Authorization management method, private cloud management platform and computer equipment

Abstract

The invention relates to an authorization management method, a private cloud management platform and computer equipment. The method comprises the following steps: receiving an authorization request for a private cloud platform as a service PaaS platform from a client, wherein the authorization request comprises a platform identifier, an application code and at least one target authorization component; verifying the authorization request, sending the authorization request to a PaaS component product console under the condition that the authorization request passes the verification so as to indicate the PaaS component product console to perform authority verification on each target authorization component, determining that the authorization of the corresponding target authorization component is passed under the condition that the authorization request passes the verification, and sending the authorization request to the PaaS component product console under the condition that the authorization request does not pass the verification. Determining authorization failure of the corresponding target authorization component; the authorization result of each target authorization component is returned to the private cloud management platform; and generating an authorization certificate based on the authorization result of each target authorization component, and returning the authorization certificate to the client. And the safety risk is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an authorization management method, a private cloud management platform, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development and application of cloud computing technology, more and more enterprises are using hybrid cloud or private cloud to deploy and manage internal application systems. The increasing number of private clouds, diversified application scenarios, and complex security management and control have brought huge challenges to the management of licenses for private cloud vendors. In terms of delivery methods, private cloud management software is provided to users, which users can install and configure on their own hardware infrastructure, flexibly build a private cloud environment, and fully control the deployment, upgrade, and data management of the software system. For private cloud vendors, the private cloud platform on the user side is a black box, which requires the cloud computing platform to provide convenient and fast software license loading functions while protecting the authorization from unauthorized use and avoiding other security risks. The license authorization content of the private cloud PaaS platform is also different from that of traditional software, which usually only requires a one-time purchase or monthly payment. The authorization of the private cloud PaaS platform focuses more on the platform loading capability, that is, the activation and management capabilities of cloud computing product components. There are many components loaded on the private cloud PaaS platform, which requires the authorization content to support diversification, and at the same time, a unified and effective method is required for platform supervision.

[0003] The traditional static license verification mechanism can no longer meet the flexible and changing business needs, especially when the platform is still in a period of rapid iteration and development. It is easy to cause errors, and the unchanging verification logic is extremely likely to cause security risks. Summary of the invention

[0004] Based on this, it is necessary to provide an authorization management method, a private cloud management platform, a computer device, a computer-readable storage medium and a computer program product that can reduce security risks in response to the above technical problems.

[0005] In a first aspect, the present application provides an authorization management method, which is applied to a private cloud management platform, including:

[0006] Receive an authorization request for a private cloud platform as a service PaaS platform from a client, the authorization request including a platform identifier, an application code, and at least one target authorization component, the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, the platform feature combination is obtained by extracting features from data under various preset platform feature dimensions by the private cloud PaaS platform, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data;

[0007] Verify the authorization request. If the verification is successful, send the authorization request to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, determine that the corresponding target authorization component is authorized. If the verification fails, determine that the authorization of the corresponding target authorization component fails. Return the authorization results of each target authorization component to the private cloud management platform;

[0008] Based on the authorization results of each target authorization component, an authorization certificate is generated, and the authorization certificate is returned to the client.

[0009] In one of the embodiments, the verification of the authorization request includes: parsing the authorization request to obtain the platform identifier and the application code; verifying the platform feature combination and resource statistical information contained in the application code; searching for historical authorization records based on the platform identifier; searching for whether the corresponding private cloud PaaS platform has ever infringed upon the platform identifier; and determining that the verification is successful if the platform feature combination and the resource statistical information are verified successfully, there is no authorization failure record in the historical authorization records, and there is no infringement on the corresponding private cloud PaaS platform.

[0010] In one of the embodiments, the generation of the authorization certificate based on the authorization results of each target authorization component includes: summarizing the component authorization information based on the authorization results of each target authorization component; generating general authorization information based on the component authorization information; and processing the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to obtain an authorization certificate.

[0011] In one of the embodiments, the authorization certificate includes header content, key decryption content, authorization content and verification content.

