Authorization method and device, electronic equipment, storage medium and computer program product

Abstract

The invention relates to an authorization method and device, electronic equipment, a storage medium and a computer program product. The authorization method comprises the steps that a first server in a server cluster obtains and displays hardware information of each server in the server cluster; the first server obtains an authorization file which is provided by a software supplier and aims at the target software; the first server compares the obtained hardware information of each server with the hardware information of the server which is allowed to be authorized and contained in the authorization file, and a comparison result is obtained; and authorizing at least one server in the server cluster based on the comparison result. Therefore, in the invention, a single-machine or multi-machine authorization mode can be supported, that is, authorization for a plurality of servers can be realized only through one authorization file. The tedious operation process of independently carrying out authorization operation on each server is avoided, the workload of server authorization is reduced, and the efficiency of server authorization is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and more particularly, to an authorization method, device, electronic device, storage medium, and computer program product. Background Art

[0002] License refers to software license, which is a standard contract. It is a common method for software developers to restrict customers' use of software and a means to prevent customers from repackaging and reselling. The main purpose of license is to stipulate and restrict customers' rights to use software or its source code.

[0003] In the prior art, an authorization file can be generated according to the contract signed between the software service provider and the customer, and the authorization file can be given to the customer for activation, so as to achieve the purpose of limiting the customer's right to use the software program. Specifically, the license authentication information and the software program are usually packaged and installed together to write the license to the customer's server file. Then, the customer's server can parse the license and control the validity period and data processing volume of the software program based on the parsed results. For example, once it is detected that the usage limit is exceeded, a prompt will be given and the software program will be exited.

[0004] However, when there are many devices that want to be authorized, authorization operations need to be performed separately for each device, that is, the number of authorization operations required is the same as the number of devices that want to be authorized. The workload of device authorization is large and the efficiency is low. Summary of the invention

[0005] The present disclosure provides an authorization method, apparatus, electronic device, storage medium and computer program product to at least solve the problem of large workload and low efficiency of device authorization in the above-mentioned related technologies.

[0006] According to a first aspect of an embodiment of the present disclosure, there is provided an authorization method, which is applied to a server cluster, and includes: obtaining, by a first server in the server cluster, and displaying hardware information of each server in the server cluster, wherein the server cluster includes at least one server requesting authorization for target software; obtaining, by the first server, an authorization file for the target software provided by a software vendor, wherein the authorization file is generated by the software vendor based on hardware information of each server provided by a user, and the user is a user who manages the server cluster; comparing, by the first server, the obtained hardware information of each server with the hardware information of the servers allowed to obtain authorization contained in the authorization file, and obtaining a comparison result; and authorizing at least one server in the server cluster based on the comparison result.

[0007] Optionally, the authorization file also includes an authorization period and an allowed authorization quantity, wherein the authorization period is used to indicate the period for the terminal to use the target software, and the allowed authorization quantity is used to indicate the maximum number of terminals allowed to obtain the right to use the target software, and the terminal is a terminal controlled by an authorized server.

[0008] Optionally, the authorization method also includes: the authorization method also includes: receiving, by a second server in the server cluster, an access request sent by a target terminal, wherein the second server is one of the authorized servers; determining, by the second server in response to the access request, a total number of terminals managed by the second server if the target terminal is connected to the second server; and controlling access to the target terminal based on a comparison result of the total number and the allowed authorized number.

[0009] Optionally, controlling the access of the target terminal based on the comparison result of the total number and the allowed authorized number includes: when the total number is less than or equal to the allowed authorized number, sending an allow notification message to the target terminal allowing access to the second server; otherwise, sending a prohibition notification message to the target terminal prohibiting access to the second server.

[0010] Optionally, the authorization method further includes: periodically acquiring the hardware information of each successfully authorized server; matching the periodically acquired hardware information of each successfully authorized server with the hardware information of the successfully authorized server acquired during the authorization process to obtain a degree of matching; when the degree of matching is greater than or equal to a preset threshold, maintaining the successfully authorized server in a successfully authorized state; otherwise, determining that the authorization for the successfully authorized server has expired.

[0011] Optionally, authorizing at least one server in the server cluster based on the comparison result includes: determining that authorization is successful for a server in the server cluster whose corresponding comparison result is consistent; and determining that authorization is failed for a server in the server cluster whose corresponding comparison result is inconsistent.

[0012] Optionally, the hardware information includes at least one of the following items: a universal unique identification code of the server, CPU information of the server, mainboard information of the server, disk information of the server, and network card information of the server.

[0013] According to a second aspect of an embodiment of the present disclosure, there is provided an authorization device, which is applied to a server cluster and includes: a hardware information acquisition module, which is configured to acquire and display hardware information of each server in the server cluster by a first server in the server cluster, wherein the server cluster includes at least one server that requests authorization for target software; an authorization file acquisition module, which is configured to acquire, by the first server, an authorization file for the target software provided by a software vendor, wherein the authorization file is generated by the software vendor based on hardware information of each server provided by a user, and the user is a user who manages the server cluster; a comparison module, which is configured to compare, by the first server, the acquired hardware information of each server with the hardware information of the servers allowed to obtain authorization contained in the authorization file to obtain a comparison result; and an authorization module, which is configured to authorize at least one server in the server cluster based on the comparison result.

[0014] Optionally, the authorization file also includes an authorization period and an allowed authorization quantity, wherein the authorization period is used to indicate the period for the terminal to use the target software, and the allowed authorization quantity is used to indicate the maximum number of terminals allowed to obtain the right to use the target software, and the terminal is a terminal controlled by an authorized server.

