Service authorization method and related device

Abstract

The invention provides a service authorization method and a related device. The service authorization method comprises the following steps: in response to an authorization request for a first service, determining a machine code of the first service and a service type of the first service; encrypting the machine code of the first service through a first private key which is set in the encryption program and corresponds to the service type to obtain an authorization file; determining the validity period of the authorization file, and updating the authorization file based on the validity period of the authorization file to obtain an updated authorization file; and authorizing the first service based on the updated authorization file. Through the service authorization method and device, the service authorization efficiency can be improved under the condition that the authorization safety is guaranteed.

Description

Technical Field

[0001] The present application relates to information communication technology, and in particular to a service authorization method and related devices. Background Art

[0002] Currently, containerized deployment is gaining more and more attention due to its unique advantages. An application system usually requires the cooperation of several to dozens of applications (services). These applications are deployed on different servers through containerization, and each application needs to be authorized before it can be used. Summary of the invention

[0003] The embodiment of the present application provides a service authorization method and related devices, which can avoid multiple encryption of services based on different private keys while ensuring the security of authorization, thereby improving the efficiency of service authorization.

[0004] The technical solution of the embodiment of the present application is implemented as follows:

[0005] The present invention provides a method for service authorization, which includes:

[0006] In response to an authorization request for a first service, determining a machine code of the first service and a service type of the first service;

[0007] The machine code of the first service is encrypted by using a first private key corresponding to the service type set in the encryption program to obtain an authorization file;

[0008] Determine the validity period of the authorization document, and based on the validity period of the authorization document, update the authorization document to obtain an updated authorization document;

[0009] The first service is authorized based on the updated authorization file.

[0010] The present application embodiment provides a service authorization device, including:

[0011] a data collection module, configured to determine, in response to an authorization request for a first service, a machine code of the first service and a service type of the first service;

[0012] An encryption module, used to encrypt the machine code of the first service by using a first private key corresponding to the service type set in an encryption program to obtain an authorization file;

[0013] The authorization module is used to determine the validity period of the authorization document, and based on the validity period of the authorization document, update the authorization document to obtain an updated authorization document; based on the updated authorization document, authorize the first service.

[0014] An embodiment of the present application provides an electronic device, including:

[0015] A memory for storing computer executable instructions;

[0016] The processor is used to implement the service authorization method provided in the embodiment of the present application when executing the computer executable instructions stored in the memory.

[0017] An embodiment of the present application provides a computer-readable storage medium storing a computer program or computer-executable instructions for implementing the service authorization method provided in the embodiment of the present application when executed by a processor.

[0018] An embodiment of the present application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, the service authorization method provided in the embodiment of the present application is implemented.

[0019] The embodiments of the present application have the following beneficial effects:

[0020] Determine the machine code of the first service and the service type of the first service, encrypt the machine code of the first service by using the first private key corresponding to the service type set in the encryption program, and obtain an authorization file. In this way, it is avoided to encrypt the machine code of services of different service types only by using a unique private key. Since the encryption method of encrypting by using a unique private key increases the risk of services of different service types being cracked at the same time, under the condition of ensuring the security of service authorization, the method of determining the corresponding private key based on the service type of the service is adopted, and there is no need to improve the security of service authorization by multiple encryptions, thereby improving the authorization efficiency. At the same time, encryption by using the first private key in the encryption program can further improve the security of service authorization. In addition, the validity period of the authorization file is determined, and based on the validity period of the authorization file, the authorization file is updated to obtain the updated authorization file, the timeliness of the authorization file is maintained, and the potential risks caused by expired authorization files are avoided, thereby improving the security of service authorization. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of the architecture of the service authorization system provided in the embodiment of the present application;

[0022] Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0023] Figure 3A This is a first flow chart of the service authorization method provided in an embodiment of the present application;

[0024] Figure 3BIt is a second flow chart of the service authorization method provided in an embodiment of the present application;

[0025] Figure 3C It is a third flow chart of the service authorization method provided in the embodiment of the present application;

[0026] Figure 3D It is a fourth flow chart of the service authorization method provided in an embodiment of the present application;

[0027] Figure 4 This is a schematic diagram of the license server network architecture provided by an embodiment of the present application;

[0028] Figure 5 This is a schematic diagram of the license client network architecture provided by an embodiment of the present application;

[0029] Figure 6 This is a file authorization flow chart provided in an embodiment of the present application.

[0030] It should be pointed out that the above-mentioned "first" and "second" are only used to distinguish different solutions, and do not represent the degree of superiority or inferiority of the solutions or the priority in the implementation process. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0032] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0033] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0034] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0035] The relevant data collection and processing in the embodiments of this application should be strictly in accordance with the requirements of relevant national laws and regulations when applied in examples, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of authorization of laws and regulations and the personal information subject.

[0036] Unless otherwise defined, all technical and scientific terms used in the embodiments of the present application have the same meanings as those commonly understood by those skilled in the art. The terms used in the embodiments of the present application are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0037] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0038] 1) Service: The service in this application example is a service that has not yet been authorized. The service can be executed in the device where the service is located only after it is authorized.

[0039] 2) Service type is used to identify the common attributes of different services. Each common attribute represents a category of service. The service type can be the service object (such as text or image), service difficulty (such as "difficult" or "easy"), resource usage level (such as "high resource occupancy" or "low resource occupancy"), etc.

[0040] 3) Private key, which is used to encrypt the machine code of the service to ensure the integrity of the machine code of the service and the authenticity of its source. The private key must be stored securely to prevent leakage.

[0041] 4) Authorization file, which is the encrypted machine code of the service, used to authorize the service so that the user or system can perform specific tasks based on the authorized service.

[0042] In the related art, since authorized applications may belong to different products and business lines, they are encrypted with only the same private key, which reduces the security of authorization. By cracking the unique private key, security risks are generated for different products and business lines. In order to improve the security of authorization, multiple private keys are required to encrypt the application multiple times, which reduces the authorization efficiency. To address the above problems, the embodiments of the present application provide a service authorization method, device, electronic device, computer-readable storage medium and computer program product, which avoid multiple encryption of services based on different private keys while ensuring the security of authorization, thereby improving the efficiency of service authorization.

[0043] The service authorization method described in the embodiments of the present application can be applied to various fields, such as data processing authorization, hardware startup authorization and other fields. That is, the service authorization method described in the embodiments of the present application is not limited to a certain field.

[0044] The following describes an exemplary application of the electronic device provided in the embodiment of the present application. The device provided in the embodiment of the present application can be implemented as a terminal or a server. The following describes an exemplary application when the device is implemented as a server.

[0045] See also Figure 1 , Figure 1 It is an architectural diagram of the service authorization system 100 provided in an embodiment of the present application. To support a service authorization application, a terminal (terminal 400 is shown as an example) is connected to a server 200 via a network 300. The network 300 may be a wide area network or a local area network, or a combination of the two.

[0046] Terminal 400 is used to send the machine code of the service and the service type of the service to server 200 through network 300, and server 200 is used to determine the private key corresponding to the service type; based on the private key, the machine code of the service is encrypted to obtain an authorization file, and the authorization file is returned to terminal 400. Terminal 400 displays the authorization file through graphical interface 410, and authorizes the service based on the authorization file.

[0047] An example of terminal 400 performing service authorization is described below.

[0048] In some embodiments, terminal 400 can independently complete service authorization tasks, such as determining the machine code of the service and the service type of the service; determining the private key corresponding to the service type; based on the private key, encrypting the machine code of the service to obtain an authorization file. Terminal 400 is used to display the authorization file through the graphical interface 410, and authorize the service based on the authorization file.

