Authorization method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses an authorization method and device, a nonvolatile storage medium and electronic equipment. The method comprises the steps that a unique identification code of an authorization service container in a private network is acquired, and the authorization service container comprises an authorization service instance to be authorized and verified; generating an authorization file according to the unique identification code and the configuration information of the target object; encrypting the authorization file; the encrypted authorization file is sent to the authorization service container, the authorization service instance is used for reading and verifying the authorization file, and the authorization service instance is activated under the condition that it is determined that the authorization file passes verification. The technical problem that authorization verification cannot be carried out in a virtualization environment due to the fact that verification is carried out through hardware information such as a media access control address in a traditional authorization mode is solved.

Description

Technical Field

[0001] The present application relates to the field of atomic capability deployment, and more specifically, to an authorization method, device, non-volatile storage medium, and electronic device. Background Art

[0002] With the continuous development of the Internet, network security issues have become a hot topic, and various network security issues have emerged one after another. Therefore, many companies will choose to build their own ecosystems in the intranet environment, resulting in an increasing demand for local deployment of atomic capability services. The local deployment of atomic capability services requires a complete authorization mechanism to limit user usage, including restrictions on the number of concurrent users, duration, validity period, etc. As virtualization technology has become very mature, the environmental deployment of many projects will rely on virtualization platforms. The traditional license authorization method is to deploy it on a physical machine and verify the machine's mac address (media access control address) and other hardware information. This method can no longer meet the needs of virtualization.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide an authorization method, device, non-volatile storage medium and electronic device to at least solve the technical problem that authorization verification cannot be performed in a virtualized environment due to the traditional authorization method that verifies hardware information such as a media access control address.

[0005] According to one aspect of an embodiment of the present application, an authorization method is provided, including: obtaining a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; generating an authorization file based on the unique identification code and configuration information of a target object; encrypting the authorization file; sending the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification has passed.

[0006] Optionally, after activating the authorization service instance, the authorization method further includes: the authorization service container starts a first transmission protocol service, and uses the first transmission protocol service to receive data uploaded by a target atomic capability service, wherein the target atomic capability service is an atomic capability service bound to the authorization service instance.

[0007] Optionally, obtaining the unique identification code of the authorization service container in the private network includes: starting the authorization service container based on the authorization service image, wherein the authorization service container is used to generate a unique identification code after startup, and starting a second transmission protocol service, the second transmission protocol service is used to provide a transmission protocol interface for obtaining the unique identification code; obtaining the unique identification code through the transmission protocol interface.

[0008] Optionally, obtaining a unique identification code through a transmission protocol interface includes: obtaining a network status statistics instruction input by the target object, wherein the network status statistics instruction is used to instruct the retrieval of the transmission protocol interface; after retrieving the transmission protocol interface according to the network status statistics instruction, obtaining the unique identification code through the transmission protocol interface.

[0009] Optionally, the authorization method further includes: the authorization service instance determines whether there is an authorization file at a preset location of the container by querying, until it is confirmed that there is an authorization file at the preset location.

[0010] Optionally, the authorization service container is also used to store a unique identification code; the authorization method also includes: decrypting the authorization file and extracting the unique identification code in the authorization file; comparing whether the extracted unique identification code is consistent with the stored unique identification code, and determining that the authorization file verification is passed if they are consistent.

[0011] Optionally, the configuration information includes at least one of the following: user identification, user key, user service name, user service identification, concurrent number limit agreed with the user, time limit agreed with the user, validity period limit agreed with the user.

[0012] According to another aspect of an embodiment of the present application, an authorization device is also provided, including: a first processing module, used to obtain a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; a second processing module, used to generate an authorization file based on the unique identification code and configuration information of the target object; a third processing module, used to encrypt the authorization file; and a fourth processing module, used to send the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification has passed.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute an authorization method.

[0014] According to another aspect of an embodiment of the present application, there is further provided an electronic device, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the authorization method is executed when the program is run.

[0015] According to another aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, and the computer program implements the authorization method when executed by a processor.