[0015] Optionally, the authorization device also includes: a request receiving module, configured to receive an access request sent by a target terminal by a second server in the server cluster, wherein the second server is one of the authorized servers; a quantity determination module, configured to determine, by the second server in response to the access request, the total number of terminals managed by the second server if the target terminal is connected to the second server; and an access control module, configured to control access of the target terminal based on a comparison result of the total number and the allowed authorized number.

[0016] Optionally, the access control module is configured to: when the total number is less than or equal to the allowed authorized number, send a permission notification message to the target terminal allowing access to the second server; otherwise, send a prohibition notification message to the target terminal prohibiting access to the second server.

[0017] Optionally, the authorization device also includes: a timed acquisition module, configured to periodically acquire the hardware information of each successfully authorized server; a matching module, configured to match the timed acquired hardware information of each successfully authorized server with the hardware information of the successfully authorized server acquired during the authorization process to obtain a matching degree; an execution module, configured to maintain the successfully authorized server in a successfully authorized state when the matching degree is greater than or equal to a preset threshold; otherwise, determine that the authorization for the successfully authorized server has expired.

[0018] Optionally, the authorization module is configured to: determine that the authorization is successful for the corresponding server in the server cluster with the consistent comparison result; and determine that the authorization is failed for the corresponding server in the server cluster with the inconsistent comparison result.

[0019] Optionally, the hardware information includes at least one of the following items: a universal unique identification code of the server, CPU information of the server, mainboard information of the server, disk information of the server, and network card information of the server.

[0020] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the authorization method according to the present disclosure.

[0021] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the authorization method according to the present disclosure.

[0022] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the authorization method according to the present disclosure is implemented.

[0023] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0024] In the present disclosure, a single machine or multiple machines authorization mode can be supported, that is, the present disclosure can realize authorization for multiple servers through only one authorization file, avoiding the cumbersome operation process of performing authorization operations for each server separately, reducing the workload of server authorization, and improving the efficiency of server authorization.

[0025] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0027] Figure 1 is a flow chart illustrating an authorization method according to an exemplary embodiment of the present disclosure;

[0028] Figure 2 is a schematic diagram showing a process of generating an authorization file according to an exemplary embodiment of the present disclosure;

[0029] Figure 3 is a schematic diagram showing a flow chart of performing access control on a terminal according to an exemplary embodiment of the present disclosure;

[0030] Figure 4 is a flowchart illustrating the use of a target software platform according to an exemplary embodiment of the present disclosure;

[0031] Figure 5 is a schematic diagram showing a process of regularly reporting hardware information according to an exemplary embodiment of the present disclosure;

[0032] Figure 6 is a schematic diagram showing a flow chart of performing timing verification using hardware information reported regularly according to an exemplary embodiment of the present disclosure;

[0033] Figure 7 is an overall flow chart showing an authorization method according to an exemplary embodiment of the present disclosure;

[0034] Figure 8 is a schematic diagram showing an authorization activation process for a server according to an exemplary embodiment of the present disclosure;

[0035] Fig. 9 is a block diagram illustrating an authorization device according to an exemplary embodiment of the present disclosure;

[0036] Fig.10 is a block diagram illustrating an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0037] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0038] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The implementation methods described in the following examples do not represent all implementation methods consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the attached claims.

[0039] It should be noted that the phrase "at least one of the items" in the present disclosure includes three types of parallel situations: "any one of the items", "a combination of any number of the items", and "all of the items". For example, "including at least one of A and B" includes the following three parallel situations: (1) including A; (2) including B; (3) including A and B. Another example is "executing at least one of step 1 and step 2" which means the following three parallel situations: (1) executing step 1; (2) executing step 2; (3) executing step 1 and step 2.

[0040] As mentioned above, License refers to a software license, and its main purpose is to stipulate and restrict the customer's right to use the software or its source code. Software licenses can be roughly divided into two types: "lifetime license" and "limited-time license". Among them, "lifetime license" is generally used more in the personal field, while "limited-time license" is generally used in the commercial field. In the relevant technology, there are many software licensing methods, that is, software authorization methods, such as "dongle" authorization method, authorization method by binding hardware information, cloud authorization method, etc.

[0041] Regarding the "encryption dongle" authorization method, it is a software encryption product that is a combination of software and hardware that is plugged into a computer interface. The dongle generally has several to dozens of Kbytes of storage space for reading and writing, and some dongles also have a single-chip microcomputer added inside. When the software is running, it can send a message to the dongle and check whether the dongle exists by judging whether the password data returned from the interface is correct. For example, the password data returned from the interface can be 0 or 1. The dongle hardware uses a chip with relatively good security. The chip can contain 64 memory units, 56 of which can be used by users.

[0042] The authorization method based on binding hardware information mainly associates and binds software authorization with machine hardware information. The bound machine hardware features mainly include: CPU serial number, BIOS serial number, hard disk serial number, network card MAC address, etc.

[0043] As for the cloud authorization method, it is mainly implemented by binding the software authorization to the authorization server on the Internet. It is an authorization solution of the cloud computing model, so it is also called "cloud authorization". The security strength of cloud authorization is very high, even higher than that of encryption lock. This is because the authorization server has a firewall and perfect intrusion detection technology, and any illegal access and abnormal situation can be monitored, so its security is much higher.

[0044] However, no matter which of the above authorization methods is used, when there are many devices that want to be authorized, authorization operations need to be performed separately for each device, that is, the number of authorization operations required is the same as the number of devices that want to be authorized. The workload of device authorization is large and the efficiency is low.

