Authorized client application update method, device, computer equipment and storage medium

Abstract

An embodiment of the present application provides an authorized client application update method, device, computer equipment and storage medium, the method comprising: after the application system is successfully authorized, the application system verifies whether the current time is within the valid period of the application system; if the current time is within the valid period of the application system, the use permission of the application system is enabled; if the current time is not within the valid period of the application system in the decrypted authorization code, a prompt message for the application system to update the valid period is generated and sent to the authorization service platform. When the application system needs to update the valid period, it can be achieved by changing the timestamp on the licensing center side. The licensing center side supports changing the configuration information according to business needs, which is flexible, easy to use, safe and controllable.

Description

[0001] This application is a divisional application of the patent application with application number 202410666327.6 and invention name “Authorized client application update method, device, computer equipment and storage medium”. Technical Field

[0002] The present application relates to the technical field of authorization and authentication, and in particular, to a method, apparatus, computer device and storage medium for updating an authorized client application. Background Art

[0003] The rapid development of informatization has prompted enterprises to continuously develop application software for users in all walks of life. It has become particularly important to protect the security of application software. Effective measures need to be taken to improve the security of self-developed application software and avoid the threat of cracking due to piracy. This is also a manifestation of responsibility for the safety of customers. Generally speaking, for customers who use the Internet as the application operating environment, they can perform authorization and restriction operations by accessing the interface provided by the development company online. They do not need to worry about the problem of the authorization code or license being cracked. In addition, online authorization is convenient and easy to use and widely used, so most corporate customers will choose online authorization.

[0004] Currently, the main anti-counterfeiting technology used is digital signature, which can verify the authenticity of data through public key. In other words, only the owner of the private key can obtain the data verified by the digital signature. Therefore, unless the private key is leaked (usually stored on the server), no one can forge a digital signature.

[0005] During the license generation process, the server will use the asymmetric private key to digitally sign the license, and the client will use the corresponding public key to verify the digital signature. Only when the verification is passed will the content of the license be verified again.

[0006] In order to increase the difficulty of cracking application software, the following methods are usually adopted:

[0007] First, application timestamp: add a release timestamp to the license file. If the time specified in the license file is less than the current timestamp, the license file cannot be used even if the system time is modified. In this way, the use of expired license files in new versions of application software is restricted.

[0008] Second, code decompilation: Enhance the difficulty of code decompilation and avoid using easily decompiled code to verify the license file, especially when the verification code is directly changed to True, and the code storing the public key string should be carefully avoided from being directly replaced. The verification code can be embedded in the binary code and the code is obfuscated to increase the difficulty of cracking.

[0009] However, the switching between permanent authorization and temporary authorization of existing authorization products can be achieved through physical adjustment, such as data rollback, which is not safe. Summary of the invention

[0010] Embodiments of the present application provide a method, apparatus, computer device, and storage medium for authorizing client application update.

[0011] A first aspect of an embodiment of the present application provides a method for updating an authorized client application, comprising:

[0012] After the application system is authorized successfully, the application system verifies whether the current time is within the valid time period of the application system;

[0013] If the current time is within the valid period of the application system, the permission to use the application system is enabled;

[0014] When the current time is not within the valid period of the application system in the decrypted authorization code, a prompt message for updating the valid period of the application system is generated and sent to the authorization service platform.

[0015] In an optional embodiment of the present application, the method further includes:

[0016] The authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains the decrypted authorization code, and sends it to the application system;

[0017] The application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the decrypted authorization code and the configuration item information, and after the verification passes, determines that the application system authorization is successful.

[0018] In an optional embodiment of the present application, the verification of the decrypted authorization code and the configuration item information includes:

[0019] Compare the decrypted authorization code with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information;

[0020] If the decrypted authorization code is consistent with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information, the verification is deemed to have passed;

[0021] If the decrypted authorization code is inconsistent with any of the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and number of application instances in the configuration item information, the verification is deemed to have failed. In particular, if the decrypted authorization code is inconsistent with the validity period in the configuration item information, a prompt message for the application system to update the validity period is generated and sent to the authorization service platform.

