Software authorization method and device

Abstract

The invention discloses a software authorization method and device, and relates to the field of communication. The method is used for a local software authorization management system, the local software authorization management system is used for managing target local software, the local software management system and the target local software are deployed in a local server, and the method comprises the following steps: acquiring an authorization identifier of the target local software, the authorization identifier comprising a software identifier for indicating the target local software, the target local software is any one of N local software managed by the local software authorization management system, and N is a positive integer; according to the authorization identifier, obtaining a first authorization certificate sent by the cloud, the first authorization certificate being used for authorizing the target local software; and managing the target local software according to the first authorization certificate. The software authorization method and device are used for improving the software authorization efficiency and reducing the software authorization cost.

Description

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on September 22, 2023, with application number 202311235025.5 and application name “A method, system and device for software authorization”, the entire contents of which are incorporated by reference in this application. Technical Field

[0002] The present application relates to the field of communications, and in particular to a software authorization method and device. Background Art

[0003] The software subscription model refers to providing software for rent within a specified period of time, and the business object (for example, an enterprise employee) needs to authorize the software before using it. In the traditional authorization method, the business object needs to manually enter the authorization code sent by the software supplier when starting the software. At this time, the software can obtain the corresponding license file of the software by decrypting the authorization code.

[0004] However, when there are a large number of software, business objects need to spend a lot of time to frequently participate in the authorization process of each software. This will inevitably lead to incorrect input due to too many authorization codes received. For example, when authorizing software A, the business object may mistakenly enter the authorization code of software B into software A, or enter the correct authorization code (for example, "113") as an incorrect authorization code (for example, "123") during the manual input process. This means that the business object may need to enter it twice or even multiple times before the software can obtain the correct authorization code for decryption. This authorization method not only affects the authorization efficiency, but also leads to excessively high authorization costs. Summary of the invention

[0005] The present application provides a software authorization method and device for improving the efficiency of software authorization and reducing the cost of software authorization.

[0006] In order to achieve the above-mentioned purpose, this application adopts the following technical solution.

[0007] In a first aspect, an embodiment of the present application provides a software authorization method, which is used in a local software authorization management system, where the local software authorization management system is used to manage target local software, and the local software management system and the target local software are deployed on a local server, the method comprising: obtaining an authorization identifier of the target local software, where the authorization identifier comprises a software identifier for indicating the target local software, where the target local software is any one of N local software managed by the local software authorization management system, where N is a positive integer; obtaining a first authorization certificate sent by the cloud based on the authorization identifier, where the first authorization certificate is used to authorize the target local software; and managing the target local software based on the first authorization certificate.

[0008] In the above method, when authorizing the target local software, the first authorization certificate for authorizing the target local software can be quickly obtained according to the authorization identifier of the target local software through the interaction between the local software authorization management system and the cloud, so as to manage the target local software according to the first authorization certificate. The entire authorization process greatly reduces human-computer interaction, which can reduce the time spent on manual participation, thereby effectively improving the efficiency of software authorization. In addition, since the number of local software managed by the local software authorization management system is N, this means that the embodiment of the present application can achieve unified management of multiple software through the intervention of the local software authorization management system, that is, there is no need to independently develop each local software separately, which can effectively avoid the waste of development resources and manpower, thereby reducing the cost of software authorization.

[0009] In one implementation, the method further includes: configuring the file permissions of the first authorization certificate to obtain a configured first authorization certificate, the file permissions including at least one of editable permissions or reading permissions, the configured first authorization certificate is used to manage the target local software; and storing the configured first authorization certificate.

[0010] In the above implementation, the local software authorization management system configures the file permissions of the first authorization certificate so that users cannot modify, delete, copy, view, etc. the first authorization certificate at will, thereby preventing the first authorization certificate from being tampered with and effectively improving the security of the authorization certificate.

[0011] In one implementation, obtaining the authorization identifier of the target local software includes: displaying a management interface including N local software; in the management interface, responding to a startup operation for the target local software among the N local software, and obtaining the authorization identifier of the target local software.

[0012] In the above implementation method, a new software startup method is provided based on the software startup function of the local software authorization management system, that is, when authorizing any local software among N local software, there is no need to exit the local software authorization management system, but you can directly respond to the startup operation of the target local software in the management interface of the local software authorization management system, thereby realizing unified login.

[0013] In one implementation, the authorization identifier includes an object identifier; the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0014] In the above implementation, since the object identifier included in the authorization identifier of the target local software is used to indicate the business object that logs in to the local software authorization management system, this can more accurately identify the business object that uses the target local software, thereby ensuring that the first authorization certificate finally obtained is generated for the business object. In other words, if the business objects that log in to the local software authorization management system are different, even if the same local server is used, the authorization certificates obtained by the local software authorization management system will be different.

[0015] In one implementation, obtaining a first authorization certificate sent by the cloud based on an authorization identifier includes: searching in a local server based on the authorization identifier to obtain a search result; if the search result indicates that the search failed, generating a download request corresponding to the first authorization certificate, the download request including a request identifier, and the request identifier is used to indicate an association between an activation request and a download request for target local software; sending a download request to the cloud; and receiving the first authorization certificate sent by the cloud.

[0016] In the above implementation, when determining the first authorization certificate, the local software authorization management system can first search locally, which means that the embodiment of the present application does not need to be connected to the Internet at all times, that is, there is no need for the local software authorization management system to interact with the cloud at all times, but the target local software can be used offline in a specific time period (i.e., within the validity period of the authorization certificate, for example, one week or one month, etc.), and after the offline time ends, that is, when no valid authorization certificate is found locally, it is necessary to send a download request to the cloud to obtain a new authorization certificate. This cloud-based authorization and offline use method can effectively solve the defect of the traditional software authorization method that requires timely networking. In addition, since the download request carries a request identifier, it can play a tracking role in the distributed system.

[0017] In one implementation, managing the target local software according to the first authorization certificate includes: verifying the validity of the first authorization certificate to obtain a verification result; when the verification result indicates that the verification is successful, sending an activation instruction to the target local software, the activation instruction is used to instruct to activate the target local software.

[0018] In the above implementation, if the local software authorization management system has a verification function, then the local software authorization management system can directly send an activation instruction to the target local software without informing the target local software of the storage location of the first authorization certificate. In other words, the first authorization certificate will be invisible to the target local software, which will greatly reduce the number of times the first authorization certificate is exposed and more effectively improve the security of the first authorization certificate.

[0019] In one implementation, managing the target local software according to the first authorization certificate includes: sending the storage location of the first authorization certificate to the target local software; sending a verification instruction to the target local software, the verification instruction is used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

[0020] In the above implementation, if the local software authorization management system does not have a verification function, then the local software authorization management system can inform the target local software of the storage location and verification instructions of the first authorization certificate, and the target local software will verify the validity of the first authorization certificate, thereby effectively saving the computing resources of the local software authorization management system.

[0021] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software when responding to a download operation for the target local software.

[0022] In the above implementation, based on the software download function of the local software authorization management system, a new software download method is provided, that is, any local software among N local software can be downloaded in the local software authorization management system, which will facilitate the local software authorization management system to manage it.

[0023] In one implementation, the local software authorization management system is further used to store a mapping relationship; the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

[0024] In the above implementation, since the local software authorization management system stores the mapping relationship between the software installation package and the software identifier, the software identifier of the target local software can be quickly and accurately determined based on the mapping relationship corresponding to the installation path.

[0025] In one implementation, the method also includes: displaying a subscription interface provided by the trading platform, the subscription interface includes the target local software; if the business object is the first object with software subscription rights, then in the subscription interface, responding to a business transaction operation for the target local software, determining the subscription data corresponding to the target local software, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; and synchronizing the subscription data corresponding to the target local software to the cloud through the trading platform.

[0026] In the above implementation, the local software authorization management system can achieve a one-stop experience for the organization to purchase, manage, and use software licenses by responding to the business transaction operations of the first object with software subscription rights (for example, a company's purchaser) for the target local software, that is, it realizes on-demand cancellation of license support, thereby effectively reducing the cost of software use by the organization and truly achieving on-demand purchase and use.

[0027] In one implementation, the method also includes: if the business object is a second object with organizational management authority, then in the authorization interface used to perform authorization management on N local software, displaying the authorization control corresponding to the target local software; responding to a trigger operation on the authorization control, displaying M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; responding to an authorization quantity change operation on a third object among the M objects, changing the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; and sending the second authorization quantity to the cloud.

[0028] In the above implementation, the local software management system can reasonably configure the device authorization quantity of members within the organization by responding to the authorization quantity change operation of a second object (for example, the administrator of the enterprise) on a certain object it manages, thereby effectively improving the convenience and efficiency of organizational management.

[0029] In a second aspect, an embodiment of the present application provides a software authorization method, which is used for target local software, including: sending activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; receiving an operation instruction returned by the local software authorization management system; if the operation instruction is a verification instruction, obtaining a storage location sent by the local software authorization management system, and managing based on a first authorization certificate in the storage location.

[0030] In the above method, the target local software can quickly obtain the operation instructions sent by the local software authorization management system by interacting with the local software authorization management system used to manage it. Therefore, when the operation instruction is a verification instruction, the target local software is quickly managed based on the first authorization certificate in the storage location. The entire process does not require manual input from the user, which can effectively improve the efficiency of software authorization and reduce the cost of authorization efficiency by reducing human-computer interaction.

[0031] In one implementation, a software development kit SDK for data interaction is integrated into the target local software, and the SDK is used to receive the storage location sent by the local software authorization management system.

[0032] In the above implementation, by providing SDK and local software authorization management system, the workload of traditional software transformation is effectively reduced, and rapid transformation can be achieved, thereby reducing the cost of software authorization.

[0033] In one implementation, if the operation instruction is a verification instruction, the storage location sent by the local software authorization management system is obtained, and management is performed based on the first authorization certificate in the storage location, including: if the operation instruction is a verification instruction, the storage location sent by the local software authorization management system is obtained through the SDK in the target local software; based on the SDK, the validity of the first authorization certificate in the storage location is verified to obtain a verification result; and activation is performed when the verification result indicates that the verification is successful.

[0034] In the above implementation, it is necessary to verify the validity of the first authorization certificate in the storage location based on whether the SDK itself has the verification function. For example, when the SDK has the verification function, the SDK can verify the validity of the first authorization certificate, which will greatly save the resource computing power of the target local software itself. When the SDK does not have the verification function, the target local software itself can verify the validity of the first authorization certificate, so that the SDK can be flexibly set up.

[0035] In a third aspect, an embodiment of the present application provides a software authorization device, which is applied to a local software authorization management system, which is used to manage target local software. The local software management system and the target local software are deployed on a local server, and the software authorization device includes: a first acquisition unit, which is used to obtain an authorization identifier of the target local software, the authorization identifier includes a software identifier used to indicate the target local software, the target local software is any one of N local software managed by the local software authorization management system, and N is a positive integer; a second acquisition unit, which is used to obtain a first authorization certificate sent by the cloud according to the authorization identifier, and the first authorization certificate is used to authorize the target local software; a management unit, which is used to manage the target local software according to the first authorization certificate.

[0036] In one implementation, the software authorization device also includes: a configuration unit, which is used to configure the file permissions of the first authorization certificate to obtain the configured first authorization certificate, the file permissions include at least one of editable permissions or reading permissions, and the configured first authorization certificate is used to manage the target local software; a storage unit, which is used to store the configured first authorization certificate.

[0037] In one implementation, a first acquisition unit is used to obtain the authorization identifier of the target local software, including: a display subunit, used to display a management interface including N local software; an acquisition subunit, used to respond to a startup operation for the target local software among the N local software in the management interface, and obtain the authorization identifier of the target local software.

