Authorization management method, private cloud management platform and computer device

Abstract

The application relates to an authorization management method, a private cloud management platform and computer equipment. The method comprises the following steps: receiving an authorization request for a private cloud platform as a service (PaaS) platform from a client, wherein the authorization request comprises a platform identifier, an application code and at least one target authorization component; verifying the authorization request; if the verification is passed, sending the authorization request to a PaaS component product console to instruct the PaaS component product console to verify the authority of each target authorization component; if the verification is passed, determining that the corresponding target authorization component is authorized; if the verification is not passed, determining that the corresponding target authorization component is not authorized; returning the authorization results of the target authorization components to the private cloud management platform; and generating an authorization certificate based on the authorization results of the target authorization components and returning the authorization certificate to the client. The security risk is reduced.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an authorization management method, a private cloud management platform, computer equipment, computer-readable storage media, and computer program products. Background Technology

[0002] With the development and application of cloud computing technology, more and more enterprises are adopting hybrid cloud or private cloud approaches to deploy and manage internal application systems. The increasing number of private clouds, the diversification of application scenarios, and the complexity of security controls pose significant challenges to the license management of private cloud vendors. In terms of delivery, private cloud vendors provide users with private cloud management software, which users can install and configure on their own hardware infrastructure, flexibly building private cloud environments and gaining complete control over software system deployment, upgrades, and data management. For private cloud vendors, the user-side private cloud platform is a black box, requiring the cloud computing platform to provide convenient and fast software license loading capabilities while protecting licenses from unauthorized use and mitigating other security risks. The license content of private cloud PaaS platforms also differs from traditional software, which typically requires a one-time purchase or monthly payment. Private cloud PaaS platform licenses focus more on platform loading capabilities, namely the ability to enable and manage cloud computing product components. Private cloud PaaS platforms load many components, requiring diverse license content and a unified and effective method for platform supervision.

[0003] Traditional static license verification mechanisms are no longer sufficient to meet the flexible and ever-changing business needs, especially during periods when the platform is still undergoing rapid iteration and development. This can easily lead to errors, and the unchanging verification logic can easily cause security risks. Summary of the Invention

[0004] Therefore, it is necessary to provide an authorization management method, a private cloud management platform, computer equipment, computer-readable storage media, and computer program products that can reduce security risks in response to the above-mentioned technical problems.

[0005] Firstly, this application provides an authorization management method applied to a private cloud management platform, including:

[0006] Receive an authorization request from a client for a private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform through feature extraction of data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics.

[0007] The authorization request is verified. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the authorization of the corresponding target authorization component is determined to be successful. If the verification fails, the authorization of the corresponding target authorization component is determined to be unsuccessful. The authorization results of each target authorization component are returned to the private cloud management platform.

[0008] Based on the authorization results of each target authorization component, an authorization certificate is generated and returned to the client.

[0009] In one embodiment, verifying the authorization request includes: parsing the authorization request to obtain the platform identifier and the application code; verifying the platform feature combination and resource statistics information contained in the application code; searching historical authorization records based on the platform identifier; searching whether the corresponding private cloud PaaS platform has ever infringed on any rights based on the platform identifier; and determining that the verification is successful if the platform feature combination and the resource statistics information are verified successfully, there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform has not infringed on any rights.

[0010] In one embodiment, generating an authorization certificate based on the authorization results of each target authorization component includes: summarizing component authorization information based on the authorization results of each target authorization component; generating general authorization information based on the component authorization information; and processing the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multi-layer anti-counterfeiting algorithm to obtain an authorization certificate.

[0011] In one embodiment, the authorization certificate includes header content, key decryption content, authorization content, and verification content.

[0012] Secondly, this application also provides an authorization management method applied to a private cloud PaaS platform, including:

[0013] Upon receiving a user-triggered application code generation request, the feature extraction module is loaded. The feature extraction module extracts features from the data under the preset platform feature dimensions to obtain platform feature combinations. Resource statistics are generated based on instance statistics data.

[0014] An application code is generated based on the platform feature combination and the resource statistics.