[0016] In an embodiment of the present application, a unique identification code of an authorization service container in a private network is obtained, wherein the authorization service container includes an authorization service instance to be authorized and verified; an authorization file is generated based on the unique identification code and configuration information of the target object; the authorization file is encrypted; and the encrypted authorization file is sent to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and when it is determined that the authorization file verification has passed, the authorization service instance is activated. The validity of the license authorization file is checked through the uuid generated by the authorization service container line in the virtual machine, thereby achieving the purpose of uniquely identifying each virtual container, thereby realizing the technical effect of locally deploying authorization services in a virtualized environment, and further solving the technical problem that the traditional authorization method cannot perform authorization verification in a virtualized environment due to verification through hardware information such as the media access control address. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a structural schematic diagram of a computer terminal provided according to an embodiment of the present application;

[0019] Figure 2 It is a flowchart of an authorization method provided according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of an authorization process provided according to an embodiment of the present application;

[0021] Figure 4 It is a structural diagram of an authorization device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0025] License authorization: A contractual form in which a supplier and a customer authorize the scope and duration of use of the product they sell or purchase. Through the license, the customer obtains the corresponding service promised by the supplier. The main purpose of the license is to control the use rights of the software.

[0026] Boost library: Boost library is a general term for some C++ libraries that provide extensions to the C++ language standard library. It is developed and maintained by the Boost community. Boost library can work perfectly with the C++ standard library and provide extended functions for it.

[0027] uuid (Universally Unique Identifier): is a 128-bit identifier used to identify information in computer systems. When UUID is generated according to standard methods, it is unique in practical applications and does not rely on registration and allocation by a central agency. The probability of duplication of UUID is close to zero and can be ignored. Therefore, everyone can create and use UUID by themselves, and it is almost certain that it will not be repeated with existing identifiers. Because of this, UUIDs generated in different places can be used in the same database or the same channel, and it is almost impossible to repeat.

[0028] With the continuous development of the Internet, network security issues have become more and more prominent. Therefore, many companies will choose to build their own ecosystems in the intranet environment, resulting in more and more demands for local deployment of atomic capability services. Local deployment of atomic capability services requires a complete authorization mechanism to limit user usage, including restrictions on the number of concurrent users, duration, validity period, etc. As virtualization technology has become very mature, the environment deployment of many projects will rely on virtualization platforms. The traditional license authorization method is to deploy to a physical machine and verify the machine's mac address and other hardware information. This method can no longer meet the needs of virtualization.

[0029] In order to solve this problem, a relevant solution is provided in the embodiments of the present application, which is described in detail below.

[0030] According to an embodiment of the present application, a method embodiment of an authorization method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing the authorization method. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0033] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the authorization method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, to implement the above-mentioned authorization method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0034] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0035] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0036] In the above operating environment, the present application embodiment provides an authorization method, such as Figure 2 As shown, the method comprises the following steps:

[0037] Step S202: Acquire a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified.

[0038] Optionally, obtaining the unique identification code of the authorization service container in the private network includes: starting the authorization service container based on the authorization service image, wherein the authorization service container is used to generate a unique identification code after startup, and starting a second transmission protocol service, the second transmission protocol service is used to provide a transmission protocol interface for obtaining the unique identification code; obtaining the unique identification code through the transmission protocol interface.

[0039] Optionally, obtaining a unique identification code through a transmission protocol interface includes: obtaining a network status statistics instruction input by the target object, wherein the network status statistics instruction is used to instruct the retrieval of the transmission protocol interface; after retrieving the transmission protocol interface according to the network status statistics instruction, obtaining the unique identification code through the transmission protocol interface.

[0040] Optionally, the target object may be a user or an operation and maintenance personnel.

[0041] Optionally, starting the authorization service container according to the authorization service image includes:

[0042] 1) An authorization service container is started based on the authorization service image. The authorization service image does not contain the authorization file. After the container is started, the authorization service still cannot be called normally for effective monitoring and verification and is in the authorization verification stage.

[0043] 2) After the authorization service container is started, it will call the method provided by the boost library to generate a uuid (Universally Unique Identifier) ​​to generate a uuid (i.e. unique identifier).

[0044] 3) Cache the uuid to memory for the user or operation and maintenance personnel to obtain and subsequently verify the license authorization file.

[0045] 4) The service hangs up and waits for the generated license file to be read.