[0049] In one implementation scenario, a server or terminal may authorize a data processing program in data processing, determine the machine code of the data processing program, and the program type of the data processing program; determine a private key corresponding to the program type; based on the private key, encrypt the machine code of the data processing program to obtain an authorization file, determine the validity period of the authorization file, and based on the validity period of the authorization file, update the authorization file to obtain an updated authorization file, and authorize the data processing program based on the updated authorization file.

[0050] In one implementation scenario, a server or terminal can perform service authorization on the hardware during hardware startup, determine the machine code of the hardware, and the hardware type of the hardware; determine the private key corresponding to the hardware type; based on the private key, encrypt the machine code of the hardware to obtain an authorization file, determine the validity period of the authorization file, and based on the validity period of the authorization file, update the authorization file to obtain an updated authorization file, and authorize the hardware based on the updated authorization file.

[0051] In some embodiments, server 200 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0052] The terminal 400 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, an intelligent voice interaction device, a smart home appliance, a vehicle terminal, an aircraft, etc., but is not limited thereto. The terminal and the server may be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiments of the present application.

[0053] See also Figure 2 , Figure 2 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, Figure 2 The electronic device 500 shown may be Figure 1 In the terminal 400 or server 200, the electronic device 500 includes: at least one processor 510, a memory 550, and at least one network interface 520. The various components in the server 200 are coupled together through a bus system 540. It can be understood that the bus system 540 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 540 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in Figure 2 Various buses are labeled as bus system 540 .

[0054] The processor 510 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0055] The user interface 530 includes one or more output devices 531 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 530 also includes one or more input devices 532, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls;

[0056] In some embodiments, when the terminal 400 independently completes the service authorization task, the server 200 provided in the embodiment of the present application does not include the user interface 530 .

[0057] The memory 550 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, a hard disk drive, an optical disk drive, etc. The memory 550 may optionally include one or more storage devices that are physically located away from the processor 510.

[0058] The memory 550 includes a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 550 described in the embodiments of the present application is intended to include any suitable type of memory.

[0059] In some embodiments, the memory 550 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0060] Operating system 551, including system programs for processing various basic system services and performing hardware-related tasks, such as framework layer, core library layer, driver layer, etc., for implementing various basic services and processing hardware-based tasks;

[0061] A network communication module 552, for reaching other computing devices via one or more (wired or wireless) network interfaces 520, exemplary network interfaces 520 include: Bluetooth, Wireless Compatibility Certification (WiFi), and Universal Serial Bus (USB);

[0062] a presentation module 553 for enabling presentation of information via one or more output devices 531 (e.g., display screen, speaker, etc.) associated with the user interface 530 (e.g., a user interface for operating peripherals and displaying content and information);

[0063] In some embodiments, when the service authorization task is completed independently by the terminal 400, the server 200 provided in the embodiment of the present application may not include the presentation module 553.

[0064] The input processing module 554 is used to detect one or more user inputs or interactions from one of the one or more input devices 532 and translate the detected inputs or interactions; in some embodiments, when the embodiment completes the service authorization task independently by the terminal 400, the server 200 provided in the embodiment of the present application may not include the presentation module 553.

[0065] In some embodiments, the device provided in the embodiments of the present application can be implemented in software. Figure 2 The service authorization device 555 stored in the memory 550 is shown, which can be software in the form of a program and a plug-in, including the following software modules: a data acquisition module 5551, an encryption module 5552, and an authorization module 5553. These modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0066] In other embodiments, the device provided in the embodiments of the present application can be implemented in hardware. As an example, the device provided in the embodiments of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the service authorization method provided in the embodiments of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application specific integrated circuits (Application Specific Integrated Circuit, ASIC), digital signal processors (Digital Signal Processor, DSP), programmable logic devices (Programmable Logic Device, PLD), complex programmable logic devices (Complex Programmable Logic Device, CPLD), field programmable gate arrays (Field-Programmable Gate Array, FPGA) or other electronic components.

[0067] It should be noted that in the example of service authorization below, those skilled in the art may apply the service authorization method provided in the embodiment of the present application to service authorization based on their understanding of the following.

[0068] See also Figure 3A , Figure 3A This is a first flow chart of the service authorization method provided in the embodiment of the present application, which will be combined with Figure 3A The steps shown are used for explanation. The service authorization method provided in the embodiment of the present application can be implemented by a server or a terminal alone, or by a server and a terminal in collaboration. The following will take the collaborative implementation by a server and a terminal as an example for explanation.

[0069] In step 101 , in response to an authorization request for a first service, a machine code of the first service and a service type of the first service are determined.

[0070] Here, the authorization request of the first service is used to apply to the server for authorization of the first service. When the first service needs to perform operations beyond its current authority, it must request additional authorization to perform the corresponding operations. The first service is a service that has not yet been authorized. After being authorized, the first service is applied to the device to perform the service; the machine code of the first service can be the device serial number of the device that applies the first service, which is used to identify the device of the first service. Each machine code corresponds to a device, and the device contains an environment for executing the first service so that the first service can perform the service. The embodiment of the present application does not limit the device, and the device can be a server, a terminal, etc.; the embodiment of the present application does not limit the service type of the first service. The embodiment of the present application can classify the service based on the service object of the first service (such as text or image), the service difficulty (such as "difficult" or "easy"), the resource usage degree (such as "high resource occupancy" or "low resource occupancy"), etc., to determine the service type of the service. For example, when the service object of the service is text, the service type of the service is a text processing type.

[0071] It should be noted that obtaining the service type of the first service can be achieved in the following manner: clustering multiple first services to obtain the service type of each first service.

[0072] For example, based on the K-nearest neighbor clustering method, multiple first services (such as first service A and first service B) are clustered to obtain the category of each first service, and the category of each first service is determined as the service type of each first service (such as the service type of first service A is a text processing type and the service type of first service B is an image processing type).

[0073] In some embodiments, see Figure 3B , Figure 3B is a second flow chart of the service authorization method provided in the embodiment of the present application. Figure 3A Before determining the machine code of the first service and the service type of the first service in step 101, execute Figure 3B Step 201 to step 202 are performed to determine the first service.

[0074] In step 201, the amount of available resources is determined.

[0075] Here, the amount of available resources refers to the resources that can be allocated, that is, the difference between the total resources and the allocated resources. The embodiment of the present application does not limit the form of resources, and the resources can be threads, computing power, memory space, etc.

[0076] For example, the difference (eg, 0.8G space) between the total resources (eg, 1G space) and the allocated resources (eg, 0.2G space) is determined as the available resource amount.

[0077] In some embodiments, Figure 3B The illustrated step 201 can be implemented through steps 2011 to 2013, which are described in detail below.

[0078] In step 2011, the total amount of resources is obtained, and the resource application amounts corresponding to the multiple historical authorization services are determined.

[0079] Here, the total amount of resources refers to the sum of all resources used for a service or application; a historical authorized service is an authorized service, and the resource application amount corresponding to each historical authorized service is the amount of resources allocated to the historical authorized service.

[0080] For example, the total resource amount is 100G storage space, where the resource application amount corresponding to the historical authorization service A is 5G storage space, and the resource application amount corresponding to the historical authorization service B is 20G storage space.