[0015] In one embodiment, an authorization certificate uploaded by a user is received; the validity and integrity of the authorization certificate are verified; if the verification is successful, the target component authorized by the authorization certificate is determined from the authorization certificate; and the authorization certificate is imported into the target component.

[0016] Thirdly, this application also provides a private cloud management platform, including:

[0017] The receiving module is used to receive an authorization request from a client for a private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform by extracting features from data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics.

[0018] The verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the authorization of the corresponding target authorization component is determined to be successful. If the verification fails, the authorization of the corresponding target authorization component is determined to be unsuccessful. The authorization results of each target authorization component are returned to the private cloud management platform.

[0019] The generation module is used to generate an authorization certificate based on the authorization results of each target authorization component and return the authorization certificate to the client.

[0020] Fourthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method provided in the first or second aspect.

[0021] Fifthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method provided in the first or second aspect.

[0022] Sixthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method provided in the first or second aspect.

[0023] The aforementioned authorization management method, private cloud management platform, computer equipment, computer-readable storage medium, and computer program product involve the private cloud management platform receiving an authorization request from a client for a private cloud platform-as-a-service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The platform features are obtained by the private cloud PaaS platform through feature extraction from data under preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics. The authorization request is verified. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the corresponding target authorization component is determined to be authorized successfully; if the verification fails, the corresponding target authorization component is determined to be authorized unsuccessfully. The authorization results for each target authorization component are returned to the private cloud management platform. Based on the authorization results for each target authorization component, an authorization certificate is generated and returned to the client. It solves the challenges of flexibility, scalability, and security in license management within private cloud PaaS platforms. Especially in environments with diverse components, increased authorization complexity, and rapid iteration, it efficiently and securely enables dynamic loading and combination of licenses, significantly reducing security risks. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a diagram illustrating the application environment of the authorization management method in one embodiment;

[0026] Figure 2 Here is a flowchart illustrating the authorization management method in one embodiment. Figure 1 ;

[0027] Figure 3 This is a schematic diagram of a fingerprint recognition interface in one embodiment;

[0028] Figure 4Here is a flowchart illustrating the authorization management method in one embodiment. Figure 2 ;

[0029] Figure 5 This is an internal framework diagram of a private cloud PaaS platform in one embodiment;

[0030] Figure 6 Here is a flowchart illustrating the authorization management method in one embodiment. Figure 3 ;

[0031] Figure 7 This is an internal framework diagram of a private cloud management platform in one embodiment;

[0032] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0034] The authorization management method provided in this application embodiment can be applied to, for example, Figure 1 The application environment shown. Figure 1The application environment shown includes a client, a private cloud Platform as a Service (PaaS) platform, a private cloud management platform, and a PaaS component product console. The private cloud PaaS platform can extract features from data across various preset platform feature dimensions to obtain platform feature combinations. It generates resource statistics based on instance statistics and generates an application code based on the platform feature combinations and resource statistics. The client can send an authorization request to the private cloud management platform targeting the private cloud PaaS platform. The authorization request includes the platform identifier, the application code, and at least one target authorized component. Upon receiving the authorization request, the private cloud management platform verifies it. If the verification is successful, the authorization request is sent to the PaaS component product console. The PaaS component product console verifies the permissions of each target authorized component. If the verification is successful, the corresponding target authorized component is authorized; otherwise, the authorization fails. The authorization results for each target authorized component are returned to the private cloud management platform. Based on the authorization results for each target authorized component, the private cloud management platform generates an authorization certificate and returns the authorization certificate to the client. It solves the challenges of flexibility, scalability, and security in license management within private cloud PaaS platforms. Especially in environments with diverse components, increased authorization complexity, and rapid iteration, it efficiently and securely enables dynamic loading and combination of licenses, significantly reducing security risks.

[0035] In one exemplary embodiment, such as Figure 2 As shown, an authorization management method is provided, which can be applied to... Figure 1 Taking a private cloud management platform as an example, the explanation includes the following steps 202 to 206. Among them:

[0036] Step 202: Receive an authorization request from the client for the private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform through feature extraction of data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics.

