to the identifier of the authorized instance; similarly, the identifier of the authorized server application can be a unique identification code representing the server platform, and the corresponding server platform can be determined according to the identifier of the authorized server application.

[0033] S12: Generate an authorization certificate based on the identifiers of each authorized client application, the identifiers of each authorized instance, the identifier of the authorized server application, and a preset authorization policy.

[0034] After obtaining the identifiers of each authorized client application, each authorized instance, and the identifier of the authorized server application that represents the server platform identity information, an authorization certificate can be generated according to the preset authorization policy. The preset authorization policy can be specifically determined based on the actual needs of the user and the resource configuration of the platform environment. For example, a user may need to run an authorized instance within a certain time in a certain platform environment, and for this authorized instance, different security policies and function usage permissions may be further configured for different users. Therefore, generating an authorization certificate through the preset authorization policy can meet the user's diversified needs for authorization management and different levels of security requirements.

[0035] S13. Send the authorization certificate to the server platform, so that the server platform generates a token according to the authorization certificate, and sends the token to the corresponding client platform through each authorized client application.

[0036] In this embodiment, after the server platform installs the authorization certificate, in response to the login request sent by each client platform, the server platform can verify the login request based on the query of the authorization certificate. If the verification is successful, the token generated based on the authorization certificate can be sent to the corresponding client platform through each authorized client application.

[0037] S14. The authorization instance on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes a token, and the authorization instance on each client platform is also used to interact with a designated application on the corresponding client platform.

[0038] After the authorization client application obtains the token from the server platform, it can send the token to the authorization instance installed on the corresponding client platform, so that the authorization instance can send an authorization request containing the token to the server platform. If the server platform's authentication result of the authorization request is correct, the authorization instance can interact with the specified application on the corresponding client platform. The interaction between the authorization instance and the specified application can be specifically starting or stopping the specified application, or accessing the corresponding resources on the server platform to serve the specified application.

[0039] The authorization method provided by the embodiment of the present invention first obtains the identifiers of each authorized client application on two or more client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform; wherein the platform environment of the two or more client platforms is at least two of the cloud native environment, the containerized environment, and the bare metal environment; the platform environment of the server platform is a bare metal environment; then based on the identifiers of each authorized client application, the identifiers of each authorized instance, the identifier of the authorized server application, and the preset authorization policy, an authorization certificate is generated; then the authorization certificate is sent to the server platform so that the server platform generates a token according to the authorization certificate, and the token is sent to the corresponding client platform through each authorized client application; in this way, the authorization instance on each client platform can send an authorization request to the server platform to apply for authorization; wherein the authorization request includes a token, and the authorization instance on each client platform is also used to interact with the specified application on the corresponding client platform. This method can be used for identity authentication and permission management in cloud native, containerized, and bare metal environments, effectively reducing the authorization management cost in various environments.

[0040] Optionally, in one embodiment of the present invention, before obtaining the identifiers of each authorized client application on two or more client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform in step S11, the authorization method further includes: installing the authorized client application of each client platform and the authorized instance of each client platform on the two or more client platforms; installing the authorized server application on the server platform. For each client platform, a corresponding authorized client application and authorized instance can be installed, and for the server platform, an authorized server application can be installed. Based on the authorized server application and the authorized client application, corresponding management policies and information interaction can be implemented between the server platform and each client platform.

[0041] Optionally, in one embodiment of the present invention, step S11 obtains the identifier of each authorized client application on more than two client platforms, the identifier of each authorized instance, and the identifier of the authorized server application on the server platform, including: obtaining, through a certificate tool, the identifier of each authorized client application on more than two client platforms, the identifier of each authorized instance, and the identifier of the authorized server application on the server platform, wherein the identifier of each authorized client application is determined based on the identifier of the host machine where the platform environment of each client platform is located, and the identifier of the authorized server application is determined based on the identifier of the host machine where the platform environment of the server platform is located.