[0038] In one implementation, the authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0039] In one implementation, a second acquisition unit is used to obtain a first authorization certificate sent by the cloud based on an authorization identifier, and includes: a search subunit, used to search in a local server based on the authorization identifier to obtain a search result; a generation subunit, used to generate a download request corresponding to the first authorization certificate if the search result indicates that the search failed, the download request including a request identifier, and the request identifier is used to indicate the association between the activation request and the download request of the target local software; a first transceiver subunit, used to send a download request to the cloud; the first transceiver subunit is also used to receive the first authorization certificate sent by the cloud.

[0040] In one implementation, a management unit is used to manage the target local software based on a first authorization certificate, and includes: a verification subunit, used to verify the validity of the first authorization certificate to obtain a verification result; a second transceiver subunit, used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct the activation of the target local software.

[0041] In one implementation, a management unit is used to manage the target local software based on the first authorization certificate, including: a third transceiver subunit, used to send the storage location of the first authorization certificate to the target local software; the third transceiver subunit is also used to send a verification instruction to the target local software, and the verification instruction is used to instruct the validity verification of the first authorization certificate in the storage location.

[0042] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software when responding to a download operation for the target local software.

[0043] In one implementation, the local software authorization management system is also used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier.

[0044] In one implementation, the software authorization device also includes: a display unit, which is used to display a subscription interface provided by a trading platform, the subscription interface includes the target local software; a determination unit, which is used to respond to a business transaction operation for the target local software in the subscription interface and determine the subscription data corresponding to the target local software if the business object is a first object with software subscription authority, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; and a transceiver unit, which is also used to synchronize the subscription data corresponding to the target local software to the cloud through the trading platform.

[0045] In one implementation, the software authorization device also includes: a display unit, which is also used to display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software if the business object is a second object with organizational management authority; the display unit is also used to respond to the trigger operation on the authorization control and display the M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; a change unit, which is used to respond to the authorization quantity change operation on the third object among the M objects and change the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; the transceiver unit is also used to send the second authorization quantity to the cloud.

[0046] In a fourth aspect, an embodiment of the present application provides a software authorization device, which is applied to a target local software, including: a transceiver unit, used to send activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; a transceiver unit, used to receive an operation instruction returned by the local software authorization management system; a processing unit, used to obtain a storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location.

[0047] In one implementation, a software development kit SDK for data interaction is integrated into the target local software; the SDK is used to receive the storage location sent by the local software authorization management system.

[0048] In one implementation, a processing unit is used to obtain a storage location sent by a local software authorization management system if an operation instruction is a verification instruction, and to manage based on a first authorization certificate in the storage location, including: a processing unit is used to obtain a storage location sent by a local software authorization management system through an SDK in a target local software if the operation instruction is a verification instruction; a processing unit is used to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; and a processing unit is used to activate when the verification result indicates that the verification is successful.

[0049] In a fifth aspect, an embodiment of the present application provides a software authorization device, comprising a memory and a processor, the memory being used to store computer instructions, and the processor being used to call and execute computer instructions from the memory to implement a method as in the first aspect or any one of the implementations of the first aspect, or to implement a method as in the second aspect or any one of the implementations of the second aspect.

[0050] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a processor, a method as in the first aspect or any one of the implementations in the first aspect is implemented, or a method as in the second aspect or any one of the implementations in the second aspect is implemented.

[0051] In the seventh aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a processor, the method is implemented as in the first aspect or any one of the implementations in the first aspect, or the method is implemented as in the second aspect or any one of the implementations in the second aspect.

[0052] The technical effects produced by any implementation method in the above-mentioned second to seventh aspects and each aspect can refer to the above-mentioned first aspect and the corresponding implementation method in the first aspect, and the repetitive parts will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of a network architecture provided in an embodiment of the present application;

[0054] Figure 2 This is a scenario deployment diagram for software authorization provided by an embodiment of the present application. Figure 1 ;

[0055] Figure 3 This is a scenario deployment diagram for software authorization provided by an embodiment of the present application. Figure 2 ;

[0056] Figure 4 A schematic diagram of a scenario deployment for software authorization provided in an embodiment of the present application Figure 3 ;

[0057] Figure 5 This is an interactive diagram of a method for performing software authorization provided by an embodiment of the present application;

[0058] Figure 6 It is a schematic diagram of a method for verifying a business object provided by an embodiment of the present application;

[0059] Figure 7 This is a schematic diagram of an interface switching for software management provided by an embodiment of the present application;

[0060] Figure 8 It is a flowchart for software management provided by an embodiment of the present application;

[0061] Fig. 9 This is a schematic diagram of a method for performing software authorization provided in an embodiment of the present application. Figure 1 ;

[0062] Fig.10 This is an interactive schematic diagram for software management provided by an embodiment of the present application. Figure 1 ;

[0063] Fig.11 An interactive schematic diagram for software management provided in an embodiment of the present application Figure 2 ;

[0064] Fig.12 This is an interactive schematic diagram for software management provided by an embodiment of the present application. Figure 3 ;

[0065] Fig.13 This is a schematic diagram of an interface switching for authorization management of members within an organization provided by an embodiment of the present application;

[0066] Fig.14 This is a schematic diagram of a method for performing software authorization provided in an embodiment of the present application. Figure 2 ;

[0067] Fig.15 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 1 ;

[0068] Fig.16 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 2 ;

[0069] Fig.17 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 3 ;

[0070] Fig.18 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 4 . DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. Among them, in order to facilitate the clear description of the technical solutions in the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. It can be understood by those skilled in the art that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not limit necessarily different. At the same time, in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0072] To facilitate understanding of the technical solutions provided by the embodiments of the present application, a brief introduction to the relevant technologies is first given.

[0073] In the current technical solution, traditional software authorization methods can include two types, one is the authorization method based on license files, and the other is the software authorization method based on the Internet (for example, Software as a Service, SaaS). Among them, the authorization method based on license files often requires business objects to participate in the software authorization process. The generation, purchase, and activation of license files cannot achieve a one-stop experience. It requires device fingerprint collection, filling in device fingerprint information when purchasing, offline delivery of license files (for example, through email, download link, or physical media, etc.), and manual import of license files. This means that the current license file method lacks connection with the transaction system and can only form a non-automated "pseudo-subscription" model through manual renewal. In the enterprise 2B scenario, due to the lack of license authorization management and automatic distribution mechanism, it is often carried out through a manual mode of "people pulling shoulders", which not only greatly affects the authorization efficiency, but also makes it difficult to guarantee the user's periodic and on-demand subscription experience.

[0074] Although the SaaS model authorization method can verify the legitimacy of the software and authorize its use on the Internet, this authorization method requires the software to maintain a connection with the server at all times. In special scenarios such as unstable networks and high security requirements (for example, industrial environments), it is often not applicable due to the lack of conditions for full Internet access. In other words, this authorization method requires a large cost to provide and maintain a relatively stable network environment.

[0075] It can be seen that traditional software licensing methods either have low licensing efficiency or high licensing costs. Therefore, how to support low-cost and high-efficiency software license subscription methods is a very necessary and challenging task.

[0076] In order to solve the above problems, an embodiment of the present application provides a new software authorization method, in which a local software authorization management system can be used to manage target local software (for example, CAD drawing software), and the target local software and the local software authorization management system are deployed on a local server, wherein the target local software is any one of the N local software managed by the local software authorization management system, and N is a positive integer. It can be understood that the local software authorization management system can obtain the authorization identifier of the target local software, and the authorization identifier includes a software identifier for indicating the target local software. Furthermore, the local software authorization management system can obtain a first authorization certificate (for example, a license file) sent by the cloud based on the authorization identifier, and then manage the target local software based on the first authorization certificate, and the first authorization certificate can be used to authorize the target local software.

[0077] In the embodiment of the present application, when authorizing the target local software, the first authorization certificate for authorizing the target local software can be quickly obtained according to the authorization identifier of the target local software through the interaction between the local software authorization management system and the cloud, so as to manage the target local software according to the first authorization certificate. The entire authorization process greatly reduces human-computer interaction, which can reduce the time spent on manual participation, thereby effectively improving the efficiency of software authorization. In addition, since the number of local software managed by the local software authorization management system is N, this means that the embodiment of the present application can achieve unified management of multiple local software through the intervention of the local software authorization management system, that is, there is no need to independently develop each local software, which can effectively avoid the waste of development resources and manpower, thereby reducing the cost of software authorization.

[0078] Among them, since the new software authorization method provided by the embodiment of the present application can put the management and distribution of software authorization in the cloud, this means that this new software authorization method involves the field of cloud technology. Among them, cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network in a wide area network or a local area network to realize the calculation, storage, processing, and sharing of data. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the application of cloud computing business model, which can form a resource pool, which is used on demand and flexible and convenient. Cloud computing technology will become an important support. The background service of the technical network system requires a large amount of computing and storage resources, such as video websites, picture websites, and more portal websites. With the high development and application of the Internet industry, in the future, each item may have its own identification mark, and all need to be transmitted to the background system for logical processing. Data of different levels will be processed separately, and all kinds of industry data need strong system backing support, which can only be achieved through cloud computing.

[0079] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network that provides resources is called a "cloud". From the user's perspective, the resources in the "cloud" are infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for as needed.

[0080] As a provider of basic cloud computing capabilities, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) will be established, and various types of virtual resources will be deployed in the resource pool for external customers to choose to use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0081] According to the logical function division, the PaaS (Platform as a Service) layer can be deployed on the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on the PaaS layer. SaaS can also be deployed directly on IaaS. PaaS is a platform for software operation, such as databases, web containers, etc. SaaS is a variety of business software, such as web portals, SMS mass senders, etc. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0082] The following is an introduction to the network architecture of the software authorization method provided by the embodiment of the present application:

[0083] See also Figure 1 , Figure 1 Schematic diagram of a network architecture provided by an embodiment of the present application. Figure 1 As shown, the network architecture can connect the trading platform and the services of independent software vendors (ISVs), and the network architecture can specifically include servers deployed locally (for example, Figure 1 The local server 10 shown) and the server deployed in the cloud (e.g., Figure 1 The management server 11 and the business server 12 are shown).

[0084] The local server 10 here may be a local server used by a business object, where the business object refers to an object in an organization, such as a corporate employee, corporate administrator, corporate purchaser, or student. Figure 1 As shown, a local software authorization management system and N local software (also called desktop tool software) can be deployed in the local server 10, where N is a positive integer. The local software authorization management system here can also be called a desktop tool management client (SCDesk), and the N local software can specifically include local software A, local software B, ..., and local software N.

[0085] The local software here can refer to stand-alone software or non-stand-alone software, which will not be limited here. It is understandable that the local software here can be a program independent of the local software authorization management system, such as drawing software (for example, CAD software), chip design software (for example, EDA software), simulation software (for example, CAE software), or an embedded subroutine integrated in the local software authorization management system, for example, it does not need to be downloaded to the local server 10, but exists in the local software authorization management system in the form of a small program, etc., and the existence form of the local software will not be limited here.

[0086] It can be understood that the local software authorization management system can be used to uniformly manage each local software among N local software. For example, the embodiment of the present application can download or log in to any local software among the N local software by using the local software authorization management system, and can also interact with the cloud in a unified manner by using the local software authorization management system.

[0087] In order to improve the efficiency of subsequently determining the software identification of the local software to be authorized, after downloading N local software, the local server 10 in the embodiment of the present application can store the mapping relationships corresponding to the N local software through the local software authorization management system. For example, the mapping relationship corresponding to the local software A is used to associate the software identification of the local software A with the installation path of the software installation package of the local software A. For ease of understanding, please refer to Table 1, which is a schematic table including multiple mapping relationships provided in the embodiment of the present application. As shown in Table 1:

[0088] Table 1

[0089]

[0090] like Figure 1 As shown, the management server 11 (e.g., SaaS service center / organization management service) can be used to provide subscription software management services. The management server 11 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The embodiment of the present application does not limit the number of servers.

[0091] In order to better achieve high availability of the system, the embodiment of the present application can take a management server deployed in the cloud as an example to illustrate a new software authorization method based on cloud computing technology. Among them, the subscription software management module in the management server 11 can not only be used for software authorization management and software installation package management, but also for data transmission with the trading platform (for example, cloud store). Among them, the trading platform here is mainly responsible for ISV authentication, transaction billing, software asset custody, etc.