[0045] In order to solve the above problems existing in the related art, the authorization method, device, electronic device, storage medium and computer program product provided by the present disclosure can support the authorization mode of a single machine or multiple machines, that is, the present disclosure can realize authorization for multiple servers through only one authorization file. The cumbersome operation process of performing authorization operations for each server separately is avoided, the workload of server authorization is reduced, and the efficiency of server authorization is improved.

[0046] Figure 1 is a flow chart illustrating an authorization method according to an exemplary embodiment of the present disclosure, which is applied to a server cluster.

[0047] Reference Figure 1 In step 101, the first server in the server cluster may obtain and display the hardware information of each server in the server cluster, wherein the server cluster may include at least one server requesting to obtain authorization for the target software.

[0048] It should be noted that in the present disclosure, information sharing can be achieved between the servers in the server cluster, that is, any server can obtain the hardware information of other servers in the server cluster. Exemplarily, the number of servers included in the server cluster can be but not limited to: 3, 4, 5, etc., and the present disclosure does not make specific restrictions on this.

[0049] According to an exemplary embodiment of the present disclosure, the above-mentioned “hardware information” may include at least one of the following items:

[0050] The server's Universally Unique Identifier (UUID), server's CPU information, server's motherboard information, server's disk information, server's network card information, etc.

[0051] In step 102, the first server may obtain an authorization file for the target software provided by the software provider, wherein the authorization file may be generated by the software provider based on hardware information of each server provided by a user, and the user may be a user who manages the server cluster.

[0052] Specifically, the first server can provide a visual page that can be used to display the hardware information of each server collected by the first server. After the user who manages the server cluster, that is, the customer's IT personnel, obtains the hardware information of each server displayed on the page, they can send the hardware information of each server to the software vendor. Then, the software vendor can write the hardware information of each server sent by the customer into the authorization file.

[0053] Figure 2 2 is a flow chart showing a method for generating an authorization file according to an exemplary embodiment of the present disclosure. Figure 2 The present disclosure may provide a license generator (LicGenerator), which is a tool for generating authorization files and can support execution on specific machines. LicGenerator can compile hardware information such as the machine's network card mac information into the authorization file to limit the range of devices that use the target software. Exemplarily, a software vendor can use LicGenerator to write information such as the hardware information, authorization period, and allowed authorization quantity of each server that is allowed to obtain authorization into the authorization file based on the software use contract signed with the customer.

[0054] In step 103, the first server may compare the acquired hardware information of each server with the hardware information of the servers allowed to obtain authorization contained in the authorization file to obtain a comparison result.

[0055] In step 104, at least one server in the server cluster may be authorized based on the comparison result. It should be noted that the authorization method provided by the present disclosure may be run based on a k8s high availability environment.

[0056] According to an exemplary embodiment of the present disclosure, it can be determined that the authorization is successful for the servers with consistent corresponding comparison results in the server cluster, and it can be determined that the authorization is failed for the servers with inconsistent corresponding comparison results in the server cluster.

[0057] Exemplarily, assuming that the first server collects the hardware information of three servers that want to be authorized, the above authorization file will contain the hardware information of the three servers that want to be authorized. For each of the three servers that want to be authorized, the hardware information of the server to be authorized collected by the first server can be compared with the hardware information of the server to be authorized contained in the authorization file. And, if the comparison results are consistent, it can be determined that the authorization for the server to be authorized is successful; otherwise, that is, if the comparison results are inconsistent, it can be determined that the authorization for the server to be authorized has failed.

[0058] In this way, by writing the hardware information of the server that wants to obtain authorization into the authorization file, it is possible to arbitrarily specify a single or multiple servers to obtain authorization for the target software based on the actual needs of the customer, and the autonomy and flexibility of software authorization are better. In addition, since the hardware information of multiple servers that want to obtain authorization is allowed to be written into the authorization file, authorization management and control of multiple servers is achieved at the same time, which improves the efficiency of server authorization.

[0059] According to an exemplary embodiment of the present disclosure, the above-mentioned "authorization file" may also include "authorization period" and "allowed authorization quantity", wherein "authorization period" may be used to indicate the period during which the terminal uses the target software. Exemplarily, the "authorization period" may be counted in "days". "Allowed authorization quantity" may be used to indicate the maximum number of terminals that are allowed to obtain the right to use the target software, and the terminals are terminals managed by the authorized server. Exemplarily, the "allowed authorization quantity" may be, but is not limited to: 100, 200, etc., which needs to be determined based on the actual needs of the customer.

[0060] In this way, in the present disclosure, in addition to supporting single-machine or multi-machine deployment methods, it is also possible to limit both the usage time of the software platform and the number of terminals using the software platform, that is, to achieve simultaneous control of the software platform and the units on the software platform, thereby expanding the scope of authorization control and improving the flexibility of authorization control.

[0061] According to an exemplary embodiment of the present disclosure, the access request sent by the target terminal can also be received by the second server in the server cluster, wherein the second server can be one of the authorized servers. Then, the second server can respond to the access request and determine the total number of terminals managed by the second server if the target terminal is connected to the second server. Next, the access of the target terminal can be controlled based on the comparison result of the total number and the authorized number allowed in the above authorization file.

[0062] According to an exemplary embodiment of the present disclosure, when the above-mentioned total number is less than or equal to the allowed authorized number, an allow notification message allowing access to the second server can be sent to the target terminal; otherwise, that is, when the above-mentioned total number is greater than the allowed authorized number, a prohibition notification message prohibiting access to the second server can be sent to the target terminal.