[0042] In this implementation, before generating an authorization certificate, the identifier of the authorized client application on each client platform and the identifier of the authorized server application on the server platform can be obtained through a certificate tool. Specifically, the identifier of the authorized client application is determined according to the host identifier of the platform environment of the corresponding client platform, and the identifier of the authorized server application is determined according to the host identifier of the platform environment of the server platform. For example, the host identifier can be a UUID (Universally Unique Identifier). UUID refers to a number generated on a machine, which defines system information that is completely unique in time and space to ensure that it is unique to all machines in the same time and space. It can be understood that when the client platform provides a specified application service, since the host identifier UUID of the platform environment of the client platform has been determined, the specified application on the client platform can also be determined to be installed on the host, and is limited to running on the host corresponding to the UUID of the client platform, thereby ensuring the security of identity authentication and access control of the client platform and the server platform.

[0043] Optionally, in one embodiment of the present invention, step S12 generates an authorization certificate based on the identifier of each authorized client application, the identifier of each authorized instance, the identifier of the authorized server application, and the preset authorization policy, including: sending the identifier of each authorized client application, the identifier of each authorized instance, the identifier of the authorized server application, and the preset authorization policy to the authorization agency, so that the authorization agency generates an authorization certificate based on the identifier of each authorized client application, the identifier of each authorized instance, the identifier of the authorized server application, and the preset authorization policy. In this embodiment, the authorization agency can generate an authorization certificate based on the relevant information of the client platform and the server platform, such as the host identifier UUID, the identifier of each authorized instance, etc., based on the preset authorization policy such as the user's specific authorization management requirements for local resources, etc., wherein the identifier of the authorization instance can be configured and determined according to different resource environments. For example, the identifier of the authorization instance in a cloud native environment or a containerized environment can be virtual, and the identifier of the authorization instance in a bare metal environment can be the host identifier UUID where the bare metal environment is located, so as to characterize the identity identification information of the authorization instance according to different resource environments.

[0044] Optionally, in one embodiment of the present invention, the server platform updates the status of the certificate, and the status of the certificate includes at least one of the following: addition, deletion, modification, and time information of the certificate. In this embodiment, after the authorization certificate is sent to the server platform, the server platform can configure a certificate library to store the authorization certificate. In addition, considering that the authority status of the authorization certificate may change at any time, a state machine can be further configured on the server platform to update the status of the authorization certificate. In this way, when the status of addition, deletion, modification, or time information of the authorization certificate changes, the authorization certificate in the certificate library can be synchronously updated through the state machine to achieve unified management and access control of services and resources.

[0045] Optionally, in one embodiment of the present invention, the token includes at least one of the following: an identifier of a host machine where the platform environment of the client platform is located, an identifier of an authorization instance, and a timestamp.

[0046] In this embodiment, when the client platform needs to provide services, the client platform may send a login request to the server platform. For example, the login request may include the host machine identifier of the platform environment of the client platform and the identifier of the authorization certificate, wherein the identifier of the authorization certificate is used to represent the identity identification information of the authorization certificate. The server platform may verify whether the host machine identifier of the platform environment of the client platform and the identifier of the authorization certificate contained in the login request are correct based on the read query of the authorization certificate. If the verification is correct, the server platform may send a token to the client platform. After the authorization instance on the client platform obtains the token, it may send an authorization request to the server platform to apply for authorization, wherein the authorization request includes the token, and the token may include the host machine identifier of the platform environment of the client platform, the identifier of the authorization instance, and the timestamp. In this way, the server platform may verify the authorization request of the authorization instance based on the read query of the authorization certificate, and send the authorization result to the authorization instance. The authorization instance determines whether to interact with the specified application on the client platform based on the authorization result. For example, the server platform may identify whether the authorization time limit of the authorization instance has expired based on the timestamp in the token.