[0022] In an optional embodiment of the present application, after generating prompt information for updating the effective period of the application system and sending it to the authorization service platform, the method further includes:

[0023] The authorization service platform obtains the updated application system authorization code, decrypts the updated application system authorization code, obtains the updated decrypted authorization code, and sends it to the application system;

[0024] The application system verifies the updated and decrypted authorization code and configuration item information. After the verification passes, it is determined that the application system authorization is successful.

[0025] In an optional embodiment of the present application, the application system communicates with the authorization service platform via the GRPC protocol.

[0026] In an optional embodiment of the present application, the method further includes:

[0027] Each application system monitors and obtains the user's authorized access behavior information, builds an application change set, establishes a distributed blockchain, and generates an access change coefficient Fw(a, b) from the access change set. If the access change coefficient Fw(a, b)> the preset change threshold, a first warning instruction is sent to the authorization service platform; if the access change coefficient Fw(a, b)≤the preset change threshold, a first qualified instruction is sent to the authorization service platform;

[0028] Use the trained authorization and authentication model to plan the application system authentication steps to obtain a number of verification matching item sets, wherein the verification matching item sets include: identity authentication matching information items, license matching information items, device management matching information items, and geographic location authentication matching information items. Generate an information verification coefficient XFx based on the matching item set. If the information verification coefficient XFx is greater than or equal to the first threshold R1, the authorization service platform generates and sends a second qualified instruction; when the information verification coefficient XFx is less than the first threshold R1, a second warning instruction is generated.

[0029] After the authorization service platform identifies the user's first qualified instruction and the second qualified instruction, it determines the priority authorization level and executes the authorization behavior on the user;

[0030] When the first warning instruction and the second warning instruction are received, the corresponding security response strategy is triggered.

[0031] In an optional embodiment of the present application, the method further includes:

[0032] Collect and obtain user authorized access behavior information, including user login IP, application operation, access content and access traffic information;

[0033] Summarize the user's access behavior information, extract the user's access frequency change value fwbd, access content change value nrbd, access time change value sjbd, access permission change value qxbd and access device change value sbbd, identify the access change ratio Bd and time interval ratio SJ, and construct an application change set; the access change ratio Bd is generated by the following formula:

[0034] Bd=E 1 *fwbd+E 2 *nrbd+E 3 *sjbd*E 4 *sjbd+E 5 *sbbd+C 1

[0035] Among them, 0<E 1 <1,0<E 2 <1,0<E 3 <1,0<E 4 <1,0<E 5 <1, and E 1 +E 2 +E 3 +E 4 +E 5 =1,E 1 、E 2 、E 3 、E 4 and E 5 is the preset proportional coefficient of the access frequency change value fwbd, the access content change value nrbd, the access time change value sjbd, the access permission change value qxbd and the access device change value sbbd, C 1 is a constant correction factor.

[0036] A second aspect of an embodiment of the present application provides an authorized client application update device, including:

[0037] The verification module is used to verify whether the current time is within the valid period of the application system after the application system is successfully authorized;

[0038] The opening module is used to open the use permission of the application system when the current time is within the valid period of the application system;

[0039] The generation module is used to generate prompt information for updating the valid period of the application system when the current time is not within the valid period of the application system in the decrypted authorization code, and send it to the authorization service platform.

[0040] According to a third aspect of an embodiment of the present application, a computer device is provided, comprising: a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the above methods for authorizing client application update are implemented.

[0041] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any of the above methods for updating an authorized client application are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 A flowchart of a method for updating an authorized client application provided in one embodiment of the present application;

[0044] Figure 2 A flowchart of a method for updating an authorized client application provided in another embodiment of the present application;

[0045] Figure 3 A flowchart of a method for updating an authorized client application provided in yet another embodiment of the present application;

[0046] Figure 4 A flowchart of a method for updating an authorized client application provided in yet another embodiment of the present application;

[0047] Figure 5 A schematic diagram of the structure of an authorized client application update device provided in one embodiment of the present application;

[0048] Figure 6 A schematic diagram of the structure of a multi-level offline authorization system provided for one embodiment of the present application;

[0049] Figure 7 A schematic diagram of the computer device structure provided for one embodiment of the present application. DETAILED DESCRIPTION

[0050] In the process of implementing the present application, the inventor discovered that the current client does not have an automatic reconnection mechanism after disconnection, and requires background configuration before reconnecting to obtain data.