[0012] In a second aspect, the present application also provides an authorization management method, which is applied to a private cloud PaaS platform, including:

[0013] After receiving the application code generation request triggered by the user, the feature extraction module is loaded, and the feature extraction module is used to extract the features of the data under each preset platform feature dimension to obtain the platform feature combination; and the resource statistical information is generated based on the instance statistical data;

[0014] An application code is generated based on the platform feature combination and the resource statistical information.

[0015] In one of the embodiments, an authorization certificate uploaded by a user is received; the validity and integrity of the authorization certificate are verified, and if the verification passes, the authorized target component is determined from the authorization certificate; and the authorization certificate is imported into the target component.

[0016] In a third aspect, the present application also provides a private cloud management platform, including:

[0017] A receiving module, configured to receive an authorization request from a client for a private cloud platform as a service PaaS platform, wherein the authorization request includes a platform identifier, an application code, and at least one target authorization component, wherein the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, wherein the platform feature combination is obtained by extracting features from data under various preset platform feature dimensions by the private cloud PaaS platform, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data;

[0018] A verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, it is determined that the corresponding target authorization component is authorized. If the verification fails, it is determined that the authorization of the corresponding target authorization component fails; the authorization results of each target authorization component are returned to the private cloud management platform;

[0019] The generation module is used to generate an authorization certificate based on the authorization results of each target authorization component, and return the authorization certificate to the client.

[0020] In a fourth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method provided in the first aspect or the second aspect when executing the computer program.

[0021] In a fifth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method provided in the first aspect or the second aspect.

[0022] In a sixth aspect, the present application further provides a computer program product, including a computer program, which implements the method provided in the first aspect or the second aspect when executed by a processor.

[0023] The above-mentioned authorization management method, private cloud management platform, computer device, computer-readable storage medium and computer program product, the private cloud management platform receives an authorization request for a private cloud platform as a service PaaS platform from a client, the authorization request includes a platform identifier, an application code and at least one target authorization component, the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, the platform feature combination is obtained by the private cloud PaaS platform performing feature extraction on data under each preset platform feature dimension, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data; the authorization request is verified, and if the verification passes, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to perform permission verification on each target authorization component, and if the verification passes, it is determined that the corresponding target authorization component is authorized, and if the verification fails, it is determined that the corresponding target authorization component fails to be authorized; the authorization results of each target authorization component are returned to the private cloud management platform; based on the authorization results of each target authorization component, an authorization certificate is generated, and the authorization certificate is returned to the client. It solves the flexibility, scalability and security problems of license management in the private cloud PaaS platform, especially in an environment with diverse components, increasing authorization complexity and rapid iteration, and realizes dynamic loading and combined authorization of licenses efficiently and securely, greatly reducing security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0025] FIG1 is a diagram of an application environment of an authorization management method in one embodiment;

[0026] Figure 2 FIG1 is a flowchart of an authorization management method in an embodiment;

[0027] Figure 3 is a schematic diagram of a fingerprint recognition interface in one embodiment;

[0028] Figure 4 A schematic diagram of the process of an authorization management method in an embodiment Figure 2 ;

[0029] Figure 5 An internal framework diagram of a private cloud PaaS platform in one embodiment;

[0030] Figure 6 A schematic diagram of the process of an authorization management method in an embodiment Figure 3 ;

[0031] Figure 7 An internal framework diagram of a private cloud management platform in one embodiment;

[0032] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0034] The authorization management method provided in the embodiment of the present application can be applied to the application environment shown in Figure 1. The application environment shown in Figure 1 includes a client, a private cloud platform as a service (Platform as a Service, PaaS for short), a private cloud management platform, and a PaaS component product console. The private cloud PaaS platform can be used to extract features from data under each preset platform feature dimension, obtain a platform feature combination, generate resource statistical information based on instance statistical data, and generate an application code based on the platform feature combination and resource statistical information. The client can send an authorization request for the private cloud PaaS platform to the private cloud management platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. After receiving the authorization request, the private cloud management platform verifies the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console. The PaaS component product console verifies the permissions of each target authorization component. If the verification is successful, it is determined that the corresponding target authorization component is authorized. If the verification fails, it is determined that the authorization of the corresponding target authorization component fails. The authorization results of each target authorization component are returned to the private cloud management platform. The private cloud management platform generates an authorization certificate based on the authorization results of each target authorization component and returns the authorization certificate to the client. This solves the flexibility, scalability, and security problems of license management in the private cloud PaaS platform, especially in an environment with component diversity, increased authorization complexity, and rapid iteration. The dynamic loading and combined authorization of licenses are realized efficiently and securely, greatly reducing security risks.