[0092] like Figure 1 As shown, the business server 12 can be an independent ISV server, used to provide business services (for example, certificate generation service, metering service) for N local software respectively, or it can refer to a server cluster including N ISV servers, and one ISV server is used to provide corresponding business services for one local software. There is no limit on the number of ISV servers included in the business server 12.

[0093] It should be understood that the embodiments of the present application can connect the local software authorization management system to the cloud to complete the online periodic issuance and update of the license file, thereby realizing a high-efficiency and low-cost software authorization method. Figure 1When any local software shown (for example, local software A) is authorized, the embodiment of the present application can quickly obtain the first authorization certificate for authorizing the local software A according to the authorization identifier of the local software A through the interaction between the local software authorization management system and the cloud. Among them, the authorization identifier of the local software A may include the software identifier (Application ID, appid) of the local software A, the device fingerprint corresponding to the local server 10, and the object identifier (for example, login account) used by the business object to log in to the local software authorization management system. The object identifier is obtained after the business object is authorized, and the acquisition of the object identifier needs to comply with the relevant laws, regulations and standards of the relevant countries and regions. Furthermore, the local software authorization management system can manage the local software A according to the first authorization certificate. The entire authorization process does not require manual participation, nor does it require independent development of the local software A. It can not only effectively improve the efficiency of software authorization, but also reduce the cost of software authorization.

[0094] Among them, for Figure 1 The network architecture shown in the figure, the embodiment of the present application can be implemented in different deployment modes, and each deployment mode will be further introduced below:

[0095] See also Figure 2 , Figure 2 This is a scenario deployment diagram for software authorization provided by an embodiment of the present application. Figure 1 .like Figure 2 As shown, the management server, transaction platform and business server (i.e., ISV server) in the embodiment of the present application are deployed independently. Among them, the embodiment of the present application involves three types of objects, which may specifically include a first object, a second object and an asset management object of a software developer. The first object refers to an object with software subscription authority (for example, a purchaser of a certain enterprise), which is used to perform business transaction operations (purchase operations, renewal operations, or cancellation operations) on a certain local software, and the second object refers to an object with organizational management authority (for example, an administrator of a certain enterprise), which is used to perform software license management for members within the organization. Among them, the first object and the second object here can be the same object or different objects, and they will not be limited here.

[0096] It is understandable that the management server here can adopt a public cloud (Public Cloud) logical multi-tenancy method to serve multiple organizations. Among them, the public cloud usually refers to a cloud that a third-party provider provides to users and can be used. The public cloud is generally available through the Internet and may be free or low-cost. The core attribute of the public cloud is shared resource services. There are many instances of this cloud that can provide services throughout the open public network today. The services provided by the management server may include software download services, organization authorization services (for example, enterprise authorization services), account management services, and software version management services.

[0097] Among them, the services provided by the trading platform may include trading services, docking services for software developers (i.e., ISV services), software asset management services, and product listing services. Each software developer's asset management object can list the corresponding local software through the trading platform. Since the trading platform can present the supply and purchase performance of local software to buyers and sellers in real time, this can not only provide buyers and sellers with visual product order information viewing, service supervision and other functions, but also enable software suppliers (e.g., asset management objects) to pay attention to the supply and sales of local software in real time, and adjust supply and marketing strategies in time. It also allows buyer users (e.g., the first object) to not worry about accidentally exceeding the limit, but to renew or cancel subscriptions in time by promptly discovering the use of the purchased license, so as to achieve on-demand purchase.

[0098] Each business server can be deployed independently (for example, using a Docker container on the cloud). This deployment method is independent and decoupled between business servers, and they do not affect each other. The software developer is mainly responsible for the operation and maintenance of the service, environment construction, etc. Figure 2 As shown, each business server corresponds to a different software developer, and specifically may include a business server corresponding to software server 1, a business server corresponding to software developer 2, ..., a business server corresponding to software developer N. Each business server may provide a docking transaction platform service, a certificate generation service, and a metering service.

[0099] See also Figure 3 , Figure 3 This is a scenario deployment diagram for software authorization provided by an embodiment of the present application. Figure 2 .like Figure 3 As shown, the embodiments of the present application can host the capabilities of a business server (eg, an ISV server) and automatically deploy them through a trading platform.

[0100] The management server here can refer to the above Figure 2The description of the management server in the example above is used to deploy it on a public cloud to serve multiple organizations. A second object (eg, an administrator of a certain enterprise) can manage software licenses for members of the organization by interacting with the management server.

[0101] in, Figure 3 The trading platform shown can also be deployed on a public cloud, and the first object (for example, a purchaser of a certain enterprise) can interact with the trading platform to perform business transaction operations such as purchasing, renewing, or canceling a certain local software. Figure 3 The trading platform shown provides not only trading services, software developer docking services, software asset management services, and product listing services, but also license management (License Manager) automated deployment services. The license management automated deployment service can be used to automatically deploy local software hosted by software developers and the license management corresponding to the local software.

[0102] for example, Figure 3 After the asset management object of the software developer shown packages the relevant functions of the ISV server (such as making it into a container image) and hosts it on the trading platform, the trading platform can automatically deploy services based on license management and automatically deploy related service instances.

[0103] For the description of the three types of objects in the embodiments of the present application, the services provided by the management server, the services provided by the transaction platform, and the services provided by each business server, please refer to the above Figure 2 The description in will not be repeated here.

[0104] Since the deployment method of the embodiment of the present application is to host the relevant functions of the business server on the trading platform, when any local software is subsequently authorized, the corresponding authorization certificate can be quickly obtained directly from the trading platform, which will further speed up service construction, reduce network delays, and thus reduce costs.

[0105] See also Figure 4 , Figure 4 This is a scenario deployment diagram for software authorization provided by an embodiment of the present application. Figure 3 .like Figure 4 As shown, the embodiments of the present application can be Figure 3 On the basis of the deployment method shown, the management server (for example, SaaS service center) is deployed downward, that is, not only the capabilities of the business server (for example, ISV server) can be hosted and automatically deployed by the transaction platform, but the management server also needs to be deployed to the organization's computer room (for example, the computer room of a certain enterprise) and be exclusive to the organization.

[0106] like Figure 4 As shown, the second object (for example, the administrator of a certain enterprise) can manage software licenses for members within the organization by interacting with the management server. When the management server and the trading platform are transmitting data, the transmitted data can be encrypted to ensure the security of the transmitted data. During the data transmission process, connections at different levels may be included, specifically including data plane connections and management plane connections. Among them, the data plane connection can not only be used for organizations to upload local data on demand (for example, the basic information of each member in a certain enterprise) to meet data security compliance and autonomous control requirements, but also for sending management instructions from the cloud and receiving return information locally. The management plane connection can be used not only to issue version upgrade packages / software installation packages for local software, but also for two-way operation and maintenance detection.

[0107] It should be noted that the local data here can be the basic information of members in the organization, such as the department, position, equipment authorization, software usage rights, object identification, etc. of an enterprise employee. In the specific implementation of this application, when the above embodiments of this application are applied to specific products or technologies, the user's permission or consent is required, and the collection, use and processing of relevant data shall comply with the relevant laws, regulations and standards of relevant countries and regions.

[0108] in, Figure 4 The trading platform shown can be deployed on a public cloud, and the first object (for example, a buyer of a certain enterprise) can interact with the trading platform to perform business transaction operations such as purchasing, renewing, or canceling a certain local software.

[0109] The description of the three types of objects, the services provided by the management server, the services provided by the transaction platform, and the services provided by each business server in the embodiment of the present application will not be further elaborated here. For details, please refer to the above Figure 2 as well as Figure 3 Description in .

[0110] Since the deployment method of the embodiment of the present application is to deploy the management server down to the organization's computer room, this will enable local software and data to run and store locally, and by combining the rich automated operation and maintenance tools of the public cloud, it can flexibly meet the needs of the organization.

[0111] Of course, in addition to the above Figure 2 , Figure 3 as well as Figure 4The deployment method provided, the software authorization method of the embodiment of the present application can also be other deployment methods, for example, the transaction platform with the business server related functions that is automatically deployed and the management server are deployed together, in other words, the services provided by the management server, the services provided by the transaction platform, and the related services corresponding to N local software can all be deployed together. The embodiment of the present application will not exemplify the deployment methods one by one.

[0112] The specific implementation method of the embodiment of the present application for efficiently and low-costly authorizing local software through the interaction between the local software authorization management system and the cloud can be found in the following Figure 5-Figure 14 The corresponding embodiment method.

[0113] For further information, see Figure 5 , Figure 5 1 is an interactive diagram of a method for performing software authorization provided by an embodiment of the present application. Figure 5 As shown, the method can be jointly executed by a local software authorization management system deployed on a local server, a target local software, and a server deployed on the cloud (also known as a cloud server), wherein the local server here can be the above-mentioned Figure 1 The local server 10 shown, the cloud server may include the above Figure 1 The management server 11 shown. The method may at least include S101-S107:

[0114] S101, the target local software sends activation information of the target local software to the local software authorization management system.

[0115] The target local software here is any one of the N local software managed by the local software authorization management system (for example, the above Figure 1 The local software A shown in the figure), N is a positive integer. The activation information here may include the software identifier of the target local software and the device fingerprint corresponding to the local server. Among them, the software identifier here can be used to uniquely indicate the target local software; the device fingerprint here can be used to uniquely identify the device characteristics or unique device identifier of the local server, such as the media access control address (e.g., Media Access Control Address, MAC address).

[0116] Among them, the target local software can be integrated with a software development kit (SDK) for data interaction. The SDK can be a development function library provided to the target local software. In essence, it is actually a collection of files of some interface APIs, which provide services for the target local software. It can also be understood that software developers can collect corresponding data by accessing these files and calling the relevant interfaces therein. Among them, the SDK can be used to receive the storage location sent by the local software authorization management system. For example, the SDK can obtain the storage location sent by the local software authorization management system through communication with the local software authorization management system (for example, socket communication).

[0117] It should be understood that when the business object performs a startup operation on the target local software, the target local software can respond to the startup operation, call the SDK activation function, and try to activate. In the embodiment of the present application, the startup operation here refers to a trigger operation for starting the target local software, which can be a contact operation such as clicking or long pressing, or a non-contact operation such as voice or gesture, which will not be limited here.

[0118] Among them, when the target local software and the local software authorization management system belong to two independent applications, the startup operation here may refer to the trigger operation performed by the business object on the target local software among N local software in the management interface provided by the local software authorization management system, or it may refer to the trigger operation performed by the business object directly on the software icon of the target local software on the local server, which will not be limited here.

[0119] Since the local software authorization management system can install the target local software based on the software installation package corresponding to the target local software when responding to the download operation for the target local software, and can also establish a mapping relationship between the installation path of the software installation package of the target local software and the software identifier after the installation is completed, and store the mapping relationship, the SDK can obtain the execution file path of the loading process (i.e., the installation path of the software installation package of the target local software) through the operating system (OS) when trying to activate, and then can quickly and accurately determine the software identifier of the target local software through the mapping relationship corresponding to the installation path. At the same time, the SDK can also obtain the device fingerprint through the operating system.

[0120] Furthermore, the target local software can determine the software identification and device fingerprint as the activation information of the target local software, and then send the activation information to the local software authorization management system. For example, the target local software can generate an activation request carrying activation information, and then send the activation request to the local software authorization management system through communication between the SDK and the local software authorization management system (for example, socket communication). The activation request here refers to a business request generated by the target local software for activating the target local software.

[0121] S102: The local software authorization management system obtains the authorization identifier of the target local software.