[0081] In some embodiments, determining the resource application amounts corresponding to multiple historical authorization services in step 2011 can be achieved in the following manner: performing the following processing for each historical authorization service, receiving the heartbeat information sent by the historical authorization service; determining the difference between the sending time point of the heartbeat information and the sending time point of the previous heartbeat information; when the difference is greater than the time threshold, determining the preset resource amount as the resource application amount of the historical authorization service.

[0082] Here, the heartbeat information sent by the historical authorization service is used to verify the online status of the historical authorization service, maintain connection, update status, etc. A timestamp indicating the sending time is used to determine the time when the message is sent. The heartbeat information sent by the historical authorization service may include identification information of the device sending the heartbeat (such as service name, IP address, machine code), target information (i.e., the target of sending the heartbeat information, such as a server), status information (i.e., the status of the device sending the heartbeat, such as "good"), additional information (such as updated resource application amount) or token or credential updates for identity authentication and authorization, wherein the historical authorization service will periodically send heartbeat messages to ensure that they are still operating normally and providing continuous services to users.

[0083] It should be noted that the historical authorization service will wait for a period of time after sending the heartbeat message and will send the heartbeat message again; the preset resource amount (such as 0G storage space) is the amount of resources saved for the historical authorization service when the difference between the sending time point of the heartbeat message sent by the historical authorization service and the sending time point of the previous heartbeat message is greater than the time threshold.

[0084] In some embodiments, the following processing is performed for each historical authorization service: receiving a heartbeat message sent by the historical authorization service; determining the difference between the sending time point of the heartbeat message (such as "20140506") and the sending time point of the previous heartbeat message (such as "20140501") (such as "000005", that is, the interval between the two heartbeat messages is 5 days); when the difference is greater than the time threshold (such as 4 days), determining the preset resource amount (such as 0G storage space) as the resource application amount of the historical authorization service.

[0085] Through the embodiments of the present application, when it is determined that the difference between the sending time point of the heartbeat information and the sending time point of the previous heartbeat information is greater than the time threshold, the preset resource amount (such as 0G storage space) is determined as the resource application amount of the historical authorization service, that is, the resources of the historical authorization service are recovered to avoid resource loss and improve resource utilization.

[0086] In some embodiments, a heartbeat message sent by a historical authorization service is received, wherein the heartbeat message carries a resource update request, and the resource update request is used to update the resource application amount based on the new resource application amount; when the new resource application amount of the historical authorization service is different from the resource application amount of the historical authorization service, the historical authorization service is re-authorized.

[0087] In step 2012, data processing is performed on the resource application amounts corresponding to the plurality of historical authorization services to obtain the used resource amounts.

[0088] Here, the used resource amount is the amount of resources allocated to multiple historical authorized services. The allocated resources are occupied by the historical authorized services so that the historical authorized services provide services based on the allocated resources and cannot be allocated to other services.

[0089] In some embodiments, step 2012 may be implemented in the following manner: performing a weighted summation of resource application amounts corresponding to a plurality of historical authorization services to obtain the used resource amount.

[0090] For example, the resource application amount corresponding to the historical authorization service A is 5G storage space, and the resource application amount corresponding to the historical authorization service B is 20G storage space. The resource application amounts corresponding to multiple historical authorization services are weighted and summed to obtain the used resource amount (such as 25G storage space).

[0091] In step 2013, the difference between the total amount of resources and the used amount of resources is determined as the available amount of resources.

[0092] Here, the available resource amount is the amount of resources that have not been allocated yet and can be allocated to the first service so that the first service can provide services based on the resources.

[0093] For example, the difference (eg, 75G storage space) between the total amount of resources (eg, 100G storage space) and the used amount of resources (eg, 25G storage space) is determined as the available amount of resources.

[0094] Through the embodiments of the present application, the first service is determined according to the usage of resources, thereby avoiding resource deadlock when allocating resources due to authorization of multiple first services, and improving the security of service authorization and resource allocation.

[0095] In step 202, a first service is determined from a plurality of services based on available resources.

[0096] Here, the multiple services are candidate services, and each service may be authorized.

[0097] It should be noted that step 202 may be implemented in the following manner: based on the available resource amount, a first service is screened out from a plurality of services, wherein the sum of the resource application amounts of the first service is less than the available resource amount.

[0098] Through the embodiments of the present application, based on the available resource amount, the first service is screened out from multiple services, so that the available resource amount is allocated to different first services, thereby realizing resource allocation of the services.

[0099] In some embodiments, see Figure 3C , Figure 3C is a third flow chart of the service authorization method provided in the embodiment of the present application, for Figure 3B Step 202 shown may be performed by Figure 3C Steps 2021 to 2023 are implemented as described in detail below.

[0100] In step 2021, service parameters corresponding to each service are determined.

[0101] The service parameters include the resource application amount or the sending time of the authorization request.

[0102] Here, the resource application amount corresponding to each service is the amount of resources applied for by each service, and the sending time of the authorization application request is the time when the service sends the authorization application request.

[0103] For example, the resource application amount corresponding to service A (such as 0.85), and the resource application amount corresponding to service B (such as 0.8).

[0104] Before step 221, in response to the sending operation of the authorization application request corresponding to the service, the sending time of the authorization application request is recorded. The embodiment of the present application does not limit the recording location of the sending time of the authorization application request. The recording location can be a database or a log file, so as to obtain the sending time of the authorization application request for each service from the database or log file in response to the sending time query operation.

[0105] In some embodiments, when the service parameter is the sending time of the authorization request, step 2021 can be implemented in the following way: in response to the sending time query operation, determine the target storage space, and determine the sending time of the authorization application requests corresponding to multiple services from the target storage space, wherein the target storage space can be a database or log file for storing the sending time of the authorization application request.

[0106] For example, in response to the sending time query operation, a database is queried or a log file is viewed to determine the sending time of the authorization application request for each service from the database or the log file.

[0107] In step 2022, multiple services are sorted based on the service parameters to obtain a sorting result.

[0108] It should be noted that the embodiment of the present application does not limit the method for obtaining the sorting results, and the method for obtaining the sorting results can be ascending sorting, descending sorting, etc.

[0109] For example, taking the service parameter as the resource application amount as an example, service A corresponds to the resource application amount (such as 0.85), and service B corresponds to the resource application amount (such as 0.8). When the first sorting result is obtained in ascending order, the services are sorted in ascending order based on the resource application amount (such as 0.85 and 0.8) to obtain an ascending sorting result (that is, the first sorting result is such as [B, A]); or, when the first sorting result is obtained in descending order, the services are sorted in descending order based on the resource application amount (such as 0.85 and 0.8) to obtain a descending sorting result (that is, the first sorting result is such as [A, B]).

[0110] Optionally, each service may be sorted according to the sending time of the authorization request in the service parameters. For example, the services may be sorted in order of sending time from earliest to latest, or the services may be sorted in order of sending time from latest to earliest.

[0111] In step 2023, a first preset number of services in the sorting result are determined as first services.

[0112] The sum of the resource application amounts of the first preset number of services is less than or equal to the available resource amount.

[0113] Exemplarily, when the first preset quantity is 1 and the acquisition method of the first sorting result is ascending sorting, the service that is the last one in the first sorting result (i.e., the ascending sorting result such as [B, A]) (such as A) is determined as the first service; or when the acquisition method of the first sorting result is descending sorting, the service that is the first one in the first sorting result (i.e., the descending sorting result such as [A, B]) (such as A) is determined as the first service.