[0035] In an exemplary embodiment, Figure 2 As shown, an authorization management method is provided, which is described by taking the method applied to the private cloud management platform in FIG. 1 as an example, and includes the following steps 202 to 206. Among them:

[0036] Step 202: Receive an authorization request from the client for the private cloud platform as a service PaaS platform, where the authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information. The platform feature combination is obtained by extracting features from data under various preset platform feature dimensions by the private cloud PaaS platform, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data.

[0037] Among them, after the private cloud vendor delivers the private cloud management software to the user, the user installs and configures the software on his own hardware infrastructure to realize the construction of the private cloud PaaS platform. In addition, the user can also install a client for docking with the private cloud PaaS platform on the terminal device. The user can trigger an application code generation request on the client, and the client sends the application code generation request to the private cloud PaaS platform. The private cloud PaaS platform extracts features from the data under the preset platform feature dimensions to obtain a platform feature combination; generates resource statistics based on instance statistics; generates an application code based on the platform feature combination and resource statistics, and returns it to the client.

[0038] Among them, after obtaining the application code, the user can trigger the authorization process on the client. Specifically, the user can select the components included in the private cloud PaaS platform built on the client and click the authorization entrance. In response to the click operation, the client can generate an authorization request for the private cloud platform as a service PaaS platform based on the platform identifier of the private cloud PaaS platform connected, the above application code and the components selected by the user. For the convenience of explanation, in the embodiment of this application, the component selected by the user is referred to as the target authorization component.

[0039] The client stores the address of the private cloud management platform. After generating an authorization request for the private cloud platform as a service PaaS platform, the authorization request can be sent to the private cloud management platform according to the address.

[0040] Step 204: verify the authorization request. If the verification is successful, send the authorization request to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, determine that the corresponding target authorization component is authorized. If the verification fails, determine that the authorization of the corresponding target authorization component fails; return the authorization results of each target authorization component to the private cloud management platform.

[0041] Among them, after receiving the authorization request, the private cloud management platform parses the authorization request to obtain the platform identification, application code and at least one target authorization component. On the one hand, the platform feature combination and resource statistical information contained in the application code are verified; on the other hand, the platform legitimacy is verified based on the platform identification. When both aspects of verification are passed, it is determined that the authorization request verification is passed.

[0042] Among them, if the authorization request is verified to be successful, the authorization request is sent to the PaaS component product console, the PaaS component product console parses the authorization request, obtains the platform identifier and at least one target authorization component, and performs permission verification on each target authorization component. If the verification is successful, it is determined that the target authorization component is authorized. If the verification fails, it is determined that the target authorization component has failed to be authorized. The authorization results of each target authorization component are returned to the private cloud management platform.

[0043] Specifically, the PaaS component product console stores the correspondence between the platform identification and component usage rights of all private cloud PaaS platforms, which can be written into the PaaS component product console after the private cloud vendor delivers the private cloud management software to the user. After parsing the platform identification and at least one target authorization component, the PaaS component product console can search for the component usage rights corresponding to the platform identification in the above correspondence. For each target authorization component, if the target authorization component is in the found component usage rights, it is determined that the target authorization component is authorized; if not, it is determined that the target authorization component fails to be authorized.

[0044] Among them, the PaaS platform provides dozens of cloud-native component products. In addition to the general number of instances and resource (CPU, memory, storage) usage, each component has its own business characteristics, such as the number of message queues, network bandwidth restrictions, cluster configuration solutions, etc. This solution splits the management-side authorization management platform (private cloud management platform) into the platform integration end and the component end. Through the microservice dynamic discovery method, the management-side license integration module is decoupled from the component, and the component can flexibly customize its authorization dimension and form; when a new component product is connected to the platform, there is no need for the platform to intervene. The component side can develop the corresponding service according to the agreed protocol to implement the intervention of new functions. During the version iteration process, the component releases its authorization policy and verification logic according to the development rhythm, avoiding coupling with the platform release. The specific implementation includes the following steps: (1) Reference nacos dependency: (2) Configure metadata: (3) Implement and provide services according to the authorization interface protocol defined by the platform.