[0037] In this process, after the private cloud vendor delivers the private cloud management software to the user, the user installs and configures the software on their own hardware infrastructure, thereby building a private cloud PaaS platform. In addition, the user can install a client on their terminal device to interface with the private cloud PaaS platform. The user can trigger an application code generation request on this client, which sends the request to the private cloud PaaS platform. The private cloud PaaS platform extracts features from data under preset platform feature dimensions to obtain platform feature combinations; generates resource statistics based on instance statistics; and generates an application code based on the platform feature combinations and resource statistics, returning it to the client.

[0038] After obtaining the application code, the user can trigger the authorization process on the client. Specifically, the user can select the components included in the private cloud PaaS platform they have built on the client, click the authorization entry, and in response to this click, the client can generate an authorization request for the private cloud platform as a service PaaS platform based on the platform identifier of the connected private cloud PaaS platform, the aforementioned application code, and the components selected by the user. For ease of explanation, in this embodiment, the component selected by the user is referred to as the target authorization component.

[0039] The client stores the address of the private cloud management platform. After generating an authorization request for the private cloud platform as a service (PaaS) platform, the authorization request can be sent to the private cloud management platform according to this address.

[0040] Step 204: Verify the authorization request. If the verification is successful, send the authorization request to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, determine that the corresponding target authorization component is authorized. If the verification fails, determine that the corresponding target authorization component is authorized. Return the authorization results of each target authorization component to the private cloud management platform.

[0041] Upon receiving an authorization request, the private cloud management platform parses the request to obtain the platform identifier, application code, and at least one target authorization component. On one hand, it verifies the combination of platform features and resource statistics contained in the application code; on the other hand, it verifies the platform's legitimacy based on the platform identifier. If both verifications pass, the authorization request is deemed to have been verified.

[0042] If the authorization request is verified, it is sent to the PaaS component product console. The PaaS component product console parses the authorization request to obtain the platform identifier and at least one target authorization component. For each target authorization component, the permission of the target authorization component is verified. If the verification is successful, the authorization of the target authorization component is determined to be successful. If the verification fails, the authorization of the target authorization component is determined to be unsuccessful. The authorization results of each target authorization component are returned to the private cloud management platform.

[0043] Specifically, the PaaS component product console stores the mapping relationship between platform identifiers and component usage permissions for all private cloud PaaS platforms. This mapping relationship can be written into the PaaS component product console by the private cloud vendor after delivering the private cloud management software to the user. After parsing the platform identifier and at least one target authorized component, the PaaS component product console can search for the component usage permission corresponding to that platform identifier in the above mapping relationship. For each target authorized component, if the target authorized component is found in the found component usage permissions, the authorization for that target authorized component is determined to be successful; otherwise, the authorization for that target authorized component is determined to be unsuccessful.

[0044] Among them, the PaaS platform provides dozens of cloud-native component products. In addition to the common limitations of the number of instances and resource (CPU, memory, storage) usage, each component has its own business characteristics, such as the number of message queues, network bandwidth limits, and cluster configuration schemes. This solution splits the management-side authorization management platform (private cloud management platform) into a platform integration end and a component end. Through the microservice dynamic discovery method, the management-side license integration module is decoupled from the component. The component can flexibly customize its authorization dimensions and forms. When new component products are integrated into the platform, no platform intervention is required. The component side can develop the corresponding service according to the agreed protocol to realize the new function. During the version iteration process, the component releases its authorization strategy and verification logic according to the development rhythm, avoiding coupling with the platform's release. The specific implementation includes the following steps: (1) Reference nacos dependency: (2) Configure metadata: (3) Implement and provide services according to the authorization interface protocol defined by the platform.

[0045] Step 206: Based on the authorization results of each target authorization component, generate an authorization certificate and return the authorization certificate to the client.

[0046] After receiving the authorization results of each target authorized component, the private cloud management platform summarizes the authorized target authorized components based on the authorization results to obtain component authorization information, generates an authorization certificate based on the component authorization information, and returns the authorization certificate to the client.

