Authorization method and device, electronic equipment, storage medium and program product

Abstract

The invention provides an authorization method and device, electronic equipment, a storage medium and a program product, the method is applied to a first service unit of a service system, and the method comprises the following steps: when an authorization service running in a second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, switching the authorization service to the first service unit; acquiring an authorization service pulled from the second service unit; obtaining a target authorization file corresponding to the authorization service and obtaining an identifier of the target authorization file; searching target authorization time information of the target authorization file according to a mapping relation between the identifier of the authorization file and the authorization time information; and under the condition of determining that the current moment meets a preset authorization condition based on the target authorization time information, controlling the authorization service to be started. According to the embodiment of the invention, the situation that the authorization service fails to start after being transferred in the service system can be reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of authorization technology, and in particular to an authorization method and device, electronic equipment, storage medium, and program product. Background Art

[0002] When the authorization service is deployed in a service system, if the authorization service has been started and run in a service unit in the service system and the authorization service is transferred to another service unit in the service system, the problem of failure to start the authorization service may occur. Summary of the invention

[0003] The present invention provides an authorization method and device, an electronic device, a storage medium, and a program product.

[0004] In a first aspect, the present disclosure provides an authorization method, which is applied to a first service unit of a service system, and the authorization method includes:

[0005] When the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, obtaining the authorization service pulled from the second service unit;

[0006] Obtaining a target authorization file corresponding to the authorization service and obtaining an identifier of the target authorization file;

[0007] According to the mapping relationship between the identifier of the authorization file and the authorization time information, searching for the target authorization time information of the target authorization file;

[0008] When it is determined based on the target authorization time information that the current time satisfies a preset authorization condition, the authorization service is controlled to start.

[0009] In a second aspect, the present disclosure provides an authorization device, which is configured in a first service unit of a service system, and the authorization device includes:

[0010] A first acquisition module, configured to acquire the authorization service pulled from the second service unit when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit;

[0011] A second acquisition module, used to acquire a target authorization file corresponding to the authorization service and to acquire an identifier of the target authorization file;

[0012] A search module, used for searching the target authorization time information of the target authorization file according to the mapping relationship between the identifier of the authorization file and the authorization time information;

[0013] The processing module is used to control the start of the authorization service when it is determined based on the target authorization time information that the current moment meets the preset authorization condition.

[0014] In a third aspect, the present disclosure provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores one or more computer programs executable by the at least one processor, and one or more of the computer programs are executed by the at least one processor so that the at least one processor can execute the above-mentioned authorization method.

[0015] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the above-mentioned authorization method when executed by a processor.

[0016] In a fifth aspect, the present disclosure provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned authorization method.

[0017] In the embodiment provided by the present disclosure, when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, the first service unit obtains the authorization service pulled from the second service unit, obtains the target authorization file corresponding to the authorization service and obtains the identifier of the target authorization file, and then searches for the target authorization time information of the target authorization file based on the mapping relationship between the identifier of the authorization file and the authorization time information, and controls the start of the authorization service when it is determined based on the target authorization time information that the current moment meets the preset authorization condition.

[0018] In the above process, when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, whether the first service unit controls the authorization service to start only depends on whether the current moment meets the preset authorization condition based on the target authorization time information. The first service unit controls the authorization service to start only with time, and has nothing to do with whether the first service unit and the second service unit are on the same physical machine, which can reduce the failure of the authorization service to start after the transfer in the service system. Moreover, when it is determined based on the target authorization time information that the current moment meets the preset authorization condition, controlling the authorization service to start can reduce the occurrence of expired authorization service startup and improve the security of authorization service startup.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. The above and other features and advantages will become more apparent to those skilled in the art by describing detailed example embodiments with reference to the accompanying drawings, in which:

[0021] Figure 1 A flowchart of an authorization method provided in an embodiment of the present disclosure;

[0022] Figure 2 A schematic diagram of transferring an authorization service in a service system provided by an embodiment of the present disclosure;

[0023] Figure 3 A flowchart of an authorization method provided in an embodiment of the present disclosure;

[0024] Figure 4 A flowchart of an authorization method provided in an embodiment of the present disclosure;

[0025] Figure 5 A flowchart of an authorization method provided in an embodiment of the present disclosure;

[0026] Figure 6 A flowchart of an authorization method provided in an embodiment of the present disclosure;