[0045] Step 206: Generate an authorization certificate based on the authorization results of each target authorization component, and return the authorization certificate to the client.

[0046] Among them, after the private cloud management platform receives the authorization results of each target authorization component, it summarizes the authorized target authorization components based on the authorization results, obtains component authorization information, generates an authorization certificate based on the component authorization information, and returns the authorization certificate to the client.

[0047] In the above embodiment, the private cloud management platform receives an authorization request from the client for the private cloud platform as a service PaaS platform, the authorization request includes a platform identifier, an application code and at least one target authorization component, the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, the platform feature combination is obtained by the private cloud PaaS platform extracting features from data under each preset platform feature dimension, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data; the authorization request is verified, and if the verification passes, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to perform permission verification on each target authorization component, and if the verification passes, it is determined that the corresponding target authorization component is authorized, and if the verification fails, it is determined that the corresponding target authorization component fails to be authorized; the authorization results of each target authorization component are returned to the private cloud management platform; based on the authorization results of each target authorization component, an authorization certificate is generated, and the authorization certificate is returned to the client. It solves the flexibility, scalability and security problems of license management in the private cloud PaaS platform, especially in an environment with diverse components, increasing authorization complexity and rapid iteration, and realizes dynamic loading and combined authorization of licenses efficiently and securely, greatly reducing security risks.

[0048] In some embodiments, the authorization request is verified, including: parsing the authorization request to obtain a platform identifier and an application code; verifying the platform feature combination and resource statistical information contained in the application code; searching for historical authorization records based on the platform identifier; searching for infringement on the corresponding private cloud PaaS platform based on the platform identifier; determining that the verification is successful if the platform feature combination and resource statistical information are verified successfully, there is no authorization failure record in the historical authorization record, and there is no infringement on the corresponding private cloud PaaS platform.

[0049] After receiving the authorization request, the private cloud management platform parses the authorization request to obtain the platform identifier, the application code and at least one target authorization component, and can verify the authorization request based on the platform identifier and the application code.

[0050] Among them, before delivering the private cloud management software to the user, the private cloud vendor can obtain the platform feature combination and resource statistics in advance and store them in the private cloud management platform. The private cloud management platform can parse the application code to obtain the platform feature combination and resource statistics, and compare the parsed data with the above-mentioned pre-stored data. If the two are consistent, it is determined that the platform feature combination and resource statistics contained in the application code have been verified.

[0051] Among them, the private cloud management platform can search for the historical authorization records of the corresponding private cloud PaaS platform based on the platform identifier obtained by parsing, and check whether there are any authorization failure records in the historical authorization records. The private cloud management platform also stores an infringement list. The private cloud management platform can search for the corresponding private cloud PaaS platform based on the platform identifier obtained by parsing whether it is on the infringement list. If it is, it is determined that the corresponding private cloud PaaS platform has infringed; if not, it is determined that the corresponding private cloud PaaS platform has not infringed. When the platform feature combination and resource statistical information are verified, there is no authorization failure record in the historical authorization record, and the corresponding private cloud PaaS platform has not infringed, it is determined that the authorization request verification is passed.

