Method for running application program, electronic equipment and storage medium

Abstract

The invention provides a method for running an application program, electronic equipment and a storage medium. The method comprises the following steps: determining host machine information related to a host machine; determining whether the host machine information meets a predetermined condition or not, and obtaining a verification result of a to-be-started container in the host machine; and in response to the fact that the verification result is detected to be passed, starting the container so as to run the application program in the container.

Description

Method for running application, electronic device and storage medium Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device, electronic device, storage medium, and computer program product for running an application. Background Art

[0002] As container technology matures, many software and IT companies are adopting it. While containers offer convenience, they also present challenges, such as the ease with which unauthorized applications can be copied and used within containers, and the inability to protect applications.

[0003] Summary of the Invention

[0004] The present disclosure provides a method, apparatus, electronic device, storage medium, and computer program product for running an application.

[0005] According to one aspect of the present disclosure, a method for running an application is provided, comprising: determining host information related to a host; determining whether the host information satisfies a predetermined condition, and obtaining a verification result of a container to be started in the host; and in response to detecting that the verification result is passed, starting the container to run the application in the container.

[0006] For example, the host information includes at least one of the following sub-information: the number of containers started in the host, the first image information of the container image in the host, the device fingerprint information of the host, and the authorization validity period of the host; the predetermined condition includes at least one of the following sub-conditions: a quantity sub-condition corresponding to the number of containers, an image sub-condition corresponding to the first image information, a fingerprint sub-condition corresponding to the device fingerprint information, and a validity period sub-condition corresponding to the authorization validity period; determining whether the host information meets the predetermined condition and obtaining a verification result of the container to be started in the host includes: determining whether at least one sub-information meets the respective corresponding sub-conditions, obtaining at least one verification sub-result corresponding to the at least one sub-information; and determining the verification result based on the at least one verification sub-result.

[0007] For example, the fingerprint sub-condition includes: the fingerprint record is consistent with the device fingerprint information.

[0008] For example, determining whether at least one sub-information satisfies the respective corresponding sub-conditions and obtaining at least one verification sub-result corresponding to the at least one sub-information includes: when the host machine is online, sending a fingerprint verification request including the device fingerprint information to the credit platform, so that the credit platform determines a first processing result representing whether the fingerprint record is consistent with the device fingerprint information; and in response to receiving the first processing result from the credit platform, determining the fingerprint verification sub-result in the verification result based on the first processing result.

[0009] For example, determining whether at least one sub-information satisfies the respective corresponding sub-conditions and obtaining at least one verification sub-result corresponding to the at least one sub-information includes: when the host machine is in an offline state, reading a local license file; wherein the license file is obtained from a credit platform; parsing the license file to obtain a fingerprint record; and determining whether the fingerprint record is consistent with the device fingerprint information to obtain a fingerprint verification sub-result in the verification result.

[0010] For example, determining whether the fingerprint record is consistent with the device fingerprint information includes: in response to detecting that the fingerprint record includes fingerprint information of a host machine, and the fingerprint information of the host machine is the same as the device fingerprint information, determining that the fingerprint record is consistent with the device fingerprint information; and in response to detecting that the fingerprint record includes multiple reference fingerprint information of multiple host machines in a cluster, and the multiple reference fingerprint information includes reference fingerprint information that is the same as the device fingerprint information, determining that the fingerprint record is consistent with the device fingerprint information; wherein the cluster is the cluster in which the host machine is located.

[0011] For example, the validity period sub-condition includes: the authorization validity period is in a valid state.

[0012] For example, determining whether at least one sub-information satisfies the respective corresponding sub-conditions and obtaining at least one verification sub-result corresponding to the at least one sub-information includes: when the host machine is online, sending a fingerprint verification request including device fingerprint information to the credit platform so that the credit platform determines a second processing result representing whether the authorization validity period is in a valid state; and in response to receiving the second processing result from the credit platform, determining the validity period verification sub-result in the verification result based on the second processing result.

[0013] For example, the mirror sub-condition includes: the second mirror information in the configuration file is consistent with the first mirror information.

[0014] For example, the first image information includes at least one of an image identifier and an image version number.

[0015] For example, the quantity sub-condition includes the number of started containers being less than a quantity threshold.

[0016] For example, the host information includes at least two sub-information, the predetermined condition includes at least two sub-conditions; and determining the verification result according to the at least one syndrome result includes: determining that the verification result is a pass in response to detecting that each syndrome result in the at least two syndrome results is a pass; and determining that the verification result is a fail in response to detecting that the at least two syndrome results include a fail syndrome result.

[0017] For example, the above method further includes: determining device fingerprint information based on at least one of a host machine identifier, disk information, motherboard information, CPU information, and network card information.

[0018] For example, determining the device fingerprint information based on at least one of the host machine identification, disk information, motherboard information, CPU information, and network card information includes: determining an initial string based on at least one of the host machine identification, disk information, motherboard information, CPU information, and network card information; and encrypting the initial string to obtain the device fingerprint information.

[0019] For example, the above method also includes: after starting the container, when the host machine is in an online state, sending a heartbeat request including device fingerprint information to the trusted platform at predetermined intervals, so that the trusted platform can determine validity information representing whether the authorization validity period of the host machine is in a valid state; and in response to receiving the validity information from the trusted platform, determining whether to close the container based on the validity information.

[0020] For example, the above method further includes: in response to detecting that the verification result is failed, stopping starting the container.

[0021] According to another aspect of the present disclosure, a method for running an application is provided, comprising: in response to receiving a verification request from a host machine, determining a processing result based on the verification request; wherein the verification request includes host machine information related to the host machine, and the processing result represents whether the host machine information satisfies a predetermined condition; and outputting the processing result to the host machine, so that the host machine determines a verification result of a container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

[0022] For example, the host information includes the device fingerprint information of the host; the processing result includes at least one of the following: a first processing result indicating whether the fingerprint record is consistent with the device fingerprint information, and a second processing result indicating whether the authorization validity period of the host is in a valid state; the verification result includes at least one of the following: a fingerprint check sub-result and a validity period check sub-result.

[0023] For example, the above method also includes: in response to receiving a heartbeat request from the host machine, determining validity information indicating whether the authorization validity period of the host machine is in a valid state based on the device fingerprint information in the heartbeat request; and sending the validity information to the host machine so that the host machine determines whether to close the container based on the validity information.

[0024] For example, the above method also includes: in response to receiving a download request from the host machine, sending a license file to the host machine, so that the host machine reads and parses the local license file when it is offline, obtains a fingerprint record, and determines whether the fingerprint record is consistent with the device fingerprint information in the host machine information, and obtains a fingerprint verification sub-result in the verification result.

[0025] According to another aspect of the present disclosure, a device for running an application is provided, comprising: a host information determination module, a verification result determination module, and a startup module. The host information determination module is configured to determine host information related to the host; the verification result determination module is configured to determine whether the host information satisfies predetermined conditions and obtain a verification result of a container to be started on the host; and the startup module is configured to, in response to detecting a passing verification result, start the container to run the application in the container.