[0114] In some embodiments, step 2023 may be implemented in the following manner: when the first sorting result is obtained by ascendingly sorting services based on the resource application amount, the following processing is performed on the i-th service in the first sorting result. When the sum of the resource application amounts of the first i services in the first sorting result is less than or equal to the available resource amount and the sum of the resource application amounts of the first i + 1 services in the first sorting result is greater than the available resource amount, the first i services in the first sorting result are determined as the first service, where i is a positive integer that increases sequentially, 1 ≤ i < I, and I is the number of services in the first sorting result; when the sum of the resource application amounts of the first I services in the first sorting result is less than or equal to the available resource amount, the first I services in the first sorting result are determined as the first service.

[0115] Exemplarily, given that the first sorting result is "[Service A, Service B, Service C]", where the resource application amount of Service A is 5G of storage space, the resource application amount of Service B is 25G of storage space, the resource application amount of Service C is 35G of storage space, and the available resource amount is 32G of storage space. Since the sum of the resource application amounts of the first 2 services (such as 30G of storage space) is less than or equal to the available resource amount and the sum of the resource application amounts of the first 3 services in the first sorting result (such as 65G of storage space) is greater than the available resource amount, the first 2 services (such as Service A and Service B) are determined as the first service.

[0116] In some embodiments, step 2023 may also be implemented in the following manner: when the first sorting result is obtained by descendingly sorting services based on the resource application amount, the following processing is performed on the i-th service in the first sorting result. When the sum of the resource application amounts of the last I - i + 1 services in the first sorting result is less than or equal to the available resource amount and the sum of the resource application amounts of the last I - i services in the first sorting result is greater than the available resource amount, the last I - i + 1 services in the first sorting result are determined as the first service, where i is a positive integer that increases sequentially, 1 ≤ i < I, and I is the number of services in the first sorting result; when the sum of the resource application amounts of the first I services in the first sorting result is less than or equal to the available resource amount, the first I services in the first sorting result are determined as the first service.

[0117] For example, given the first sorting result is "[Service A, Service B, Service C]", where the resource application amount of service A is 35G storage space, the resource application amount of service B is 25G storage space, the resource application amount of service C is 5G storage space, and the available resources are 32G storage space. Since the sum of the resource application amounts of the last two services (such as 30G storage space) is less than or equal to the available resources and the sum of the resource application amounts of the last three services in the first sorting result (such as 65G storage space) is greater than the available resources, the last two services (such as service A and service B) are determined as the first service.

[0118] In some embodiments, after step 202, resources of services different from the first service are reclaimed.

[0119] Here, for a service different from the first service, its resources are recycled.

[0120] Here, resources refer to the hardware and software resources on the server that are available to applications and users for server operation and service provision. This application implements no restrictions on resources. Resources can be central processing units, memory, storage resources, network resources, etc. The central processing unit is the brain of the server, used to execute program instructions and process data; memory is a place for temporary storage of data, used to speed up data access and program operation; storage resources are used to store data, such as hard disk drives for long-term data storage devices, solid-state drives for faster data reading and writing, etc.; network resources are used to transmit data, such as ports for data transmission channels for specific services. Resource recycling refers to the process of releasing or reusing already allocated resources on the server, thereby improving resource utilization efficiency and performance and ensuring that resources are used to the maximum extent.

[0121] Through the embodiments of the present application, when the service parameter is the resource application amount, the first service is obtained based on the resource application amount, and the resources are allocated to the service with high resource usage, thereby improving the resource utilization rate. When the service parameter is the sending time of the authorization application request, the first service is obtained based on the sending time of the authorization application request, and the resources are allocated to the priority application service, thereby avoiding the service with low resource usage waiting for authorization for a long time, resulting in the inability to execute the service, thereby affecting the normal development of other services, thereby improving the security of resource allocation.

[0122] In some embodiments, after the step of "determining the machine code of the first service" in step 101, the following processing is performed: when the operating system is accessed by an authorized account, the access permission list set for the operating system is determined, wherein the authorized account is an account that authorizes the first service; when the access permission list includes the authorized account, the operation of encrypting the machine code of the first service by using the first private key corresponding to the service type set in the encryption program is determined.

[0123] Here, the operating system includes hardware resources, software services, and user interfaces, etc. It is used to manage computer hardware resources, provide user interfaces, and provide necessary support for application program operations.

[0124] The operating system accessed by the authorized account is a restricted-access operating system. A restricted-access operating system uses various security mechanisms and policies to limit the access rights of users or applications to protect system resources and data security.

[0125] An encryption program is a software or hardware system used to implement data encryption and decryption, which is used to protect the security and privacy of data and ensure that only authorized users can access it. An access permission list is a list used to define and control the access rights of users or user groups to specific resources. The access permission list includes at least one candidate authorization account.

[0126] In some embodiments, the above-mentioned "when the access permission table includes an authorized account, determining to execute the operation of encrypting the machine code of the first service by using the first private key corresponding to the service type set in the encryption program" can be processed in the following way: query the authorized account in the access permission table, and when the similarity between any candidate authorized account in the access permission table and the authorized account is greater than the similarity threshold, determining to execute the operation of encrypting the machine code of the first service by using the first private key corresponding to the service type set in the encryption program.

[0127] In step 102, the machine code of the first service is encrypted by using the first private key corresponding to the service type set in the encryption program to obtain an authorization file.

[0128] Here, the encryption program runs in an operating system with restricted access, and the machine code of the first service is encrypted by a first private key corresponding to the service type set in the encryption program to ensure the integrity and source authenticity of the machine code of the first service.

[0129] Among them, the first private key must be stored securely to prevent leakage. The authorization file is the encrypted machine code of the first service, which is used to authorize the first service so that the user or system can perform a specific task based on the authorized service. The embodiment of the present application does not limit the form of the authorization file. The authorization file can be a string, a file, etc. In addition, the authorization file can be used in multiple application fields such as software licensing, network access, and cloud service access.

[0130] It should be noted that each service type corresponds to a first private key, and the step of obtaining the first private key corresponding to the service type can be implemented in the following way: determine the first private key corresponding to the service type from the correspondence between the candidate service types and the candidate first private keys.

[0131] For example, from the correspondence between the candidate service types and the candidate first private keys (such as candidate first private key A for candidate service type A, and candidate first private key B for candidate service type B), determine the first private key (such as candidate first private key A) corresponding to the service type (such as candidate service type A).

[0132] In some embodiments, see Figure 3D , Figure 3D is a fourth flow chart of the service authorization method provided in the embodiment of the present application, in Figure 3A Before step 102 shown, execute Figure 3D Steps 301 to 303 in are described in detail below.

[0133] In step 301, the approval object information of the first service is determined according to the service type of the first service, and the first private key identifier of the first service is determined according to the approval object information.

[0134] Here, the approval object information of the first service can be determined according to the service type of the first service, that is, the approval object for approving the first service. The approval object is used to approve services of this service type. The present application embodiment does not limit the approval object, and the approval object can be a robot with approval functions. Approval refers to the process of reviewing and approving a service in service authorization.

[0135] Furthermore, the approval object information can be used to determine the approval object, and can also be used to determine the first private key identifier of the first service. It should be noted that each approval object holds its own first private key identifier. The first private key identifier generally refers to information used to uniquely identify the first private key in a public key cryptographic system. The embodiment of the present application does not limit the information that uniquely identifies the first private key. The information that uniquely identifies the first private key may include the digital signature of the private key, the encryption algorithm identifier, the user identifier, etc.