[0122] Specifically, after obtaining the activation information (including software identification and device fingerprint) sent by the target local software, the local software authorization management system can determine the object identification and the request identification respectively, and then determine the software identification, device fingerprint, object identification and request identification as the authorization identification of the target local software. Among them, the object identification here can be used to uniquely indicate the business object that logs in to the local software authorization management system. The request identification here is generated by the cloud server when it first receives the activation request from the business object for the target local software. The request identification can be used to indicate the association between the activation request of the target local software and the download request of the target local software. The download request here refers to the business request generated by the local authorization management system for obtaining the first authorization certificate.

[0123] For the target local software, the activation request and the download request are asynchronous. When the local authorization management system receives the activation request for the first time, the cloud server (for example, the management server) can return a request identifier to the local authorization management system. In this way, the local authorization management system needs to carry the request identifier when requesting the authorization certificate of the target local software in subsequent regular cycles. When the cloud server obtains the authorization certificate, it will also associate and save the authorization certificate with the request identifier. That is, the entire request identifier is used in the authorization process of the target local software, thereby playing a tracking role in the distributed system.

[0124] Furthermore, the local software authorization management system can search in the local server according to the authorization identifier of the target local software to obtain the search result. For example, if there is a file storage space (e.g., a local safe) in the local server for storing the authorization certificates of each local software, then when the local software authorization management system obtains the authorization identifier of the target local software, it can search in the file storage space and realize the online subscription mode by rotating the authorization certificate.

[0125] If the authorization certificate of the target local software exists in the file storage space, and the authorization certificate of the target local software is valid, the search result can be determined as a result indicating a successful search. At this time, the embodiment of the present application can determine this valid authorization certificate as the first authorization certificate for authorizing the target local software, and then directly jump to step S106. This means that the embodiment of the present application does not need to be connected to the Internet at all times, that is, there is no need for the local software authorization management system to interact with the cloud at all times, but the target local software can be used offline in a specific time period (i.e., within the validity period of the authorization certificate, for example, one week or one month, etc.).

[0126] If the authorization certificate of the target local software exists in the file storage space, but the authorization certificate is invalid, or the authorization certificate of the target local software does not exist in the file storage space, the query result is determined to be a result indicating that the search failed. This means that after the offline time ends, that is, when a valid authorization certificate is not found locally, data interaction with the cloud is performed by continuing to execute step S103 to obtain the first authorization certificate sent by the cloud. The whole process does not require the user to install and maintain complex authorization management software.

[0127] S103, the local software authorization management system sends the authorization identifier of the target local software to the cloud.

[0128] Exemplarily, the local software authorization management system may generate a download request corresponding to the first authorization certificate and send the download request to the cloud, wherein the download request may carry the authorization identifier (software identifier, device fingerprint, object identifier, and request identifier) ​​of the target local software.

[0129] S104, the cloud server obtains a first authorization certificate.

[0130] Specifically, since the cloud server here can provide business services for data interaction with software developers corresponding to N local software, when the cloud server obtains the authorization identifier of the target local software, it can determine the business service (i.e., the target service) corresponding to the software identifier from the N business services. Among them, the target service here may be deployed in a business server included in the cloud server, or it may be directly deployed in a management server included in the cloud server, and the deployment method of the target service will not be limited here. Further, the cloud server can obtain the first authorization data sent by the target service. Among them, the first authorization data here may include a first authorization certificate for authorizing the target local software, and structured information corresponding to the first authorization certificate. Among them, the first authorization certificate here may include a device fingerprint, a digital signature, an expiration time, and a feature set. The feature set here refers to the enhanced / high-level functional characteristics of the software, such as high-level 3D drawing capabilities. The structured information may include a request identifier and a validity period, and the validity period in the structured information can be used for display in the local software authorization management system, so that the business object can quickly know when the target local software expires, thereby eliminating the process of reading the first authorization certificate.

[0131] Among them, the organization where the business object is located may include a first object (i.e., an object with software subscription authority, for example, a purchaser of a certain enterprise) and a second object (i.e., an object with organizational management authority, for example, an administrator of a certain enterprise). The first object and the second object here can be the same object or different objects, and they will not be limited here.

[0132] It is understandable that if the cloud server includes a management server and a target server that provides target services, and the management server and the target server are both able to synchronize the subscription data sent by the trading platform, the trading platform and the target server can be connected so as to exchange the authorization certificate generated by the target server based on the subscription data. The subscription data refers to the order information generated by the trading platform in response to the business transaction operation (for example, a trigger operation for purchase, renewal or cancellation) performed by the first object on the target local software. The order information may specifically include an order identifier (for example, an order number), a product identifier, a subscription set, a cycle, a number of cycles, a cycle expiration time, etc.

[0133] In addition, the management server may also store the configuration information determined by the second object for all members in the organization. The configuration information here may refer to the device authorization quantity reasonably configured by the second object for members in the organization according to the number of subscriptions of the target local software (for example, 100 sets). The device authorization quantity is used to indicate the number of devices allowed to be used by the same member. For example, if the target local software is drawing software, the second object may configure the device authorization quantity for employees in the design department to 3, and the device authorization quantity for other employees who do not use drawing software to 0.

[0134] Based on this, after obtaining the authorization identifier of the target local software, the management server can verify the business object according to the subscription data and configuration information stored in the management server to determine the object verification result of the business object. If the object verification result indicates that the verification is successful, the management server can request the first authorization certificate from the target server. Optionally, if the object verification result indicates that the verification fails, there is no need to request the target server to generate the first authorization certificate, but directly send a notification message indicating the activation failure to the local software authorization management system.

[0135] Among them, the object verification result here may include a first verification result, a second verification result, and a third verification result. The first verification result can be used to indicate whether the current authorization amount of the business object reaches the device authorization amount when the subscription data is in a normal state; the second verification result can be used to indicate whether the business object corresponding to the object identifier is a member of the organization; the third verification result can be used to indicate whether the current number of sets used by the organization corresponding to the object identifier reaches the number of subscription sets. It should be understood that if any one of the first verification result, the second verification result, or the third verification result indicates a verification failure, it is determined that the object verification result indicates a verification failure. If the first verification result, the second verification result, and the third verification result all indicate a successful verification, it is determined that the object verification result indicates a successful verification.

[0136] Since the services provided by the management server, the trading platform and the target server are different, in order to better meet the actual business needs, the above three verification results can be undertaken by different verification devices. For example, in the embodiment of the present application, the management server can determine the first verification result, the trading platform can determine the second verification result, and the target server can determine the third verification result.

[0137] For further understanding, please refer to Figure 6 , Figure 6 Schematic diagram of a method for verifying a business object provided by an embodiment of the present application. Figure 6 As shown, the method involves a management server, a trading platform, and a target server corresponding to the target local software.

[0138] Among them, after obtaining the authorization identifier of the target local software, the management server can execute step S201 to verify the business object based on the authorization identifier of the target local software to obtain a first verification result. Exemplarily, the management server can first determine the first information corresponding to the software identifier and the second information corresponding to the software identifier. Among them, the first information here can be used to indicate the subscription data corresponding to the target local software. The second information here can be used to indicate the device authorization quantity corresponding to the object identifier (for example, 3 units). Further, the management server can verify the business object based on the subscription data and the device authorization quantity to obtain a first verification result, and then determine the object verification result corresponding to the business object based on the first verification result.

[0139] If the first verification result indicates that the subscription data is in a normal state, and the current authorized quantity of the business object (for example, 3 units) has reached the device authorization quantity (that is, the verification failed), then the management server can directly determine that the object verification result indicates a verification failure, and then send a notification message to the local software authorization management system to indicate an activation failure.

[0140] Optionally, if the first verification result indicates that the subscription data is in a normal state, and the current authorized quantity of the business object (for example, 2 units) does not reach the device authorization quantity (i.e., the verification is successful), the management server may execute step S202 to forward the authorization identifier of the target local software to the trading platform, so that the trading platform executes step S203 to verify the business object based on the authorization identifier of the target local software to obtain a second verification result. The management server may receive the second verification result of the trading platform for the business object, and further determine the object verification result corresponding to the business object based on the second verification result.

[0141] If the second verification result indicates that the business object corresponding to the object identifier is not a member of the organization (for example, the business object has resigned), the trading platform may send the second verification result indicating a verification failure to the management server. Upon receiving the second verification result, the management server may determine that the object verification result indicates a verification failure based on the second verification result, and then send a notification message indicating an activation failure to the local software authorization management system.

[0142] If the second verification result indicates that the business object corresponding to the object identifier belongs to a member within the organization, the trading platform determines that the second verification result indicates that the verification is successful. At this time, the trading platform can execute step S204 to send the authorization identifier of the target local software to the target server, so that the target server executes step S205 to verify the business object to obtain a third verification result. Further, the target server can execute steps S206-S207 to send the third verification result to the management server through the trading platform.

[0143] When the third verification result indicates that the number of sets currently used by the organization corresponding to the object identifier (for example, 80 sets) has reached the number of subscribed sets (i.e., verification failed), the management server can determine that the object verification result indicates verification failure based on the third verification result used to indicate verification failure, and then send a notification message indicating activation failure to the local software authorization management system. When the third verification result indicates that the number of sets currently used by the organization corresponding to the object identifier (for example, 80 sets) has not reached the number of subscribed sets (i.e., verification succeeded), the management server can determine that the object verification result indicates verification success based on the third verification result used to indicate verification success.

[0144] It is understandable that when the third verification result indicates that the verification is successful, the target server can also execute step S208 to generate a first authorization certificate for the business object, and then execute steps S209-S210 to send the first authorization certificate to the management server through the transaction platform.

[0145] S105, the cloud server sends a first authorization certificate to the local software authorization management system.

[0146] S106: The local software authorization management system sends an operation instruction determined according to the first authorization certificate to the target local software.

[0147] The operation instruction here is a verification instruction or an activation instruction. The verification instruction is generated by the local software authorization management system when it does not have a verification function; while the activation instruction is generated by the local software authorization management system when it has a verification function and determines that the first authorization certificate is valid.

[0148] It should be understood that when receiving the first authorization certificate, the local software authorization management system may store the first authorization certificate. For example, the local software authorization management system may directly store the first authorization certificate in a local database.

[0149] Optionally, in order to improve the security of the first authorization certificate, the local software authorization management system can configure the file permissions of the first authorization certificate, so as to obtain the configured first authorization certificate, and then store the configured first authorization certificate. The file permissions here can include at least one of editable permissions or reading permissions; the configured first authorization certificate can also be used to manage the target local software.

[0150] Exemplarily, the local software authorization management system can save the first authorization certificate to the local safe. It is understandable that the local safe configures the file permissions of the folder (configurable by the user) of a specific path through some underlying mechanisms of the operating system, and ultimately implements the user's inability to modify, delete, and other operations at will. For example, before the input / output data operation (Input / Output operation, I / O operation) reaches the file system, the I / O operation can be intercepted by the file system's filter driver, and the user cannot modify, delete, copy, view, and other operations on the first authorization certificate (for example, License file) by switching in and rewriting related callbacks (such as file modification, deletion, copying, viewing, etc.). Only related applications in the whitelist have the permission to open, etc., thereby implementing the protection function of the License file.

[0151] Among them, in an operating system (e.g., a Windows system), one of the most common and powerful locations for inserting filter drivers is on the file system. File system filter drivers (e.g., minifilters) intercept I / O operations (from applications and the system itself) before they reach the file system. For example, minifilter callbacks can include PreOperation callbacks and PostOperation callbacks. The PreOperation callback is called before each I / O operation of a specified type is passed to the file system. PostOperation is called after the file system processes a specific type of I / O operation.

[0152] It should be understood that when the local software authorization management system does not have a verification function, the local software authorization management system not only needs to send a verification instruction to the target local software, but also needs to send the storage location associated with the first authorization certificate to the target local software, so that the target local software can verify the validity of the first authorization certificate in the storage location based on the verification instruction.