[0051] In response to the above problems, an embodiment of the present application provides an authorized client application update method, including: after the application system is successfully authorized, the application system verifies whether the current time is within the valid period of the application system; when the current time is within the valid period of the application system, the application system usage permission is enabled; when the current time is not within the valid period of the application system in the decrypted authorization code, a prompt message for the application system to update the valid period is generated and sent to the authorization service platform. When the application system needs to update the valid period, it can be achieved by changing the timestamp on the licensing center. The licensing center supports changing configuration information according to business needs, which is flexible, easy to use, safe and controllable.

[0052] The solutions in the embodiments of the present application can be implemented using various computer languages, for example, the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0053] In order to make the technical solutions and advantages in the embodiments of the present application more clearly understood, the exemplary embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than an exhaustive list of all the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0054] See also Figure 1 The authorization client application update method provided in the embodiment of the present application includes the following steps S1 to S3:

[0055] S1, after the application system is authorized successfully, the application system verifies whether the current time is within the valid period of the application system.

[0056] S2: When the current time is within the valid period of the application system, the permission to use the application system is enabled.

[0057] S3, when the current time is not within the valid period of the application system in the decrypted authorization code, a prompt message for updating the valid period of the application system is generated and sent to the authorization service platform.

[0058] In an optional embodiment of the present application, the application system communicates with the authorization service platform via the GRPC protocol.

[0059] In an optional embodiment of the present application, the method further includes:

[0060] The authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains the decrypted authorization code, and sends it to the application system;

[0061] The application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the decrypted authorization code and the configuration item information, and after the verification passes, determines that the application system authorization is successful.

[0062] In an optional embodiment of the present application, the verification of the decrypted authorization code and the configuration item information includes:

[0063] Compare the decrypted authorization code with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information;

[0064] If the decrypted authorization code is consistent with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information, the verification is deemed to have passed;

[0065] If the decrypted authorization code is inconsistent with any of the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and number of application instances in the configuration item information, the verification is deemed to have failed. In particular, if the decrypted authorization code is inconsistent with the validity period in the configuration item information, a prompt message for the application system to update the validity period is generated and sent to the authorization service platform.

[0066] In an optional embodiment of the present application, after generating prompt information for updating the effective period of the application system and sending it to the authorization service platform, the method further includes:

[0067] The authorization service platform obtains the updated application system authorization code, decrypts the updated application system authorization code, obtains the updated decrypted authorization code, and sends it to the application system;

[0068] The application system verifies the updated and decrypted authorization code and configuration item information. After the verification passes, it is determined that the application system authorization is successful.

[0069] See also Figure 2 The authorization client instance management method provided in the embodiment of the present application includes the following steps S21 to S23:

[0070] S21, the authorization client sends an instance creation request to the authorization service platform, wherein the authorization client is implanted in the application system, and the application system and the authorization service platform are deployed in the same cluster environment.

[0071] In an optional embodiment of the present application, before the authorization client sends the instance creation request to the authorization service platform, the method further includes:

[0072] The authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains the decrypted authorization code, and sends it to the application system;

[0073] The application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the decrypted authorization code and the configuration item information, and after the verification passes, determines that the application system authorization is successful.

[0074] In an optional embodiment of the present application, the application system communicates with the deployment authorization service platform via the GRPC protocol.

[0075] In an optional embodiment of the present application, an authorization service platform and an application system implanted with an authorization client SDK are deployed in a customer site cluster environment. The authorization service platform obtains cluster identification information, i.e., the authorization service platform identification information, for use when applying for authorization. The uniqueness of the authorization service platform identification information and the application system identification information determines the application system in the customer site cluster environment, making it impossible to use across cluster environments, thereby ensuring the spatial security of the authorization file.

[0076] S22, the authorization service platform receives the instance creation request and determines whether the number of available instances is 0. If the number of available instances is not 0, an instance authorization code is generated and sent to the authorization client, where each instance corresponds to an instance authorization code; if the number of available instances is 0, there is no response.