[0026] According to another aspect of the present disclosure, a device for running an application is provided, including: a processing result determination module and an output module, wherein the processing result determination module is used to determine a processing result according to the verification request in response to receiving a verification request from a host machine; wherein the verification request includes host machine information related to the host machine, and the processing result represents whether the host machine information meets a predetermined condition; the output module is used to output the processing result to the host machine, so that the host machine determines the verification result of a container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

[0027] According to another aspect of the present disclosure, an electronic device is provided, including a memory and a processor, wherein instructions executable by the processor are stored in the memory, and when the instructions are executed by the processor, the processor executes the above method.

[0028] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the above method.

[0029] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, which implements the above method when executed by a processor.

[0030] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0032] FIG1 is a schematic flow chart of a method for running an application according to an embodiment of the present disclosure;

[0033] FIG2 is a schematic diagram of an online mode of a single-machine single-container scenario according to an embodiment of the present disclosure;

[0034] FIG3 is a schematic diagram of an offline mode in a single-machine single-container scenario according to an embodiment of the present disclosure;

[0035] FIG4 is a schematic diagram of a host machine deployment architecture in an offline mode for a single-machine, single-container scenario according to an embodiment of the present disclosure;

[0036] FIG5 is a schematic diagram of an online mode of a single-machine multi-container scenario according to an embodiment of the present disclosure;

[0037] FIG6 is a schematic diagram of an offline mode in a single-machine multi-container scenario according to an embodiment of the present disclosure;

[0038] FIG7 is a schematic diagram of a host machine deployment architecture in offline mode for a single-machine multi-container scenario according to an embodiment of the present disclosure;

[0039] FIG8 is a schematic diagram of a deployment architecture of an offline mode in a cluster scenario according to an embodiment of the present disclosure;

[0040] FIG9 is a schematic diagram of a method for running an application according to an embodiment of the present disclosure;

[0041] FIG10 is a schematic flow chart of a method for running an application according to an embodiment of the present disclosure;

[0042] FIG11 is a schematic structural block diagram of an apparatus for running an application according to an embodiment of the present disclosure;

[0043] FIG12 is a schematic structural block diagram of an apparatus for running an application according to an embodiment of the present disclosure; and

[0044] FIG13 is a block diagram of an electronic device suitable for implementing a method for running an application according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of them. Based on the described embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure. It should be noted that throughout the drawings, the same elements are represented by the same or similar figure marks. In the following description, some specific embodiments are only for descriptive purposes and should not be understood as any limitation to the present disclosure, but are only examples of the embodiments of the present disclosure. Conventional structures or configurations will be omitted when they may cause confusion in the understanding of the present disclosure. It should be noted that the shapes and sizes of the components in the figures do not reflect the actual size and proportion, but only illustrate the contents of the embodiments of the present disclosure.

[0046] Unless otherwise defined, technical or scientific terms used in the embodiments of the present disclosure shall have the same general meaning as those skilled in the art. The terms "first," "second," and similar terms used in the embodiments of the present disclosure do not denote any order, quantity, or importance, but are merely used to distinguish different components.

[0047] FIG1 is a schematic flowchart of a method for running an application according to an embodiment of the present disclosure.

[0048] As shown in FIG. 1 , the present disclosure provides a method 100 for running an application program. The method 100 may be executed by a host machine. The method 100 may include operations S110 to S130 .

[0049] In operation S110 , host information related to the host is determined.

[0050] For example, the host machine may include a physical machine or a virtual machine. The host machine may store at least one container image locally, and at least one container may be created using the single container image, and at least one application may be run in the container.

[0051] For example, the host information may include a device identifier, or may include information such as a container image identifier in the host.

[0052] In operation S120 , it is determined whether the host information meets a predetermined condition, and a verification result of the container to be started in the host is obtained.

[0053] For example, the predetermined condition may include that the device identifier of the host machine is in a predetermined device identifier list, or may include that the container image identifier in the host machine is in a predetermined image identifier list.

[0054] For example, the verification result may include pass and fail. If the host information meets a predetermined condition, the verification result may be determined to be pass, otherwise the verification result may be determined to be fail.

[0055] In operation S130 , in response to detecting that the verification result is passed, the container is started to run the application in the container.

[0056] It is understandable that in some embodiments, if the verification result is failed, the container can be stopped to prevent the application in the container from running.

[0057] According to the technical solution provided by the embodiment of the present disclosure, the verification result is first determined based on the host information and predetermined conditions, and the application is run when the verification result is passed. If there are problems such as the application being stolen or copied, the verification result may be failed, and then the application may not be run, thereby protecting the application in the container, alleviating the problem of the application being copied or stolen, and protecting the rights and interests of the application developer. In addition, the method provided by the embodiment of the present disclosure is implemented by software, does not rely on hardware, and has a low cost. There is no need to deploy a separate service on the host machine, and the container can be directly run for identification, which is convenient to deploy.

[0058] The following describes the host information and reservation conditions.

[0059] In one example, the host information may include the device fingerprint information of the host. Accordingly, the predetermined condition may include a fingerprint sub-condition, for example, the fingerprint sub-condition may include that the fingerprint record is consistent with the device fingerprint information. The fingerprint record may be pre-recorded locally or in the cloud, and the fingerprint record records the device fingerprint information of the legitimate device. When the host is online, the device fingerprint information can be compared with the fingerprint record stored in the cloud or locally on the host to see if they are consistent. When the host is offline, the device fingerprint information can be compared with the fingerprint record stored locally on the host to see if they are consistent. This example can verify the device fingerprint to determine whether the host is legitimate.

[0060] Exemplarily, device fingerprint information can be determined based on at least one device information selected from the host machine identification, disk information, motherboard information, CPU information, and network card information. For example, CPU information can include CPU vendor information, CPU quantity, etc., and network card information can include network card address. Disk information can include disk identification, and motherboard information can include motherboard identification. For example, an initial string can be determined based on at least one of the host machine identification, disk information, motherboard information, CPU information, and network card information. For example, a certain device information can be determined as the initial string, or the above-mentioned multiple device information can be combined into an initial string in a predetermined order. The initial string can then be encrypted to obtain device fingerprint information. The encryption method can include symmetric encryption and asymmetric encryption, such as encryption using the sha256 encryption algorithm. In this example, encrypting the initial string can improve the security of the device fingerprint information. For another example, the initial string can be omitted and directly used as the device fingerprint information. In this example, the encryption operation is omitted, so no subsequent decryption processing is required, thereby improving data processing efficiency.

[0061] In another example, the host information may include the authorization validity period of the host. Accordingly, the predetermined condition may include a validity period sub-condition. For example, the validity period sub-condition may include: the authorization validity period is in a valid state. During the actual verification process, the validity period may be pre-recorded locally or stored in the cloud. When the host is online, the authorization validity period may be compared with the validity period stored in the cloud or the host locally to see if they are consistent. When the host is offline, the authorization validity period may be compared with the validity period stored locally on the host to see if they are consistent. This example can verify the authorization validity period of the host, thereby preventing a legitimate but expired host from running a protected application.