[0047] In the above embodiments, the private cloud management platform receives an authorization request from the client for the private cloud Platform as a Service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The platform feature combination is obtained by the private cloud PaaS platform extracting features from data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics. The authorization request is verified. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the corresponding target authorization component is determined to be authorized successfully; if the verification fails, the corresponding target authorization component is determined to be authorized unsuccessfully. The authorization results of each target authorization component are returned to the private cloud management platform. Based on the authorization results of each target authorization component, an authorization certificate is generated and returned to the client. It solves the challenges of flexibility, scalability, and security in license management within private cloud PaaS platforms. Especially in environments with diverse components, increased authorization complexity, and rapid iteration, it efficiently and securely enables dynamic loading and combination of licenses, significantly reducing security risks.

[0048] In some embodiments, verifying an authorization request includes: parsing the authorization request to obtain a platform identifier and an application code; verifying the platform feature combination and resource statistics information contained in the application code; searching historical authorization records based on the platform identifier; searching whether the corresponding private cloud PaaS platform has ever infringed upon any rights based on the platform identifier; and determining that the verification is successful if the platform feature combination and resource statistics information are verified successfully, there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform has not infringed upon any rights.

[0049] Upon receiving an authorization request, the private cloud management platform parses the request to obtain a platform identifier, an application code, and at least one target authorization component. The platform identifier and application code are then used to verify the authorization request.

[0050] Before delivering private cloud management software to users, private cloud vendors can obtain platform feature combinations and resource statistics in advance and store them in the private cloud management platform. The private cloud management platform can parse the application code to obtain the platform feature combinations and resource statistics, compare the parsed data with the aforementioned pre-stored data, and if they match, determine that the platform feature combinations and resource statistics contained in the application code have been verified.

[0051] The private cloud management platform can use the parsed platform identifier to search for the historical authorization records of the corresponding private cloud PaaS platform and check for any authorization failures. The platform also stores an infringement list. Based on the parsed platform identifier, the platform can check if the corresponding private cloud PaaS platform is on the infringement list. If it is, the platform has been found to have infringed on any rights; otherwise, it has not. If the platform feature combination and resource statistics are verified, there are no authorization failures in the historical authorization records, and the corresponding private cloud PaaS platform has not infringed on any rights, the authorization request is considered successfully verified.

[0052] Specifically, the private cloud management platform can decouple license verification logic from core business logic through a Service Provider Interface (SPI) mechanism. Different authorization policies or verification algorithms can be dynamically loaded as plugins, adapting to constantly changing business needs and security policies without modifying the core system. This mechanism allows for the dynamic addition, updating, or removal of authorization rules at runtime, greatly improving the system's flexibility and scalability. In scenarios with multiple versions of private clouds, compatibility with different versions' authorization verification requirements can be achieved by layering plugins. Furthermore, in high-risk exposure environments, enabling multiple plugins simultaneously can handle complex verification and authorization processes, significantly increasing the difficulty of cracking and dynamically strengthening security. In the embodiments of this application, fingerprint and feature are the same concept and can be used interchangeably. See also... Figure 3 As shown, the fingerprint recognition interface is defined as follows: Name: Specifies the fingerprint module name. Version: Specifies the version number. For scenarios with multiple versions coexisting in a private cloud, the management end can iteratively strengthen the module by adding new versions. During environment fingerprint verification, the corresponding fingerprint verification module will be activated by the name and version number. getFingerprint: Gets the environment fingerprint policy function. The following example illustrates this: For platforms deployed on purely physical machines, the getFingerPrint interface can form a structure by obtaining the machine's hardware information; for containerized deployment platforms, it can combine static business data with hash functions to extract relevant features. checkFingerPrint: Environment fingerprint verification. The authorization certificate will include environment fingerprint information. When importing the certificate, the environment is checked for compatibility using a signature verification policy.

[0053] The above embodiments provide a specific implementation method for verifying authorization requests. This method performs security verification in multiple dimensions, further reducing security risks.

[0054] In some embodiments, generating an authorization certificate based on the authorization results of each target authorization component includes: summarizing component authorization information based on the authorization results of each target authorization component; generating general authorization information based on the component authorization information; and processing the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multi-layer anti-counterfeiting algorithm to obtain an authorization certificate.