[0046] Optionally, obtaining a unique identification code of the authorization service container in the private network includes:

[0047] 1) The authorization service container provides an http interface to the user:

[0048] 2) When the container starts, an http service (second transport protocol service) is started in the background to implement the http interface for obtaining uuid provided to users;

[0049] 3) The user checks that the background HTTP service is successfully started, and checks the specific port (transmission protocol interface) through the netstat-nltp command (network status statistics command);

[0050] 4) Call the specified http interface to return the generated uuid.

[0051] Step S204: Generate an authorization file based on the unique identification code and the configuration information of the target object.

[0052] Optionally, the configuration information includes at least one of the following: user identification, user key, user service name, user service identification, concurrent number limit agreed with the user, time limit agreed with the user, validity period limit agreed with the user.

[0053] Optionally, generating an authorization file according to the unique identification code and the configuration information of the target object includes:

[0054] After the user obtains the unique identification code through the second transmission protocol service, an authorization file is generated in the authorization service container. The license file information is stored in the toml format, where the specific information includes user_id: user id (i.e. user identification), secret_key: the key assigned to the current user (i.e. user key), server_name: service name under the current user (i.e. user service name), server_id: service id under the current user (i.e. user service identification), instance_uuid: uuid (i.e. unique identification code) generated internally by the license service obtained by calling the specified http interface, concurrent_num_threshold: the concurrent number limit agreed with the user (i.e. the concurrent number limit agreed with the user), audio_duration_threshold: the duration limit agreed with the user (i.e. the duration limit agreed with the user), live_time: the validity period limit agreed with the user (i.e. the validity period limit agreed with the user). In addition to the above configurations, other parameters can be added according to your business needs.

[0055] Step S206, encrypting the authorization file.

[0056] Optionally, after configuring the plain text license file, to prevent configuration information from being tampered with in the user's private environment, the license file needs to be encrypted using the OpenSSL AES-256-CBC encryption method.

[0057] Step S208: Send the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification passes.

[0058] Optionally, upload the generated license file (authorization file) to the container (authorization service container) corresponding to the started license service (authorization service instance).

[0059] Optionally, the authorization method further includes: the authorization service instance determines whether there is an authorization file at a preset location of the container by querying, until it is confirmed that there is an authorization file at the preset location.

[0060] Optionally, the license service that has been started polls to read the license file, and stops polling after reading the license file.

[0061] Optionally, the authorization service container is also used to store a unique identification code; the authorization method also includes: decrypting the authorization file and extracting the unique identification code in the authorization file; comparing whether the extracted unique identification code is consistent with the stored unique identification code, and determining that the authorization file verification is passed if they are consistent.

[0062] Optionally, the authorization service instance decrypts the authorization file according to OpenSSL AES-256-CBC, obtains the authorization file information, and stores it in memory. It also compares the instance_uuid field in the license file information with the uuid generated by calling the method for generating uuid provided by the boost library and stored in the memory. If the two field values ​​are exactly the same, the license file is considered to be a valid license authorization file, and the authorization file verification is confirmed to be successful.

[0063] Optionally, after activating the authorization service instance, the authorization method further includes: the authorization service container starts a first transmission protocol service, and uses the first transmission protocol service to receive data uploaded by a target atomic capability service, wherein the target atomic capability service is an atomic capability service bound to the authorization service instance.

[0064] Optionally, when it is detected that the license authorization file is valid, the authorization service instance is activated, and the activated authorization service instance service starts an http service (first transmission protocol service) for receiving data that needs to be collected and reported by the atomic capability service bound to the license service.

[0065] Optionally, the data reported by the atomic capability service includes: the number of concurrent services, the number of service durations, etc.

[0066] This application embodiment provides an authorization process, such as Figure 3 As shown, the process includes the following steps:

[0067] 1. The license authorization service generates uuid and starts the http service in the background.

[0068] 2. The operation and maintenance personnel obtain the UUID through the curl command HTTP request.

[0069] 3. The http response body sent by the license authorization service carries the generated uuid.

[0070] 4. The operation and maintenance personnel create a plain text license authorization file based on the uuid.

[0071] 5. The operation and maintenance personnel call the authorization file encryption program.

[0072] 6. The authorization file encryption program generates an encrypted license authorization file.