[0063] Specifically, Figure 3 2 is a flow chart showing a process of performing access control on a terminal according to an exemplary embodiment of the present disclosure. Figure 3 , the target terminal can send an access request to the software platform service on the second server, and then the software platform service can search for authorization information from the authorization service on the second server based on the received access request, for example, the authorization period, the number of authorized terminals allowed, and the like can be searched from the authorization service. Next, if it is determined that the authorization has not expired, the total number of terminals that have been connected to the second server after the target terminal is connected to the second server can be determined based on the number of terminals that have currently been connected to the second server, and the total number of terminals that have been connected can be compared with the number of authorized terminals allowed corresponding to the second server.

[0064] When the total number of connected terminals does not exceed the allowed authorization number contained in the authorization file, that is, when the authorization point control is met, the target terminal can be allowed to access the second server. At this time, the target terminal obtains the right to use the target software, that is, the target terminal can enjoy the relevant services of the target software platform; otherwise, that is, when the total number of connected terminals exceeds the allowed authorization number contained in the authorization file, that is, when it exceeds the authorization point control, the target terminal can be prohibited from accessing the second server. At this time, the target terminal cannot obtain the right to use the target software, that is, the target terminal cannot enjoy the relevant services of the target software platform.

[0065] Thus, in the present disclosure, the allowed number of authorizations can be written into the authorization file based on the actual needs of the customer, and a flexible decision can be made as to whether new terminals are allowed to access the target software platform service, thereby providing better autonomy and flexibility in authorization management and control of terminals.

[0066] Figure 4 FIG. 1 is a flow chart showing a method of using a target software platform according to an exemplary embodiment of the present disclosure. Figure 4When a customer wants to use a function of the target software platform, he can click on the corresponding function option. At this time, the customer terminal will send a function usage request to the target software platform service on the authorized server. Then, the target software platform service can request authorization information from the authorization service on the authorized server, for example, authorization period information. Next, it can be determined whether the authorization has expired based on the requested authorization period. If it is determined that the authorization has expired, the customer can be notified that the authorization has expired, and the customer can be prohibited from using the relevant functions; otherwise, that is, if it is determined that the authorization has not expired, the corresponding functional service can be provided to the customer.

[0067] According to an exemplary embodiment of the present disclosure, the hardware information of each successfully authorized server can also be obtained at regular intervals. Then, the hardware information of each successfully authorized server obtained at regular intervals can be matched with the hardware information of the successfully authorized server obtained during the authorization process to obtain a matching degree. Next, when the matching degree is greater than or equal to a preset threshold, the successfully authorized server can be maintained in a successfully authorized state; otherwise, that is, when the matching degree is less than the preset threshold, it can be determined that the authorization for the successfully authorized server has expired.

[0068] Specifically, Figure 5 FIG. 1 is a schematic diagram showing a process of regularly reporting hardware information according to an exemplary embodiment of the present disclosure. Figure 5 , Collection service (Collect) and License service can be deployed on each server in the server cluster. And, each time the collection service on a server is started, the collection service will collect the hardware information of the server and report the collected hardware information to a designated server in the server cluster, where the designated server is used to collect the hardware information regularly reported by each successfully authorized server and perform regular verification based on the regularly reported hardware information.

[0069] For example, a scheduled task can be registered in the collection service. Whenever the time specified by the scheduled task is reached, the hardware information of the server can be collected, and then the collected hardware information can be reported to the license service of the above-mentioned specified server through grpc. For example, the collection frequency of the scheduled task can be but is not limited to: one day, that is, the scheduled task can perform hardware information collection and reporting once a day.

[0070] Figure 6 FIG. 1 is a flow chart showing a process of performing a timing check using hardware information reported regularly according to an exemplary embodiment of the present disclosure. Figure 6, the collection service on the successfully authorized server can only execute a scheduled task once a day to complete the reporting of hardware information. When the license service on the designated server detects that the hardware information regularly reported by a successfully authorized server and the degree of match between the hardware information of the successfully authorized server obtained during the authorization process is lower than the preset threshold, it can be determined that the authorization for the successfully authorized server has expired. If the server still wants to continue using the target software, it needs to reactivate the authorization. Exemplarily, the above-mentioned "preset threshold" can be but not limited to: 60%.

[0071] It should be noted that, as mentioned above, the hardware information of the server may include: UUID, CPU information (CPU SN), motherboard information (motherboard SN), disk information (disk SN), network card information (network card Mac information), etc. In addition, UUID refers to a number generated on a machine, which is guaranteed to be unique to all machines in the same time and space, that is, UUID is a unique identifier that will not be copied. In addition, when performing periodic verification of hardware information, the verification priority of the above-mentioned hardware information may be different. Exemplarily, the verification priority of "UUID" can be the highest, that is, it can be the first priority; and the verification priority of hardware information such as "CPU information", "motherboard information", "disk information", and "network card information" can be second, that is, it can be the second priority.

[0072] Specifically, when verifying hardware information, the UUID can be compared first. If the comparison result of the UUID is inconsistent, it can be determined that the server indicated by the UUID has never been authorized. In addition, "the comparison result of the UUID is inconsistent" generally includes two scenarios:

[0073] One scenario may be: the total number of regularly reported UUIDs is greater than the total number of UUIDs obtained during the authorization process. For example, the total number of regularly reported UUIDs is 4, while the total number of UUIDs obtained during the authorization process is 3. This means that only three servers were activated and authorized before, and the customer is currently trying to add another unauthorized server to the target software platform service. Obviously, there will only be three pairs of UUIDs that match at this time, and there must be one regularly reported UUID that cannot find a matching UUID during the authorization process. At this point, it can be determined that the UUID that failed to match does not have the right to use the target software, and the server indicated by the UUID can be prohibited from using the target software.