[0047] Optionally, in one embodiment of the present invention, the server platform periodically communicates with each authorized client application, sends a token to each authorized client application, reads the authorization certificate from the certificate library, and verifies the token sent by each authorized client application. Specifically, the client platform can maintain periodic communication with the server platform based on the heartbeat message mechanism. After the server platform sends the token to the authorized client application, the client platform sends the token to the server platform at a preset time. The server platform parses the token based on the query of the authorization certificate, determines the authority of the client platform, or sends a new token to the client platform, so that the authorization instance of the client platform can update the token in time, thereby improving the management efficiency and security level of the authorization service.

[0048] Optionally, in one embodiment of the present invention, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0049] Since the present embodiment provides a unified identity authentication, authority management and access control mechanism in different installation environments, the user does not need to configure and manage authorization policies for each environment separately, thereby achieving the uniformity and scalability of authorization management. In this way, whether it is a microservice running in the cloud native environment of the first client platform, or a container cluster installed in the containerized environment of the second client platform, or a virtualized environment running on a server in the bare metal environment of the third client platform, the user can ensure the security and compliance of his access rights through a unified authorization mechanism. In addition, each microservice corresponds to an authorization instance, each container corresponds to an authorization instance, and each virtualized environment corresponds to an authorization instance. In this way, regardless of whether the platform environment of the client platform where the authorization instance is specifically installed is a cloud native, container, or bare metal environment, the corresponding running device and authority of the authorization instance can be limited according to the host machine where the cloud native environment is located, or the host machine where the container environment is located, or the host machine where the bare metal environment is located. For example, after determining the host machine identifier of the platform environment of the client platform, the authorization instance installed by the client platform is also limited to run on the corresponding host machine, so the authorization quantity, authorization copies and other permissions of the authorization instance can also be limited. The authorization instance can obtain a token from the authorized client application of the client platform, and based on the verification of the authorization request containing the token by the authorized server application of the server platform, interact with the specified application on the client platform to start or stop the specified application on the client platform. The specified application can be specifically installed in the above-mentioned microservice, container or virtualization environment.

[0050] In a second aspect, an embodiment of the present invention further provides an authorization system that can effectively reduce authorization management costs in a variety of environments.

[0051] like Figure 2 As shown, the authorization system provided in the embodiment of the present application may include:

[0052] Client platforms, the number of client platforms is more than two, each client platform includes an authorized client application module and an authorized instance module; the platform environment of the more than two client platforms is at least two of the cloud native environment, containerized environment and bare metal environment.

[0053] The server platform includes an authorization server application module; the platform environment of the server platform is a bare metal environment.

[0054] The authorization agency is used to generate an authorization certificate based on the identifiers of each authorized client application module, the identifiers of each authorized instance module, the identifiers of the authorized server application module, and the preset authorization policy, and send the authorization certificate to the server platform so that the server platform can generate a token according to the authorization certificate, and send the token to each authorized client application module, so that the authorization instance module on each client platform can send an authorization request to the server platform to apply for authorization; wherein the authorization request includes the token, and the authorization instance module on each client platform is also used to interact with the specified application on the corresponding client platform.

[0055] The authorization system provided by the embodiment of the present invention includes a client platform, a server platform, and an authorization agency, wherein the number of client platforms is more than two, and each client platform includes an authorization client application module and an authorization instance module; the platform environment of the more than two client platforms is at least two of a cloud native environment, a containerized environment, and a bare metal environment; the server platform includes an authorization server application module; the platform environment of the server platform is a bare metal environment; the authorization agency is used to generate an authorization certificate based on the identifiers of each authorization client application module, the identifiers of each authorization instance module, the identifiers of the authorization server application module, and the preset authorization policy, and issue the authorization certificate to the server platform, so that the server platform generates a token according to the authorization certificate, and sends a token to each authorization client application module, so that the authorization instance module on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes a token, and the authorization instance module on each client platform is also used to interact with a specified application on the corresponding client platform. The authorization system can be used for identity authentication and permission management in cloud native, containerized, and bare metal environments, effectively reducing the authorization management cost in various environments.

[0056] Optionally, in one embodiment of the present invention, the identifier of each authorized client application module is determined according to the host identifier of the platform environment of each client platform, and the identifier of the authorized server application module is determined according to the host identifier of the platform environment of the server platform.