[0052] Specifically, the private cloud management platform can achieve the decoupling of license verification logic from core business logic through the service discovery mechanism (Service Provider Interface, SPI for short). Different authorization strategies or verification algorithms can be dynamically loaded as plug-ins, which can adapt to changing business needs and security policies without modifying the core system. This mechanism allows the dynamic addition, update or removal of authorization rules at runtime, greatly improving the flexibility and scalability of the system. In response to multi-version scenarios of private clouds, different versions of authorization verification requirements can be compatible by superimposing plug-ins. At the same time, in a high-risk exposure environment, the complexity of verification authorization can be completed by enabling multiple sets of plug-ins at the same time, which exponentially increases the difficulty of cracking and dynamically realizes security reinforcement. The fingerprint and feature in the embodiments of this application are the same concept and can be used interchangeably. See Figure 3As shown, the fingerprint recognition interface is defined as follows: Name: Specifies the name of the fingerprint module. Version: Specifies the version number. For scenarios where multiple versions of the private cloud coexist, the management end can iteratively reinforce the module by adding new versions. When verifying the environmental fingerprint, the corresponding fingerprint verification module will be activated by the name and version number. getFingerprint: Get the environmental fingerprint policy function. The following examples illustrate: For a platform deployed on a pure physical machine, the getFingerPrint interface can be constructed by obtaining the hardware information of the machine; for a containerized deployment platform, static business data and hash functions can be combined to extract relevant features. checkFingerPrint: Environmental fingerprint verification. The authorization certificate will include environmental fingerprint information. When importing the certificate, the signature verification policy is used to detect whether the environment matches.

[0053] In the above embodiment, a specific implementation method for verifying the authorization request is provided, which performs security verification in multiple dimensions and further reduces security risks.

[0054] In some embodiments, an authorization certificate is generated based on the authorization results of each target authorization component, including: summarizing component authorization information based on the authorization results of each target authorization component; generating general authorization information based on the component authorization information; and processing the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to obtain an authorization certificate.

[0055] After receiving the authorization results of each target authorization component, the private cloud management platform summarizes the authorized target authorization components based on the authorization results to obtain component authorization information, converts the format of the component authorization information, and generates general authorization information. Use at least one of a hash check algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to process the general authorization information accordingly to obtain an authorization certificate.

[0056] In the above embodiment, a specific implementation method for generating an authorization certificate is provided. This method uses at least one of a hash verification algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to process the general authorization information, thereby further improving the authorization security.

[0057] In some embodiments, the authorization certificate includes header content, key decryption content, authorization content, and verification content.

[0058] For example, the authorization certificate License is divided into four sections by “.”:

[0059] The first header part (header content): This part is encoded with Base64 and the decoded content is as follows:

[0060] {

[0061] "alg": "RSA-OAEP", / / Second part key encryption algorithm

[0062] "enc": "A256CBC", / / License theme encryption algorithm

[0063] "kid": "f3c30571587f11ef9440d3f1c9b14b7e", / / Public key id corresponding to the key encryption algorithm

[0064] "typ": "LIC", / / Type, License

[0065] "cty": "LIC" / / Subject type, License

[0066] }

[0067] The second section is the license subject encryption key (key decryption content): the plain text is decrypted through the optimal asymmetric encryption padding RSA algorithm (RSA-OAEP) and the key specified by the system kid. The following are the steps of the decryption algorithm:

[0068] (1) Obtain the public key in the corresponding system based on kid.

[0069] (2) Select a random number r: r is a random or pseudo-random byte string of length 11.

[0070] (3) Calculate the coding block DB: DB = m plus G(r) where plus⊕ represents the XOR operation and G(r) is the output of the generator function G for r.

[0071] (4) Calculate the mask DBMask: DBMask = H(r plus H(DB))DBMask=H(r⊕H(DB)) Here HH is the hash function, and H(DB)H(DB) is the hash of DBDB.

[0072] (5) Calculate the coded block maskedDB: maskedDB = DB plus DBMaskmaskedDB=DB⊕DBMask

[0073] (6) Calculate the mask seedMask: seedMask = H(maskedDB)seedMask=H(maskedDB)

[0074] (7) Calculate the masked seed maskedSeed: maskedSeed = r plus seedMask

[0075] (8) Construct EM (encrypted message): EM = maskedSeed || maskedDB Here || represents the concatenation operation.

[0076] (9) Encryption EM: c = EM^e mod n

[0077] The third section is the main part of the license: according to the key decrypted in the second section, use the algorithm specified by enc to decrypt and obtain the license authorization content.