[0077] In an optional embodiment of the present application, determining whether the available instance is 0 includes:

[0078] The preset number of instances is compared with the actual number of instances that have been created. When the actual number of instances that have been created is less than the preset number of instances, it is determined that the available instances are not 0; when the actual number of instances that have been created is equal to the preset number of instances, it is determined that the available instances are 0.

[0079] S23, the authorization client receives the instance authorization code and creates an instance in the application system.

[0080] In an optional embodiment of the present application, the application system authorization code is generated based on the licensing center platform according to the client identification information, the authorization service platform identification information, the valid period of the application system, the application system identification information and name, and the number of application instances.

[0081] In an optional embodiment of the present application, when creating an instance in the application system, the creation limit is controlled according to the total number of instances of the application system authorization code. Each time an instance is created, the authorization client SDK automatically obtains the instance authorization code from the authorization service platform through the GRPC protocol, and generates an instance authorization code each time an instance is created. If the number of instances exceeds the creation limit of the authorization application, the authorization service platform stops generating instance authorization codes. In addition, if the application system returns the instance, the total number of instances remains unchanged, the number of available instances increases, the authorization service platform returns to normal, and a new instance authorization code is generated.

[0082] See also Figure 3 The authorization client application deployment method provided in the embodiment of the present application includes the following steps S31-S32:

[0083] S31, obtain at least one application system corresponding to the authorized client, implant the authorized client SDK into the application system, and write the application system identification code and name into the application system, wherein the authorized client SDK has a built-in authorized client and encapsulates the authorization client's registration instance, query instance authorization, query application system authorization, and application system registration programs for calling.

[0084] In an optional embodiment of the present application, the step of obtaining the application system corresponding to the authorized client includes:

[0085] Export the application system corresponding to the authorized client from the licensing center platform in the form of a file.

[0086] S32, deploy each application system in the target cluster corresponding to the authorized client, wherein the application system automatically communicates with the authorization service platform through the GRPC protocol based on the authorization client SDK, and determines the uniqueness of the application system through the application system identification code and name combined with the authorization service platform identification information. The GRPC protocol is used to connect the authorization service platform and the application system services.

[0087] In an optional embodiment of the present application, after deploying each application system in the target cluster corresponding to the authorized client, the method further includes:

[0088] The authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains authorization information, and sends it to the application system. The application system authorization code is generated based on the client identification information, the authorization service platform identification information, the validity period of the application system, the application system identification information and name, and the number of application instances;

[0089] The application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the authorization information and the configuration item information, and after the verification passes, determines that the application system authorization is successful.

[0090] See also Figure 4 In an optional embodiment of the present application, before step S1, the method further includes:

[0091] S41, the licensing center platform generates an application system authorization code corresponding to the target cluster, wherein the application system authorization code is generated according to the client identification information, the authorization service platform identification information, the valid period of the application system, the application system identification information and name, and the number of application instances, and the authorization client SDK is embedded in the application system information, and the application system information includes the identification information and name of the application system;

[0092] S42, deploying an authorization service platform and a preset application system in the target cluster, wherein the application system communicates with the deployment authorization service platform through a GRPC protocol;

[0093] S43, the authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains the decrypted authorization code, and sends it to the application system;

[0094] S44, the application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the decrypted authorization code and the configuration item information, and after the verification passes, determines that the application system authorization is successful, so that the application system is allowed to log in to the use instance.

[0095] In an optional embodiment of the present application, the information for applying for authorization is filled in at a licensing center in the cluster environment that provides the application system, including the user, third-party application information, project information, cluster identification information (authorization service platform identification information) of the deployed application system, valid timestamp, number of instances and number of application systems. After a successful application, the approval process of the connected third party is triggered, and the approval is completed by the designated person in charge. After the approval is completed, the authorization code of the application system is obtained from the licensing center.

[0096] In an optional embodiment of the present application, in a customer on-site cluster environment, the authorization service platform automatically discovers that an application system needs to be authorized when it is used for the first time, and gives the authorization code of the application system obtained from the licensing center platform offline to the designated person in charge, and then pastes the authorization code under the application system corresponding to the authorization service platform.

[0097] In an optional embodiment of the present application, the authorization service platform obtains the application system authorization code and decrypts the application system authorization code, including:

[0098] The authorization service platform decrypts the application system authorization code based on the preset private key.