[0027] Figure 7 A block diagram of an authorization device provided in an embodiment of the present disclosure;

[0028] Figure 8 A block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the exemplary embodiments of the present disclosure are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0030] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0031] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0032] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a" and "the" are also intended to include plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "including" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded. "Connected" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0033] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0034] In the process of realizing the present disclosure, the inventors analyzed the relevant technologies and found that:

[0035] In recent years, with the continuous development of Internet technology, the deployment of application services has gradually changed from physical machine deployment to virtual machine deployment. The advantage of virtual machine deployment is that it can more efficiently utilize physical machine resources and reduce the complexity of application deployment. The mainstream deployment method of application services now is to create more virtual machines through multiple physical machines, and then use virtual machines to deploy k8s clusters to achieve containerized management, and deploy program service images to pods managed by k8s, which greatly improves production resource utilization and deployment efficiency. However, this method also has certain disadvantages. For example, it is not so friendly when deploying authorization services.

[0036] Among them, kubernetes, abbreviated as k8s, is an abbreviation formed by replacing the 8 characters in the middle of the name "ubernete". It is an open source containerized application for managing multiple hosts in the cloud platform. The goal of k8s is to make the deployment of containerized applications simple and efficient. k8s provides a mechanism for application deployment, planning, updating and maintenance.

[0037] Pod is the smallest unit that can be created and managed in the k8s system. It is the smallest resource object model created or deployed by the user in the resource object model. It is also the resource object for running containerized applications on k8s. Other resource objects are used to support or extend the functions of pod objects. Pod is the smallest basic unit created or deployed by k8s. A pod represents a process running on a k8s cluster. Pod is an instance of a single application in k8s. It is a resource shared by a single container or multiple containers. A pod encapsulates one or more containers.

[0038] In the related art, the authorization service is deployed on a physical machine, and whether the authorization service is started is controlled by comparing the authorization information of the authorization service with the hardware information of the physical machine where the authorization service is located. However, when the authorization service is deployed in a service system, if the authorization service has been started and run in a service unit in the service system, and the authorization service is transferred to another service unit in the service system, the problem of the authorization service starting failure may occur because the physical machines where the two service units are located are different.

[0039] In order to solve the problem that an authorization service fails to start after being transferred in a service system, the present disclosure provides an authorization method and device, an electronic device, a storage medium, and a program product.

[0040] Figure 1 A flowchart of an authorization method provided by an embodiment of the present disclosure. The authorization method is applied to a first service unit of a service system.

[0041] In some embodiments, the service unit refers to the smallest unit for providing services. In some embodiments, the service system refers to a k8s cluster, and the service unit refers to a pod.

[0042] k8s runs in the form of a cluster. A k8s cluster includes multiple nodes. A node can run multiple pods. Each pod will be scheduled to run on a node. The node can be a physical machine or a virtual machine. The node is used to run containers. Pod is the smallest basic unit created or deployed by k8s. A pod represents a process running on a k8s cluster. A pod is an instance of a single application in k8s. It is a resource shared by a single container or multiple containers. A pod encapsulates one container or multiple containers.

[0043] Reference Figure 1 , the method comprising:

[0044] Step 101: when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, the authorization service pulled from the second service unit is obtained.

[0045] In an exemplary embodiment, Figure 2 A schematic diagram of transferring an authorization service in a service system provided by an embodiment of the present disclosure. Figure 2 In the data center, there are three physical machines, namely physical machine 1, physical machine 2, and physical machine 3. A k8s-1 node is deployed on physical machine 1, a k8s-2 node is deployed on physical machine 2, and a k8s-3 node is deployed on physical machine 3. Pod 1, pod 2, and pod 3 are deployed in the k8s-1 node. The authorization service is started and running on pod 1. Pod 4, pod 5, and pod 6 are deployed in the k8s-2 node. The authorization service is started and running on pod 4. Pod 7, pod 8, and pod 9 are deployed in the k8s-3 node. When the authorization service is running in pod 4, pod 4 crashes, and the authorization service is transferred from pod 4 to pod 8 and started in pod 8.

[0046] In some embodiments, the authorization service is a service running in a container. During the process of the authorization service running in the second service unit of the service system, the second service unit of the service system crashes, and the operation of the authorization service in the second service unit of the service system is interrupted. The k8s scheduler pulls the container where the authorization service is located from the second service unit to the first service unit.