[0062] In another example, the host information may include first image information of a container image in the host. Accordingly, the predetermined condition may include an image sub-condition, such as an image sub-condition that the second image information in the configuration file is consistent with the first image information. The first image information may include at least one of an image identifier and an image version number of the container image in the host. Similarly, the second image information may include at least one of an image identifier and an image version number in the configuration file. The image identifier may include an image name. This example can verify the image information to prevent the host from creating a container using an illegal image.

[0063] In another example, the host information may include the number of containers started on the host. Accordingly, the predetermined condition may include a quantity sub-condition, such as the quantity sub-condition that the number of started containers is less than a quantity threshold. In this example, the container quantity can be verified to prevent the host from running containers exceeding the quantity limit.

[0064] In some embodiments, the host information may include only one sub-information among the above-mentioned multiple sub-information, and accordingly, the predetermined condition may include only one sub-condition corresponding to the one sub-information.

[0065] In other embodiments, the host information may include multiple sub-information, and accordingly, the predetermined condition may include multiple sub-conditions corresponding to the multiple sub-information. For example, the host information may include the number of containers started on the host, the first image information of the container image on the host, the device fingerprint information of the host, and the authorization validity period of the host. Accordingly, the predetermined condition may include a quantity sub-condition, an image sub-condition, a fingerprint sub-condition, and a validity period sub-condition.

[0066] It should be noted that when the host information includes multiple sub-information and the predetermined condition includes multiple sub-conditions, it can be determined whether the multiple sub-information meets the corresponding sub-conditions. The verification result can be determined to be passed when all the sub-information meets the corresponding sub-conditions, otherwise it is failed, thereby performing a more comprehensive verification of the host information to ensure the security of the application in the container in the host. Alternatively, the verification result can be determined to be passed when a certain sub-information meets the corresponding sub-condition, otherwise it is failed. It should be noted that this embodiment does not limit the order of determining whether multiple sub-information meet the corresponding sub-conditions.

[0067] In actual deployment, the method for running applications provided by the disclosed embodiments is applicable to diverse scenarios, including a single machine with a single container, a single machine with multiple containers, and a container cluster, thus achieving a wide range of applications. In each scenario, both online and offline modes are supported, making authorization more convenient. It should be noted that in offline mode, the host machine does not need to interact with the trusted platform. In online mode, the host machine does need to interact with the trusted platform, which is described below.

[0068] The trust platform may include a storage unit, a processor, and the like. In terms of physical deployment, the trust platform may be deployed on a single server, for example, on a host node or a container node, or on another server independent of the host. The trust platform may be used to compare whether the obtained sub-information satisfies the pre-stored sub-conditions. The following describes a signature verification process of the trust platform in conjunction with an embodiment. For example, the host machine obtains the device fingerprint information through a local acquisition program, and then the host machine may send the device fingerprint information to the trust platform in the form of a data packet. The monitoring function of the trust platform may monitor whether the trust platform obtains the device fingerprint information from the host machine, and when it monitors that the trust platform has obtained the device fingerprint information, it triggers the trust platform to retrieve the fingerprint record pre-stored in the storage unit, and then compares the device fingerprint information with the fingerprint record on the processor, thereby achieving the above-mentioned signature verification process.

[0069] The following describes the method of running an application in various scenarios in conjunction with specific embodiments.

[0070] FIG2 is a schematic diagram of an online mode in a single-machine single-container scenario according to an embodiment of the present disclosure.

[0071] The following describes the online mode of a single-machine single-container scenario in conjunction with FIG2 . A single-machine single-container scenario may represent a host machine 201 running a protected container. The host machine 201 may be a physical machine or a virtual machine.

[0072] In operation S211, the host machine 201 determines whether the first image information satisfies the image sub-condition. For example, the first image information in the configuration file is read during the startup of the container. A predetermined program in the container can be called, and the predetermined program is, for example, docker-check-sdk. The predetermined program can read the configuration file and obtain the first image information. The first image information may include the image name and the image version number. The predetermined program can then execute the docker command on the host machine 201 via ssh to enable interaction between the container and the host machine 201, and check whether there is a second image information with the same image name in the host machine 201. If not, it indicates that the host machine 201 is illegal and the program can be terminated. If it exists, the next step can be performed.

[0073] In operation S212, a determination is made as to whether the number of containers started on host machine 201 satisfies the quantity sub-condition. For example, a check may be made as to whether the container on host machine 201 is already started. Since this is a single-machine, single-container scenario, host machine 201 only supports running one container. The quantity threshold may be 1. If the container is already started, the number of started containers is 1, which does not satisfy the quantity sub-condition. Therefore, the check status is determined to be false. If not started, the next step may be performed.

[0074] Next, it may be determined whether the device fingerprint information of the host machine 201 meets the fingerprint sub-condition through the following operations S213 and S221 .

[0075] In operation S213, the host machine 201 obtains the device fingerprint information and then remotely calls the verification interface of the trust platform 202 and sends a fingerprint verification request. The verification interface may be an http interface, and the fingerprint verification request includes the device fingerprint information.

[0076] In operation S221, the trust platform 202 determines whether the host machine 201 is legal. For example, after the verification interface of the trust platform 202 receives the fingerprint verification request from the host machine 201, the trust platform 202 parses the device fingerprint information and compares the parsed device fingerprint information with the fingerprint record recorded by the trust platform 202. If the fingerprint record is consistent with the device fingerprint information, the trust platform 202 determines that the host machine 201 is legal and returns the first processing result of true to the host machine 201, and can also proceed to the next step. If they are inconsistent, the trust platform 202 determines that the host machine 201 is illegal and returns the first processing result in the check status status to the host machine 201 as false. It can be seen that the legality of the host machine 201 indicates that the device fingerprint information meets the fingerprint sub-condition, and the illegality of the host machine 201 indicates that the device fingerprint information does not meet the fingerprint sub-condition. In addition, the above-mentioned fingerprint record includes at least one reference fingerprint information. When the at least one reference fingerprint information includes the same fingerprint information as the device fingerprint information, it can be determined that the fingerprint record is consistent with the device fingerprint information.

[0077] Next, it may be determined through the following operation S222 whether the validity period information of the host machine 201 satisfies the validity period sub-condition.

[0078] In operation S222, the trusted platform 202 determines whether the host machine 201 is within the validity period. For example, the trusted platform 202 queries the device service authorization validity period based on the device fingerprint information and compares the validity period with the current time on the trusted platform 202. If the validity period is before the current time on the trusted platform 202, it indicates that the device has expired. The interface can return the second processing result in the check status as false to the host machine 201. Otherwise, it returns the second processing result in the check status as true. It can be seen that the second processing result indicates whether the authorization validity period is valid.

[0079] In operation S214 , the host machine 201 may record the authorization status.