[0057] Optionally, in one embodiment of the present invention, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservice modules, and each microservice module corresponds to an authorization instance module; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance module; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualization environment modules, and each virtualization environment module corresponds to an authorization instance module.

[0058] Optionally, in one embodiment of the present invention, the server platform includes: a certificate library for storing authorization certificates; a state machine for updating the status of the certificate, the status of the certificate including at least one of the following: addition, deletion, modification and time information of the certificate; a heartbeat server module for periodically communicating with each authorized client application module, sending a token to each authorized client application module, and reading the authorization certificate from the certificate library, and verifying the token sent by each authorized client application module; an authorization server module for reading the authorization certificate from the certificate library, and based on the authorization certificate and the authorization request sent by the authorization instance module on each client platform, determining whether to authorize the authorization instance module on each client platform, so that the authorization instance module on each client platform interacts with the designated application on the corresponding client platform according to the authorization.

[0059] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides a schematic diagram of an authorization system:

[0060] The authorization agency 101 generates an authorization certificate based on the identifier of the authorized client application module (for example, the host identifier UUID where the platform environment of the client platform is located), the identifier of the authorized instance module 1032, the identifier of the authorized server application module (for example, the host identifier UUID where the platform environment of the server platform is located), and the preset authorization policy. The authorization agency 101 then issues the authorization certificate to the server platform 102. The server platform 102 can import the authorization certificate into the certificate library 1022, and the state machine 1023 can synchronously update the status of the authorization certificate such as addition, deletion, modification or time information.

[0061] In response to the login request of the client platform 103 (the login request may include the host machine identifier of the platform environment of the client platform and the identifier of the authorization certificate), the server platform 102 verifies the login request based on the read query of the authorization certificate in the certificate library 1022. If the verification is correct, the server platform 102 may send a token to the client platform 103 through the heartbeat server module 1024, such as a gRPC (remote procedure call) server. The token may be generated according to the authorization certificate, and the token may specifically include the host machine identifier of the platform environment of the client platform. The client platform 103 can also maintain periodic communication with the server platform 102 based on the heartbeat message mechanism of the heartbeat server module 1024, and the client platform 103 sends the token to the server platform 102 at a preset time. The server platform 102 parses the token based on the query of the authorization certificate, determines the authority of the client platform 103, or sends a new token to the client platform 103, so that the authorization instance module 1032 of the client platform 103 can update the token in time.

[0062] The gRPC client 1033 of the client platform 103 can send the received token to the authorization instance module 1032. After the authorization instance module 1032 obtains the token, it can use the token to send an authorization request to the authorization server module 1025 of the server platform 102, such as an HTTP (Hypertext Transfer Protocol) server, to apply for authorization. The authorization instance module 1032 can be a microservice module in a cloud native environment, a container in a containerized environment, or a virtualization environment module in a bare metal environment. The authorization server module 1025 determines whether to authorize the authorization request of the authorization instance module 1032 based on a read query of the certificate library 1022; after the authorization instance module 1032 obtains authorization, the authorization instance module 1032 starts or stops the specified application on the client platform 103 based on the interaction with the specified application on the client platform 103.

[0063] In a third aspect, an embodiment of the present invention further provides an authorization method, such as Figure 4As shown, it is applied to the server platform, and the server platform includes an authorized server application; the platform environment of the server platform is a bare metal environment, and the authorization method includes: S31, obtaining an authorization certificate issued by an authorization agency; S32, generating a token based on the authorization certificate, and sending the token to the authorized client application of more than two client platforms; the platform environment of more than two client platforms is at least two of the cloud native environment, containerized environment and bare metal environment; S33, receiving an authorization request sent by an authorized instance on more than two client platforms, and the authorization request includes a token; S34, verifying the token to determine whether to authorize the authorized instance, so that the authorized instance interacts with the designated application on the corresponding client platform according to the authorization. Among them, the authorization certificate can be generated based on the identification of the authorized client application of each client platform, the identification of the authorized instance of each client platform, the identification of the authorized server application, and the preset authorization policy.