[0047] In some embodiments, the first service unit and the second service unit may be deployed on the same physical machine or on different physical machines.

[0048] Step 102: Obtain a target authorization file corresponding to the authorization service and obtain an identifier of the target authorization file.

[0049] In some embodiments, obtaining the identification of the target authorization file in step 102 includes: calculating a hash value of the target authorization file, and using the hash value of the target authorization file as the identification of the target authorization file.

[0050] Hashing is the process of transforming an input of arbitrary length into an output of fixed length through a hash algorithm. The output is the hash value. This conversion is a compression mapping.

[0051] The hash value of the target authorization file can be the MD5 value of the target authorization file, or a hash value calculated by other hash algorithms. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that can generate a 128-bit (16-byte) hash value to ensure that information transmission is complete and consistent.

[0052] The hash value of the target authorization file is used as the identifier of the target authorization file, so the identifier of the target authorization file is the encrypted result, which can further improve security, and the identifier length of the authorization file is consistent, which is convenient for storage and query.

[0053] Step 103: searching for target authorization time information of the target authorization file according to the mapping relationship between the identifier of the authorization file and the authorization time information.

[0054] In some embodiments, the mapping relationship between the identification of the authorization file and the authorization time information includes the mapping relationship between the identification of multiple authorization files and the authorization time information, including the mapping relationship between the identification of the target authorization file and the target authorization time information. The mapping relationship between the identification of the target authorization file and the target authorization time information is pre-stored when the authorization service is started in the second service unit.

[0055] When the authorization service is started in the second service unit, the mapping relationship between the identifier of the target authorization file and the target authorization time information is pre-stored to facilitate the subsequent interruption of the authorization service running in the second service unit of the service system, and when the authorization service is to be switched to the first service unit, the mapping relationship between the identifier of the target authorization file and the target authorization time information is found according to the identifier of the target authorization file, and the target authorization time information of the target authorization file is further found.

[0056] Step 104: When it is determined based on the target authorization time information that the current time satisfies the preset authorization condition, control the authorization service to start.

[0057] In some embodiments, the authorization method further includes: decrypting the target authorization time information to obtain the authorization deadline; and when the current time is less than the authorization deadline, determining that the current time satisfies a preset authorization condition.

[0058] The target authorization time information is the encrypted value of the authorization deadline, which reduces the possibility of others tampering with the authorization deadline, resulting in delayed authorization deadline, and improves the security of starting the authorization service.

[0059] In some embodiments, after decrypting the target authorization time information and obtaining the authorization deadline, the authorization method also includes: when the current time is greater than or equal to the authorization deadline, determining that the current time does not meet the preset authorization conditions; deleting the mapping relationship between the identifier of the target authorization file and the target authorization time information.

[0060] When the current time is greater than or equal to the authorization deadline, it is determined that the current time does not meet the preset authorization conditions and the authorization service fails to start. At this time, the mapping relationship between the identifier of the target authorization file and the target authorization time information is deleted. This can reduce the occurrence of an expired mapping relationship when the authorization service is started next time, and the loading of a new authorization file will not be affected when the authorization expires and is re-authorized.

[0061] In some embodiments, the authorization method also includes: in the case where the mapping relationship between the identification of the target authorization file and the target authorization time information is not found, controlling the start of the authorization service according to the target authorization file, the hardware information of the physical machine where the first service unit is located and the current time, obtaining the target authorization time information of the target authorization file, and storing the mapping relationship between the identification of the target authorization file and the target authorization time information.

[0062] In the case where the mapping relationship between the identifier of the target authorization file and the target authorization time information is not found, the authorization service is controlled to start, and the mapping relationship between the identifier of the target authorization file and the target authorization time information is stored, so as to reduce the occurrence of the situation where the mapping relationship between the identifier of the target authorization file and the target authorization time information cannot be found when the authorization service is transferred to the third service unit in the service system.

[0063] In some embodiments, obtaining target authorization time information of a target authorization file includes: extracting an authorization deadline from the target authorization file; and encrypting the authorization deadline to obtain target authorization time information of the target authorization file.

[0064] Encrypt the authorization deadline to obtain the target authorization time information of the target authorization file, reduce the possibility of others tampering with the authorization deadline, resulting in delayed authorization deadline, and improve the security of starting the authorization service.