[0080] In operation S215, the host machine 201 determines whether the verification result is passed. If passed, operation S216 is executed, that is, the application is run. If not, the process ends. For example, the host machine 201 can determine the fingerprint verification sub-result and the validity period verification sub-result based on the first processing result and the second processing result, respectively. For example, the first processing result is true and false, respectively indicating that the fingerprint verification sub-result is passed and failed, and the second processing result is true and false, respectively indicating that the validity period verification sub-result is passed and failed. The host machine 201 can also determine whether to run the application based on the value returned by the verification interface of the credit platform 202. For example, if the verification interface returns false, it means that the service has expired or the device is illegal, and the application can be not run at this time. For example, if the verification interface returns true, the application in the container can be run.

[0081] In addition, after starting the container, the validity information of the host machine 201 can be verified online to determine whether to close the container. The following describes the online verification process through operations S223 and S217.

[0082] In operation S223, it is determined whether the validity period of the host machine 201 is within the validity period. For example, during the operation of the protected application, the host machine 201 can call the online verification interface of the credit platform 202 at predetermined intervals and send a heartbeat request to the online verification interface. The predetermined time period can be 1 hour, and the heartbeat request includes the device fingerprint information. The credit platform 202 can determine the validity information representing whether the authorization validity period of the host machine 201 is in a valid state based on the device fingerprint information. If the authorization validity period of the host machine 201 has expired, that is, the authorization validity period of the host machine 201 is in an invalid state, the credit platform 202 returns the validity information false to the host machine 201, otherwise it returns the validity information true.

[0083] In operation S217, the host machine 201 can determine whether to close the container based on the received validity information. For example, if the received validity information is false, the host machine 201 can destroy the container and stop running the application. If the received validity information is true, the host machine 201 can continue running the application. This embodiment can verify online whether the authorization validity period of the host machine 201 has expired during the running of the application, and determine whether to close the application based on the expiration result, thereby preventing the host machine 201 from continuing to run the application after the authorization validity period has expired.

[0084] It should be noted that this embodiment does not limit the order of verifying whether multiple sub-information satisfy their corresponding sub-conditions. In other embodiments, other verification orders may also be used.

[0085] FIG3 is a schematic diagram of an offline mode in a single-machine single-container scenario according to an embodiment of the present disclosure.

[0086] The offline mode of a single-machine, single-container scenario is described below with reference to FIG3 .

[0087] In operation S311 , device fingerprint information of the host machine 301 is obtained.

[0088] In operation S321, the trust platform 302 generates a license file based on the device fingerprint information. For example, the operator manually enters customer information, product information, and other information into the front-end interface of the trust platform 302. Product information may include information about the software to be trusted. The operator may also enter device fingerprint information into the front-end interface of the trust platform 302, or the host machine 301 may send the device fingerprint information to the trust platform 302 while online. The trust platform 302 may generate a license file based on the device fingerprint information. The license file may be, for example, a license file.

[0089] In operation S312, host machine 301 may mount the license file to the container. For example, host machine 301 may download the license file from trusted platform 302 while online and store it locally. For example, host machine 301 may send a download request to trusted platform 302, which then sends the license file to host machine 301. Host machine 301 may then mount the license file to the container using Docker Compose (a tool for standalone container orchestration).

[0090] In operation S313 , the host machine 301 may parse the license file to obtain device fingerprint information in the license file, which is called a fingerprint record.

[0091] In operation S314, the host machine 301 determines whether the verification result is passed. If passed, operation S315 is performed, otherwise the process ends.

[0092] For example, host machine 301 can use a local license file for verification while offline. During the verification process, host machine 301 can determine whether the first image information meets the image sub-condition, whether the number of containers started on host machine 301 meets the quantity sub-condition, and whether the device fingerprint information of host machine 301 meets the fingerprint sub-condition. The determination method can be referred to the single-machine single-container online mode above, and will not be repeated in this embodiment.

[0093] It should be noted that this embodiment differs from the single-machine, single-container online mode in that, in determining whether the device fingerprint information of host machine 301 meets the fingerprint sub-condition, host machine 301 can read the local license file, parse the license file, and obtain the fingerprint record. Host machine 301 then determines whether the fingerprint record is consistent with the device fingerprint information, obtaining the fingerprint syndrome result in the verification result. If the fingerprint syndrome result is a pass, the application is run; otherwise, the process ends and the application is not run.

[0094] In operation S315 , the application program is executed.

[0095] In some embodiments, the offline mode can omit the operation of determining whether the validity period information of the host machine 301 satisfies the validity period sub-condition. In some embodiments, the offline mode can also determine whether the validity period information of the host machine 301 satisfies the validity period sub-condition. In this case, the validity period threshold can be recorded in the license file. The host machine 301 can obtain the validity period threshold after parsing the license file and further determine the validity period check sub-condition.

[0096] It should be noted that, in some embodiments, the trust platform can encrypt the license file, and the host machine can decrypt the encrypted license file. For example, the trust platform and the host machine pre-agree on the encryption method and decryption method, and then the trust platform encrypts according to the predetermined encryption method, and the host machine decrypts according to the predetermined decryption method. For another example, encryption can be achieved by combining symmetric encryption and asymmetric encryption. The trust platform can use a symmetric encryption algorithm to generate a symmetric key, and then use the symmetric key to encrypt the license file, use the public key in the key pair generated by the asymmetric encryption algorithm to encrypt the above-mentioned symmetric key, and send the encrypted license file and the encrypted symmetric key to the host machine. The host machine can use the private key in the key pair to decrypt the encrypted symmetric key, and then use the decrypted symmetric key to decrypt the encrypted license file, thereby obtaining the license file. This embodiment can improve the security of the license file by encrypting and decrypting the license file, thereby preventing the license file from being tampered with and causing an erroneous judgment that the device fingerprint information meets the corresponding sub-condition, thereby improving the security of the application.

[0097] It is understandable that in other embodiments, the license file may not be encrypted, and the trust platform may directly send the unencrypted license file to the host machine. Accordingly, the host machine does not need to decrypt the license file.

[0098] FIG4 is a schematic diagram of a host machine deployment architecture in offline mode for a single-machine, single-container scenario according to an embodiment of the present disclosure.

[0099] As shown in Figure 4, host machine 410 includes a file system 411 and a container 412. Application 4121 in container 412 is the application to be protected. Application 4121 includes a predetermined verification program, such as a verification SDK program. The verification SDK program can read and verify license file 4111 in file system 411. In this embodiment, license file 4111 is mounted to container 412, eliminating the need for additional servers and reducing hardware costs.

[0100] FIG5 is a schematic diagram of an online mode of a single-machine multi-container scenario according to an embodiment of the present disclosure.

[0101] The following describes the online mode of a single-machine multi-container scenario with reference to FIG5 . A single-machine single container may represent a host machine 501 running multiple protected containers.

[0102] In this embodiment, the method for running an application involves a host machine 501 and a trusted platform 502 . The method may include operations S511 to S517 , and operations S521 to S524 .