[0099] In an optional embodiment of the present application, the licensing center platform and the authorization service platform may not be in the same cluster environment. The licensing center platform can be deployed in a cluster environment that provides application system services as an entry point for applying for authorization; the authorization service platform is deployed together with the application system that the customer needs to use in the customer's on-site cluster environment, and has the ability to automatically discover applications, offline authorization, and automatically verify authorization information.

[0100] In an optional embodiment of the present application, the deploying the authorization service platform in the target cluster includes:

[0101] Create a new namespace in the target cluster and deploy the authorization file and authorization service platform in the namespace.

[0102] Bind the authorization file to the authorization service platform, wherein the authorization file includes target cluster identification information, client identification information, application system identification information and name.

[0103] In an optional embodiment of the present application, the method further includes:

[0104] After the application system is successfully authorized, the application system verifies whether the decrypted authorization code is consistent with the target cluster identification information, client identification information, application system identification information and name in the authorization file;

[0105] When the decrypted authorization code is consistent with the target cluster identification information, client identification information, application system identification information and name in the authorization file, the current application system is displayed on the authorization service platform.

[0106] In an optional embodiment of the present application, the license center platform is a central end, at least one target cluster is a remote end, and the license center platform is deployed by the following steps:

[0107] Deploy a file corresponding to each target cluster, which includes the authorization service platform identification information, the effective period of the application system, the application system identification information, and the number of application instances.

[0108] In an optional embodiment of the present application, the licensing center platform generates an application system authorization code corresponding to the target cluster through an asymmetric encryption algorithm.

[0109] In an optional embodiment of the present application, the authorization items on the licensing center side support multi-level advanced configurations, including users, application systems, deployment cluster environments, timestamps, and number of instances / applications. It also supports changing configuration information according to business needs, making it flexible, easy to use, safe and controllable.

[0110] In an optional embodiment of the present application, the method further includes:

[0111] Each application system monitors and obtains the user's authorized access behavior information, builds an application change set, establishes a distributed blockchain, and generates an access change coefficient Fw(a, b) from the access change set. If the access change coefficient Fw(a, b)> the preset change threshold, a first warning instruction is sent to the authorization service platform; if the access change coefficient Fw(a, b)≤the preset change threshold, a first qualified instruction is sent to the authorization service platform;

[0112] Use the trained authorization and authentication model to plan the application system authentication steps to obtain a number of verification matching item sets, wherein the verification matching item sets include: identity authentication matching information items, license matching information items, device management matching information items, and geographic location authentication matching information items. Generate an information verification coefficient XFx based on the matching item set. If the information verification coefficient XFx is greater than or equal to the first threshold R1, the authorization service platform generates and sends a second qualified instruction; when the information verification coefficient XFx is less than the first threshold R1, a second warning instruction is generated.

[0113] After the authorization service platform identifies the user's first qualified instruction and the second qualified instruction, it determines the priority authorization level and executes the authorization behavior on the user;

[0114] When the first warning instruction and the second warning instruction are received, the corresponding security response strategy is triggered.

[0115] In an optional embodiment of the present application, the method further includes:

[0116] Collect and obtain user authorized access behavior information, including user login IP, application operation, access content and access traffic information;

[0117] Summarize the user's access behavior information, extract the user's access frequency change value fwbd, access content change value nrbd, access time change value sjbd, access permission change value qxbd and access device change value sbbd, identify the access change ratio Bd and time interval ratio SJ, and construct an application change set; the access change ratio Bd is generated by the following formula:

[0118] Bd=E 1 *fwbd+E 2 *nrbd+E 3 *sjbd*E 4 *sjbd+E 5 *sbbd+C 1

[0119] Among them, 0<E 1 <1,0<E 2 <1,0<E 4 <1,0<E 4<1,0<E 5 <1, and E 1 +E 2 +E 3 +E 4 +E 5 =1,E 1 、E 2 、E 3 、E 4 and E 5 is the preset proportional coefficient of the access frequency change value fwbd, the access content change value nrbd, the access time change value sjbd, the access permission change value qxbd and the access device change value sbbd, C 1 is a constant correction factor.