[0055] The private cloud management platform receives the authorization results from each target authorized component, summarizes the authorized components based on these results to obtain component authorization information, converts the format of the component authorization information, and generates general authorization information. At least one of a hash verification algorithm, encryption algorithm, or multi-layer anti-counterfeiting algorithm is then used to process the general authorization information to obtain an authorization certificate.

[0056] The above embodiments provide a specific implementation method for generating authorization certificates. This method uses at least one of a hash verification algorithm, an encryption algorithm, or a multi-layer anti-counterfeiting algorithm to process general authorization information, thereby further improving authorization security.

[0057] In some embodiments, the authorization certificate includes header content, key decryption content, authorization content, and verification content.

[0058] For example, the license certificate is divided into four segments separated by ".":

[0059] The first header section (header content): This part is Base64 encoded, and the decoded content is as follows:

[0060] {

[0061] "alg": "RSA-OAEP", / / Second part: key encryption algorithm

[0062] "enc": "A256CBC", / / License topic encryption algorithm

[0063] "kid": "f3c30571587f11ef9440d3f1c9b14b7e", / / Public key ID corresponding to the encryption algorithm

[0064] "typ": "LIC", / / Type, License

[0065] "cty": "LIC" / / Main type, License

[0066] }

[0067] The second part is the License main encryption key (key decryption content): the plaintext is decrypted using the RSA algorithm with optimal asymmetric encryption padding (RSA-OAEP) and the key specified by the system kid. The decryption algorithm steps are as follows:

[0068] (1) Obtain the public key in the corresponding system based on the kid.

[0069] (2) Select a random number r: r is a random or pseudo-random byte string of length 11.

[0070] (3) Calculate the coded block DB: DB = m plus G(r) Here, plus⊕ represents the XOR operation, and G(r) is the output of r using the generator function G.

[0071] (4) Calculate the mask DBMask: DBMask = H(r plus H(DB)) DBMask=H(r⊕H(DB)) Here HH is a hash function, H(DB)H(DB) is the hash of DBDB.

[0072] (5) Calculate the coded block maskedDB: maskedDB = DB plus DBMask maskedDB = DB⊕DBMask

[0073] (6) Calculate the mask seedMask: seedMask = H(maskedDB)

[0074] (7) Calculate the masked seed maskedSeed: maskedSeed = r plus seedMask

[0075] (8) Construct EM (encrypted message): EM = maskedSeed || maskedDB Here, || represents the concatenation operation.

[0076] (9) Encrypting EM: c = EM^e mod n

[0077] The third part is the main body of the License: based on the key decrypted in the second part, it is decrypted using the algorithm specified by enc to obtain the License authorization content.

[0078] {

[0079] "sub": "platformId", / / Private platform ID

[0080] "aud": "customer@company.com.cn", / / License audience

[0081] "iss": "clouddesktop@chinatelecom.cn", / / License issuing authority

[0082] "exp": 1660302743, / / Expiration time

[0083] "iat": 1660299143, / / Issuance Time

[0084] "nbf": 1660299143, / / Effective Time

[0085] "gra": {} / / Authorization information. The core content of the authorization is further encrypted and decrypted using the system's built-in security hardening algorithm, which will not be explained here.

[0086] }

[0087] The fourth verification section (verification content): This section combines the first three sections with the system's built-in key to generate a MAC code using a hash function. This MAC code is verified when importing the license file to ensure information integrity and reliability.

[0088] In the above embodiments, the authorization certificate includes header content, key decryption content, authorization content, and verification content, which can be used to ensure information integrity and reliability during import.

[0089] In one exemplary embodiment, such as Figure 4 As shown, an authorization management method is provided, which can be applied to... Figure 1 Taking a private cloud PaaS platform as an example, the explanation includes steps 402 to 404. Wherein:

[0090] Step 402: After receiving the user-triggered application code generation request, load the feature extraction module, extract features from the data under the preset platform feature dimensions through the feature extraction module, and obtain the platform feature combination; generate resource statistics information based on instance statistics data.