[0078] {

[0079] "sub": "platformId", / / privatization platform id

[0080] "aud": "customer@company.com.cn", / / License audience

[0081] "iss": "clouddesktop@chinatelecom.cn", / / License issuing authority

[0082] "exp": 1660302743, / / Expiration time

[0083] "iat": 1660299143, / / Issuance time

[0084] "nbf": 1660299143, / / Effective time

[0085] "gra": {} / / Authorization information. The core content of the authorization is further encrypted and decrypted using the system's built-in security reinforcement algorithm, which will not be explained here.

[0086] }

[0087] The fourth part (verification content): This part uses a hash function to generate a MAC code for the first three parts in combination with the system's built-in key. It is verified when the license file is imported to ensure information integrity and reliability.

[0088] In the above embodiment, the authorization certificate includes header content, key decryption content, authorization content and verification content, which can be used to ensure information integrity and reliability when imported.

[0089] In an exemplary embodiment, Figure 4 As shown, an authorization management method is provided, and the method is applied to the private cloud PaaS platform in FIG. 1 as an example for explanation, including the following steps 402 to 404. Among them:

[0090] Step 402: After receiving the application code generation request triggered by the user, the feature extraction module is loaded, and the feature extraction module is used to extract features from the data under each preset platform feature dimension to obtain a platform feature combination; and resource statistical information is generated based on instance statistical data.

[0091] Optionally, the preset platform feature dimensions include: business data dimension, platform base dimension, operating environment dimension, etc.

[0092] Among them, the user can trigger an application code generation request on the client, and the client sends the application code generation request to the private cloud PaaS platform. After receiving the application code generation request, the private cloud PaaS platform loads the feature extraction module, and uses a pre-set feature algorithm that matches the business data dimension through the feature extraction module to extract features from the business data to obtain business data features; uses a pre-set feature algorithm that matches the platform base dimension to extract features from the platform base data to obtain platform base features; uses a pre-set feature algorithm that matches the operating environment dimension to extract features from the operating environment data to obtain operating environment features, and combines the business data features, platform base features and operating environment features to obtain a platform feature combination.

[0093] See also Figure 5 As shown, the private cloud PaaS platform may include the following frameworks: Figure 4 The framework shown includes a license import module, a license application module, a license feature calculation interface, and at least one feature module. The license import module is used to import the authorization certificate, the license application module is used to generate the application code, the license feature calculation interface is used to obtain the platform feature combination, and each feature module is used to extract a feature, for example, feature module 1 is used to extract business data features, feature module 2 is used to extract platform base features, and feature module 3 is used to extract operating environment features.

[0094] Optionally, the instance statistics include resource usage requests such as the number of instances, CPU, memory, storage, etc. After receiving the application code generation request, the private cloud PaaS platform can generate resource statistics based on the resource usage requests such as the number of instances, CPU, memory, storage, etc.

[0095] Step 404: Generate an application code based on the platform feature combination and resource statistical information.

[0096] Among them, after obtaining the platform feature combination and resource statistical information, the private cloud PaaS platform can use the corresponding algorithm to generate an application code based on the platform feature combination and resource statistical information. The embodiment of the present application does not limit the algorithm for generating the application code.

[0097] In the above embodiment, after receiving the application code generation request triggered by the user, the private cloud PaaS platform loads the feature extraction module, extracts the data under each preset platform feature dimension through the feature extraction module, and obtains the platform feature combination; generates resource statistical information based on the instance statistical data; and generates the application code based on the platform feature combination and resource statistical information. The application code can be used for subsequent authorization, which solves the flexibility, scalability and security problems of license management in the private cloud PaaS platform, especially in the environment of component diversity, increased authorization complexity and rapid iteration, and realizes the dynamic loading and combined authorization of licenses efficiently and securely, greatly reducing security risks.

[0098] In some embodiments, the authorization management method provided by the embodiments of the present application also includes: receiving an authorization certificate uploaded by a user; verifying the validity and integrity of the authorization certificate, and if the verification passes, determining the target component to be authorized from the authorization certificate; and importing the authorization certificate into the target component.

[0099] Among them, after the client receives the authorization certificate, the user can upload the authorization certificate to the private cloud PaaS platform through the client. The private cloud PaaS platform uses the corresponding validity verification algorithm to verify the validity of the authorization certificate, and uses the corresponding integrity verification algorithm to verify the integrity of the authorization certificate. If the verification passes, the target component that obtains authorization is determined from the authorization content in the authorization certificate; the authorization certificate is imported into the target component, thereby completing the certificate authorization process.