[0103] Host machine 501 performs operations S511 through S517. These operations can be referenced to operations S211 through S217 in the single-machine, single-container online mode described above and are not further described in this embodiment. Based on these operations, host machine 501 can determine whether the first image information satisfies the image sub-condition, whether the number of containers started on host machine 501 satisfies the quantity sub-condition, whether the device fingerprint information of host machine 501 satisfies the fingerprint sub-condition, and whether the validity period information of host machine 501 satisfies the validity period sub-condition.

[0104] The credit granting platform 502 performs operations S521 to S524, wherein operations S521, S522 and S524 may refer to operations S221 to S223 above, and will not be described in detail in this embodiment.

[0105] It should be noted that this embodiment differs from the single-machine, single-container online mode in that, in determining whether the number of containers already started on host machine 501 meets the quantity sub-condition, the trust platform 502 can, after receiving the fingerprint verification request, perform operation S523. This involves querying the host machine 501's pre-authorized quantity threshold based on the device fingerprint information in the fingerprint verification request and returning the quantity threshold to the host machine 501. Accordingly, the host machine 501 can detect the number of already started containers, and it can be seen that this number does not include the container currently being started. If the number of already started containers equals the quantity threshold, indicating that the number of container starts has reached the authorized upper limit, the container to be started will not be started. Otherwise, the container to be started can be started.

[0106] FIG6 is a schematic diagram illustrating an offline mode in a single-machine multi-container scenario according to an embodiment of the present disclosure.

[0107] The offline mode of a single-machine multi-container scenario is described below with reference to FIG6 .

[0108] In this embodiment, the method for running an application involves a host machine 601 and a trusted platform 602. The method may include operations S611 through S615 and an operation S621. Host machine 601 performs operations S611 through S615. These operations can be referenced to operations S311 through S315 described above in the offline mode for a single machine and single container, and are not further described in this embodiment. Trusted platform 602 performs operation S621. This operation can be referenced to operation S321 described above in the offline mode for a single machine and single container, and is not further described in this embodiment.

[0109] It should be noted that this embodiment differs from the offline mode in the single-machine, single-container scenario in that a quantity threshold can be entered into the trust platform 602. Trust platform 602 can record this quantity threshold in the license file during the license file generation process. Accordingly, after parsing the license file, host machine 601 can obtain the quantity threshold from the license file.

[0110] FIG7 is a schematic diagram of a host machine deployment architecture in offline mode for a single-machine multi-container scenario according to an embodiment of the present disclosure.

[0111] As shown in Figure 7, a host machine 710 includes a file system 711 and n containers, where n is an integer greater than or equal to 2. The applications in the containers are the applications to be protected, and the applications include a predetermined verification program. A license file 7111 is mounted to the n containers, and the predetermined verification program of each container can read the license file 7111. For example, the n containers include container 1 712, ..., container n 713. Container 1 712 can run application 7121, and container n 713 can run application 7131. The applications in the n containers can be the same or different.

[0112] The following describes the online and offline modes of a cluster scenario. A cluster scenario includes multiple hosts, which can belong to the same cluster. Each host can have one or more containers deployed.

[0113] In actual applications, container clusters can be used in some large and complex scenarios, such as smart transportation, smart banks, and especially smart parks. In smart parks, due to the complexity of the Internet environment, the variety of functional requirements, and the large amount of data involved, the processing capabilities of single physical machines, virtual machines, and other stand-alone devices cannot meet the usage requirements, so a cluster composed of multiple devices is required to provide higher processing capabilities. It is understandable that due to spatial distance limitations and other reasons in large parks, the use security of physical device interfaces in multiple real-world scenarios is low. The method provided by the embodiments of the present disclosure can be used to run applications more safely, concisely, and efficiently.

[0114] For the online mode in a cluster scenario, refer to the online mode for a single machine and a single container or the online mode for a single machine and multiple containers to verify each host in the cluster scenario separately.

[0115] For offline mode in cluster scenarios, refer to the online mode for a single machine with a single container or the offline mode for a single machine with multiple containers to verify each host in the cluster separately.

[0116] Regarding the offline mode in cluster scenarios, the following describes another implementation of the offline mode in a single-machine multi-container scenario.

[0117] This embodiment differs from the offline mode in the cluster scenario described above in that it can obtain a list of device fingerprint information for each host in the cluster and use this list as a fingerprint record. The trust platform can generate a license file based on the list of device fingerprint information and the number threshold for each host. This license file can be stored locally on each host in the cluster and mounted on a container. The host parses the license file to obtain the list of device fingerprint information and the number threshold for each host.

[0118] In the process of determining whether the device fingerprint information meets the fingerprint sub-condition, the host machine may determine whether the device fingerprint information of the host machine exists in the device fingerprint information list. If so, the fingerprint record is determined to be consistent with the device fingerprint information; otherwise, they are determined to be inconsistent.

[0119] In some embodiments, the trust platform can encrypt the above-mentioned device fingerprint information list, and accordingly, the host machine can decrypt the encrypted device fingerprint information list. In addition, during the actual encryption process, the entire device fingerprint information list can be encrypted and decrypted as a whole, or each device fingerprint information in the device fingerprint information list can be encrypted and decrypted separately, thereby increasing the difficulty of verifying whether the device fingerprint information is consistent with the fingerprint record, increasing the difficulty of the application in the host machine being stolen, and further improving the security of the application. The encryption and decryption methods in this embodiment can be referred to above and will not be repeated in this embodiment.

[0120] FIG8 is a schematic diagram of a deployment architecture of an offline mode in a cluster scenario according to an embodiment of the present disclosure.

[0121] As shown in Figure 8, the cluster includes N host machines, where N is an integer greater than or equal to 2, and each host machine can include at least one container. The license files in the N host machines can be the same. For the same host machine, the license file in the host machine can be mounted to multiple containers in the host machine, and the multiple containers can read the license file. For example, the cluster includes host machine 1 810,..., host machine N 820, wherein host machine 1 810 can include n1 containers, wherein container 1 812 and container n1 813 can run applications 8121 and 8131 respectively, the file system 811 includes a license file 8111, and the applications in each container in host machine 1 810 can read the license file 8111. Similarly, host machine N 820 may include n2 containers, wherein container 1 822 and container n2 823 may run applications 8221 and 8231, respectively. File system 821 includes a license file 8211, and applications in each container in host machine N 820 may read license file 8211. Both n1 and n2 are integers greater than or equal to 1.

[0122] FIG9 is a schematic diagram of a method for running an application according to an embodiment of the present disclosure.

[0123] This embodiment involves a trust platform 920 , at least one first host machine 911 , and at least one second host machine 912 .

[0124] The credit granting platform 920 may include multiple functional modules, such as a data processing module, a legitimacy verification module, a license management module, an analysis and warning module, a device fingerprint acquisition module, an application activation module, a product and order management module, an encryption module, etc. The following describes each functional module in the credit granting platform 920.

[0125] The data processing module can be used to process the data to be analyzed to obtain analysis results. The data to be analyzed may include business distribution information of the application, industry distribution information, etc.