[0064] Optionally, in one embodiment of the present invention, the more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein the platform environment of the first client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; the platform environment of the second client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; the platform environment of the third client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0065] In a fourth aspect, an embodiment of the present invention further provides an authorization method, such as Figure 5 As shown, it is applied to the client platform, and the platform environment of the client platform is a cloud native environment, a containerized environment or a bare metal environment; the authorization method includes: S41, authorizing the client application to obtain a token from the server platform; S42, the authorization instance sends an authorization request to the server platform, and the authorization request includes a token; S43, receiving the authorization result returned by the server platform; S44, if the authorization result is authorization, the authorization instance interacts with the specified application. Among them, the authorization certificate can be generated based on the authorization certificate, and the authorization certificate can be generated according to the identifier of the authorized client application of each client platform, the identifier of the authorization instance of each client platform, the identifier of the authorized server application, and the preset authorization policy.

[0066] Optionally, in one embodiment of the present invention, the authorization instance sends an authorization request to the server platform, including: the first authorization instance of the client platform sends a first authorization request to the server platform, wherein the first authorization request includes a token; the platform environment of the client platform is a cloud native environment, the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; or the second authorization instance of the client platform sends a second authorization request to the server platform, wherein the second authorization request includes a token; the platform environment of the client platform is a containerized environment, the containerized environment includes more than two containers, and each container corresponds to an authorization instance; or the third authorization instance of the client platform sends a third authorization request to the server platform, wherein the third authorization request includes a token; the platform environment of the client platform is a bare metal environment, the bare metal environment includes more than two virtualized environments, and each virtualized environment corresponds to an authorization instance.

[0067] In a fifth aspect, an embodiment of the present invention further provides an electronic device.

[0068] like Figure 6 As shown, the electronic device provided in the embodiment of the present application includes: a shell 51, a processor 52, a memory 53, a circuit board 54 and a power supply circuit 55, wherein the circuit board 54 is arranged inside the space enclosed by the shell 51, and the processor 52 and the memory 53 are arranged on the circuit board 54; the power supply circuit 55 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 53 is used to store executable program codes; the processor 52 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 53, so as to execute any one of the authorization methods provided in the embodiments of the present invention.

[0069] The specific execution process of the above steps by the processor 52 and the steps further executed by the processor 52 by running the executable program code can be found in the description of the previous embodiment, which will not be repeated here.

[0070] The above electronic devices exist in many forms, including but not limited to:

[0071] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, feature phones, and low-end phones.

[0072] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0073] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0074] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general-purpose computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0075] (5) Other electronic devices with data interaction functions.

[0076] In the sixth aspect, the embodiments of the present application also provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any authorization method provided by the embodiments of the present invention, thereby also being able to achieve the corresponding technical effects, which have been described in detail above and will not be repeated here.

[0077] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0078] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0079] In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0080] For the convenience of description, the above system is described by dividing the functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0081] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0082] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An authorization method, characterized in that: include: Obtaining the identifiers of each authorized client application and each authorized instance on two or more client platforms, and the identifier of the authorized server application on the server platform; the platform environments of the two or more client platforms are at least two of a cloud native environment, a containerized environment, and a bare metal environment; the platform environment of the server platform is a bare metal environment; Generate an authorization certificate based on the identifiers of the authorized client applications, the identifiers of the authorized instances, the identifier of the authorized server application, and a preset authorization policy; The authorization certificate is issued to the server platform, so that the server platform generates a token according to the authorization certificate, and sends the token to the corresponding client platform through each authorized client application; The authorization instance on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes the token, and the authorization instance on each client platform is also used to interact with a specified application on the corresponding client platform; The identifier of the authorization instance is configured and determined according to different resource environments. The identifier of the authorization instance in the cloud native environment or the containerized environment is virtual, and the identifier of the authorization instance in the bare metal environment is the host identifier UUID where the bare metal environment is located.