[0153] When the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate to obtain a verification result. When the verification result indicates that the verification is successful, an activation instruction is generated, and the activation instruction can be sent to the target local software. For example, if the digital signature in the first authorization certificate here is obtained by encrypting the first summary information (obtained by using a certain summary algorithm to perform hash calculation on the certificate contents such as device fingerprint, expiration time and feature set) based on the software supplier of the target local software based on its own private key, then the local software authorization management system needs to first obtain the public key of the software supplier corresponding to the target local software when verifying the validity of the first authorization certificate, and then decrypt the digital signature based on the public key to obtain the first summary information. Then, the local software authorization management system needs to use the same summary algorithm as the software supplier to perform hash calculation on the certificate contents such as device fingerprint, expiration time and feature set to obtain the second summary information, and then the first summary information can be compared with the second summary information. When it is determined that the first summary information is consistent with the second summary information, the local software authorization management system can generate a verification result indicating successful verification; when it is determined that the first summary information is inconsistent with the second summary information, the local software authorization management system can generate a verification result indicating failed verification.

[0154] In an embodiment of the present application, if the local software authorization management system has a verification function, the first authorization certificate will be invisible to the target local software, which will greatly reduce the number of times the first authorization certificate is exposed and more effectively improve the security of the first authorization certificate.

[0155] S107, the target local software is managed based on the operation instruction.

[0156] Exemplarily, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software has a verification function, the SDK verifies the validity of the first authorization certificate in the storage location, obtains a verification result, and sends the verification result to the target local software, so that the target local software is activated when it is determined that the verification result indicates that the verification is successful.

[0157] Optionally, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software does not have a verification function, the SDK sends the storage location to the target local software. Further, the target local software can call the software license verification module in the target local software, and based on the software license verification module, verify the validity of the first authorization certificate to obtain a verification result, and activate it when it is determined that the verification result indicates that the verification is successful.

[0158] Optionally, if the operation instruction is an activation instruction, the target local software can be directly activated.

[0159] Among them, the process of SDK verifying the validity of the first authorization certificate in the embodiment of the present application, and the process of the target local software verifying the validity of the first authorization certificate, can all refer to the process of the local software authorization management system verifying the validity of the first authorization certificate, and will not be repeated here.

[0160] For further understanding, please refer to Figure 7 , Figure 7 1 is a schematic diagram of an interface switching for software management provided by an embodiment of the present application. Figure 7 As shown, the interface J1 may be a management interface provided by the local software authorization management system, and the interface J1 may include N local software, where N is a positive integer. Here, 3 may be taken as an example, and specifically may include local software A, local software B, and local software C. The interface J1 may also include a control K1 (e.g., an "open" control) and a control K2 (e.g., an "install" control). The control K1 here may be a business control for indicating the startup of software, and the control K2 may be a business control for indicating the installation of software.

[0161] In addition, in order to improve the user experience, the local software authorization management system also has the function of reminding the local software that is about to expire. For example, in the prompt area of ​​the interface J1 (for example, Figure 7 A prompt message indicating the software expiration is displayed in the area Q1) shown, so that the business object can quickly know the local software that is about to expire. For another example, the embodiment of the present application can also display the prompt message in the function interface of the local software that is about to expire. Among them, the prompt message here can be a text message such as "The authorization certificate of your local software B will expire in 7 days. In order not to affect your normal use, please contact the enterprise administrator in time for renewal processing." Of course, the prompt message can also be picture information or video information, which will not be limited here.

[0162] like Figure 7 As shown, in the embodiment of the present application, an expiration date label can be displayed on the software icon of the local software that is about to expire in the interface J1. The expiration date label can be a label such as "expiring in 7 days" displayed on the software icon of the local software B. The embodiment of the present application can also describe the software function of each local software, for example, Figure 7 The area Q2 shown displays information briefly describing the software functions of the local software C.

[0163] It should be understood that in the interface J1, the local software authorization management system can respond to the start operation of the target local software (for example, local software A) among the three local software, and then refer to the above Figure 5 The description of steps S101 to S107 in the corresponding embodiment obtains the authorization identifier of the target local software, and based on the authorization identifier of the target local software, obtains the first authorization certificate sent by the cloud, and then manages the target local software according to the first authorization certificate.

[0164] For example, when the business object can execute a startup operation on the control K1 of the local software A, the local software authorization management system can respond to the startup operation and display the interface J2 (i.e., the authorization waiting interface). The interface J2 can display the progress animation corresponding to the software activation process and the progress information corresponding to the software activation process (for example, Figure 7 information in area Q3 shown).

[0165] If the verification result obtained by validating the authorization certificate of local software A indicates successful verification, it means that the embodiment of the present application can successfully activate local software A. At this time, the activation result interface displayed by the local server is the functional interface of local software A. If the verification result obtained by validating the authorization certificate of local software A indicates a verification failure, or the object verification result determined by the local software authorization management system when verifying the business object indicates a verification failure, it means that the embodiment of the present application failed to successfully activate local software A. At this time, the activation result interface displayed by the local server is Figure 7 The interface J3 shown in the figure. The area Q4 of the interface J3 may include the reason for the activation failure and the method for handling the activation failure.

[0166] It should be noted that Figure 7 The interfaces and controls shown are only some forms of expression for reference. In actual business scenarios, developers can make relevant designs according to product requirements. The embodiments of the present application do not limit the specific forms of the interfaces and controls involved.

[0167] It can be seen that the new software authorization method based on cloud computing technology provided by the embodiment of the present application, by placing the management and distribution of software authorization in the cloud, users / enterprise leaders / enterprise administrators only need to purchase on the trading platform, and need to be connected to the Internet when activating. They can be used offline in a specific time period (such as weeks, months, etc.). Users only need to activate once within a certain period, and do not need to activate every time they open the software. Compared with the traditional software authorization method, the embodiment of the present application can realize the purchase, automatic renewal or cancellation of software authorization at any time as needed through on-demand use of cloud authorization and offline use, without the need to maintain real-time connection network conditions, thereby improving the flexibility of software authorization and expanding the scope of application of software authorization. In addition, since the first authorization certificate is generated in the cloud, in the enterprise-oriented scenario, the enterprise administrator can authorize the device, ensure the legal use of the software through signature authentication on the corresponding device, and protect the first authorization certificate through the local safe mechanism, thereby improving the anti-tampering capability and security.

[0168] For further understanding, please refer to Figure 8 , Figure 8 1 is a flowchart for software management provided by an embodiment of the present application. Figure 8 As shown, the process involved in the embodiment of the present application may include a software download process and a software activation process. Among them, the software download process here may include steps S301-step S304, and the software activation process may include steps S305-step S316.

[0169] In the software download process, the business object can execute step S301 to perform a download operation on the target local software in the management interface provided by the local software authorization management system to request to download the software installation package of the target local software. Figure 7 In the interface J1 shown, a download operation is performed on the control K2 to request downloading of the local software C.

[0170] When responding to the download operation, the local software authorization management system can execute step S302, call the download software package interface, and send the software identifier corresponding to the target local software to the cloud to request the cloud to download the software installation package that matches the software identifier. Further, the cloud can execute step S303 to send the software installation package that matches the software identifier to the local software authorization management system. At this time, the local software authorization management system can execute step S304 to persist the installation information in the local database, that is, to establish a mapping relationship between the installation path of the software installation package and the software identifier, and store the mapping relationship in the local database so that the software identifier can be quickly obtained later.

[0171] Among them, in the software activation process, the business object can execute step S305 to perform a startup operation on the target local software. When the target local software responds to the startup operation, step S306 is executed to call the activation function of the software development kit SDK to attempt activation. Further, the software development kit can execute step S307 to obtain the activation information of the target local software through the operating system. Among them, the activation information here may include the software identifier of the target local software and the device fingerprint corresponding to the local server. Then, the software development kit can execute step S308 to send activation information to the local software authorization management system through communication with the local software authorization management system to request the local software authorization management system to determine the first authorization certificate of the target local software.

[0172] After receiving the activation information of the target local software, the local software authorization management system can determine the object identifier and the request identifier respectively, and then determine the software identifier, device fingerprint, object identifier and request identifier as the authorization identifier of the target local software. Then, based on the authorization identifier of the target local software, a local search can be performed in the file storage space (for example, a local safe or a local database) in the local server to obtain the search result. If the search result indicates that there is an authorization certificate for the target local software in the local safe, but the authorization certificate in the local safe is invalid, or the authorization certificate for the target local software does not exist in the local safe, it means that the search result indicates that the search failed. At this time, the local software authorization management system can execute step S309 to request the cloud to generate a first authorization certificate, that is, the local software authorization management system can generate a download request for managing the target local software and send the download request to the cloud. The download request can include the authorization identifier of the target local software.

[0173] Further, when the cloud determines that the object verification result of the business object indicates that the verification is successful, step S310 may be executed to send first authorization data including a first authorization certificate and structured information to the local software authorization management system. The first authorization certificate here may include a device fingerprint, a digital signature, an expiration time, and a feature set, etc. The structured information may include a request identifier and a validity period.

[0174] At this time, the local software authorization management system can execute step S311 to save the first authorization certificate and the structured information to the file storage space. The file storage space here can be a local database corresponding to the local server or a local safe. Further, the local software authorization management system can manage the target local software according to the first authorization certificate.

[0175] For example, if the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate and obtain a verification result, and then send an activation instruction to the target local software when the verification result indicates that the verification is successful; the activation instruction is used to instruct the target local software to be activated. When the verification result indicates that the verification fails, a notification message indicating that the activation failed is sent to the target local software.

[0176] If the local software authorization management system does not have a verification function, the local software authorization management system needs to execute step S312, and send the storage location of the first authorization certificate to the target local software through the software development kit. At the same time, the local software authorization management system also needs to send a verification instruction to the target local software. The verification instruction here can be used to instruct the validity verification of the first authorization certificate in the storage location.

[0177] It is understandable that when the software development kit receives the storage location of the first authorization certificate, it is necessary to execute step S313 to determine whether the software development kit itself has the verification function. If the software development kit has the verification function, the software development kit can execute steps S314-S315 to verify the validity of the first authorization certificate in the storage location, obtain the verification result, and send the verification result to the target local software, so that the target local software is activated when it is determined that the verification result indicates that the verification is successful. Optionally, if the software development kit does not have the verification function, the software development kit can execute step S316 to send the storage location to the target local software, so that the target local software can verify the validity of the first authorization certificate in the storage location based on its own software license verification module, obtain the verification result, and activate it when it is determined that the verification result indicates that the verification is successful.

[0178] The specific implementation of steps S305-S316 can be found in the above Figure 5 The description of S101-S107 in the corresponding embodiment will not be repeated here.

[0179] The following describes the method provided in the embodiment of the present application from the perspective of a single network device in conjunction with the accompanying drawings.

[0180] See also Fig. 9 , Fig. 9 This is a schematic diagram of a method for performing software authorization provided in an embodiment of the present application. Figure 1 .like Fig. 9 As shown, the method is used for a local software authorization management system, and the local software authorization management system can be used to manage target local software, and the local software management system and the target local software are deployed on a local server. The method may at least include S401-S403:

[0181] S401, obtaining the authorization identifier of the target local software.

[0182] Among them, the authorization identification of the target local software may include a software identification, a device fingerprint, an object identification and a request identification. Among them, the software identification is used to indicate the target local software; the device fingerprint can be used to uniquely identify the device characteristics or unique device identification of the local server; the object identification can be used to uniquely indicate the business object that logs into the local software authorization management system; the request identification is used to manage the server when it first receives the activation request for the target local software from the business object. The request identification can be used to indicate the association between the activation request of the target local software and the download request of the target local software. Among them, the target local software is any one of the N local software managed by the local software authorization management system; N is a positive integer.

[0183] S402: Obtain a first authorization certificate sent by the cloud according to the authorization identifier.

[0184] Specifically, the local software authorization management system can perform a local search in the local server according to the authorization identifier of the target local software to obtain a search result. If the search result indicates that the search failed, the local software authorization management system can generate a download request for managing the target local software, and then send the download request to the cloud to receive the first authorization certificate sent by the cloud. The download request can include a request identifier. The first authorization certificate here can be used to authorize the target local software.