[0126] The legitimacy verification module is used to perform online legitimacy verification when the first host machine 911 is in online mode. For example, the legitimacy verification module can compare the device fingerprint information with the pre-stored fingerprint record to see whether it is consistent, or can compare the host machine's authorization validity period to see whether it is within the validity period.

[0127] The license management module is used to manage the license file, such as managing the validity period of the license file, the correspondence between the license file and the first host machine 911 , etc. It can also generate a license file and issue the license file to the first host machine 911 .

[0128] The analysis and warning module is used to provide event warnings. For example, if the validity period of a device is about to expire, a warning message can be output to remind the user that the device is approaching its validity period.

[0129] The device fingerprint acquisition module may include an acquisition program for acquiring device fingerprint information. The acquisition program may be distributed by the trust platform 920 to the first host machine 911 and the second host machine 912. The first host machine 911 and the second host machine 912 may respectively run local acquisition programs 9112 and 9122 to determine their own device fingerprint information. The acquisition programs 9112 and 9122 may be the same or different.

[0130] The application activation module may include a decryption program for decrypting the license file. The decryption program may be sent by the trust platform 920 to the first host machine 911 , and the first host machine 911 may run a local decryption program to decrypt the license file.

[0131] The product and order management module is used to manage order information, such as the user, product, expiration date, etc. It can also be used to manage product information, where the product can be the protected application mentioned above, for example, it can manage application version information.

[0132] The encryption module is used to encrypt the license file.

[0133] There is at least one first host machine 911. It can be seen that when there are multiple first host machines 911, these first host machines 911 form a first cluster. The first host machine 911 is online and includes a container environment. The container environment may include a protected application 9111 and an acquisition program 9112. The first host machine 911 may download the acquisition program 9112 from the trusted platform 920. The acquisition program 9112 may, for example, determine device fingerprint information based on at least one device information item selected from the group consisting of the first host machine identifier, disk information, motherboard information, CPU information, and network card information.

[0134] The trust platform 920 and the first host machine 911 can interact with each other through the interface 921. For example, the first host machine 911 can send device fingerprint information to the interface 921 of the trust platform 920, and the trust platform 920 can return a processing result based on the device fingerprint information to the first host machine 911. The trust platform 920 can send a license file to the first host machine 911, and the first host machine 911 can send a heartbeat request to the interface 921.

[0135] Similarly, there is at least one second host machine 912. It can be seen that when there are multiple second host machines 912, these second host machines 912 form a second cluster. The second host machine 912 is in an offline state. The second host machine 912 includes a container environment, which may include a protected application 9121 and an acquisition program 9122. The second host machine 912 can download the acquisition program 9122 from the trusted platform 920. The second host machine 912 can download the license file from the trusted platform 920 in advance through the interface 921 and perform verification based on the license file in offline mode.

[0136] FIG10 is a schematic flowchart of a method for running an application according to an embodiment of the present disclosure.

[0137] As shown in FIG. 10 , the method 1000 in this embodiment may be executed by a credit granting platform. The method 1000 may include operations S1010 to S1020 .

[0138] In operation S1010 , in response to receiving a verification request from a host machine, a processing result is determined according to the verification request; wherein the verification request includes host machine information related to the host machine, and the processing result indicates whether the host machine information meets a predetermined condition.

[0139] In operation S1020, the processing result is output to the host machine, so that the host machine determines a verification result of the container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

[0140] For example, the verification request may include the fingerprint verification request described above. The trust platform may determine at least one of the first processing result and the second processing result based on the device fingerprint information in the verification request. The first processing result and the second processing result can be referred to above and will not be further described here. Accordingly, after the trust platform outputs the processing result to the host machine, the host machine may determine the fingerprint syndrome sub-result based on the first processing result, or may determine the validity period syndrome sub-result based on the second processing result.

[0141] The technical solution provided in this embodiment can protect applications within the container, alleviate the problem of application duplication or theft, and protect the rights and interests of application developers.

[0142] FIG11 is a schematic structural block diagram of an apparatus for running an application according to an embodiment of the present disclosure.

[0143] As shown in FIG. 11 , the apparatus 1100 for running an application may include a host information determination module 1110 , a verification result determination module 1120 , and a startup module 1130 .

[0144] The host information determination module 1110 is used to determine host information related to the host.

[0145] The verification result determination module 1120 is used to determine whether the host information meets a predetermined condition and obtain a verification result of the container to be started in the host.

[0146] The starting module 1130 is configured to start the container in response to detecting that the verification result is passed, so as to run the application in the container.

[0147] According to another embodiment of the present disclosure, the host information includes at least one of the following sub-information: the number of containers started in the host, the first image information of the container image in the host, the device fingerprint information of the host, and the authorization validity period of the host; the predetermined condition includes at least one of the following sub-conditions: a quantity sub-condition corresponding to the number of containers, an image sub-condition corresponding to the first image information, a fingerprint sub-condition corresponding to the device fingerprint information, and a validity period sub-condition corresponding to the authorization validity period; the verification result determination module includes a sub-result determination sub-module and a verification result determination sub-module. The sub-result determination sub-module is used to determine whether at least one sub-information satisfies the respective corresponding sub-conditions and obtain at least one verification sub-result corresponding to the at least one sub-information; the verification result determination sub-module is used to determine the verification result based on the at least one verification sub-result.

[0148] According to another embodiment of the present disclosure, the fingerprint sub-condition includes: the fingerprint record is consistent with the device fingerprint information.

[0149] According to another embodiment of the present disclosure, the sub-result determination submodule includes: a verification request sending unit and a fingerprint verification sub-result determination unit. The verification request sending unit is configured to, when the host machine is online, send a fingerprint verification request including device fingerprint information to the trust platform so that the trust platform can determine a first processing result indicating whether the fingerprint record is consistent with the device fingerprint information; and the fingerprint verification sub-result determination unit is configured to, in response to receiving the first processing result from the trust platform, determine the fingerprint verification sub-result in the verification result based on the first processing result.

[0150] According to another embodiment of the present disclosure, the sub-result determination submodule includes: a reading unit, a parsing unit, and a fingerprint check sub-result determination unit. The reading unit is configured to read a local license file when the host machine is offline; the license file is obtained from the trust platform; the parsing unit is configured to parse the license file to obtain a fingerprint record; and the fingerprint check sub-result determination unit is configured to determine whether the fingerprint record is consistent with the device fingerprint information, thereby obtaining a fingerprint check sub-result in the verification result.

[0151] According to another embodiment of the present disclosure, a fingerprint check sub-result determination unit includes: a first determination sub-unit and a second determination sub-unit. The first determination sub-unit is configured to, in response to detecting that the fingerprint record includes fingerprint information of a host machine, and the fingerprint information of the host machine is identical to the device fingerprint information, determine that the fingerprint record is consistent with the device fingerprint information; and the second determination sub-unit is configured to, in response to detecting that the fingerprint record includes multiple reference fingerprint information of multiple host machines in a cluster, and the multiple reference fingerprint information includes reference fingerprint information that is identical to the device fingerprint information, determine that the fingerprint record is consistent with the device fingerprint information; wherein the cluster is the cluster in which the host machine is located.