[0074] Another scenario may be: the customer clones a virtual machine of a server that has been successfully authorized, that is, copies the hardware information configuration of the successfully authorized server to another server. Then, the customer will shut down the successfully authorized server and enable another server that has copied the hardware information configuration of the successfully authorized server, thereby attempting to transfer the use rights of the target software to another server that has not been authorized at all. However, as mentioned above, UUID is a unique identifier for each server, that is, it is not replicable. Therefore, as long as the total number of UUIDs reported at a certain time is the same as the total number of UUIDs obtained during the authorization process, but there are some UUIDs that are inconsistent, it can be determined that the servers indicated by these inconsistent UUIDs are servers that the customer attempted to unreasonably obtain the use rights of the target software by copying hardware information, that is, the servers indicated by these inconsistent UUIDs have not actually been authorized at all.

[0075] Thus, in the present disclosure, by dynamically verifying the hardware information, that is, by periodically verifying the UUID of the server, it is possible to prevent the situation in which the customer transfers the target software usage rights to a device that has not been authorized without permission. That is, it is possible to provide a mechanism to prevent the tampering of permissions and avoid unreasonable malicious damage to the rights and interests of software vendors.

[0076] It should be noted that, when the multiple UUIDs reported regularly are consistent with the multiple UUIDs obtained during the authorization process, it is also possible to determine whether the "CPU information", "mainboard information", "disk information" and "network card information" of each server reported regularly match the "CPU information", "mainboard information", "disk information" and "network card information" of the server obtained during the authorization process. In addition, the weight of each type of hardware information such as "CPU information", "mainboard information", "disk information" and "network card information" may be different, wherein the greater the weight, the greater the impact of the matching degree of the corresponding type of hardware information on the overall matching degree. Exemplarily, the weight corresponding to each type of hardware information may be, but is not limited to: SN weight of CPU: 50%, SN weight of mainboard: 10%, SN weight of disk: 20%, Mac weight of network card: 20%.

[0077] In addition, the scenario where the UUID comparison is consistent but the other hardware information comparison is inconsistent can be: the customer did not replace the server itself, but replaced some hardware inside the server, such as the CPU, motherboard, disk, network card Mac, etc. The hardware information corresponding to different hardware of the same type is also different. For example, each of the two CPUs has its own SN, that is, the two SNs corresponding to the two CPUs are different; each of the two motherboards has its own SN, that is, the two SNs corresponding to the two motherboards are also different, etc. Therefore, when the customer replaces more hardware contained in the same server, the UUID comparison may be consistent, but the other hardware information comparison is inconsistent. At this time, it can also be considered that the authorization of the server with consistent UUID comparison but inconsistent other hardware information comparison has expired, that is, if the server wants to continue to use the target software, it needs to reactivate the authorization.

[0078] In this way, by distinguishing different priorities for hardware information verification, the granularity of hardware information verification can be finer and the levels can be clearer, thereby ensuring the accuracy and objectivity of the verification results.

[0079] Figure 7 is an overall flow chart illustrating an authorization method according to an exemplary embodiment of the present disclosure.

[0080] Reference Figure 7 In step 701, the hardware information, authorization period, allowed authorization quantity (terminal point control) and other information of the server to be authorized are obtained.

[0081] As mentioned above, "hardware information" may include but is not limited to: UUID, CPU information, motherboard information, disk information, network card information, etc.; "authorization period" may be used to indicate the period during which the terminal can use the target software. Exemplarily, "authorization period" may be counted in "days"; "allowed authorization quantity" may be used to indicate the maximum number of terminals that are allowed to obtain the right to use the target software, and the terminals are the terminals managed by the authorized server. Exemplarily, "allowed authorization quantity" may be but is not limited to: 100, 200, etc., which needs to be determined based on the actual needs of the customer.

[0082] In step 702, the software provider uses LicGenerator to encrypt the hardware information, authorization period, allowed authorization quantity and other information of the server to be authorized and generate an authorization file.

[0083] In step 703, authorization activation is performed on the server to be authorized based on the generated authorization file. It should be noted that the implementation process of authorization activation on the server to be authorized using the authorization file has been described in detail in the above embodiment and will not be repeated here.

[0084] Figure 8 is a schematic diagram illustrating a process of performing authorization activation on a server according to an exemplary embodiment of the present disclosure.

[0085] Reference Figure 8 In step 801, an authorization file is generated and imported into the server.

[0086] Specifically, if you want to activate authorization for three servers in a server cluster, you can start the collection service on each of the three servers, and then the collection service on each server can collect the hardware information of the corresponding server and report the collected hardware information to one of the three servers. That is, in the present disclosure, information sharing can be achieved between the servers in the server cluster, that is, any server can obtain the hardware information of other servers in the server cluster.

[0087] Next, after one of the three servers obtains the hardware information of each of the three servers, the hardware information can be displayed through a page. Exemplarily, the uim service can be called to display the hardware information through a page.

[0088] Then, the customer can send the hardware information to the software supplier, and the software supplier can use LicGenerator to encrypt the hardware information of each of the three servers, the authorization period agreed with the customer, and the authorization points (allowed authorization quantity) agreed with the customer and generate an authorization file.