[0065] In some embodiments, extracting the authorization deadline from the target authorization file includes: decrypting the target authorization file to obtain a plain text file; and reading the authorization deadline in the plain text file.

[0066] The target authorization file is an encrypted file, which further improves the security of starting the authorization service.

[0067] In some embodiments, storing the mapping relationship between the identification of the target authorization file and the target authorization time information includes: using the identification of the target authorization file as a key, using the target authorization time information as a value, and storing the mapping relationship between the identification of the target authorization file and the target authorization time information in a key-value pair format.

[0068] The mapping relationship between the identifier of the target authorization file and the target authorization time information is stored in the form of a key-value pair, so as to facilitate the subsequent search for the target authorization time information according to the identifier of the target authorization file.

[0069] In some embodiments, the mapping relationship between the identification of the target authorization file and the target authorization time information is stored in a key-value pair, which can be storing the mapping relationship between the identification of the target authorization file and the target authorization time information in a remote dictionary service in a key-value pair.

[0070] Remote Dictionary Server (Redis) is an open source network-enabled, memory-based, persistent, log-based, key-value database that provides application programming interfaces in multiple languages.

[0071] The mapping relationship between the identifier of the target authorization file and the target authorization time information is stored in the remote dictionary service in the form of a key-value pair, so as to facilitate the subsequent search for the target authorization time information from the remote dictionary service according to the identifier of the target authorization file.

[0072] In some embodiments, the life cycle of the target authorization file identifier stored in the remote dictionary service is set to the difference between the authorization expiration time and the current time. The target authorization file identifier can be automatically deleted after the authorization expires to avoid querying the target authorization file identifier during restart, which affects the loading of a new authorization file.

[0073] In some embodiments, the authorization service is started up by controlling the target authorization file, the hardware information of the physical machine where the first service unit is located, and the current time, including: extracting the authorization hardware information and the authorization deadline from the target authorization file; and controlling the authorization service to start up when the authorization hardware information is consistent with the hardware information of the physical machine where the first service unit is located, and the current time is less than the authorization deadline.

[0074] In some embodiments, extracting the authorized hardware information and the authorization deadline from the target authorization file includes: decrypting the target authorization file to obtain a plain text file; reading the authorized hardware information and the authorization deadline in the plain text file. The authorized hardware information may be a machine fingerprint. The machine fingerprint is generated by the CPU (Central Processing Unit), MAC address (Media Access Control Address), and system serial number of the physical machine.

[0075] Figure 3A flowchart of an authorization method provided by an embodiment of the present disclosure. The authorization method is applied to a second service unit of a service system, in which an authorization service is deployed. The authorization service is loaded for the first time in the second service unit of the service system.

[0076] Reference Figure 3 , the method comprising:

[0077] Step 301, obtaining the target authorization file corresponding to the authorization service.

[0078] Step 302: Control the start of the authorization service according to the target authorization file, the hardware information of the physical machine where the second service unit is located, and the current time.

[0079] Step 303: when the control authorization service is started, obtain the identifier of the target authorization file, obtain the target authorization time information of the target authorization file, and store the mapping relationship between the identifier of the target authorization file and the target authorization time information.

[0080] When the authorization service is started in the second service unit, the mapping relationship between the identifier of the target authorization file and the target authorization time information is pre-stored to facilitate the subsequent interruption of the authorization service running in the second service unit of the service system, and when the authorization service is to be switched to the first service unit, the mapping relationship between the identifier of the target authorization file and the target authorization time information is found according to the identifier of the target authorization file, and the target authorization time information of the target authorization file is further found.

[0081] In some embodiments, obtaining the identification of the target authorization file includes: calculating a hash value of the target authorization file, and using the hash value of the target authorization file as the identification of the target authorization file.

[0082] Hashing is the process of transforming an input of arbitrary length into an output of fixed length through a hash algorithm. The output is the hash value. This conversion is a compression mapping.

[0083] The hash value of the target authorization file can be the MD5 value of the authorization file, or a hash value calculated by other hash algorithms. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that can generate a 128-bit (16-byte) hash value to ensure that information transmission is complete and consistent.

[0084] The hash value of the target authorization file is used as the identifier of the target authorization file, so the identifier of the target authorization file is the encrypted result, which can further improve security, and the identifier length of the authorization file is consistent, which is convenient for storage and query.