[0136] In some embodiments, determining the first private key identifier of the first service based on the approval object information can be achieved by: obtaining the object identifier from the approval object information, fusing the object identifier of the approval object with the type identifier of the service type of the first service, and obtaining the first private key identifier of the first service.

[0137] For example, the object identifier of the approval object (such as 10001) and the type identifier of the service type of the first service (such as 10001) are concatenated to obtain the first private key identifier of the first service (such as 1000110001).

[0138] Steps 302 to 303 are executed through the encryption program.

[0139] In step 302, a first private key library of the encryption program is queried according to the first private key identifier.

[0140] The first private key library includes corresponding relationships between different private key identifiers and different private keys.

[0141] Here, the embodiment of the present application does not limit the correspondence between different private key identifiers and different private keys. The correspondence can be that multiple private key identifiers correspond to one private key, or that each private key identifier corresponds to its own private key.

[0142] It should be noted that the first private key library is a data structure for storing the correspondence between a private key identifier and a private key. The embodiment of the present application does not limit the first private key library. The first private key library can be a data structure implemented as a hash table, a data structure implemented as an array, etc., for quickly performing the corresponding relationship between the private key identifier and the private key. Lookup, insertion and deletion operations, wherein the hash table uses a hash function to calculate the index value, and maps the input first private key identifier to the position in the hash table to access the private key. In the case of a private key identifier that matches the first private key identifier, the private key corresponding to the private key identifier that matches the first private key identifier is queried.

[0143] In some embodiments, after step 302, if no private key identifier matching the first private key identifier is found, a first encrypted private key matching the first private key identifier is determined, and a password corresponding to the first encrypted private key is determined.

[0144] Here, each first encrypted private key corresponds to a unique password. The embodiment of the present application does not limit the form of the password, and the password can be a fingerprint, a character string, etc.

[0145] It should be noted that each first private key identifier corresponds to a first encryption private key. The above-mentioned "determining the first encryption private key corresponding to the first private key identifier" can be implemented in the following way: determine the first encryption private key corresponding to the first private key identifier from the correspondence between the candidate private key identifiers and the candidate encryption private keys.

[0146] For example, from the correspondence between the candidate private key identifiers and the candidate encryption private keys (such as candidate encryption private key A of candidate private key identifier A, and candidate encryption private key B of candidate private key identifier B), the first encryption private key (such as candidate encryption private key A) corresponding to the first private key identifier (such as candidate private key identifier A) is determined.

[0147] In some embodiments, Figure 3D After step 302 shown, the following processing is performed: if a private key identifier matching the first private key identifier is not queried in the first private key library, then a query is made in the second private key library based on the first private key identifier, wherein the second private key library includes a correspondence between private key identifiers and encrypted private keys; if a private key identifier matching the first private key identifier is queried in the second private key library, then the encrypted private key corresponding to the matching private key identifier in the second private key library is determined as the first encrypted private key; the first encrypted private key is decrypted to obtain the first private key.

[0148] Here, the embodiment of the present application does not limit the correspondence between different private key identifiers and different encryption private keys. The correspondence can be that multiple private key identifiers correspond to one encryption private key, or that each private key identifier corresponds to its own encryption private key.

[0149] It should be noted that the second private key library includes a correspondence between multiple private key identifiers and encrypted private keys. When the similarity between any private key identifier in the second private key library and the first private key identifier is greater than a similarity threshold, any private key identifier is determined as a private key identifier corresponding to the first private key identifier, and when a private key identifier corresponding to the first private key identifier is queried, the encrypted private key corresponding to the private key identifier that matches the first private key identifier is determined as the first encrypted private key.

[0150] In some embodiments, the above-mentioned "decrypting the first encrypted private key based on the password of the first encrypted private key to obtain the first private key" can be implemented in the following way: obtaining the encryption method corresponding to the first encrypted private key, decrypting the first encrypted private key based on the encryption method and the password to obtain the first private key, wherein the encryption method is used to execute the step of encrypting the first private key based on the password to obtain the first encrypted private key.

[0151] It should be noted that the embodiments of the present application do not limit the encryption method, and the encryption method may be Advanced Encryption Standard (AES), Data Encryption Standard (DES), etc.

[0152] For example, the first encrypted private key (such as "DE") is decrypted based on the encryption method (such as the Advanced Encryption Standard) and the password (such as "Q1") to obtain the first private key (such as "SA") corresponding to the service type.

[0153] Through the embodiments of the present application, since the same first private key is used for encryption, the security of authorization is reduced. By matching the corresponding first encryption private key to the service type, multiple encryption of the first service based on different first private keys is avoided while ensuring the security of authorization, thereby improving the efficiency of service authorization. In addition, by encrypting the first private key, the security of service authorization is improved.

[0154] In step 303, if a private key identifier matching the first private key identifier is found in the first private key library, the private key corresponding to the matching private key identifier is determined as the first private key.

[0155] For example, private key A of private key identifier A is determined, private key B of private key identifier B is determined, and the private key (such as private key A) corresponding to the queried private key identifier (such as private key identifier A) that matches the first private key identifier is determined as the private key corresponding to the first private key identifier.

[0156] In some embodiments, before "if a private key identifier matching the first private key identifier is queried in the first private key library" in step 303, the following processing is performed: for each private key identifier in the first private key library, if the similarity between the first private key identifier and the private key identifier in the first private key library is greater than a threshold, the private key identifier is determined as a private key identifier matching the first private key identifier.

[0157] For example, when the similarity (such as 0.95) between a first private key identifier (such as 1000110001 used to characterize a bird image processing type) and a private key identifier (such as 1000110002 used to characterize an eagle image processing type) is greater than a similarity threshold (such as 0.85), the private key identifier is determined to be a queried private key identifier that matches the first private key identifier.

[0158] In some embodiments, Figure 3A The illustrated step 102 may be implemented through steps 1021 to 1023, which are described in detail below.

[0159] In step 1021, the machine code of the first service is divided into plain texts to obtain a plurality of plain texts.

[0160] Here, the plaintext division processing performed on the machine code of the first service may be uniform plaintext division, non-uniform plaintext division, etc. The machine code is divided into different plaintexts through different plaintext division methods.

[0161] It should be noted that plain text refers to original, unencrypted information (ie, the machine code of the first service after plain text segmentation processing), that is, a user-readable form. In the encryption process, plain text is input, that is, information to be protected.

[0162] For example, the machine code of the first service (such as a machine code of 128 bytes) is evenly divided into plaintexts of 64 bytes to obtain the first plaintext with index byte subscripts from 0 bytes to 63 bytes and the second plaintext with index byte subscripts from 64 bytes to 127 bytes in the machine code of the first service. The machine code of the first service (such as a machine code of 128 bytes) is unevenly divided into plaintexts to obtain the first plaintext with index byte subscripts from 0 bytes to 31 bytes in the machine code of the first service, the second plaintext with index byte subscripts from 32 bytes to 63 bytes and the third plaintext with index byte subscripts from 64 bytes to 127 bytes.

[0163] In step 1022, each plaintext is encrypted based on the first private key to obtain a ciphertext.

[0164] It should be noted that ciphertext is the result of plaintext being processed by an encryption algorithm. It is a disguised form that cannot be understood by unauthorized users. Ciphertext is the output of encryption and is used to securely transmit information over untrusted networks or storage media.

[0165] In some embodiments, the embodiments of the present application do not limit the step encryption processing process. The encryption processing can be weighted summing of the first private key and each plaintext, concatenating the first private key and each plaintext, etc.