[0089] Next, the authorization file may be imported into the server through the page displaying the hardware information, wherein the server for importing the authorization file may be the server for collecting the hardware information of each server.

[0090] In step 802, the authorization file is sent to the license service on the server via grpc.

[0091] In step 803, the license service on the server is used to perform a decryption operation on the authorization file to obtain the decrypted hardware information of each of the three servers.

[0092] In step 804, the decrypted hardware information of each of the three servers is compared with the hardware information reported by the server in step 801 to obtain a comparison result.

[0093] In step 805, when the comparison result corresponding to a certain server is inconsistent, it is determined that the authorization for the server has failed, and the authorization result is fed back to the page to prompt the customer that the activation has failed.

[0094] In step 806, when the comparison result corresponding to a certain server is consistent, the hardware information and authorization file reported by the server in step 801 are saved locally, that is, the hardware information and authorization file reported by the server in step 801 can be saved in the local file of the license service.

[0095] In step 807, it is determined that the authorization of the server with the corresponding consistent comparison result is successful.

[0096] In step 808, the authorization result of the server with the same comparison result is fed back to the page to prompt the customer that the activation is successful.

[0097] Fig. 9 is a block diagram illustrating an authorization device 900 according to an exemplary embodiment of the present disclosure, which is applied to a server cluster.

[0098] Reference Fig. 9 The authorization device 900 may include a hardware information acquisition module 901, an authorization file acquisition module 902, a comparison module 903 and an authorization module 904.

[0099] The hardware information acquisition module 901 of the first server in the server cluster may acquire and display the hardware information of each server in the server cluster, wherein the server cluster may include at least one server requesting to obtain authorization for the target software.

[0100] It should be noted that in the present disclosure, information sharing can be achieved between the servers in the server cluster, that is, any server can obtain the hardware information of other servers in the server cluster. Exemplarily, the number of servers included in the server cluster can be but not limited to: 3, 4, 5, etc., and the present disclosure does not make specific restrictions on this.

[0101] According to an exemplary embodiment of the present disclosure, the above-mentioned "hardware information" may include at least one of the following items: the server's universally unique identifier (UUID), the server's CPU information, the server's motherboard information, the server's disk information, the server's network card information, and the like.

[0102] The authorization file acquisition module 902 of the first server may acquire the authorization file for the target software provided by the software supplier, wherein the authorization file may be generated by the software supplier based on the hardware information of each server provided by a user, and the user may be a user who manages the server cluster.

[0103] Specifically, the first server can provide a visual page that can be used to display the hardware information of each server collected by the first server. After the user who manages the server cluster, that is, the customer's IT personnel, obtains the hardware information of each server displayed on the page, they can send the hardware information of each server to the software vendor. Then, the software vendor can write the hardware information of each server sent by the customer into the authorization file.

[0104] The comparison module 903 of the first server may compare the acquired hardware information of each server with the hardware information of the server allowed to obtain authorization contained in the authorization file to obtain a comparison result.

[0105] The authorization module 904 can authorize at least one server in the server cluster based on the above comparison result. It should be noted that the authorization method provided by the present disclosure can be run based on the k8s high-availability environment.

[0106] According to an exemplary embodiment of the present disclosure, the authorization module 904 may determine that the authorization is successful for a server with a consistent corresponding comparison result in the server cluster, and the authorization module 904 may determine that the authorization is failed for a server with an inconsistent corresponding comparison result in the server cluster.

[0107] Exemplarily, assuming that the first server collects the hardware information of three servers that want to be authorized, the above authorization file will contain the hardware information of the three servers that want to be authorized. For each of the three servers that want to be authorized, the hardware information of the server to be authorized collected by the first server can be compared with the hardware information of the server to be authorized contained in the authorization file. And, if the comparison results are consistent, it can be determined that the authorization for the server to be authorized is successful; otherwise, that is, if the comparison results are inconsistent, it can be determined that the authorization for the server to be authorized has failed.

[0108] In this way, by writing the hardware information of the server that wants to obtain authorization into the authorization file, it is possible to arbitrarily specify a single or multiple servers to obtain authorization for the target software based on the actual needs of the customer, and the autonomy and flexibility of software authorization are better. In addition, since the hardware information of multiple servers that want to obtain authorization is allowed to be written into the authorization file, authorization management and control of multiple servers is achieved at the same time, which improves the efficiency of server authorization.

[0109] According to an exemplary embodiment of the present disclosure, the above-mentioned "authorization file" may also include "authorization period" and "allowed authorization quantity", wherein "authorization period" may be used to indicate the period during which the terminal uses the target software. Exemplarily, the "authorization period" may be counted in "days". "Allowed authorization quantity" may be used to indicate the maximum number of terminals that are allowed to obtain the right to use the target software, and the terminals are terminals managed by the authorized server. Exemplarily, the "allowed authorization quantity" may be, but is not limited to: 100, 200, etc., which needs to be determined based on the actual needs of the customer.

[0110] In this way, in the present disclosure, in addition to supporting single-machine or multi-machine deployment methods, it is also possible to limit both the usage time of the software platform and the number of terminals using the software platform, that is, to achieve simultaneous control of the software platform and the units on the software platform, thereby expanding the scope of authorization control and improving the flexibility of authorization control.

[0111] According to an exemplary embodiment of the present disclosure, the authorization device 900 may further include a request receiving module, a quantity determining module and an access control module.