[0085] In some embodiments, obtaining target authorization time information of a target authorization file includes: extracting an authorization deadline from the target authorization file; and encrypting the authorization deadline to obtain target authorization time information of the target authorization file.

[0086] Encrypt the authorization deadline to obtain the target authorization time information of the target authorization file, reduce the possibility of others tampering with the authorization deadline, resulting in delayed authorization deadline, and improve the security of starting the authorization service.

[0087] In some embodiments, extracting the authorization deadline from the target authorization file includes: decrypting the target authorization file to obtain a plain text file; and reading the authorization deadline in the plain text file.

[0088] The target authorization file is an encrypted file, which further improves the security of starting the authorization service.

[0089] In some embodiments, storing the mapping relationship between the identification of the target authorization file and the target authorization time information includes: using the identification of the target authorization file as a key, using the target authorization time information as a value, and storing the mapping relationship between the identification of the target authorization file and the target authorization time information in a key-value pair format.

[0090] The mapping relationship between the identifier of the target authorization file and the target authorization time information is stored in the form of a key-value pair, so as to facilitate the subsequent search for the target authorization time information according to the identifier of the target authorization file.

[0091] In some embodiments, the mapping relationship between the identification of the target authorization file and the target authorization time information is stored in a key-value pair, which can be storing the mapping relationship between the identification of the target authorization file and the target authorization time information in a remote dictionary service in a key-value pair.

[0092] The mapping relationship between the identifier of the target authorization file and the target authorization time information is stored in the remote dictionary service in the form of a key-value pair, so as to facilitate the subsequent search for the target authorization time information from the remote dictionary service according to the identifier of the target authorization file.

[0093] In some embodiments, the life cycle of the target authorization file identifier stored in the remote dictionary service is set to the difference between the authorization expiration time and the current time. The target authorization file identifier can be automatically deleted after the authorization expires to avoid querying the target authorization file identifier during restart, which affects the loading of a new authorization file.

[0094] In some embodiments, the authorization service is started up controlled according to the authorization file, the hardware information of the physical machine where the second service unit is located, and the current time, including: extracting the authorization hardware information and the authorization deadline from the target authorization file; when the authorization hardware information is consistent with the hardware information of the physical machine where the second service unit is located, and the current time is less than the authorization deadline, the authorization service is started up controlled.

[0095] In some embodiments, extracting the authorized hardware information and the authorization deadline from the target authorization file includes: decrypting the target authorization file to obtain a plain text file; reading the authorized hardware information and the authorization deadline in the plain text file. The authorized hardware information may be a machine fingerprint. The machine fingerprint is generated by the CPU (Central Processing Unit), MAC address (Media Access Control Address), and system serial number of the physical machine.

[0096] The disclosed embodiment can realize that there is no need to apply for authorization when the authorization service is expanded. After storing the mapping relationship between the identifier of the target authorization file and the target authorization time information, one target authorization file can authorize all virtual machines. When it is determined based on the target authorization time information that the current moment meets the preset authorization conditions, the authorization service is controlled to start, and the authorization for the use of services that are not within the authorization scope is strictly controlled, which simplifies the cumbersome and frequent authorization process and saves labor costs and server resource costs.

[0097] In some embodiments, Figure 4 A flowchart of an authorization method provided in an embodiment of the present disclosure. Figure 4 In the example above, the authorization service is loaded for the first time in the second service unit of the service system. Figure 4 , the method comprising:

[0098] Get the target authorization file corresponding to the authorization service;

[0099] Decrypt the target authorization file to obtain the plain text file; read the machine fingerprint code and authorization deadline in the plain text file;

[0100] Determine whether the machine fingerprint code matches the hardware information of the physical machine where the second service unit is located. If so, determine whether the current time is less than the authorization deadline; otherwise, send an email to the authorization personnel for re-authorization;

[0101] Determine whether the current time is less than the authorization deadline. If so, control the start of the authorization service. Otherwise, send an email to the authorization personnel to re-authorize.

[0102] After the control authorization service is started, the hash value of the target authorization file is used as the key, and the encrypted value of the authorization deadline is used as the value, which are stored in the remote dictionary service.