[0120] In an optional embodiment of the present application, the time interval ratio SJ is generated by the following formula:

[0121]

[0122] Among them, SJ j represents the time interval between the jth and j+1th visits of the user, m represents the total number of visits of the user, and calculates the time interval SJ of all visits of the user j The sum of the time intervals of the users is obtained by SJ.

[0123] In an optional embodiment of the present application, according to the access variation ratio Bd and the time interval ratio SJ, after dimensionless processing, the corresponding data values ​​are mapped to the region and the corresponding data values ​​are mapped to the interval [0, 1], and then the access variation coefficient Fw(a, b) is generated according to the following formula:

[0124]

[0125] in, is the preset mean of the access change ratio, is the preset mean value of the time interval ratio, n is a positive integer greater than 1, i=1, 2, ..., n, is the number of access behavior information; Bd i is the access change ratio of the i-th access behavior information, a and b are weight values; 0<a<1, 0<b<1, and a+b=1.

[0126] It should be understood that, although the various steps in the flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the figure may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0127] See also Figure 5 An embodiment of the present application provides an authorized client application update device, comprising:

[0128] Verification module 11, used to verify whether the current time is within the valid period of the application system after the application system is successfully authorized;

[0129] An opening module 12 is used to open the use permission of the application system when the current time is within the valid period of the application system;

[0130] The generating module 13 is used to generate prompt information for updating the valid period of the application system when the current time is not within the valid period of the application system in the decrypted authorization code, and send it to the authorization service platform.

[0131] For the specific definition of the above-mentioned authorized client application update device, please refer to the definition of the method above, which will not be repeated here. Each module in the above-mentioned authorized client application update device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0132] See also Figure 6 An embodiment of the present application provides a multi-level offline authorization system, including an authorization client application update device, and also includes:

[0133] The licensing center platform is used to generate an application system authorization code corresponding to the target cluster, wherein the application system authorization code is generated according to the client identification information, the authorization service platform identification information, the valid period of the application system, the application system identification information and name, and the number of application instances, and the authorization client SDK is embedded in the application system information, and the application system information includes the identification information and name of the application system;

[0134] The authorization service platform is deployed in the target cluster, and is used to obtain the application system authorization code, decrypt the application system authorization code, obtain the decrypted authorization code, and send it to the application system, wherein the application system communicates with the deployment authorization service platform through the GRPC protocol;

[0135] The application system (product) is deployed in the target cluster and is used to parse the configuration item information of the authorization client SDK, obtain the configuration item information, verify the decrypted authorization code and the configuration item information, and after the verification, determine that the application system is authorized successfully. Among them, the authorization client application update device is implanted in the application system.

[0136] In one embodiment, a computer device is provided, the internal structure diagram of which can be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an authorized client application update method as described above is implemented. It includes: a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, any step in the authorized client application update method as described above is implemented.

[0137] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any step in the above method for authorizing client application update can be implemented.

[0138] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0139] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0141] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0142] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0143] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for updating an authorized client application, characterized in that: include: After the application system is authorized successfully, the application system verifies whether the current time is within the valid time period of the application system; If the current time is within the valid period of the application system, the permission to use the application system is enabled; If the current time is not within the valid period of the application system in the decrypted authorization code, a prompt message for the application system to update the valid period is generated and sent to the authorization service platform. Among them, each application system monitors and obtains the user's authorized access behavior information, constructs an application change set, establishes a distributed blockchain, and generates an access change coefficient Fw(a, b) from the access change set. If the access change coefficient Fw(a, b)> the preset change threshold, a first warning instruction is sent to the authorization service platform; if the access change coefficient Fw(a, b)≤the preset change threshold, a first qualified instruction is sent to the authorization service platform; Use the trained authorization and authentication model to plan the application system authentication steps to obtain a number of verification matching item sets, wherein the verification matching item sets include: identity authentication matching information items, license matching information items, device management matching information items, and geographic location authentication matching information items. Generate an information verification coefficient XFx based on the matching item set. If the information verification coefficient XFx is greater than or equal to the first threshold R1, the authorization service platform generates and sends a second qualified instruction; when the information verification coefficient XFx is less than the first threshold R1, generate a second warning instruction; After the authorization service platform identifies the user's first qualified instruction and the second qualified instruction, it determines the priority authorization level and executes the authorization behavior on the user; When the first warning instruction and the second warning instruction are received, the corresponding security response strategy is triggered.