[0185] Among them, since the first authorization certificate here can include device fingerprint, digital signature, expiration time and feature set, etc., therefore, authorizing the target local software means determining whether the business object currently logged in to the local software authorization management system can use it normally. It can be understood that the goal of authorization is to allow the business object to use the target local software according to the purchased license, which mainly involves the number of copies of the local software installed, the effective time of using the local software, the scope of application and functional modules, etc. The emergence of software authorization technology, especially cloud authorization technology, solves the software developers' needs for digitalization, automation and manageability of software sales, and is a model of the integration of software authorization technology and "Internet +".

[0186] S403: Manage the target local software according to the first authorization certificate.

[0187] Specifically, if the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate to obtain a verification result. When the verification result indicates that the verification is successful, an activation instruction is sent to the target local software, so that when the target local software executes the activation instruction, the target local software is activated to display the functional interface of the target local software; when the verification result indicates that the verification fails, a notification message indicating the activation failure is sent to the target local software, so that the target local software displays the notification message (for example, in the above Figure 7 The interface J3 shown in the figure shows that the business object cannot enter the target local software. In other words, the management here refers to determining whether the target local software is successfully activated based on the verification result of the first authorization certificate.

[0188] Optionally, if the local software authorization management system does not have a verification function, the local software authorization management system can send the storage location of the first authorization certificate to the target local software, or send a verification instruction to the target local software, so that the target local software or the software development kit of the target local software verifies the validity of the first authorization certificate in the storage location.

[0189] It should be understood that the local software authorization management system in the embodiment of the present application can not only be used to install the target local software based on the software installation package corresponding to the target local software when responding to the download operation for the target local software, but also be used to store the mapping relationship. Among them, the mapping relationship can be used to associate the installation path of the software installation package with the software identifier corresponding to the target local software, so that the software identifier can be quickly found according to the installation path later, thereby improving the efficiency of software authorization.

[0190] The specific implementation of steps S401 to S404 can be found in the above Figure 5 The description of steps S102-S106 in the corresponding embodiment will not be repeated here.

[0191] It can be understood that when the business object corresponding to the local server is the first object with software subscription rights, the business object can realize a one-stop experience for the organization to purchase, manage, and use software licenses, thereby improving the experience of the organization, its members, and software suppliers, making the entire delivery and use process easier to trace and control.

[0192] For example, the local software authorization management system can be used to display the subscription interface provided by the trading platform. The subscription interface here can include the target local software. If the business object is the first object with software subscription rights, then in the subscription interface, the local software authorization management system can respond to the business transaction operation for the target local software, determine the subscription data corresponding to the target local software, and then synchronize the subscription data corresponding to the target local software to the cloud through the trading platform. The business transaction operation here is a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software.

[0193] For further understanding, please refer to Fig.10 , Fig.10 This is an interactive schematic diagram for software management provided by an embodiment of the present application. Figure 1 .like Fig.10 As shown, the interaction diagram here may specifically involve members within the organization, a first object within the organization (e.g., a purchaser of an enterprise), a trading platform, a management server, a target server, and a local software authorization management system deployed on a local server and target local software. The interaction diagram may include a software purchase process and a software activation process. The software purchase process here may include steps S11 to S13, and the software activation process may include steps S14 to S22.

[0194] In the software purchase process, the first object in the organization can perform a purchase operation on the target local software in the subscription interface provided by the trading platform, so that the trading platform generates subscription data (i.e., purchase information) corresponding to the target local software when responding to the purchase operation. Then, the trading platform can execute steps S12-S13 to synchronize the purchase information to the target server deployed in the cloud and the management server deployed in the cloud respectively.

[0195] In the software activation process, members within the organization can execute step S14 to perform a startup operation on the target local software, for example, starting the target local software through the local software authorization management system or directly starting the target local software. Then, the local software authorization management system can obtain the authorization identification of the target local software locally, and when a valid first authorization certificate is not found locally, it can execute step S15 to send the authorization identification of the target local software to the management server. At this time, the management server can verify the members within the organization based on the authorization identification of the target local software to obtain a first verification result. When the first verification result indicates that the verification is successful, the management server can execute step S16 to send the authorization identification of the target local software to the trading platform, so that the trading platform verifies the business object based on the authorization identification of the target local software to obtain a second verification result. When the second verification result indicates that the verification is successful, the trading platform can execute step S17 to send the authorization identification of the target local software to the target server, so that the target server verifies the business object to obtain a third verification result. When the third verification result indicates that the verification is successful, the target server can generate a first authorization certificate and structured information corresponding to the first authorization certificate for the business object, and then execute steps S18-S20 to send the first authorization data including the first authorization certificate and structured information to the local software authorization management system through the trading platform and the management server.

[0196] At this time, the local software authorization management system can execute step S21 to send an operation instruction (e.g., an activation instruction / verification instruction) to the target local software so that the target local software executes the operation instruction. When it is determined that the verification result of the validity verification of the first authorization certificate indicates that the verification is successful, the target local software can execute step S22 to display the functional interface of the target local software.

[0197] For further information, see Fig.11 , Fig.11 This is an interactive schematic diagram for software management provided by an embodiment of the present application. Figure 2 .like Fig.11 As shown, the interaction diagram here may specifically involve members within the organization, a first object within the organization (e.g., a purchaser of an enterprise), a trading platform, a management server, a target server, and a local software authorization management system deployed on a local server and target local software. Among them, the interaction diagram may include a software renewal process and a software activation process. Among them, the software renewal process here may include steps S31-S33, and the software activation process may include steps S34-S42.

[0198] In the software renewal process, the first object in the organization can perform a renewal operation on the target local software in the subscription interface provided by the trading platform, so that the trading platform generates subscription data (i.e., renewal information) corresponding to the target local software when responding to the renewal operation. Then, the trading platform can execute steps S32-S33 to synchronize the renewal information to the target server deployed in the cloud and the management server deployed in the cloud respectively.

[0199] in, Fig.11 The software activation process shown can be found in the above Fig.10 The software activation process shown will not be described in detail here.

[0200] For further information, see Fig.12 , Fig.12 This is an interactive schematic diagram for software management provided by an embodiment of the present application. Figure 3 .like Fig.12 As shown, the interaction diagram here may specifically involve members within the organization, a first object within the organization (eg, a purchaser of an enterprise), a transaction platform, a management server, a target server, and a local software authorization management system deployed on a local server and target local software.

[0201] It is understandable that this cancellation scenario often occurs when a member within an organization has activated the target local software based on the first authorization certificate of the target local software, and the first object within the organization performs an unsubscription or deactivation (device change) scenario for the target local software. For example, the first object within the organization can perform a cancellation operation on the target local software in the subscription interface provided by the trading platform, so that the trading platform generates subscription data (i.e., cancellation information) corresponding to the target local software when responding to the cancellation operation. Then, the trading platform can execute steps S52-S53 to synchronize the cancellation information to the target server deployed in the cloud and the management server deployed in the cloud, respectively.

[0202] At this time, when the members in the organization execute step S54 and perform the startup operation for the target local software, the local software authorization management system can call the certificate refresh interface to obtain the authorization identifier of the target local software locally, and then execute step S55 to send the authorization identifier of the target local software to the management server. At this time, the management server can verify the members in the organization based on the authorization identifier of the target local software to obtain a first verification result. Since the management server has synchronized the cancellation information corresponding to the target local software, the first verification result here indicates that the subscription data is in an abnormal state (for example, a state indicating that the target local software has been canceled / unsubscribed). At this time, the management server needs to obtain the second authorization certificate generated by the target server for the members in the organization, and then send the second authorization certificate to the local software authorization management system to receive the cancellation success message returned by the local software authorization management system for the target local software. Among them, the cancellation success message here can be used to indicate that the activation instruction for the target local software has been successfully canceled.

[0203] Specifically, if the first verification result indicates that the subscription data is in an abnormal state, the management server can execute steps S56-S57, and send the authorization identifier of the target local software to the target server through the trading platform, so that the target server generates a second authorization certificate and structured information corresponding to the second authorization certificate for members within the organization based on the authorization identifier of the target local software and the subscription data synchronized in advance. Further, the target server can execute steps S58-S50, and send the second authorization data including the second authorization certificate and its structured information to the local software authorization management system through the trading platform and the management server.

[0204] At this time, the local software authorization management system can execute step S52 to send an operation cancellation instruction (i.e., an instruction to cancel the activation instruction / verification instruction) to the target local software, so that the target local software generates a cancellation success message after executing the operation cancellation instruction. Then, the target server can execute steps S52-S55 to forward the cancellation success message to the local software authorization management system, the management server, the trading platform and the target server respectively.

[0205] It can be seen that the local software authorization management system can cancel the corresponding software license of the activated device through negotiation with the trading platform, the target server, and the management server. This scenario requires the user to be connected to the Internet during the cancellation process, and the cancellation process is completed only after confirming with the cloud that the cancellation is complete, otherwise the cancellation process fails. The trading platform can use this rule to constrain the organization / members within the organization to stay connected to the Internet during the cancellation process. Under the condition of being connected to the Internet, a new authorization certificate (i.e., the second authorization certificate) is obtained again through interaction with the management server, the trading platform, and the target server. Among them, the validity period of the second authorization certificate may be an expired time.

[0206] It is understandable that when the business object is a second object with organizational management authority, the business object can be used to manage M objects in the organization, where M is a positive integer, wherein the second object and the M objects belong to the same organization.

[0207] For example, the local software authorization management system can display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software. When the second object performs a trigger operation on the authorization control corresponding to the target local software, the local software authorization management system can respond to the trigger operation and display the M objects managed by the second object. Among them, these M objects can be displayed in the bottom area of ​​the authorization interface in the form of a floating window, a mask, or a semi-transparent form, or can be displayed in a shrinkable interface that can change the display size by dragging, and the size of the interface is smaller than the authorization interface. Furthermore, the second object can perform an authorization quantity change operation (an operation for changing the device authorization quantity of the third object) on any one of the M objects (i.e., the third object). When the local software authorization management system responds to the authorization quantity change operation, the device authorization quantity of the third object in the target local software is changed from the first authorization quantity to the second authorization quantity, and then the second authorization quantity can be sent to the cloud.

[0208] For further understanding, please refer to Fig.13 , Fig.13 1 is a schematic diagram of an interface switching for authorization management of members within an organization provided by an embodiment of the present application. Fig.13 As shown, interface J4 refers to an authorization interface for authorization management of N local software, where N is a positive integer. Here, 3 can be taken as an example, specifically including local software A, local software B, and local software C. Each local software corresponds to an authorization control (for example, a "member authorization" control).

[0209] When the second object (for example, an administrator of a certain enterprise) targets the authorization control corresponding to the local software A ( Fig.13When the control K3 shown in the figure executes a trigger operation, the local software authorization management system can respond to the trigger operation and display an interface J5. The interface J5 can be a sub-interface (for example, a pop-up window) displayed independently on the interface J4. Fig.13 As shown, the interface J5 may include M objects managed by the second object (e.g., members within a department). It is understandable that the interface J5 may be displayed according to the organizational structure, or the earliest member to be configured may be displayed by default, and the operable area (e.g., a selected check box) corresponding to the activated member (e.g., object b) may be grayed out.

[0210] In addition, the interface J5 may also include subscription data corresponding to the local software A (e.g., order number, number of subscriptions, number of unallocated copies, etc.), so as to prompt the second object to reasonably configure the members within the organization. It should be noted that when the second object reduces the device authorization quantity of a member, it is necessary to meet the condition that the device authorization quantity is greater than or equal to the number of activated devices of the member. When adding new members or increasing the device authorization quantity of existing members, it is necessary to meet the condition that the device authorization quantity is greater than or equal to 1 when the unallocated quantity is greater than 0.