[0073] 7. The operation and maintenance personnel upload the generated encrypted license authorization file.

[0074] 8. The license authorization service detects the validity of the authorization file.

[0075] 9. If the authorization file is detected to be valid, the license service is officially started.

[0076] 10. If the detection authorization file is invalid, continue to wait for a valid license file.

[0077] Through the above steps, in order to solve the problem that the traditional authorization method cannot be applied to license authorization in a virtualized environment, a whole set of new localized authorization service processes are provided, which can realize the local deployment of license authorization in a virtualized environment, and rely on the uuid generated online to detect the validity of the license authorization file, solving the technical problem that the traditional authorization method cannot perform authorization verification in a virtualized environment due to verification through hardware information such as the media access control address. Specifically, the method embodiment of the present application has the following advantages:

[0078] (1) As a localized deployment authorization solution. This perfectly solves the problem of not being able to obtain the real and unique device information used to generate the license file during private deployment. This makes the license service deployment scenario more flexible and prevents users from using virtual containers to deploy authorization services, which can lead to various risks of invalid authorization.

[0079] (2) Local deployment requires copying the license service image to the user's server. The user can start multiple containers based on the license service image. Since the license service image does not contain the authorization file, the multiple instances corresponding to the started license service are still in an invalid authorization state. This avoids the invalidation of authorization restrictions caused by starting multiple containers.

[0080] (3) Local deployment operation and maintenance personnel cannot connect to the customer's deployment environment and need to send the generated authorization file to the customer. The uuid for license authorization verification is the uuid generated when the service is started. When the user uses the generated authorization file to start another container, the verification fails because the uuid generated by the newly started container is inconsistent with the uuid in the license authorization file, and the license service remains invalid. This prevents users from using the generated authorization file to start multiple containers, causing the authorization restrictions to become invalid.

[0081] (4) Local deployment of containerized license service starts normally. Users may copy the container image or directly copy the hard disk data storing docker, so that the copied container information is completely consistent with the license service container that has been started. When the copied container is started, a uuid will be regenerated, which is inconsistent with the uuid generated by the copied container. If the license authorization file of the copied container is taken, the uuid consistency check that the license service depends on to change from an invalid state to a valid state will fail due to the inconsistent uuid. This avoids the user starting multiple license service containers by copying containers, which causes the authorization restrictions to become invalid.

[0082] (5) The method embodiments of the present application have been used in multiple projects such as speech recognition. Since our operation and maintenance personnel cannot remotely log in to the customer's environment, all image packages, authorization files and other materials need to be transmitted to the other party's operation and maintenance personnel. Users can operate flexibly, which greatly increases the risk of authorization restriction failure and perfectly realizes the license authorization solution for local deployment in a virtualized environment.

[0083] The present application embodiment provides an authorization device, Figure 4 is a schematic diagram of the structure of the device, such as Figure 4 As shown, the device includes: a first processing module 40, used to obtain a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; a second processing module 42, used to generate an authorization file based on the unique identification code and configuration information of the target object; a third processing module 44, used to encrypt the authorization file; and a fourth processing module 46, used to send the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification has passed.

[0084] In some embodiments of the present application, after activating the authorization service instance, the authorization method also includes: the authorization service container starts a first transmission protocol service, and uses the first transmission protocol service to receive data uploaded by a target atomic capability service, wherein the target atomic capability service is an atomic capability service bound to the authorization service instance.

[0085] In some embodiments of the present application, the first processing module 40 obtains the unique identification code of the authorization service container in the private network, including: starting the authorization service container based on the authorization service image, wherein the authorization service container is used to generate a unique identification code after startup, and starting a second transmission protocol service, the second transmission protocol service is used to provide a transmission protocol interface for obtaining the unique identification code; obtaining the unique identification code through the transmission protocol interface.

[0086] In some embodiments of the present application, the first processing module 40 obtains a unique identification code through the transmission protocol interface, including: obtaining a network status statistics instruction input by the target object, wherein the network status statistics instruction is used to instruct the retrieval of the transmission protocol interface; according to the network status statistics instruction, after retrieving the transmission protocol interface, obtaining a unique identification code through the transmission protocol interface.