[0100] In the above embodiment, after the private cloud management platform returns the authorization certificate, the user can upload the authorization certificate to the private cloud PaaS platform. The private cloud PaaS platform verifies the validity and integrity of the authorization certificate. If the verification passes, the authorization certificate is imported into the authorized target component, thereby realizing dynamic loading and combined authorization of the license efficiently and securely, greatly reducing security risks.

[0101] In some embodiments, see Figure 6As shown, an authorization management method is provided, including the following steps: the client sends the application code generation request to the private cloud PaaS platform, and after the private cloud PaaS platform receives the application code generation request, it loads the feature extraction module and obtains the platform feature combination through the feature extraction module; based on the resource usage request of the number of instances, CPU, memory, storage, etc., it generates resource statistics; based on the platform feature combination and resource statistics, it uses the corresponding algorithm to generate the application code, and returns the application code to the client. The client sends an authorization request for the private cloud platform as a service PaaS platform to the private cloud management platform, and the private cloud management platform verifies the platform feature combination and resource statistics, and verifies the authorization record and infringement phenomenon. If all pass, the authorization request is sent to the PaaS component product console. The PaaS component product console parses the authorization request, obtains the platform identifier and at least one target authorization component, and performs permission verification on each target authorization component. If the verification passes, it is determined that the target authorization component is authorized, and if the verification fails, it is determined that the target authorization component fails to be authorized; the authorization results of each target authorization component are returned to the private cloud management platform. The private cloud management platform summarizes the component authorization information based on the authorization results of each target authorization component; generates general authorization information based on the component authorization information; processes the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to obtain an authorization certificate. The authorization certificate is returned to the client. The client uploads the authorization certificate to the private cloud PaaS platform, which verifies the validity and integrity of the authorization certificate. If the verification passes, the authorized target component is determined from the authorization certificate; the authorization certificate is imported into the target component. The internal framework of the private cloud management platform can be as follows: Figure 7 shown.

[0102] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a private cloud management platform for implementing the authorization management method involved above. The implementation solution provided by the private cloud management platform to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more private cloud management platform embodiments provided below can refer to the limitations on the authorization management method above, and will not be repeated here.

[0104] In an exemplary embodiment, a private cloud management platform is provided, including:

[0105] A receiving module is used to receive an authorization request from a client for a private cloud platform as a service PaaS platform, the authorization request including a platform identifier, an application code and at least one target authorization component, the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, the platform feature combination is obtained by the private cloud PaaS platform performing feature extraction on data under various preset platform feature dimensions, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data;

[0106] The verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, it is determined that the corresponding target authorization component is authorized. If the verification fails, it is determined that the authorization of the corresponding target authorization component fails; the authorization results of each target authorization component are returned to the private cloud management platform;

[0107] The generation module is used to generate an authorization certificate based on the authorization results of each target authorization component and return the authorization certificate to the client.

[0108] In some embodiments, a verification module is used to parse the authorization request to obtain a platform identifier and an application code; verify the platform feature combination and resource statistical information contained in the application code; search for historical authorization records based on the platform identifier; search for infringements on the corresponding private cloud PaaS platform based on the platform identifier; and determine that the verification is successful if the platform feature combination and resource statistical information are verified, there is no authorization failure record in the historical authorization records, and there is no infringement on the corresponding private cloud PaaS platform.

[0109] In some embodiments, a generation module is used to summarize component authorization information based on the authorization results of each target authorization component; generate general authorization information based on the component authorization information; and process the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multiple anti-counterfeiting algorithm to obtain an authorization certificate.

[0110] In some embodiments, the authorization certificate includes header content, key decryption content, authorization content, and verification content.

[0111] Each module in the above private cloud management platform can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0112] Based on the same inventive concept, the embodiment of the present application also provides a private cloud PaaS platform for implementing the authorization management method involved above. The implementation solution provided by the private cloud PaaS platform to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more private cloud PaaS platform embodiments provided below can refer to the limitations on the authorization management method above, and will not be repeated here.