[0211] It should be understood that the second object needs to first select the object to be configured (i.e., the third object, for example, object a and object c) in the member selection area (for example, area Q5) in the interface J5, and then when the selected object is displayed in the member authorization area (for example, area Q6), the second object can perform authorization quantity change operations for object a and object c respectively, for example, changing the device authorization quantity of object a to 4, and changing the device authorization quantity of object c to 2.

[0212] After reconfiguring the device authorization amount of object a and object c, the second object can perform a trigger operation on the confirmation control in interface J5 (for example, the "OK" control shown in control K4), so that the local software authorization management system displays interface J6 in response to the trigger operation. The interface J6 can also be a sub-interface (for example, a pop-up window) displayed independently on interface J4. Fig.13 As shown, the interface J6 may include changes in the device authorization quantity of object a (for example, increased from 3 to 4) and changes in the device authorization quantity of object c (for example, reduced from 5 to 2), so that the second object reconfirms whether to authorize the above-mentioned objects a and c.

[0213] After the second object is confirmed to be correct, it can perform a trigger operation on the authorization confirmation control in the interface J6 (for example, the "Confirm" control shown in the control K5), so that the local software authorization management system, in response to the trigger operation, determines that the device authorization amount of object a is changed from the first authorization amount (for example, 3) to the second authorization amount (for example, 4), and the device authorization amount of object c is changed from the first authorization amount (for example, 5) to the second authorization amount (for example, 2). Then, the local software authorization management system can send the second authorization amount of object a and the second authorization amount of object c to the cloud.

[0214] See also Fig.14 , Fig.14 This is a schematic diagram of a method for performing software authorization provided in an embodiment of the present application. Figure 2 .like Fig.14 As shown, the method is used for target local software. The method may at least include S501-S503:

[0215] S501, sending activation information of the target local software to the local software authorization management system.

[0216] The activation information here may include the software identifier of the target local software and the device fingerprint corresponding to the local server. The software identifier here can be used to uniquely indicate the target local software; the device fingerprint here can be used to uniquely identify the device characteristics or unique device identifier of the local server, such as the media access control address (e.g., Media Access Control Address, MAC address). The local software authorization management system can be used to manage the target local software.

[0217] S502: Receive an operation instruction returned by the local software authorization management system.

[0218] The operation instruction here is a verification instruction or an activation instruction. The verification instruction is generated by the local software authorization management system when it does not have a verification function; while the activation instruction is generated by the local software authorization management system when it has a verification function and determines that the first authorization certificate is valid.

[0219] S503: If the operation instruction is a verification instruction, obtain the storage location sent by the local software authorization management system, and manage based on the first authorization certificate in the storage location.

[0220] Specifically, if the operation instruction is a verification instruction, the storage location sent by the local software authorization management system is obtained through the SDK in the target local software. The target local software can verify the validity of the first authorization certificate in the storage location based on the SDK, obtain the verification result, and activate it when the verification result indicates that the verification is successful.

[0221] Exemplarily, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software has a verification function, the SDK verifies the validity of the first authorization certificate in the storage location, obtains a verification result, and sends the verification result to the target local software, so that the target local software is activated when it is determined that the verification result indicates that the verification is successful.

[0222] Optionally, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software does not have a verification function, the SDK sends the storage location to the target local software. Further, the target local software can call the software license verification module in the target local software, and based on the software license verification module, verify the validity of the first authorization certificate to obtain a verification result, and activate it when it is determined that the verification result indicates that the verification is successful.

[0223] The specific implementation of S501-S503 can be found in the above Figure 5 The description of S101-S107 in the corresponding embodiment will not be repeated here.

[0224] It can be seen that the business objects in the embodiments of the present application do not need to install and maintain complex authorization management software. They only need to connect to the cloud through the Internet after the offline time ends to use the software, thereby effectively improving the simplicity of software authorization. In addition, the embodiments of the present application can effectively reduce the workload of traditional software transformation through software SDK and local software authorization management system. For enterprises, software licenses can be subscribed according to the actual needs of users, avoiding the fixed costs and waste in traditional software authorization methods, thereby effectively reducing the cost of software authorization.

[0225] For further information, see Fig.15 , Fig.15 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 1 .like Fig.15 As shown, the software authorization device 1 may include at least one of a first acquisition unit 1501, a second acquisition unit 1502, and a management unit 1503. These units may execute the response functions of each device in the above method embodiment.

[0226] In a possible implementation, the software authorization device 1 can be used to implement Fig. 9 The local software authorization management system is used to manage the target local software. The local software management system and the target local software are deployed on the local server.

[0227] Specifically, the first acquisition unit 1501 is used to obtain the authorization identifier of the target local software, the authorization identifier includes a software identifier used to indicate the target local software, the target local software is any one of N local software managed by the local software authorization management system, N is a positive integer; the second acquisition unit 1502 is used to obtain the first authorization certificate sent by the cloud according to the authorization identifier, the first authorization certificate is used to authorize the target local software; the management unit 1503 is used to manage the target local software according to the first authorization certificate.

[0228] The specific implementation of the first acquisition unit 1501, the second acquisition unit 1502 and the management unit 1503 can be found in the above Fig. 9 The description of steps S401 to S403 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated.

[0229] For further information, see Fig.16 , Fig.16 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 2 .like Fig.16 As shown, the software authorization device 2 may include at least one of a first acquisition unit 1601, a second acquisition unit 1602, a management unit 1603, a configuration unit 1604, a storage unit 1605, a display unit 1606, a determination unit 1607, a transceiver unit 1608, and a change unit 1609. These units may perform the response functions of each device in the above method embodiment.

[0230] In a possible implementation, the software authorization device 2 can be used to implement Fig. 9 The local software authorization management system is used to manage the target local software. The local software management system and the target local software are deployed on the local server.

[0231] Specifically, the first acquisition unit 1601 is used to obtain the authorization identifier of the target local software, the authorization identifier includes a software identifier used to indicate the target local software, the target local software is any one of N local software managed by the local software authorization management system, N is a positive integer; the second acquisition unit 1602 is used to obtain the first authorization certificate sent by the cloud according to the authorization identifier, the first authorization certificate is used to authorize the target local software; the management unit 1603 is used to manage the target local software according to the first authorization certificate.

[0232] In one implementation, the software authorization device also includes: a configuration unit 1604, which is used to configure the file permissions of the first authorization certificate to obtain the configured first authorization certificate, the file permissions include at least one of editable permissions or reading permissions, and the configured first authorization certificate is used to manage the target local software; a storage unit 1605, which is used to store the configured first authorization certificate.

[0233] In one implementation, the first acquisition unit 1601 is used to acquire the authorization identifier of the target local software, including: a display subunit 16011 and an acquisition subunit 16012.

[0234] The display subunit 16011 is used to display the management interface including N local software; the acquisition subunit 16012 is used to respond to the startup operation of the target local software among the N local software in the management interface and acquire the authorization identifier of the target local software.

[0235] In one implementation, the authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0236] In one implementation, the second acquisition unit 1602 is used to acquire the first authorization certificate sent by the cloud according to the authorization identifier, and includes: a search subunit 16021, a generation subunit 16022 and a first transceiver subunit 16023.

[0237] The search subunit 16021 is used to search in the local server according to the authorization identifier to obtain a search result; the generation subunit 16022 is used to generate a download request corresponding to the first authorization certificate if the search result indicates that the search failed, and the download request includes a request identifier, and the request identifier is used to indicate the association between the activation request and the download request of the target local software; the first transceiver subunit 16023 is used to send the download request to the cloud; the first transceiver subunit 16023 is also used to receive the first authorization certificate sent by the cloud.

[0238] In one implementation, the management unit 1603 is used to manage the target local software according to the first authorization certificate, and includes: a verification subunit 16031 and a second transceiver subunit 16032 .

[0239] The verification subunit 16031 is used to verify the validity of the first authorization certificate and obtain a verification result; the second transceiver subunit 16032 is used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct the activation of the target local software.

[0240] In one implementation, the management unit 1603 is used to manage the target local software according to the first authorization certificate, and includes: a third transceiver subunit 16033.

[0241] The third transceiver subunit 16033 is used to send the storage location of the first authorization certificate to the target local software; the third transceiver subunit 16033 is also used to send a verification instruction to the target local software, and the verification instruction is used to instruct to verify the validity of the first authorization certificate in the storage location.

[0242] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software when responding to a download operation for the target local software.

[0243] In one implementation, the local software authorization management system is further used to store a mapping relationship; the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

[0244] In one implementation, the software authorization device also includes: a display unit 1606, which is used to display a subscription interface provided by the transaction platform, the subscription interface includes the target local software; a determination unit 1607, which is used to respond to a business transaction operation for the target local software in the subscription interface if the business object is the first object with software subscription authority, and determine the subscription data corresponding to the target local software, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; a transceiver unit 1608, which is also used to synchronize the subscription data corresponding to the target local software to the cloud through the transaction platform.

[0245] In one implementation, the software authorization device also includes: a display unit 1606, which is also used to display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software if the business object is a second object with organizational management authority; the display unit 1606 is also used to respond to a trigger operation on the authorization control and display M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; a change unit 1609 is used to respond to an authorization quantity change operation on a third object among the M objects, and change the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; the transceiver unit 1606 is also used to send the second authorization quantity to the cloud.

[0246] The specific implementation of the first acquisition unit 1601, the second acquisition unit 1602, the management unit 1603, the configuration unit 1604, the storage unit 1605, the display unit 1606, the determination unit 1607, the transceiver unit 1608 and the change unit 1609 can be referred to above. Fig. 9 The description of steps S401 to S403 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated.

[0247] For further information, see Fig.17 , Fig.17 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 3 .like Fig.17 As shown, the software authorization device 3 may include at least one of a transceiver unit 1701 and a processing unit 1702. These units may execute the response functions of each device in the above method embodiment.

[0248] In a possible implementation, the software authorization device 3 can be used to implement Fig.14 The functionality of the target local software in.

[0249] Specifically, the transceiver unit 1701 is used to send activation information of the target local software to the local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; the transceiver unit 1701 is used to receive an operation instruction returned by the local software authorization management system; the processing unit 1702 is used to obtain a storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location.

[0250] In one implementation, a software development kit SDK for data interaction is integrated into the target local software, and the SDK is used to receive the storage location sent by the local software authorization management system.

[0251] In one implementation, the processing unit 1702 is used to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location, including: the processing unit 1702 is specifically used to obtain the storage location sent by the local software authorization management system through the SDK in the target local software if the operation instruction is a verification instruction; the processing unit 1702 is specifically used to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; the processing unit 1702 is specifically used to activate when the verification result indicates that the verification is successful.

[0252] The specific implementation of the transceiver unit 1701 and the processing unit 1702 can be found in the above Fig.14The description of steps S501 to S503 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here either.

[0253] For further information, see Fig.18 , Fig.18 This is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. Figure 4 .like Fig.18 As shown, specifically, the software authorization device 4 can be used to implement Fig. 9 The function of the local software authorization management system in the software authorization device 4 can be used to implement Fig.14 The functionality of the target local software.

[0254] Reference Fig.18 The software authorization device 4 includes: a processor 1801, a communication interface 1802 and all or part of the hardware in a memory 1803. The number of the processor 1801 in the software authorization device 4 can be one or more. Fig.18 In the embodiment of the present application, the processor 1801, the communication interface 1802 and the memory 1803 may be connected via a bus system or other means, wherein: Fig.18 The connection via bus system 1804 is taken as an example.

[0255] The processor 1801 may be a central processor unit (CPU), a network processor (NP), or a combination of a CPU and a NP. The processor 1801 may also include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0256] The communication interface 1802 is used to receive and send data. Specifically, the communication interface 1802 may include a receiving interface and a sending interface. The receiving interface may be used to receive data, and the sending interface may be used to send data. The number of the communication interface 1802 may be one or more.

[0257] Memory 1803 may include volatile memory, such as random-access memory (RAM); memory 3003 may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); memory 1803 may also include a combination of the above types of memory.