[0103] In some embodiments, Figure 5 A flowchart of an authorization method provided in an embodiment of the present disclosure. Figure 5 In the example, the authorization service running in the second service unit of the service system is interrupted, the authorization service is pulled from the second service unit to the first service unit, and the authorization service is loaded for the second time in the first service unit of the service system. Figure 5 , the method comprising:

[0104] Get the target authorization file and the hash value of the target authorization file;

[0105] Determine whether the hash value of the target authorization file exists in the remote dictionary service. If so, search the remote dictionary service for the target authorization time information corresponding to the hash value of the target authorization file, decrypt the target authorization time information, and obtain the authorization expiration time;

[0106] Determine whether the current time is less than the authorization deadline. If so, control the start of the authorization service. Otherwise, delete the hash value of the target authorization file from the remote dictionary service and send an email to the authorization personnel to re-authorize.

[0107] Determine whether the hash value of the target authorization file exists in the remote dictionary service. If not, decrypt the target authorization file to obtain a plain text file; read the machine fingerprint code and authorization deadline in the plain text file;

[0108] Determine whether the machine fingerprint code matches the hardware information of the physical machine where the first service unit is located. If so, determine whether the current time is less than the authorization deadline; otherwise, send an email to the authorization personnel to re-authorize;

[0109] Determine whether the current time is less than the authorization deadline. If so, control the start of the authorization service. Otherwise, send an email to the authorization personnel to re-authorize.

[0110] After the control authorization service is started, the hash value of the target authorization file is used as the key, and the encrypted value of the authorization deadline is used as the value, which are stored in the remote dictionary service.

[0111] In some embodiments, Figure 6 A flowchart of an authorization method provided by an embodiment of the present disclosure. Figure 6 , the method comprising:

[0112] During the loading process of the authorization service, an original file is generated, wherein the original file includes the machine fingerprint code and the authorization deadline;

[0113] Send the original documents to the authorized person by email;

[0114] Obtain the target authorization file sent by the authorized person after encrypting the original file, and put the target authorization file into the designated folder of the authorization service;

[0115] When the target authorization file is detected to exist, the target authorization file is decrypted to obtain the plain text file; the machine fingerprint code and authorization deadline in the plain text file are read;

[0116] Determine whether the machine fingerprint code matches the hardware information of the physical machine where the authorization service is located. If so, determine whether the current time is less than the authorization deadline;

[0117] Determine whether the current time is less than the authorization deadline, if so, control the start of the authorization service;

[0118] After the control authorization service is started, the hash value of the target authorization file is used as the key, and the encrypted value of the authorization deadline is used as the value, which are stored in the remote dictionary service.

[0119] Specifically, before the original document is sent to the authorized person via email, the authorization deadline in the original document can be modified as needed.

[0120] In summary, in the embodiments provided by the present disclosure, when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, the first service unit obtains the authorization service pulled from the second service unit, obtains the target authorization file corresponding to the authorization service, and obtains the identifier of the target authorization file, and then searches for the target authorization time information of the target authorization file based on the mapping relationship between the identifier of the authorization file and the authorization time information, and controls the start of the authorization service when it is determined based on the target authorization time information that the current moment meets the preset authorization conditions.

[0121] In the above process, when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, whether the first service unit controls the authorization service to start only depends on whether the current moment meets the preset authorization condition based on the target authorization time information. The first service unit controls the authorization service to start only with time, and has nothing to do with whether the first service unit and the second service unit are on the same physical machine, which can reduce the failure of the authorization service to start after the transfer in the service system. Moreover, when it is determined based on the target authorization time information that the current moment meets the preset authorization condition, controlling the authorization service to start can reduce the occurrence of expired authorization service startup and improve the security of authorization service startup.

[0122] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0123] In addition, the present disclosure also provides an authorization device, an electronic device, a storage medium, and a program product, all of which can be used to implement any authorization method provided by the present disclosure. The corresponding technical solutions and descriptions are referred to in the corresponding records of the method part and will not be repeated here.

[0124] Figure 7 A block diagram of an authorization device provided in an embodiment of the present disclosure.

[0125] Reference Figure 7 The present disclosure provides an authorization device configured in a first service unit of a service system, the authorization device comprising:

[0126] A first acquisition module 701 is configured to acquire the authorization service pulled from the second service unit when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit;

[0127] The second acquisition module 702 is used to acquire the target authorization file corresponding to the authorization service and to acquire the identifier of the target authorization file;

[0128] A search module 703, used for searching the target authorization time information of the target authorization file according to the mapping relationship between the identifier of the authorization file and the authorization time information;

[0129] The processing module 704 is used to control the start of the authorization service when it is determined based on the target authorization time information that the current time satisfies the preset authorization condition.