2. The method according to claim 1, characterized in that The method further comprises: The authorization service platform obtains the application system authorization code, decrypts the application system authorization code, obtains the decrypted authorization code, and sends it to the application system; The application system parses the configuration item information of the authorization client SDK, obtains the configuration item information, verifies the decrypted authorization code and the configuration item information, and after the verification passes, determines that the application system authorization is successful.

3. The method according to claim 2, characterized in that The verification of the decrypted authorization code and configuration item information includes: Compare the decrypted authorization code with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information; If the decrypted authorization code is consistent with the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and application instance quantity in the configuration item information, the verification is deemed to have passed; If the decrypted authorization code is inconsistent with any of the client identification information, authorization service platform identification information, application system validity period, application system identification information and name, and number of application instances in the configuration item information, the verification is deemed to have failed. In particular, if the decrypted authorization code is inconsistent with the validity period in the configuration item information, a prompt message for the application system to update the validity period is generated and sent to the authorization service platform.

4. The method according to claim 3, characterized in that After generating prompt information of the application system updating effective period and sending it to the authorization service platform, the method further includes: The authorization service platform obtains the updated application system authorization code, decrypts the updated application system authorization code, obtains the updated decrypted authorization code, and sends it to the application system; The application system verifies the updated and decrypted authorization code and configuration item information. After the verification passes, it is determined that the application system authorization is successful.

5. The method according to claim 1, characterized in that The application system communicates with the authorization service platform via the GRPC protocol.

6. The method according to claim 1, characterized in that The method further comprises: Collect and obtain user authorized access behavior information, including user login IP, application operation, access content and access traffic information; Summarize the user's access behavior information, extract the user's access frequency change value fwbd, access content change value nrbd, access time change value sjbd, access permission change value qxbd and access device change value sbbd, identify the access change ratio Bd and time interval ratio SJ, and construct an application change set; the access change ratio Bd is generated by the following formula: Bd=E1*fwbd+E2*nrbd+E3*sjbd+E4*qxbd+E5*sbbd+C1 Among them, 0<E1<1, 0<E2<1, 0<E3<1, 0<E4<1, 0<E5<1, and E1+E2+E3+E4+E5=1, E1, E2, E3, E4 and E5 are the preset proportional coefficients of the access frequency change value fwbd, the access content change value nrbd, the access time change value sjbd, the access permission change value qxbd and the access device change value sbbd, and C1 is the constant correction coefficient.

7. An authorized client application update device, characterized in that: include: The verification module is used to verify whether the current time is within the valid period of the application system after the application system is successfully authorized; The opening module is used to open the use permission of the application system when the current time is within the valid period of the application system; The generation module is used to generate a prompt message for the application system to update the valid period when the current time is not within the valid period of the application system in the decrypted authorization code, and send it to the authorization service platform. Among them, each application system monitors and obtains the user's authorized access behavior information, constructs an application change set, establishes a distributed blockchain, and generates an access change coefficient Fw(a, b) from the access change set. If the access change coefficient Fw(a, b)> the preset change threshold, a first warning instruction is sent to the authorization service platform; if the access change coefficient Fw(a, b)≤the preset change threshold, a first qualified instruction is sent to the authorization service platform; Use the trained authorization and authentication model to plan the application system authentication steps to obtain a number of verification matching item sets, wherein the verification matching item sets include: identity authentication matching information items, license matching information items, device management matching information items, and geographic location authentication matching information items. Generate an information verification coefficient XFx based on the matching item set. If the information verification coefficient XFx is greater than or equal to the first threshold R1, the authorization service platform generates and sends a second qualified instruction; when the information verification coefficient XFx is less than the first threshold R1, generate a second warning instruction; After the authorization service platform identifies the user's first qualified instruction and the second qualified instruction, it determines the priority authorization level and executes the authorization behavior on the user; When the first warning instruction and the second warning instruction are received, the corresponding security response strategy is triggered.

8. A computer device comprising: The method comprises a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the steps of the method for updating an authorized client application as claimed in any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the authorized client application update method according to any one of claims 1 to 6 are implemented.

Images