[0166] In some embodiments, step 1022 can be implemented in the following manner: for each plaintext, data processing is performed on the first private key and the plaintext to obtain an initial ciphertext; byte substitution is performed on the initial ciphertext to obtain a substituted ciphertext; shift processing is performed on the substituted ciphertext to obtain a shifted ciphertext; data processing is performed on the first private key and the shifted ciphertext to obtain a ciphertext.

[0167] In some embodiments, the present application embodiment does not limit the data processing method for processing the first private key and the plain text. The data processing may be XOR processing, weighted sum processing, etc.

[0168] Following the above embodiment, performing byte substitution processing on the initial ciphertext to obtain the substituted ciphertext can be achieved in the following manner: performing the following processing on each ciphertext in the initial ciphertext to determine the replacement ciphertext corresponding to the ciphertext; combining each replacement ciphertext to obtain the substituted ciphertext.

[0169] For example, determine the replacement ciphertext (such as the ciphertext "SL" of "QA"; such as the ciphertext "S5" of "Q1") corresponding to each ciphertext in the initial ciphertext (such as "QA Q1"); combine each replacement ciphertext (such as "SL" and "S5") to obtain the substitution ciphertext (such as "SLS5").

[0170] Continuing from the above embodiment, shifting the substitution ciphertext to obtain the shifted ciphertext can be achieved in the following manner: obtaining a shift sequence (such as "120"), wherein the characters in the shift sequence are index subscripts of the substitution ciphertext block; performing the following processing on each character in the shift sequence: determining the ciphertext (such as "A") corresponding to the character (such as 1) in the substitution ciphertext (such as "QAW") as the shifted ciphertext; combining each shifted ciphertext to obtain the shifted ciphertext (such as "AWQ").

[0171] Following the above embodiment, the step of performing data processing on the first private key and the shifted ciphertext to obtain the ciphertext is similar to the step of performing data processing on the first private key and the plaintext to obtain the ciphertext, and will not be repeated here.

[0172] In step 1023, multiple ciphertexts are combined to obtain an authorization file.

[0173] For example, multiple ciphertexts (such as "SL" and "S5") are combined to obtain an authorization file (such as "SLS5").

[0174] Through the embodiment of the present application, the plaintext is encrypted based on the first private key, thereby improving the security of service authorization.

[0175] In step 103, the validity period of the authorization file is determined, and based on the validity period of the authorization file, the authorization file is updated to obtain an updated authorization file.

[0176] Here, the validity period of the authorization file refers to the period of time during which the authorization file is valid. The length of the validity period depends on the type of authorization file, related agreements and policies. The validity period of the authorization file is to manage and control the use of licenses or permissions, and to ensure that users use services or software legally within the prescribed time frame; the validity period of the authorization file is a preset time period (such as 30 days) starting from the time when the authorization file is generated.

[0177] It should be noted that within the validity period of the authorization document, the first service is authorized through the authorization document. Within or outside the validity period of the authorization document, the first service cannot be authorized. Taking the validity period of the authorization document as 30 days after the authorization document is generated as an example, the first service can be authorized through the authorization document within 30 days after the generation time point corresponding to the generation of the authorization document (such as "20140505", where "20140506" is used to represent the time point of receiving the authorization application request as May 5, 2014).

[0178] In some embodiments, Figure 3A The illustrated step 103 may be implemented through steps 1031 to 1033, which are described in detail below.

[0179] In step 1031, the time point of receiving the authorization request for the first service is determined.

[0180] In some embodiments, determining the time point of receiving the authorization request of the first service may be achieved in the following manner: in response to the authorization request of the first service, determining the time point of receiving the authorization request as the receiving time point.

[0181] For example, in response to the authorization request of the first service, the time point of receiving the authorization request (such as "20140506", where "20140506" is used to represent the time point of receiving the authorization request as May 6, 2014) is determined as the receiving time point.

[0182] In step 1032, when the receiving time point is not within the validity period of the authorization file, the authorization file is updated to obtain an updated authorization file.

[0183] It should be noted that the receiving time point is not within the validity period of the authorization file, that is, the authorization file has expired, and the first service cannot be authorized based on the authorization file. It is necessary to re-acquire the authorization file based on the first private key and the machine code of the first service, that is, update the authorization file to obtain an updated authorization file.

[0184] In some embodiments, updating the authorization file to obtain an updated authorization file can be achieved in the following manner: in response to an authorization file update request, encrypting the machine code of the first service based on the first private key to obtain an updated authorization file, wherein the validity period of the updated authorization file is a preset time period (e.g., 30 days) starting from the generation time point (e.g., "20140506") corresponding to the generation of the authorization file after the update request time point (e.g., "20140506") of the authorization file.

[0185] Continue to see Figure 3A In step 104, the first service is authorized based on the updated authorization file.

[0186] In some embodiments, step 104 may be implemented in the following manner: in response to an update operation of the authorization file, authorizing the first service based on the updated authorization file.

[0187] In some embodiments, before step 104, the following processing is performed: when the first service meets the authorization condition, determine to execute the authorization processing of the first service based on the updated authorization file; wherein the service includes a first service and a second service, and the authorization condition includes one of the following: the second service includes an authorization file; the authorization file of the second service is within the validity period.

[0188] It should be noted that the first service and the second service are sub-services of the service. The service usually refers to those services that have not been authorized in permission management and access control. The first service and the second service are more specific service items or functional modules in the service. If the authorization file of the second service is not determined, the authorization process for the first service based on the updated authorization file will not be executed to avoid affecting the operation of the first service due to the unverified second service. If the authorization file of the second service is determined, even if the authorization file of the second service is not within the validity period, the second service is a verified functional module, and the operation of authorizing the second service will not be executed. The authorization process for the first service based on the updated authorization file can be executed.

[0189] Through the embodiment of the present application, the authorization file is automatically reloaded when an update of the authorization file is detected.

[0190] In some embodiments, after step 105, the resource application amount of the first service is obtained; and the resources corresponding to the resource application amount are sent to the first service, so that the first service provides service based on the resources.

[0191] It should be noted that the resource application amount is the number of resources applied for. The resources are used to support the normal operation and functions of the service. The embodiment of the present application does not limit the type of resources. The resources can be computing resources (such as CPU, memory, network resources (such as specific network bandwidth and Internet Protocol (IP) address), storage resources (such as disk space), etc.

[0192] For example, taking the first service as an image processing service, the resource application amount (such as 1G computing power) of the first service (such as image processing service) is obtained; the resources corresponding to the resource application amount are sent to the first service, so that the first service performs services (such as image processing) based on the resources.

[0193] The following describes an exemplary application of the service authorization method provided in an embodiment of the present application in an actual application scenario.

[0194] In the related technology, since the authorized applications belong to different products and business lines, they are encrypted with only the same private key, which reduces the security of authorization. By cracking the unique private key, security risks can be created for different products and business lines at the same time. In order to improve the security of authorization, multiple private keys are required to encrypt the application multiple times, which reduces the authorization efficiency.

[0195] In order to solve the above problems, an embodiment of the present application proposes a service authorization method, which improves the authorization efficiency while ensuring the security of the authorization.

[0196] Take service authorization as an example, see Figure 4 , Figure 4 is a schematic diagram of the network architecture of the license server 401 provided in the embodiment of the present application. Figure 4 middle, Figure 4 It includes multiple modules for service authorization in the embodiment of the present application, such as a machine code collection module 402, a license server storage module 403 and other modules. The multiple modules for service authorization provided in the embodiment of the present application are explained below.