[0152] According to another embodiment of the present disclosure, the validity period sub-condition includes: the authorization validity period is in a valid state.

[0153] According to another embodiment of the present disclosure, the sub-result determination submodule includes: a verification request sending unit and a validity period verification sub-result determination unit. The verification request sending unit is configured to, when the host machine is online, send a fingerprint verification request including device fingerprint information to the trust platform so that the trust platform can determine a second processing result indicating whether the authorization validity period is valid; and the validity period verification sub-result determination unit is configured to, in response to receiving the second processing result from the trust platform, determine the validity period verification sub-result in the verification result based on the second processing result.

[0154] According to another embodiment of the present disclosure, the mirroring sub-condition includes: the second mirroring information in the configuration file is consistent with the first mirroring information.

[0155] According to another embodiment of the present disclosure, the first image information includes at least one of an image identifier and an image version number.

[0156] According to another embodiment of the present disclosure, the quantity sub-condition includes that the number of started containers is less than a quantity threshold.

[0157] According to another embodiment of the present disclosure, the host information includes at least two sub-information, the predetermined condition includes at least two sub-conditions, and the verification result determination submodule includes: a first verification result determination unit and a second verification result determination unit. The first verification result determination unit is configured to determine that the verification result is a pass in response to detecting that each of the at least two syndrome sub-results is a pass; and the second verification result determination unit is configured to determine that the verification result is a fail in response to detecting that the at least two syndrome sub-results include a fail syndrome sub-result.

[0158] According to another embodiment of the present disclosure, the apparatus further includes: a device fingerprint information determination module, configured to determine device fingerprint information based on at least one of a host machine identifier, disk information, motherboard information, CPU information, and network card information.

[0159] According to another embodiment of the present disclosure, a device fingerprint information determination module includes a string determination submodule and an encryption submodule. The string determination submodule is configured to determine an initial string based on at least one of a host machine identifier, disk information, motherboard information, CPU information, and network card information; the encryption submodule is configured to encrypt the initial string to obtain device fingerprint information.

[0160] According to another embodiment of the present disclosure, the above-mentioned device also includes: a heartbeat request sending module, which is used to send a heartbeat request including device fingerprint information to the trust platform at predetermined intervals after starting the container and when the host machine is online, so that the trust platform can determine validity information representing whether the authorization validity period of the host machine is in a valid state; and a status determination module, which is used to determine whether to close the container in response to receiving the validity information from the trust platform based on the validity information.

[0161] According to another embodiment of the present disclosure, the apparatus further includes: a stopping module configured to stop starting the container in response to detecting that the verification result is failed.

[0162] FIG12 is a schematic structural block diagram of an apparatus for running an application according to an embodiment of the present disclosure.

[0163] As shown in FIG. 12 , the apparatus 1200 for running an application may include a processing result determination module 1210 and an output module 1220 .

[0164] The processing result determination module 1210 is used to determine the processing result according to the verification request received from the host machine in response to the verification request; wherein the verification request includes host machine information related to the host machine, and the processing result represents whether the host machine information meets the predetermined conditions.

[0165] The output module 1220 is used to output the processing result to the host machine, so that the host machine determines the verification result of the container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

[0166] According to another embodiment of the present disclosure, the host machine information includes the device fingerprint information of the host machine; the processing result includes at least one of the following: a first processing result characterizing whether the fingerprint record is consistent with the device fingerprint information, and a second processing result characterizing whether the authorization validity period of the host machine is in a valid state; the verification result includes at least one of the following: a fingerprint check sub-result and a validity period check sub-result.

[0167] According to another embodiment of the present disclosure, the apparatus further includes: a validity information determination module and a validity information sending module. The validity information determination module is configured to, in response to receiving a heartbeat request from the host, determine validity information indicating whether the authorization validity period of the host is valid based on device fingerprint information in the heartbeat request; and the validity information sending module is configured to send the validity information to the host so that the host can determine whether to close the container based on the validity information.

[0168] According to another embodiment of the present disclosure, the above-mentioned device also includes: a license file sending module, which is used to send a license file to the host machine in response to receiving a download request from the host machine, so that the host machine can read and parse the local license file when it is offline, obtain a fingerprint record, and determine whether the fingerprint record is consistent with the device fingerprint information in the host machine information, and obtain a fingerprint verification sub-result in the verification result.

[0169] FIG13 is a block diagram of an electronic device suitable for implementing a method for running an application according to an embodiment of the present disclosure.

[0170] As shown in Figure 13, the electronic device 1300 according to an embodiment of the present disclosure includes a processor 1301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1302 or a program loaded from a storage part 1308 into a random access memory (RAM) 1303. The processor 1301 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1301 may also include an onboard memory for caching purposes. The processor 1301 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0171] The RAM 1303 stores various programs and data required for the operation of the electronic device 1300. The processor 1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. The processor 1301 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 1302 and / or the RAM 1303. It should be noted that the programs may also be stored in one or more memories other than the ROM 1302 and the RAM 1303. The processor 1301 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0172] According to an embodiment of the present disclosure, electronic device 1300 may further include an input / output (I / O) interface 1305, which is also connected to bus 1304. Electronic device 1300 may further include one or more of the following components connected to I / O interface 1305: an input portion 1306 including a keyboard, mouse, etc.; an output portion 1307 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage portion 1308 including a hard disk; and a communication portion 1309 including a network interface card such as a LAN card or modem. Communication portion 1309 performs communication processing via a network such as the Internet. A drive 1310 is also connected to I / O interface 1305 as needed. Removable media 1311, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 1310 as needed, so that computer programs read from the removable media can be installed into storage portion 1308 as needed.

[0173] The present disclosure also provides a non-transitory computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0174] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, such as, but not limited to, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1302 and / or RAM 1303 described above and / or one or more memories other than ROM 1302 and RAM 1303.

[0175] Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the method for verifying process data of a product provided by the embodiments of the present disclosure.

[0176] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 1301. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0177] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal over a network medium, downloaded and installed via the communication portion 1309, and / or installed from removable media 1311. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0178] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1309 and / or installed from the removable medium 1311. When the computer program is executed by the processor 1301, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0179] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0180] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0181] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0182] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method of running an application, include: Determine host information associated with the host; Determine whether the host information meets a predetermined condition, and obtain a verification result of the container to be started in the host; as well as In response to detecting that the verification result is passed, starting the container to run the application in the container.

2. The method according to claim 1, in, The host information includes at least one of the following sub-information: the number of containers started in the host, the first image information of the container image in the host, the device fingerprint information of the host, and the authorization validity period of the host; The predetermined condition includes at least one of the following sub-conditions: a quantity sub-condition corresponding to the quantity of the containers, an image sub-condition corresponding to the first image information, a fingerprint sub-condition corresponding to the device fingerprint information, and a validity period sub-condition corresponding to the authorization validity period; The determining whether the host information satisfies a predetermined condition and obtaining a verification result of the container to be started in the host includes: Determine whether the at least one sub-information satisfies the respective corresponding sub-conditions, and obtain at least one syndrome sub-result corresponding to the at least one sub-information; as well as The verification result is determined according to the at least one syndrome result.