2. The authorization method according to claim 1, characterized in that: Before obtaining the identifiers of each authorized client application on two or more client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform, the method further includes: On the two or more client platforms, an authorized client application of each client platform and an authorized instance of each client platform are installed; and the authorized server application is installed on the server platform.

3. The authorization method according to claim 1, characterized in that: The obtaining of the identifiers of each authorized client application on two or more client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform includes: Through the certificate tool, the identifiers of each authorized client application on more than two client platforms, the identifiers of each authorized instance, and the identifier of the authorized server application on the server platform are obtained respectively, wherein the identifier of each authorized client application is determined according to the identifier of the host machine where the platform environment of each client platform is located, and the identifier of the authorized server application is determined according to the identifier of the host machine where the platform environment of the server platform is located.

4. The authorization method according to claim 1, characterized in that: The generating of the authorization certificate based on the identifiers of the authorized client applications, the identifiers of the authorized instances, the identifier of the authorized server application, and the preset authorization policy includes: The identifiers of the authorized client applications, the identifiers of the authorized instances, the identifiers of the authorized server applications, and the preset authorization policies are sent to the authorization agency, so that the authorization agency generates an authorization certificate based on the identifiers of the authorized client applications, the identifiers of the authorized instances, the identifiers of the authorized server applications, and the preset authorization policies.

5. The authorization method according to claim 1, characterized in that: The more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein, The platform environment of the first client platform is a cloud native environment, and the cloud native environment includes more than two microservices, each microservice corresponds to an authorization instance; The platform environment of the second client platform is a containerized environment, and the containerized environment includes more than two containers, and each container corresponds to an authorization instance; The platform environment of the third client platform is a bare metal environment, which includes more than two virtualized environments, and each virtualized environment corresponds to an authorized instance.

6. An authorization system, characterized in that: include: Client platforms, the number of the client platforms is more than two, each client platform includes an authorized client application module and an authorized instance module; the platform environment of the more than two client platforms is at least two of a cloud native environment, a containerized environment, and a bare metal environment; A server platform, the server platform comprising an authorization server application module; the platform environment of the server platform is a bare metal environment; The authorization agency is used to generate an authorization certificate based on the identifiers of each authorized client application module, the identifiers of each authorized instance module, the identifier of the authorized server application module, and a preset authorization policy, and issue the authorization certificate to the server platform, so that the server platform generates a token according to the authorization certificate, and sends the token to each authorized client application module, so that the authorization instance module on each client platform sends an authorization request to the server platform to apply for authorization; wherein the authorization request includes the token, and the authorization instance module on each client platform is also used to interact with a specified application on the corresponding client platform; The identifier of the authorization instance module is configured and determined according to different resource environments. The identifier of the authorization instance module in the cloud native environment or the containerized environment is virtual, and the identifier of the authorization instance module in the bare metal environment is the host machine identifier UUID where the bare metal environment is located.

7. The authorization system according to claim 6, characterized in that: The identifier of each authorized client application module is determined according to the host machine identifier of the platform environment of each client platform, and the identifier of the authorized server application module is determined according to the host machine identifier of the platform environment of the server platform.

8. The authorization system according to claim 6, characterized in that: The more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein, The platform environment of the first client platform is a cloud native environment, and the cloud native environment includes more than two microservice modules, and each microservice module corresponds to an authorization instance module; The platform environment of the second client platform is a containerized environment, and the containerized environment includes more than two containers, and each container corresponds to an authorization instance module; The platform environment of the third client platform is a bare metal environment, which includes more than two virtualization environment modules, and each virtualization environment module corresponds to an authorization instance module.

9. The authorization system according to claim 6, characterized in that: The server platform includes: A certificate library, used to store the authorization certificate; A state machine, used to update the status of the certificate, wherein the status of the certificate includes at least one of the following: addition, deletion, modification and time information of the certificate; A heartbeat server module, used for periodically communicating with each authorized client application module, sending a token to each authorized client application module, reading an authorization certificate from the certificate library, and verifying the token sent by each authorized client application module; The authorization server module is used to read the authorization certificate from the certificate library, and determine whether to authorize the authorization instance module on each client platform based on the authorization certificate and the authorization request sent by the authorization instance module on each client platform, so that the authorization instance module on each client platform interacts with the specified application on the corresponding client platform according to the authorization.