[0091] Optional, the preset platform feature dimensions include: business data dimension, platform foundation dimension, and operating environment dimension.

[0092] In this process, users can trigger an application code generation request on the client. The client then sends this request to the private cloud PaaS platform. Upon receiving the request, the private cloud PaaS platform loads the feature extraction module. Using a pre-set feature algorithm that matches the business data dimension, the module extracts features from the business data to obtain business data features. It also uses a pre-set feature algorithm that matches the platform infrastructure dimension to extract features from the platform infrastructure data to obtain platform infrastructure features. Finally, it uses a pre-set feature algorithm that matches the runtime environment dimension to extract features from the runtime environment data to obtain runtime environment features. The business data features, platform infrastructure features, and runtime environment features are then combined to obtain the platform feature combination.

[0093] See Figure 5 As shown, a private cloud PaaS platform may include the following framework: Figure 4 The framework shown includes a license import module, a license application module, a license feature calculation interface, and at least one feature module. The license import module imports the authorization certificate, the license application module generates the application code, the license feature calculation interface obtains platform feature combinations, and each feature module extracts one feature; for example, feature module 1 extracts business data features, feature module 2 extracts platform infrastructure features, and feature module 3 extracts runtime environment features.

[0094] Optionally, instance statistics include resource usage requests such as the number of instances, CPU, memory, and storage. After receiving the application code generation request, the private cloud PaaS platform can generate resource statistics based on resource usage requests such as the number of instances, CPU, memory, and storage.

[0095] Step 404: Generate an application code based on platform feature combinations and resource statistics.

[0096] In this application, after obtaining the platform feature combination and resource statistics information, the private cloud PaaS platform can generate an application code using the corresponding algorithm based on the platform feature combination and resource statistics information. The algorithm for generating the application code is not limited in this application embodiment.

[0097] In the above embodiments, after receiving a user-triggered application code generation request, the private cloud PaaS platform loads a feature extraction module. This module extracts features from data across preset platform feature dimensions to obtain platform feature combinations. Resource statistics are generated based on instance statistics. Finally, an application code is generated based on the platform feature combinations and resource statistics. This application code can be used for subsequent authorization, solving the challenges of flexibility, scalability, and security in license management within the private cloud PaaS platform. Especially in environments with diverse components, increased authorization complexity, and rapid iteration, it efficiently and securely enables dynamic loading and combination of licenses, significantly reducing security risks.

[0098] In some embodiments, the authorization management method provided in this application further includes: receiving an authorization certificate uploaded by a user; verifying the validity and integrity of the authorization certificate; if the verification is successful, determining the target component to be authorized from the authorization certificate; and importing the authorization certificate into the target component.

[0099] After receiving the authorization certificate, the user can upload the certificate to the private cloud PaaS platform. The private cloud PaaS platform uses the corresponding validity verification algorithm to verify the validity of the authorization certificate and the corresponding integrity verification algorithm to verify its integrity. If the verification is successful, the platform determines the target component to be authorized from the authorization content in the authorization certificate and imports the authorization certificate into the target component, thereby completing the certificate authorization process.

[0100] In the above embodiments, after the private cloud management platform returns the authorization certificate, the user can upload the authorization certificate to the private cloud PaaS platform. The private cloud PaaS platform verifies the validity and integrity of the authorization certificate. If the verification is successful, the authorization certificate is imported into the target component that has been authorized, thus realizing the dynamic loading and combination authorization of the license in an efficient and secure manner, which greatly reduces security risks.