[0087] In some embodiments of the present application, the authorization method further includes: the authorization service instance determines whether there is an authorization file at a preset location of the container by querying, until it is confirmed that there is an authorization file at the preset location.

[0088] In some embodiments of the present application, the authorization service container is also used to store a unique identification code; the authorization method also includes: decrypting the authorization file and extracting the unique identification code in the authorization file; comparing whether the extracted unique identification code is consistent with the stored unique identification code, and determining that the authorization file verification is successful if they are consistent.

[0089] In some embodiments of the present application, the configuration information includes at least one of the following: user identification, user key, user service name, user service identification, concurrent number limit agreed with the user, time limit agreed with the user, and validity period limit agreed with the user.

[0090] It should be noted that the various modules in the above-mentioned authorization device can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0091] An embodiment of the present application provides a non-volatile storage medium, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute the following authorization method: obtaining a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; generating an authorization file based on the unique identification code and configuration information of a target object; encrypting the authorization file; sending the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification has passed.

[0092] An embodiment of the present application provides an electronic device, including: a memory and a processor, the processor is used to run a program stored in the memory, wherein the following authorization method is executed when the program is running: obtaining a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; generating an authorization file based on the unique identification code and configuration information of a target object; encrypting the authorization file; sending the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification passes.

[0093] An embodiment of the present application provides a computer program product, including a computer program, which implements the following authorization method when executed by a processor: obtaining a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; generating an authorization file based on the unique identification code and configuration information of a target object; encrypting the authorization file; sending the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file verification passes.

[0094] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0096] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0097] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0098] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0099] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. An authorization method, characterized in that: include: Obtaining a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; generating an authorization file based on the unique identification code and configuration information of the target object; Encrypting the authorization file; The encrypted authorization file is sent to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file has passed the verification.

2. The authorization method according to claim 1, characterized in that: After activating the authorization service instance, the authorization method further includes: The authorization service container starts a first transmission protocol service and uses the first transmission protocol service to receive data uploaded by a target atomic capability service, wherein the target atomic capability service is an atomic capability service bound to the authorization service instance.

3. The authorization method according to claim 1, characterized in that: Obtaining the unique identifier of the authorization service container in the private network includes: Starting the authorization service container according to the authorization service image, wherein the authorization service container is used to generate the unique identification code after starting, and starting the second transmission protocol service, wherein the second transmission protocol service is used to provide a transmission protocol interface for obtaining the unique identification code; The unique identification code is obtained through the transmission protocol interface.

4. The authorization method according to claim 3, characterized in that: Acquiring the unique identification code through the transmission protocol interface includes: Obtaining a network status statistics instruction input by a target object, wherein the network status statistics instruction is used to instruct to retrieve the transmission protocol interface; After the transmission protocol interface is retrieved according to the network status statistics instruction, the unique identification code is obtained through the transmission protocol interface.

5. The authorization method according to claim 1, characterized in that: The authorization method further includes: The authorization service instance determines whether the authorization file exists at the preset location of the container by querying, until it is confirmed that the authorization file exists at the preset location.

6. The authorization method according to claim 1, characterized in that: The authorization service container is also used to store the unique identification code; the authorization method also includes: Decrypting the authorization file and extracting the unique identification code in the authorization file; The extracted unique identification code is compared with the stored unique identification code to see if they are consistent, and if they are consistent, it is determined that the authorization document verification has passed.

7. The authorization method according to claim 1, characterized in that: The configuration information includes at least one of the following: user identification, user key, user service name, user service identification, concurrent number limit agreed with the user, time limit agreed with the user, and validity period limit agreed with the user.

8. An authorization device, characterized in that: include: A first processing module is used to obtain a unique identification code of an authorization service container in a private network, wherein the authorization service container includes an authorization service instance to be authorized and verified; A second processing module, configured to generate an authorization file based on the unique identification code and configuration information of the target object; A third processing module, used for encrypting the authorization file; The fourth processing module is used to send the encrypted authorization file to the authorization service container, wherein the authorization service instance is used to read and verify the authorization file, and activate the authorization service instance when it is determined that the authorization file has been verified.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the authorization method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the authorization method described in any one of claims 1 to 7 when running.

11. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the authorization method according to any one of claims 1 to 7.

Images