10. An authorization method, characterized in that: Applied to a server platform, the server platform including an authorized server application; The platform environment of the server platform is a bare metal environment, and the authorization method includes: Obtain the authorization certificate issued by the authorized agency; Generate a token based on the authorization certificate, and send the token to authorized client applications of two or more client platforms; the platform environments of the two or more client platforms are at least two of a cloud native environment, a containerized environment, and a bare metal environment; Receiving authorization requests sent by the authorization instances on the two or more client platforms, wherein the authorization requests include the token; Verifying the token to determine whether to authorize the authorization instance, so that the authorization instance interacts with a designated application on a corresponding client platform according to the authorization; The authorization certificate is generated based on the identifier of the authorization client application, the identifier of the authorization instance, the identifier of the authorization server application and a preset authorization policy; the identifier of the authorization instance is configured and determined according to different resource environments, the identifier of the authorization instance in the cloud native environment or the containerized environment is virtual, and the identifier of the authorization instance in the bare metal environment is the host identifier UUID where the bare metal environment is located.

11. The authorization method according to claim 10, characterized in that: The more than two client platforms include at least two of a first client platform, a second client platform and a third client platform; wherein, The platform environment of the first client platform is a cloud native environment, and the cloud native environment includes more than two microservices, each microservice corresponds to an authorization instance; The platform environment of the second client platform is a containerized environment, and the containerized environment includes more than two containers, and each container corresponds to an authorization instance; The platform environment of the third client platform is a bare metal environment, which includes more than two virtualized environments, and each virtualized environment corresponds to an authorized instance.

12. An authorization method, characterized in that: Applied to a client platform, the platform environment of the client platform is a cloud native environment, a containerized environment, or a bare metal environment; the authorization method includes: Authorize the client application to obtain a token from the server platform; The authorization instance sends an authorization request to the server platform, wherein the authorization request includes the token; Receiving the authorization result returned by the server platform; If the authorization result is authorization, the authorization instance interacts with the specified application; The token is generated based on an authorization certificate; the authorization certificate is generated based on an identifier of the authorization client application, an identifier of the authorization instance, an identifier of the authorization server application on the server platform, and a preset authorization policy; The platform environment of the server platform is a bare metal environment; the number of the client platforms is more than two, and the platform environments of the more than two client platforms are at least two of a cloud native environment, a containerized environment, and a bare metal environment; The identifier of the authorization instance is configured and determined according to different resource environments. The identifier of the authorization instance in the cloud native environment or the containerized environment is virtual, and the identifier of the authorization instance in the bare metal environment is the host identifier UUID where the bare metal environment is located.

13. The authorization method according to claim 12, characterized in that: The authorization instance sends an authorization request to the server platform, including: The first authorization instance of the client platform sends a first authorization request to the server platform, wherein the first authorization request includes the token; the platform environment of the client platform is a cloud native environment, and the cloud native environment includes more than two microservices, and each microservice corresponds to an authorization instance; or The second authorization instance of the client platform sends a second authorization request to the server platform, wherein the second authorization request includes the token; the platform environment of the client platform is a containerized environment, and the containerized environment includes more than two containers, each container corresponding to an authorization instance; or The third authorization instance of the client platform sends a third authorization request to the server platform, wherein the third authorization request includes the token; the platform environment of the client platform is a bare metal environment, and the bare metal environment includes more than two virtualization environments, and each virtualization environment corresponds to an authorization instance.

14. An electronic device, characterized in that: The electronic device comprises: a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the shell, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits and devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the authorization method described in any one of claims 1 to 5, or to execute the authorization method described in any one of claims 10 to 13.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the authorization method described in any one of claims 1-5, or to implement the authorization method described in any one of claims 10-13.

Images