[0197] The machine code collection module 402 is used to obtain the machine code of the service. The process of obtaining the machine code of the service provided in the embodiment of the present application is explained below.

[0198] The system serial number / central processing unit identity document (CPUID) of the license server host is used as the machine code, wherein the system serial number / CPUID can be obtained through a command or by reading a system file. To increase confidentiality and prevent users from inferring the composition of the machine code, the obtained machine code is encrypted with a private key to obtain an authorization file.

[0199] The license server storage module 403 is used to store information in the license server, such as a public key, a private key, a machine code, and an authorization file.

[0200] The following is an explanation of the process of the service authorization method provided in the embodiment of the present application in combination with the above modules.

[0201] In step 1, submit an authorization application to the authorization platform.

[0202] Here, the authorization application 404 includes the service name (such as service A), the service type (such as v1.1), the concurrency (such as 100), the authorization validity period (such as permanent validity), and the machine code obtained from the machine code collection module 402 (such as device serial number 1), and the authorization application 405 includes the service name (such as service D), the service type (such as v1.1), the concurrency (such as 100), the authorization validity period (such as permanent validity), and the machine code obtained from the machine code collection module 402 (such as device serial number 2).

[0203] The authorization application 404 sends the acquired machine code to the authorization website to apply for authorization, and specifies the corresponding approval object according to the service type required by the service (i.e., the first service) (for example, the service type corresponding to the version number of the service) when applying for authorization. The approval object can be a machine object that approves the service. When an authorization application (i.e., authorization request) for the service is received, approval processing is performed on the service.

[0204] In step 2, generate the authorization file.

[0205] Here, in response to the application authorization request for the service, based on each approval object (such as Figure 4 The private keys (private_key) of approval object 1 and approval object 2 (i.e., the objects of the service of the approval service type) (such as Figure 4 The private key 1 and the private key 2 in the authorization file 406, i.e., the first private key) generate an authorization file of the corresponding service type (such as the authorization file 1 in the authorization file 406 and the authorization file 2 in the authorization file 407), wherein the private key of the approval object is encrypted based on the password by an offline encryption operation (such as the Advanced Encryption Standard method), and the encrypted private key (such as Figure 4 The encrypted private key 1 and the encrypted private key 2 (i.e., the first encrypted private key) in the authorization website are stored. In response to the application authorization request for the service, the service is approved. During the approval process, the password corresponding to the approval object is obtained, and the encrypted private key of the approval object is automatically decrypted based on the password. The machine code is encrypted based on the decrypted private key to generate an authorization file. This ensures the security of the private key and simplifies the approval operation of the approval object. In addition, after each approval object is approved, an independent authorization file will be generated, which can be loaded separately, and the deployment and debugging of the service can be started.

[0206] In step 3, the authorization file (eg, authorization file 1, authorization file 2) is downloaded from the authorization platform.

[0207] Here, the authorization file is downloaded from the authorization platform to the license server 401 .

[0208] After step 3, the license server 401 will identify the changes of the files under the authorization directory, wherein the authorization directory is used to store the index of the authorization files under the license server, and the license server is used to store the authorization files. After the second approval object is approved, the corresponding second authorization file will be generated. After the second authorization file is generated, the second authorization file is uploaded to the license server. When there are multiple authorization files, each authorization file will be loaded one by one based on the corresponding public key (publice_key), and the loading process is the process of decrypting the authorization file based on the public key.

[0209] After the service updates the authorization file, it uploads the updated authorization file to the license server. The license server will detect the update of the authorization file and automatically reload the updated authorization file (without restarting the service). The loading process is the process of decrypting the authorization file to obtain the decrypted machine code and the authorization type corresponding to the authorization file, so as to verify the authorized service based on the decoded machine code and the authorization type corresponding to the authorization file. Since the public keys of different authorization files are different, and each public key corresponds to a unique private key, the impact of key leakage is greatly reduced. After the private key corresponding to each approval object is encrypted, the encrypted private key is saved on the authorization website. After the public key is encrypted, the encrypted public key is stored on the license server. To ensure security, the encrypted file (i.e., the encrypted public key and private key) can be updated periodically. In addition, since the public key and private key have corresponding validity periods, they can be replaced periodically.

[0210] To avoid problems such as container drift, deploy the centralized authorization service on a separate physical machine (or bind the service to the physical machine), see Figure 5 , Figure 5 Schematic diagram of the license client network architecture provided by the embodiment of the present application. Figure 5 As shown, the license client network architecture includes a primary license server 501 , an auxiliary license server 502 , and license clients 503 to 505 .

[0211] Among them, the main license server 501 (License Server Master) is a key component in the license management system, which is responsible for managing and distributing authorization files to license clients 503 to 505. The auxiliary license server 502 (License Server Slave) is a component in the license management system, which is used to assist the main license server in managing and distributing authorization files to license clients 503 to 505. In the master-slave architecture, the role of the auxiliary server is to take over the license service when the main server fails to ensure the continuity of the service. The license clients 503 to 505 (LicenseClient) refer to computers or devices that have software (i.e., services) installed and need to access authorization files to legally run the software. The license clients 503 to 505 run the services installed on the license clients 503 to 505 based on the authorization files distributed by the main license server 501 or the auxiliary license server 502.

[0212] After placing the authorization file corresponding to each service to be authorized on the license server, see Figure 6 , Figure 6 This is a file authorization flow chart provided in an embodiment of the present application. The file authorization process is described in detail below.

[0213] In step 601, authorization is performed for services based on the total amount of resources.

[0214] Here, all services in the system initiate authorization requests to the license server, which is responsible for controlling the total amount of resources and authorizing each service based on resource usage. For example, in the authorization file, the Automatic Speech Recognition (ASR) service supports a total of 100 concurrent requests. Four ASR services initiate authorization requests to the license server, and the resources required for each ASR service in the authorization request are 30 concurrent requests. The concurrent request is used to represent the number of requests that the service can process at the same time. The first three requests will be authorized successfully, and the fourth request will fail to be authorized due to insufficient resources.

[0215] In step 602, resources are recycled.

[0216] Here, each application (i.e., the first service) periodically sends heartbeats (i.e., heartbeat information) to the license server. When three heartbeats are lost, the license server will reclaim the resources applied for by this node (i.e., the successfully authorized application). After the container drifts, it only needs to wait for three heartbeats to apply for resources again. This solution solves the problem of invalid authorization after container drift. In cloud computing and containerization technology, container drift refers to the gradual change of container configuration and status. These changes may not be monitored or recorded, resulting in the behavior of the container being different from the expected configuration. When container drift occurs, each application domain license server loses connection, resulting in the inability to recycle resources. This drift may be caused by various reasons, such as manual changes, incorrect updates of configuration files, differences between environments, incorrect execution of automated scripts, etc.

[0217] In step 603, resources are dynamically allocated.

[0218] Here, since the performance of the servers where each application is located may be different, the processing capabilities of different nodes of the same service are different. It is unreasonable for each application to apply for a fixed amount of resources (i.e., the amount of resource application) according to the configuration file or other methods. Applying for an average amount of resources for nodes with weaker processing capabilities will lead to resource waste, and applying for an average amount of resources for nodes with higher processing capabilities will lead to idle processing capabilities. When each application sends a heartbeat to the license server regularly, it can adjust the requested resources by carrying the requested number of resources. The specific adjustment method can be calculated based on the current usage (i.e., the amount of resources used), such as applying for 1.2 times the current usage; or applying for resource expansion when the usage reaches 80% of the currently applied resources, and applying for resource contraction when the usage reaches 60% of the currently applied resources. The license server will record the resource application status of each node and dynamically reallocate it according to the resource request carried in the heartbeat.