[0101] In some embodiments, see Figure 6As shown, an authorization management method is provided, including the following steps: The client sends an application code generation request to a private cloud PaaS platform. Upon receiving the request, the private cloud PaaS platform loads a feature extraction module to obtain platform feature combinations. Resource statistics are generated based on resource usage requests such as instance count, CPU, memory, and storage. Based on the platform feature combinations and resource statistics, an application code is generated using a corresponding algorithm and returned to the client. The client sends an authorization request to the private cloud management platform for the private cloud platform-as-a-service (PaaS) platform. The private cloud management platform verifies the platform feature combinations and resource statistics, as well as authorization records and infringement issues. If all verifications are successful, the authorization request is sent to the PaaS component product console. The PaaS component product console parses the authorization request to obtain the platform identifier and at least one target authorization component. For each target authorization component, permission verification is performed. If verification passes, the target authorization component is authorized; otherwise, authorization fails. The authorization results for each target authorization component are returned to the private cloud management platform. The private cloud management platform aggregates component authorization information based on the authorization results of each target authorized component; it then generates general authorization information based on this information; finally, it processes this general authorization information using at least one of a hash verification algorithm, encryption algorithm, or multiple anti-counterfeiting algorithms to obtain an authorization certificate. The authorization certificate is then returned to the client. The client uploads the authorization certificate to the private cloud PaaS platform, which verifies its validity and integrity. If the verification passes, the platform identifies the authorized target component from the certificate and imports the authorization certificate into that component. The internal framework of the private cloud management platform can be as follows: Figure 7 As shown.

[0102] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0103] Based on the same inventive concept, this application also provides a private cloud management platform for implementing the authorization management method described above. The solution provided by this private cloud management platform is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more private cloud management platform embodiments provided below can be found in the limitations of the authorization management method described above, and will not be repeated here.

[0104] In one exemplary embodiment, a private cloud management platform is provided, comprising:

[0105] The receiving module is used to receive authorization requests from clients for the private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform by extracting features from data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics.

[0106] The verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the authorization of the corresponding target authorization component is determined to be successful. If the verification fails, the authorization of the corresponding target authorization component is determined to be unsuccessful. The authorization results of each target authorization component are returned to the private cloud management platform.

[0107] The generation module is used to generate authorization certificates based on the authorization results of each target authorization component and return the authorization certificates to the client.

[0108] In some embodiments, the verification module is used to parse the authorization request to obtain the platform identifier and application code; verify the platform feature combination and resource statistics information contained in the application code; search for historical authorization records based on the platform identifier; search for whether the corresponding private cloud PaaS platform has ever infringed on any rights based on the platform identifier; and determine that the verification is successful if the platform feature combination and resource statistics information are verified successfully, there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform has not infringed on any rights.

[0109] In some embodiments, the generation module is used to summarize component authorization information based on the authorization results of each target authorized component; generate general authorization information based on the component authorization information; and process the general authorization information based on at least one of a hash verification algorithm, an encryption algorithm, or a multi-layer anti-counterfeiting algorithm to obtain an authorization certificate.

[0110] In some embodiments, the authorization certificate includes header content, key decryption content, authorization content, and verification content.

[0111] The modules in the aforementioned private cloud management platform can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0112] Based on the same inventive concept, this application also provides a private cloud PaaS platform for implementing the authorization management method described above. The solution provided by this private cloud PaaS platform is similar to the implementation scheme described in the above method; therefore, the specific limitations of one or more private cloud PaaS platform embodiments provided below can be found in the limitations of the authorization management method described above, and will not be repeated here.

[0113] In one exemplary embodiment, a private cloud PaaS platform is provided, comprising:

[0114] The receiving module receives a user-triggered application code generation request, loads the feature extraction module, and extracts features from the data under various preset platform feature dimensions to obtain platform feature combinations; it also generates resource statistics information based on instance statistics data.

[0115] The generation module is used to generate application codes based on platform feature combinations and resource statistics.

[0116] In some embodiments, the private cloud PaaS platform further includes an upload module for receiving authorization certificates uploaded by users; verifying the validity and integrity of the authorization certificates; determining the target component authorized from the authorization certificates if the verification is successful; and importing the authorization certificates into the target components.

[0117] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiments.

[0118] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0119] In one exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiments.

[0120] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiments.

[0121] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the private cloud management platform or the private cloud PaaS platform side in the authorization management method provided in the above embodiments.