[0113] In an exemplary embodiment, a private cloud PaaS platform is provided, including:

[0114] The receiving module is used to load the feature extraction module after receiving the application code generation request triggered by the user, and extract the features of the data under each preset platform feature dimension through the feature extraction module to obtain the platform feature combination; and generate resource statistical information based on the instance statistical data;

[0115] The generation module is used to generate an application code based on a combination of platform features and resource statistics.

[0116] In some embodiments, the private cloud PaaS platform also includes an upload module for receiving an authorization certificate uploaded by a user; verifying the validity and integrity of the authorization certificate, and if the verification passes, determining the target component to obtain authorization from the authorization certificate; and importing the authorization certificate into the target component.

[0117] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiment are implemented.

[0118] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiment are implemented.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiment are implemented.

[0121] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiment.

[0122] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An authorization management method, characterized in that: Applied to private cloud management platforms, including: Receive an authorization request for a private cloud platform as a service PaaS platform from a client, the authorization request including a platform identifier, an application code, and at least one target authorization component, the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, the platform feature combination is obtained by extracting features from data under various preset platform feature dimensions by the private cloud PaaS platform, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data; Verify the authorization request. If the verification is successful, send the authorization request to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, determine that the corresponding target authorization component is authorized. If the verification fails, determine that the authorization of the corresponding target authorization component fails. Return the authorization results of each target authorization component to the private cloud management platform; Based on the authorization results of each target authorization component, an authorization certificate is generated, and the authorization certificate is returned to the client.

2. The method according to claim 1, characterized in that The verifying the authorization request includes: Parsing the authorization request to obtain the platform identifier and the application code; Verifying the platform feature combination and resource statistics information contained in the application code; Searching for historical authorization records based on the platform identifier; Based on the platform identifier, find out whether the corresponding private cloud PaaS platform has ever infringed the rights; If the platform feature combination and the resource statistical information are verified, there is no authorization failure record in the historical authorization record, and there is no infringement on the corresponding private cloud PaaS platform, it is determined that the verification is passed.

3. The method according to claim 1, characterized in that The step of generating an authorization certificate based on the authorization results of each target authorization component includes: Based on the authorization results of each target authorization component, the component authorization information is summarized; Based on the component authorization information, generating general authorization information; Based on at least one of a hash verification algorithm, an encryption algorithm or a multiple anti-counterfeiting algorithm, the general authorization information is processed to obtain an authorization certificate.

4. The method according to any one of claims 1 to 3, characterized in that: The authorization certificate includes header content, key decryption content, authorization content and verification content.

5. An authorization management method, characterized in that: Applied to private cloud PaaS platform, including: After receiving the application code generation request triggered by the user, the feature extraction module is loaded, and the feature extraction module is used to extract the features of the data under each preset platform feature dimension to obtain the platform feature combination; and the resource statistical information is generated based on the instance statistical data; An application code is generated based on the platform feature combination and the resource statistical information.

6. The method according to claim 4, characterized in that The method further comprises: Receive the authorization certificate uploaded by the user; Verifying the validity and integrity of the authorization certificate, and if the verification passes, determining the target component to be authorized from the authorization certificate; Import the authorization certificate into the target component.

7. A private cloud management platform, characterized in that: include: A receiving module, configured to receive an authorization request from a client for a private cloud platform as a service PaaS platform, wherein the authorization request includes a platform identifier, an application code, and at least one target authorization component, wherein the application code is generated by the private cloud PaaS platform based on a platform feature combination and resource statistical information, wherein the platform feature combination is obtained by extracting features from data under various preset platform feature dimensions by the private cloud PaaS platform, and the resource statistical information is generated by the private cloud PaaS platform based on instance statistical data; A verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the authority of each target authorization component. If the verification is successful, it is determined that the corresponding target authorization component is authorized. If the verification fails, it is determined that the authorization of the corresponding target authorization component fails. Returning the authorization results of each target authorization component to the private cloud management platform; The generation module is used to generate an authorization certificate based on the authorization results of each target authorization component, and return the authorization certificate to the client.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images