[0219] In summary, when applying for authorization, the embodiment of the present application specifies the corresponding approval object according to the required service type, and each approval object uses its own private key to generate an authorization file of the corresponding service type. Each authorization file can be loaded independently, so that the deployment and debugging of the service can be started after an approval object is approved, and there is no need to wait for all approval objects to be approved; each approval object has its own independent private key and public key, and the private key and public key of the approval object can be updated periodically, which greatly reduces the impact of key leakage; the license server will automatically reload the authorization file when it detects an update to the authorization file (without restarting the service); it supports dynamic adjustment of the number of authorized resources for each node; when each application sends a heartbeat to the license server regularly, it can adjust the requested resources by carrying the number of requested resources, and record the resource application status of each node and dynamically reallocate them according to the resource request carried in the heartbeat.

[0220] The following is a description of an exemplary structure of the service authorization device 555 provided in the embodiment of the present application implemented as a software module. In some embodiments, for example, Figure 2 As shown, the software modules stored in the service authorization device 555 of the memory 550 may include:

[0221] The data collection module 5551 is used to determine the machine code of the first service and the service type of the first service in response to an authorization request for the first service.

[0222] The encryption module 5552 is used to encrypt the machine code of the first service by using the first private key corresponding to the service type set in the encryption program to obtain an authorization file.

[0223] The authorization module 5553 is used to determine the validity period of the authorization file, and based on the validity period of the authorization file, update the authorization file to obtain an updated authorization file; and authorize the first service based on the updated authorization file.

[0224] An embodiment of the present application provides a computer program product, which includes computer executable instructions. The computer executable instructions are stored in a computer-readable storage medium. A processor of an electronic device reads the computer executable instructions from the computer-readable storage medium, and the processor executes the computer executable instructions, so that the electronic device executes the service authorization method described above in the embodiment of the present application.

[0225] The embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions or computer programs are stored. When the computer-executable instructions or computer programs are executed by a processor, the processor will be caused to execute the service authorization method provided by the embodiment of the present application, for example, FIG. 3A to FIG. 3D The service authorization method shown.

[0226] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or may be various devices including one or any combination of the above memories.

[0227] In some embodiments, computer executable instructions may be in the form of a program, software, software module, script or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine or other unit suitable for use in a computing environment.

[0228] As an example, computer-executable instructions may, but need not, correspond to a file in a file system, may be stored as part of a file that stores other programs or data, such as in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions).

[0229] As an example, computer executable instructions may be deployed to be executed on one electronic device, or on multiple electronic devices located at one site, or on multiple electronic devices distributed at multiple sites and interconnected by a communication network.

[0230] In summary, the embodiment of the present application can determine the machine code of the first service and the service type of the first service, and encrypt the machine code of the first service through the first private key corresponding to the service type set in the encryption program to obtain an authorization file. In this way, it is avoided to encrypt the machine code of services of different service types only through a unique private key. Since the encryption method of encrypting through a unique private key increases the risk of services of different service types being cracked at the same time, under the condition of ensuring the security of service authorization, the method of determining the corresponding private key based on the service type of the service is adopted, and there is no need to improve the security of service authorization through multiple encryptions, thereby improving the authorization efficiency. At the same time, encryption through the first private key in the encryption program can further improve the security of service authorization. In addition, the validity period of the authorization file is determined, and based on the validity period of the authorization file, the authorization file is updated to obtain an updated authorization file, the timeliness of the authorization file is maintained, and the potential risks caused by expired authorization files are avoided, thereby improving the security of service authorization.

[0231] The above is only an embodiment of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. A service authorization method, characterized in that: The method comprises: In response to an authorization request for a first service, determining a machine code of the first service and a service type of the first service; The machine code of the first service is encrypted by using a first private key corresponding to the service type set in the encryption program to obtain an authorization file; Determine the validity period of the authorization document, and based on the validity period of the authorization document, update the authorization document to obtain an updated authorization document; The first service is authorized based on the updated authorization file.

2. The method according to claim 1, characterized in that Before encrypting the machine code of the first service by using the first private key corresponding to the service type set in the encryption program to obtain the authorization file, the method further includes: Determine the approval object information of the first service according to the service type of the first service, and determine the first private key identifier of the first service according to the approval object information; The following processing is performed by the encryption program: Querying a first private key library of the encryption program according to the first private key identifier, wherein the first private key library includes a correspondence between private key identifiers and private keys; If a private key identifier matching the first private key identifier is found in the first private key library, the private key corresponding to the matching private key identifier is determined as the first private key.

3. The method according to claim 2, characterized in that After querying the first private key library of the encryption program according to the first private key identifier, the method further includes: If a private key identifier matching the first private key identifier is not found in the first private key library, querying in a second private key library according to the first private key identifier, wherein the second private key library includes a correspondence between private key identifiers and encrypted private keys; If a private key identifier matching the first private key identifier is found in the second private key library, the encrypted private key corresponding to the matching private key identifier in the second private key library is determined as the first encrypted private key; The first encrypted private key is decrypted to obtain the first private key.

4. The method according to claim 2, characterized in that: If before the first private key library finds a private key identifier that matches the first private key identifier, the method further includes: For each private key identifier in the first private key library, if the similarity between the first private key identifier and the private key identifiers in the first private key library is greater than a threshold, the private key identifier is determined as a private key identifier that matches the first private key identifier.

5. The method according to claim 1, characterized in that The service includes the first service and the second service. Before authorizing the first service based on the updated authorization file, the method further includes: In a case where the first service meets the authorization condition, determining to execute a process of authorizing the first service based on the updated authorization file; The authorization condition includes one of the following: the second service includes an authorization document; the authorization document of the second service is within the validity period.

6. The method according to claim 1, characterized in that The first service is determined by: Determine the amount of available resources; The first service is determined from a plurality of services based on the available resource amount.

7. The method according to claim 6, characterized in that The determining the first service from a plurality of services based on the available resource amount comprises: Determine a service parameter corresponding to each service, wherein the service parameter includes a resource application amount or a sending time of the authorization request; Sorting the multiple services based on the service parameters to obtain a sorting result; Determine a first preset number of services in the sorting result as the first service, wherein a sum of resource application amounts of the first preset number of services is less than or equal to the available resource amount; After determining the first service from a plurality of services based on the available resource amount, the method further includes: Resources of a service different from the first service are reclaimed.

8. The method according to claim 1, characterized in that The encryption program runs in the operating system with restricted access; After determining the machine code of the first service, the method further includes: In a case where the operating system is accessed by an authorized account, determining an access permission table set for the operating system, wherein the authorized account is an account that authorizes the first service; In a case where the access permission table includes the authorized account, it is determined to execute an operation of encrypting the machine code of the first service by using a first private key corresponding to the service type set in an encryption program.

9. An electronic device, characterized in that: The electronic device comprises: A memory for storing computer executable instructions; The processor is used to implement the service authorization method described in any one of claims 1 to 8 when executing the computer executable instructions or computer programs stored in the memory.

10. A computer-readable storage medium storing computer-executable instructions or a computer program, characterized in that: The computer executable instructions or computer program, when executed by a processor, implements the service authorization method described in any one of claims 1 to 8.

Images