[0130] Each module in the above authorization device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0131] Figure 8 A block diagram of an electronic device provided in an embodiment of the present disclosure.

[0132] Reference Figure 8An embodiment of the present disclosure provides an electronic device, which includes: at least one processor 801; at least one memory 802, and one or more I / O interfaces 803, connected between the processor 801 and the memory 802; wherein the memory 802 stores one or more computer programs that can be executed by the at least one processor 801, and the one or more computer programs are executed by the at least one processor 801 so that the at least one processor 801 can execute the above-mentioned authorization method.

[0133] Each module in the above electronic device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0134] The embodiment of the present disclosure also provides a computer-readable storage medium, which may be a volatile or non-volatile computer-readable storage medium, on which a computer program is stored, wherein the computer program implements the above-mentioned authorization method when executed by a processor.

[0135] The embodiment of the present disclosure also provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above-mentioned authorization method.

[0136] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable storage medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium).

[0137] As is known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable program instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technology, portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. In addition, it is known to those of ordinary skill in the art that communication media typically contain computer-readable program instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and may include any information delivery medium.

[0138] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0139] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0140] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK), etc.

[0141] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0142] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0143] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0144] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0145] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly noted, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. An authorization method, characterized in that: A first service unit applied to a service system comprises: When the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit, obtaining the authorization service pulled from the second service unit; Obtaining a target authorization file corresponding to the authorization service and obtaining an identifier of the target authorization file; According to the mapping relationship between the identifier of the authorization file and the authorization time information, searching for the target authorization time information of the target authorization file; When it is determined based on the target authorization time information that the current time satisfies a preset authorization condition, the authorization service is controlled to start.

2. The authorization method according to claim 1, characterized in that: The step of obtaining the identifier of the target authorization file includes: A hash value of the target authorization file is calculated, and the hash value of the target authorization file is used as an identifier of the target authorization file.

3. The authorization method according to claim 1, characterized in that: The method further comprises: Decrypting the target authorization time information to obtain the authorization deadline; When the current time is less than the authorization deadline, it is determined that the current time satisfies a preset authorization condition.

4. The authorization method according to claim 3, characterized in that: After decrypting the target authorization time information to obtain the authorization deadline, the method further includes: When the current time is greater than or equal to the authorization deadline, determining that the current time does not meet the preset authorization condition; The mapping relationship between the identifier of the target authorization file and the target authorization time information is deleted.

5. The authorization method according to claim 1, characterized in that: The method further comprises: In the case where the mapping relationship between the identifier of the target authorization file and the target authorization time information is not found, the authorization service is controlled to start according to the target authorization file, the hardware information of the physical machine where the first service unit is located, and the current time, the target authorization time information of the target authorization file is obtained, and the mapping relationship between the identifier of the target authorization file and the target authorization time information is stored.

6. The authorization method according to claim 5, characterized in that: The step of obtaining target authorization time information of the target authorization file includes: Extracting the authorization expiration time from the target authorization file; The authorization deadline is encrypted to obtain target authorization time information of the target authorization file.

7. The authorization method according to claim 5, characterized in that: The mapping relationship between the identifier of the target authorization file and the target authorization time information is stored, including: The identifier of the target authorization file is used as a key, the target authorization time information is used as a value, and the mapping relationship between the identifier of the target authorization file and the target authorization time information is stored in a key-value pair manner.

8. An authorization device, characterized in that: The first service unit configured in the service system includes: A first acquisition module, configured to acquire the authorization service pulled from the second service unit when the authorization service running in the second service unit of the service system is interrupted and the authorization service is to be switched to the first service unit; A second acquisition module, used to acquire a target authorization file corresponding to the authorization service and to acquire an identifier of the target authorization file; A search module, used for searching the target authorization time information of the target authorization file according to the mapping relationship between the identifier of the authorization file and the authorization time information; The processing module is used to control the start of the authorization service when it is determined based on the target authorization time information that the current moment meets the preset authorization condition.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the authorization method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the authorization method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The invention comprises a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the authorization method as described in any one of claims 1 to 7.

Images