[0258] Optionally, the memory 1803 stores an operating system and a program, an executable module or a data structure, or a subset thereof, or an extended set thereof, wherein the program may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks. The processor 1801 may read the program in the memory 1803 to implement the method provided in the embodiment of the present application.

[0259] The memory 1803 may be a storage device in the software authorization device 4 , or may be a storage device independent of the software authorization device 4 .

[0260] The bus system 1804 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus system 3004 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.18 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0261] In some possible embodiments, the above-mentioned software authorization device can be implemented as a virtualized device. For example, the virtualized device can be a virtual machine (VM) running a program for performing software authorization functions, and the virtual machine is deployed on a hardware device (for example, a physical server). A virtual machine refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. The virtual machine can be configured as a software authorization device. For example, the functions of the software authorization device can be implemented based on a general physical server in combination with network function virtualization (NFV) technology. Those skilled in the art can virtualize a software authorization device with the above-mentioned functions on a general physical server in combination with NFV technology by reading this application, which will not be repeated here.

[0262] It should be noted that the software authorization device mentioned in the embodiments of the present application may be a local software authorization management system deployed by a local server, or may be a target local software deployed by a local server, or may be a chip used to implement the method of the present application, and the embodiments of the present application do not make specific limitations. When the software authorization device is a chip, the interface circuit in the chip may be used to perform the receiving or sending operation in the software authorization device, and the processor in the chip may be used to perform the processing operation.

[0263] In a specific implementation, the embodiment of the present application further provides a chip, including a processor and an interface circuit, the interface circuit is used to receive instructions and transmit them to the processor; the processor can be used to execute the operations of each software authorization device in the above software authorization method. The processor is coupled to a memory, and the memory is used to store programs or instructions. When the program or instruction is executed by the processor, the chip implements the method in any of the above method embodiments.

[0264] Optionally, the processor in the chip may be one or more. The processor may be implemented by hardware and / or software. When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented by software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0265] Optionally, the memory in the chip may be one or more. The memory may be integrated with the processor or may be separately provided with the processor, which is not limited in the present application. Exemplarily, the memory may be a non-transient processor, such as a read-only memory ROM, which may be integrated with the processor on the same chip or may be provided on different chips. The present application does not specifically limit the type of memory and the arrangement of the memory and the processor.

[0266] Exemplarily, the chip may be a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD), or other integrated chips.

[0267] An embodiment of the present application also provides a computer-readable storage medium, including instructions or computer programs, which, when executed on a processor, enable the processor to execute the software authorization method provided in the above embodiment.

[0268] The embodiment of the present application also provides a computer program product including instructions or a computer program, which, when executed on a processor, enables a software authorization device to execute the software authorization method provided in the above embodiment.

[0269] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0270] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0271] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical business division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0272] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0273] Those skilled in the art should be aware that in one or more of the above examples, the services described in this application can be implemented with hardware, software, firmware, or any combination thereof. When implemented using software, these services can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media can be any available media that a general or special-purpose computer can access.

[0274] The above specific implementation methods further describe in detail the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above are only specific implementation methods of the present application.

[0275] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A software authorization method, characterized in that: The method is used for a local software authorization management system, the local software authorization management system is used to manage target local software, the local software management system and the local software are deployed on a local server, and the method includes: Obtaining an authorization identifier of the target local software, the authorization identifier including a software identifier for indicating the target local software, the target local software being any one of N local software managed by the local software authorization management system, where N is a positive integer; According to the authorization identifier, obtaining a first authorization certificate sent by the cloud, where the first authorization certificate is used to authorize the target local software; The target local software is managed according to the first authorization certificate.

2. The method according to claim 1, characterized in that The method further comprises: configuring the file permissions of the first authorization certificate to obtain a configured first authorization certificate, wherein the file permissions include at least one of an edit permission or a read permission, and the configured first authorization certificate is used to manage the target local software; The configured first authorization certificate is stored.

3. The method according to claim 1 or 2, characterized in that: The authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into the local software authorization management system.

4. The method according to any one of claims 1 to 3, characterized in that: The step of obtaining, according to the authorization identifier, a first authorization certificate sent by the cloud, includes: Searching in the local server according to the authorization identifier to obtain a search result; If the search result indicates that the search fails, generating a download request corresponding to the first authorization certificate, the download request including a request identifier, the request identifier being used to indicate an association relationship between the activation request of the target local software and the download request; Sending the download request to the cloud; Receive the first authorization certificate sent by the cloud.

5. The method according to any one of claims 1 to 4, characterized in that: The managing the target local software according to the first authorization certificate includes: Verifying the validity of the first authorization certificate to obtain a verification result; When the verification result indicates that the verification is successful, an activation instruction is sent to the target local software, where the activation instruction is used to instruct to activate the target local software.

6. The method according to any one of claims 1 to 5, characterized in that: The managing the target local software according to the first authorization certificate includes: Sending the storage location of the first authorization certificate to the target local software; A verification instruction is sent to the target local software, where the verification instruction is used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

7. The method according to any one of claims 1 to 6, characterized in that: The local software authorization management system is also used to install the target local software based on the software installation package corresponding to the target local software when responding to a download operation for the target local software.

8. The method according to claim 7, characterized in that The local software authorization management system is also used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Displaying a subscription interface provided by a trading platform, wherein the subscription interface includes the target local software; If the business object is a first object with software subscription rights, in the subscription interface, in response to a business transaction operation for the target local software, the subscription data corresponding to the target local software is determined, wherein the business transaction operation is a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; The subscription data corresponding to the target local software is synchronized to the cloud through the transaction platform.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: If the business object is a second object with organizational management authority, then in the authorization interface for authorization management of the N local software, an authorization control corresponding to the target local software is displayed; In response to a trigger operation on the authorization control, M objects managed by the second object are displayed, where M is a positive integer, and the second object and the M objects belong to the same organization; In response to an authorization quantity change operation on a third object among the M objects, changing the device authorization quantity of the third object in the target local software from a first authorization quantity to a second authorization quantity; The second authorization amount is sent to the cloud.

11. A software authorization method, characterized in that: The method is used for target local software, comprising: Sending activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; Receiving an operation instruction returned by the local software authorization management system; If the operation instruction is a verification instruction, a storage location sent by the local software authorization management system is obtained, and management is performed based on the first authorization certificate in the storage location.

12. The method according to claim 11, characterized in that The target local software is integrated with a software development kit SDK for data interaction, and the SDK is used to receive the storage location sent by the local software authorization management system.

13. The method according to claim 11 or 12, characterized in that: If the operation instruction is a verification instruction, obtaining the storage location sent by the local software authorization management system, and managing based on the first authorization certificate in the storage location, including: If the operation instruction is a verification instruction, obtaining the storage location sent by the local software authorization management system through the SDK in the target local software; Based on the SDK, verify the validity of the first authorization certificate in the storage location to obtain a verification result; The activation is performed when the verification result indicates that the verification is successful.

14. A software authorization device, characterized in that: The software authorization device is applied to a local software authorization management system, the local software authorization management system is used to manage target local software, the local software management system and the target local software are deployed on a local server, and the software authorization device includes: A first acquisition unit, configured to acquire an authorization identifier of the target local software, wherein the authorization identifier includes a software identifier for indicating the target local software, and the target local software is any one of N local software managed by the local software authorization management system, where N is a positive integer; A second acquisition unit, configured to acquire, according to the authorization identifier, a first authorization certificate sent by the cloud, wherein the first authorization certificate is used to authorize the target local software; A management unit is used to manage the target local software according to the first authorization certificate.

15. The software authorization device according to claim 14, characterized in that: The software authorization device also includes: a configuration unit, configured to configure the file permissions of the first authorization certificate to obtain a configured first authorization certificate, wherein the file permissions include at least one of an edit permission or a read permission, and the configured first authorization certificate is used to manage the target local software; The storage unit is used to store the configured first authorization certificate.

16. The software authorization device according to claim 14 or 15, characterized in that: The authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into the local software authorization management system.

17. The software authorization device according to any one of claims 14 to 16, characterized in that: The second acquisition unit is used to acquire the first authorization certificate sent by the cloud according to the authorization identifier, including: A search subunit, configured to search in the local server according to the authorization identifier to obtain a search result; a generating subunit, configured to generate a download request corresponding to the first authorization certificate if the search result indicates that the search fails, the download request including a request identifier, the request identifier being used to indicate an association relationship between the activation request for the target local software and the download request; A first transceiver subunit, used to send the download request to the cloud; The first transceiver subunit is further used to receive the first authorization certificate sent by the cloud.

18. The software authorization device according to any one of claims 14 to 17, characterized in that: The management unit is used to manage the target local software according to the first authorization certificate, including: A verification subunit, used to verify the validity of the first authorization certificate and obtain a verification result; The second transceiver subunit is used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct to activate the target local software.

19. The software authorization device according to any one of claims 14 to 18, characterized in that: The management unit is used to manage the target local software according to the first authorization certificate, including: A third transceiver subunit is used to send the storage location of the first authorization certificate to the target local software; The third transceiver subunit is further used to send a verification instruction to the target local software, where the verification instruction is used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

20. The software authorization device according to any one of claims 14 to 19, characterized in that: The local software authorization management system is also used to install the target local software based on the software installation package corresponding to the target local software when responding to a download operation for the target local software.

21. The software authorization device according to claim 20, characterized in that: The local software authorization management system is also used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

22. The software authorization device according to any one of claims 14 to 21, characterized in that: The software authorization device also includes: A display unit, used to display a subscription interface provided by the trading platform, wherein the subscription interface includes the target local software; a determination unit, configured to determine, in the subscription interface, subscription data corresponding to the target local software in response to a business transaction operation for the target local software if the business object is a first object having software subscription rights, wherein the business transaction operation is a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; The transceiver unit is also used to synchronize the subscription data corresponding to the target local software to the cloud through the transaction platform.

23. The software authorization device according to any one of claims 14 to 22, characterized in that: The software authorization device also includes: The display unit is further configured to display the authorization control corresponding to the target local software in the authorization interface for performing authorization management on the N local software if the business object is a second object with organizational management authority; The display unit is further used to respond to a trigger operation on the authorization control and display M objects managed by the second object, where M is a positive integer, and the second object and the M objects belong to the same organization; A changing unit, configured to respond to an authorization quantity change operation on a third object among the M objects, and change the device authorization quantity of the third object in the target local software from a first authorization quantity to a second authorization quantity; The transceiver unit is further configured to send the second authorization amount to the cloud.

24. A software authorization device, characterized in that: The software authorization device is applied to the target local software, including: A transceiver unit, configured to send activation information of the target local software to a local software authorization management system, wherein the local software authorization management system is configured to manage the target local software, wherein the activation information of the target local software includes a software identifier, and the software identifier is configured to indicate the target local software; The transceiver unit is used to receive the operation instruction returned by the local software authorization management system; The processing unit is configured to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and perform management based on the first authorization certificate in the storage location.

25. The software authorization device according to claim 24, characterized in that: The target local software is integrated with a software development kit SDK for data interaction, and the SDK is used to receive the storage location sent by the local software authorization management system.

26. The software authorization device according to claim 24 or 25, characterized in that: The processing unit is configured to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location, including: The processing unit is specifically configured to obtain, through the SDK in the target local software, a storage location sent by the local software authorization management system if the operation instruction is a verification instruction; The processing unit is specifically configured to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; The processing unit is specifically configured to be activated when the verification result indicates that the verification is successful.

27. A software authorization device, characterized in that: It comprises a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to implement the method as claimed in any one of claims 1 to 10, or to implement the method as claimed in any one of claims 11 to 13.

28. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the method according to any one of claims 1 to 10 is implemented, or the method according to any one of claims 11 to 13 is implemented.

29. A computer program product, characterized in that The computer program product comprises instructions, which, when executed on a processor, are used to implement the method according to any one of claims 1 to 10, or to implement the method according to any one of claims 11 to 13.

Images