[0122] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0124] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An authorization management method, characterized in that, Applications in private cloud management platforms include: Receive an authorization request from a client for a private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform through feature extraction of data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics. The authorization request is verified. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the authorization of the corresponding target authorization component is determined to be successful. If the verification fails, the authorization of the corresponding target authorization component is determined to be unsuccessful. The authorization results of each target authorization component are returned to the private cloud management platform. Based on the authorization results of each target authorization component, an authorization certificate is generated and returned to the client; The verification of the authorization request includes: The authorization request is parsed to obtain the platform identifier and the application code; The platform feature combination and resource statistics information contained in the application code are verified; Search historical authorization records based on the platform identifier; Based on the platform identifier, search whether the corresponding private cloud PaaS platform has ever infringed upon any rights. If the platform feature combination and resource statistics are verified, and there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform does not have any infringement issues, the verification is deemed successful.

2. The method according to claim 1, characterized in that, The generation of authorization certificates based on the authorization results of each target authorization component includes: Based on the authorization results of each target authorization component, the component authorization information is summarized. Generate general authorization information based on the component authorization information; The general authorization information is processed based on at least one of a hash verification algorithm, an encryption algorithm, or a multi-layer anti-counterfeiting algorithm to obtain an authorization certificate.

3. The method according to any one of claims 1-2, characterized in that, The authorization certificate includes header content, key decryption content, authorization content, and verification content.

4. An authorization management method, characterized in that, Applied to private cloud PaaS platforms, including: After receiving the application code generation request triggered by the user on the client, the feature extraction module is loaded, and the feature extraction module performs feature extraction on the data under the preset platform feature dimensions to obtain the platform feature combination; resource statistics information is generated based on instance statistics data; Based on the platform feature combination and the resource statistics, an application code is generated; The application code is returned to the client, and the client sends an authorization request to the private cloud management platform for the private cloud PaaS platform. The authorization request includes the platform identifier, the application code, and at least one target authorization component. The private cloud management platform verifies the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the corresponding target authorization component is determined to be authorized; if the verification fails, the corresponding target authorization component is determined to be authorized to fail. The authorization results of each target authorization component are returned to the private cloud management platform. The management platform generates an authorization certificate based on the authorization results of each target authorization component and returns the authorization certificate to the client. The process by which the private cloud management platform verifies the authorization request includes: parsing the authorization request to obtain the platform identifier and the application code; verifying the platform feature combination and resource statistics information contained in the application code; searching historical authorization records based on the platform identifier; searching whether the corresponding private cloud PaaS platform has ever infringed on any rights based on the platform identifier; and determining that the verification is successful if the platform feature combination and the resource statistics information are verified successfully, there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform has not infringed on any rights.

5. The method according to claim 4, characterized in that, The method further includes: Receive authorization certificates uploaded by users; The validity and integrity of the authorization certificate are verified, and if the verification is successful, the target component authorized is determined from the authorization certificate. Import the authorization certificate into the target component.

6. A private cloud management platform, characterized in that, include: The receiving module is used to receive an authorization request from a client for a private cloud platform as a service (PaaS) platform. The authorization request includes a platform identifier, an application code, and at least one target authorization component. The application code is generated by the private cloud PaaS platform based on a combination of platform features and resource statistics. The combination of platform features is obtained by the private cloud PaaS platform by extracting features from data under various preset platform feature dimensions. The resource statistics are generated by the private cloud PaaS platform based on instance statistics. The verification module is used to verify the authorization request. If the verification is successful, the authorization request is sent to the PaaS component product console to instruct the PaaS component product console to verify the permissions of each target authorization component. If the verification is successful, the corresponding target authorization component is determined to be authorized. If the verification fails, the corresponding target authorization component is determined to be authorized to fail. The authorization results of each target authorized component are returned to the private cloud management platform; The generation module is used to generate an authorization certificate based on the authorization results of each target authorization component and return the authorization certificate to the client. The verification module is used for: The authorization request is parsed to obtain the platform identifier and the application code; The platform feature combination and resource statistics information contained in the application code are verified; Search historical authorization records based on the platform identifier; Based on the platform identifier, search whether the corresponding private cloud PaaS platform has ever infringed upon any rights. If the platform feature combination and resource statistics are verified, and there are no authorization failure records in the historical authorization records, and the corresponding private cloud PaaS platform does not have any infringement issues, the verification is deemed successful.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images