[0112] The access request sent by the target terminal can also be received by the request receiving module of the second server in the server cluster, wherein the second server can be one of the authorized servers. Then, the number determination module of the second server can respond to the access request and determine the total number of terminals controlled by the second server if the target terminal is connected to the second server. Next, the access control module can control the access of the target terminal based on the comparison result of the total number and the authorized number allowed in the above authorization file.

[0113] According to an exemplary embodiment of the present disclosure, when the above-mentioned total number is less than or equal to the allowed authorized number, the access control module may send a permission notification message to the target terminal allowing access to the second server; otherwise, that is, when the above-mentioned total number is greater than the allowed authorized number, the access control module may send a prohibition notification message to the target terminal prohibiting access to the second server.

[0114] Thus, in the present disclosure, the allowed number of authorizations can be written into the authorization file based on the actual needs of the customer, and a flexible decision can be made as to whether new terminals are allowed to access the target software platform service, thereby providing better autonomy and flexibility in authorization management and control of terminals.

[0115] According to an exemplary embodiment of the present disclosure, the authorization device 900 may further include a timing acquisition module, a matching module and an execution module.

[0116] The timing acquisition module can also periodically acquire the hardware information of each successfully authorized server. Then, the matching module can match the hardware information of each successfully authorized server acquired periodically with the hardware information of the successfully authorized server acquired during the authorization process to obtain the degree of matching. Next, when the degree of matching is greater than or equal to a preset threshold, the execution module can maintain the successfully authorized server in a successfully authorized state; otherwise, that is, when the degree of matching is less than the preset threshold, the execution module can determine that the authorization for the successfully authorized server has expired.

[0117] Thus, in the present disclosure, by dynamically verifying the hardware information, that is, by periodically verifying the UUID of the server, it is possible to prevent the client from transferring the target software usage rights to a device that has not been authorized without permission, that is, it is possible to provide a mechanism to prevent the tampering of the rights and interests, and to avoid unreasonable and malicious damage to the rights and interests of software vendors. Furthermore, by distinguishing different priorities for hardware information verification, the granularity of hardware information verification can be finer and the levels can be more distinct, thereby ensuring the accuracy and objectivity of the verification results.

[0118] Fig.10 is a block diagram illustrating an electronic device 1000 according to an exemplary embodiment of the present disclosure.

[0119] Reference Fig.10 The electronic device 1000 includes at least one memory 1001 and at least one processor 1002. The at least one memory 1001 stores instructions. When the instructions are executed by the at least one processor 1002, the authorization method according to the exemplary embodiment of the present disclosure is executed.

[0120] As an example, the electronic device 1000 may be a PC, a tablet device, a personal digital assistant, a smart phone, or other device capable of executing the above instructions. Here, the electronic device 1000 is not necessarily a single electronic device, but may also be any device or circuit capable of executing the above instructions (or instruction sets) individually or in combination. The electronic device 1000 may also be part of an integrated control system or a system manager, or may be configured as a portable electronic device interconnected with a local or remote (e.g., via wireless transmission) interface.

[0121] In the electronic device 1000, the processor 1002 may include a central processing unit (CPU), a graphics processing unit (GPU), a programmable logic device, a dedicated processor system, a microcontroller or a microprocessor. As an example and not limitation, the processor may also include an analog processor, a digital processor, a microprocessor, a multi-core processor, a processor array, a network processor, etc.

[0122] The processor 1002 may execute instructions or codes stored in the memory 1001, wherein the memory 1001 may also store data. Instructions and data may also be sent and received over a network via a network interface device, wherein the network interface device may employ any known transmission protocol.

[0123] The memory 1001 may be integrated with the processor 1002, for example, by placing RAM or flash memory within an integrated circuit microprocessor or the like. In addition, the memory 1001 may include a separate device, such as an external disk drive, a storage array, or any other storage device that can be used by a database system. The memory 1001 and the processor 1002 may be operatively coupled, or may communicate with each other, such as through an I / O port, a network connection, etc., so that the processor 1002 can read files stored in the memory.

[0124] In addition, the electronic device 1000 may further include a video display (such as a liquid crystal display) and a user interaction interface (such as a keyboard, a mouse, a touch input device, etc.) All components of the electronic device 1000 may be connected to each other via a bus and / or a network.

[0125] According to an exemplary embodiment of the present disclosure, a computer-readable storage medium may also be provided, and when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the above-mentioned authorization method. Examples of computer-readable storage media here include: read-only memory (ROM), random access programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), flash memory, non-volatile memory, CD-ROM, CD-R, CD+R, CD-RW, CD+RW, DVD-ROM, DVD-R, DVD+R, DVD-RW, DVD+RW, DVD-RAM, BD-ROM, BD-R, BD-R LTH, BD-RE, Blu-ray or optical disk storage, hard disk drive (HDD), solid state drive (SSD), card storage (such as, multimedia card, secure digital (SD) card or extreme digital (XD) card), magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk and any other device, any other device is configured to store computer programs and any associated data, data files and data structures in a non-transitory manner and provide the computer programs and any associated data, data files and data structures to a processor or computer so that the processor or computer can execute the computer program. The computer program in the above-mentioned computer-readable storage medium can be run in an environment deployed in a computer device such as a client, a host, an agent device, a server, etc. In addition, in one example, the computer program and any associated data, data files and data structures are distributed on a networked computer system, so that the computer program and any associated data, data files and data structures are stored, accessed and executed in a distributed manner by one or more processors or computers.

[0126] According to an exemplary embodiment of the present disclosure, a computer program product may also be provided, including a computer program, and when the computer program is executed by a processor, the authorization method according to the present disclosure is implemented.