3. The method according to claim 2, in, The fingerprint sub-condition includes: the fingerprint record is consistent with the device fingerprint information.

4. The method according to claim 3, in, The determining whether the at least one sub-information satisfies the corresponding sub-conditions and obtaining at least one syndrome result corresponding to the at least one sub-information comprises: When the host machine is online, sending a fingerprint verification request including the device fingerprint information to a trust platform, so that the trust platform determines a first processing result indicating whether the fingerprint record is consistent with the device fingerprint information; and In response to receiving the first processing result from the credit granting platform, a fingerprint verification sub-result in the verification result is determined according to the first processing result.

5. The method according to claim 3, in, The determining whether the at least one sub-information satisfies the corresponding sub-conditions and obtaining at least one syndrome result corresponding to the at least one sub-information comprises: When the host machine is in an offline state, reading a local license file; wherein the license file is obtained from the credit authorization platform; Parsing the license file to obtain the fingerprint record; and Determine whether the fingerprint record is consistent with the device fingerprint information, and obtain a fingerprint verification sub-result in the verification result.

6. The method according to claim 5, in, The determining whether the fingerprint record is consistent with the device fingerprint information includes: In response to detecting that the fingerprint record includes fingerprint information of a host machine, and the fingerprint information of the host machine is the same as the device fingerprint information, it is determined that the fingerprint record is consistent with the device fingerprint information.

7. The method according to claim 5, in, The determining whether the fingerprint record is consistent with the device fingerprint information includes: In response to detecting that the fingerprint record includes multiple reference fingerprint information of multiple host machines in a cluster, and the multiple reference fingerprint information includes reference fingerprint information that is the same as the device fingerprint information, it is determined that the fingerprint record is consistent with the device fingerprint information; wherein the cluster is the cluster where the host machine is located.

8. The method according to claim 2, in, The validity period sub-condition includes: the authorization validity period is in a valid state.

9. The method according to claim 8, in, The determining whether the at least one sub-information satisfies the corresponding sub-conditions and obtaining at least one syndrome result corresponding to the at least one sub-information comprises: When the host machine is online, sending a fingerprint verification request including the device fingerprint information to a credit platform, so that the credit platform can determine a second processing result indicating whether the authorization validity period is valid; and In response to receiving the second processing result from the credit platform, a validity period verification sub-result in the verification result is determined according to the second processing result.

10. The method according to claim 2, in, The mirror sub-condition includes: the second mirror information in the configuration file is consistent with the first mirror information.

11. The method according to claim 10, in, The first image information includes at least one of an image identifier and an image version number.

12. The method according to claim 2, in, The quantity sub-condition includes that the quantity of started containers is less than a quantity threshold.

13. The method according to any one of claims 2 to 12, in, The host information includes at least two sub-information, the predetermined condition includes at least two sub-conditions; and the determining the verification result according to the at least one verification sub-result includes: In response to detecting that each of the at least two syndrome results is a pass, determining that the check result is a pass; and In response to detecting that the at least two syndrome results include a failed syndrome result, determining that the verification result is a failed syndrome result.

14. The method according to claim 2, further comprising: include: The device fingerprint information is determined according to at least one of a host machine identification, disk information, motherboard information, CPU information, and network card information.

15. The method according to claim 14, in, The determining the device fingerprint information according to at least one of the host identification, disk information, motherboard information, CPU information and network card information comprises: Determine an initial string according to at least one of a host machine identifier, disk information, motherboard information, CPU information, and network card information; and The initial character string is encrypted to obtain the device fingerprint information.

16. The method according to claim 1, further comprising: include: After starting the container, When the host machine is online, a heartbeat request including the device fingerprint information is sent to the trust platform at predetermined intervals so that the trust platform can determine whether the authorization validity period representing the host machine is Whether the validity information is in a valid state; as well as In response to receiving the validity information from the trusted platform, determining whether to close the container is based on the validity information.

17. The method according to claim 1, further comprising: include: In response to detecting that the verification result is failed, stopping the activation of the container.

18. A method of running an application, include: In response to receiving a verification request from a host machine, determining a processing result according to the verification request; wherein the verification request includes host machine information related to the host machine, and the processing result indicates whether the host machine information meets a predetermined condition; and The processing result is output to the host machine, so that the host machine determines a verification result of the container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

19. The method according to claim 18, in, The host machine information includes device fingerprint information of the host machine; The processing result includes at least one of the following: a first processing result indicating whether the fingerprint record is consistent with the device fingerprint information, and a second processing result indicating whether the authorization validity period of the host machine is in a valid state; The verification result includes at least one of the following: a fingerprint check sub-result and a validity period check sub-result.

20. The method according to claim 18, further comprising: include: In response to receiving a heartbeat request from the host machine, determining validity information indicating whether the authorization validity period of the host machine is in a valid state according to device fingerprint information in the heartbeat request; The validity information is sent to the host machine, so that the host machine determines whether to close the container according to the validity information.

21. The method according to claim 18, further comprising: include: In response to receiving a download request from the host machine, a license file is sent to the host machine, so that the host machine reads and parses the local license file in an offline state to obtain a fingerprint record, And determine whether the fingerprint record is consistent with the device fingerprint information in the host information, and obtain the fingerprint verification sub-result in the verification result.

22. A device for running an application program, include: A host information determination module, used to determine host information related to the host; A verification result determination module, used to determine whether the host information meets a predetermined condition, and obtain a verification result of the container to be started in the host; as well as A starting module is used for starting the container in response to detecting that the verification result is passed, so as to run the application in the container.

23. The device according to claim 22, in, The host information includes at least one of the following sub-information: the number of containers started in the host, the first image information of the container image in the host, the device fingerprint information of the host, and the authorization validity period of the host; The predetermined condition includes at least one sub-condition of the following: a quantity sub-condition corresponding to the quantity of the containers, an image sub-condition corresponding to the first image information, a fingerprint sub-condition corresponding to the device fingerprint information, and a validity period sub-condition corresponding to the authorization validity period.

24. A device for running an application program, include: a processing result determination module, configured to, in response to receiving a verification request from a host machine, determine a processing result according to the verification request; wherein the verification request includes host machine information related to the host machine, and the processing result indicates whether the host machine information satisfies a predetermined condition; and An output module is used to output the processing result to the host machine, so that the host machine determines the verification result of the container to be started in the host machine based on the processing result, and starts the container and runs the application in the container if the verification result is passed.

25. An electronic device comprising a memory and a processor, wherein the memory stores instructions executable by the processor, and when the instructions are executed by the processor, the processor executes the method according to any one of claims 1 to 21.

26. A non-transitory computer-readable storage medium storing computer instructions, in, The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 21.

27. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 21.

Images