[0127] According to the authorization method, device, electronic device, storage medium and computer program product disclosed in the present invention, a single machine or multiple machines authorization mode can be supported, that is, the present invention can realize authorization for multiple servers through only one authorization file, avoiding the cumbersome operation process of performing authorization operations for each server separately, reducing the workload of server authorization, and improving the efficiency of server authorization.

[0128] According to the exemplary embodiment of the present disclosure, by writing the hardware information of the server that wants to obtain authorization into the authorization file, it is possible to arbitrarily specify a single or multiple servers to obtain authorization for the target software based on the actual needs of the customer, and the autonomy and flexibility of software authorization are good. In addition, since the hardware information of multiple servers that want to obtain authorization is allowed to be written into the authorization file, authorization management and control of multiple servers is achieved at the same time, which improves the efficiency of server authorization.

[0129] According to the exemplary embodiments of the present disclosure, in addition to supporting the deployment of a single machine or multiple machines, it is also possible to limit both the usage time of the software platform and the number of terminals using the software platform, that is, to achieve simultaneous control of the software platform and the units on the software platform, thereby expanding the scope of authorization control and improving the flexibility of authorization control.

[0130] According to an exemplary embodiment of the present disclosure, in the present disclosure, the allowed authorization quantity can be written into the authorization file based on the actual needs of the customer himself, and a flexible decision can be made whether to allow new terminals to access the target software platform service, which provides better autonomy and flexibility in authorization management and control of terminals.

[0131] According to an exemplary embodiment of the present disclosure, in the present disclosure, by dynamically verifying hardware information, that is, by periodically verifying the UUID of the server, it is possible to prevent the situation where the customer migrates the use rights of the target software to a device that has not been authorized without permission, that is, a mechanism can be provided to prevent permissions from being tampered with, thereby avoiding unreasonable malicious damage to the rights and interests of software vendors.

[0132] According to an exemplary embodiment of the present disclosure, by distinguishing different priorities for hardware information verification, the granularity of hardware information verification can be finer and the levels can be more distinct, thereby ensuring the accuracy and objectivity of the verification result.

[0133] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0134] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An authorization method, applied to a server cluster, characterized in that: include: Acquiring and displaying hardware information of each server in the server cluster by a first server in the server cluster, wherein the server cluster includes at least one server requesting authorization for target software; The first server obtains an authorization file for the target software provided by a software provider, wherein the authorization file is generated by the software provider based on hardware information of each server provided by a user, and the user is a user who manages the server cluster; The first server compares the acquired hardware information of each server with the hardware information of the server allowed to obtain authorization contained in the authorization file to obtain a comparison result; Based on the comparison result, at least one server in the server cluster is authorized.

2. The authorization method according to claim 1, characterized in that: The authorization file also includes an authorization period and an allowed authorization quantity, wherein the authorization period is used to indicate the period during which the terminal uses the target software, and the allowed authorization quantity is used to indicate the maximum number of terminals allowed to obtain the right to use the target software, and the terminal is a terminal controlled by an authorized server.

3. The authorization method according to claim 2, characterized in that: The authorization method further includes: The second server in the server cluster receives an access request sent by the target terminal, wherein the second server is a server in the authorized servers; The second server determines, in response to the access request, a total number of terminals that are managed by the second server if the target terminal is connected to the second server; Based on the comparison result between the total number and the allowed authorization number, access of the target terminal is controlled.

4. The authorization method according to claim 3, characterized in that: The controlling the access of the target terminal based on the comparison result between the total number and the allowed authorization number includes: When the total number is less than or equal to the allowed authorized number, a permission notification message is sent to the target terminal to allow access to the second server; otherwise, a prohibition notification message is sent to the target terminal to prohibit access to the second server.

5. The authorization method according to claim 1, characterized in that: The authorization method further includes: Regularly obtain the hardware information of each successfully authorized server; Matching the hardware information of each successfully authorized server obtained at a fixed time with the hardware information of the successfully authorized server obtained during the authorization process to obtain a matching degree; When the matching degree is greater than or equal to a preset threshold, the successfully authorized server is maintained in a successfully authorized state; otherwise, it is determined that the authorization for the successfully authorized server has expired.

6. The authorization method according to claim 1, characterized in that: Authorizing at least one server in the server cluster based on the comparison result includes: Determining that the server in the server cluster that has the same comparison result is authorized successfully; It is determined that authorization fails for the server in the server cluster whose corresponding comparison result is inconsistent.

7. The authorization method according to claim 1, characterized in that: The hardware information includes at least one of the following items: The universal unique identification code of the server, the CPU information of the server, the mainboard information of the server, the disk information of the server, and the network card information of the server.

8. An authorization device, applied to a server cluster, characterized in that: include: a hardware information acquisition module configured to acquire and display hardware information of each server in the server cluster by a first server in the server cluster, wherein the server cluster includes at least one server requesting authorization for target software; an authorization file acquisition module, configured to acquire, by the first server, an authorization file for the target software provided by a software provider, wherein the authorization file is generated by the software provider based on hardware information of each server provided by a user, and the user is a user who manages the server cluster; A comparison module is configured to compare the hardware information of each server obtained by the first server with the hardware information of the server allowed to obtain authorization contained in the authorization file to obtain a comparison result; The authorization module is configured to authorize at least one server in the server cluster based on the comparison result.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the authorization method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the authorization method as described in any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the authorization method according to any one of claims 1 to 7 is implemented.

Images