Authorization and authentication method for electric meter data analysis system and distributed authorization and authentication system

Abstract

The present invention provides an authorization and authentication method and distributed authorization and authentication system for an electric meter data analysis system. The method includes: a management module, upon receiving a machine code reported by a business service, updating a machine code table for applications associated with the business service; the machine code table records the machine code and its corresponding business service; an authentication module, based on a license timed verification task or a license verification interface call, requests the management module to obtain the machine code key for the application associated with the license to be verified; the management module encrypts the application's machine code table, generates the application's machine code key, and returns it; and the authentication module verifies the license to be verified based on the received machine code key. The present invention can improve the system's availability, security, and scalability.

Description

Technical Field

[0001] The present invention relates to the technical field of software authorization and authentication, and in particular to an authorization and authentication method of an electric meter data analysis system and a distributed authorization and authentication system. Background Art

[0002] As a core asset in the power industry, meter data serves as both a barometer of grid operation and the foundation of energy management. With the proliferation of smart meters and the increasing frequency of data collection, traditional methods of processing meter data are becoming inadequate. This necessitates the deployment of specialized meter data analysis systems, hereinafter referred to as "applications," to provide more targeted and effective analysis and processing of meter data. For security reasons, the deployment of meter data analysis systems requires authorization and authentication, specifically license generation and verification.

[0003] Traditional application authorization and authentication mechanisms typically use a centralized server for authorization verification. This type of solution has the following drawbacks:

[0004] 1. Single point of failure risk. Relying on a single authentication node, if the centralized server goes down or is attacked, the entire authorization system will fail, seriously affecting business continuity.

[0005] 2. Performance bottleneck: In high-concurrency scenarios, centralized servers can easily become a bottleneck in system performance, limiting overall throughput.

[0006] 3. Insufficient security. Authorization information is centrally stored, making it susceptible to tampering or forgery, and lacks decentralized auditing and protection mechanisms.

[0007] 4. Poor scalability. It is difficult to flexibly adapt to the dynamic increase and decrease of nodes in a distributed and microservice architecture.

[0008] Therefore, it is necessary to propose a new license authentication mechanism that can effectively solve the above problems existing in the traditional centralized license authentication model, so as to improve the availability, security and scalability of the authorization authentication system. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide a new authorization and authentication method and a distributed authorization and authentication system for an electricity meter data analysis system, which can improve the availability, security and scalability of the authorization and authentication system.

[0010] In order to solve the above technical problems, the first technical solution adopted by the present invention is:

[0011] The authorization and authentication method of the electric meter data analysis system includes:

[0012] After receiving the machine code reported by the business service, the management module updates the machine code table of the application associated with the business service; wherein the machine code table records the machine code and its corresponding business service;

[0013] The authentication module requests the management module to obtain the machine code key of the application associated with the license to be verified based on the license timing verification task or the license verification interface call;

[0014] The management module encrypts the machine code table of the application, generates the machine code Key of the application and returns it;

[0015] The authentication module verifies the license to be verified according to the received machine code Key.

[0016] Optionally, the authentication module verifies the license to be verified based on the received machine code Key, including:

[0017] The authentication module decrypts the license to be verified using the received machine code Key;

[0018] If the decryption is successful, the license to be verified is determined to be valid;

[0019] If the decryption fails, the license to be verified is determined to be invalid.

[0020] Optionally, after determining that the license to be verified is invalid, the method further includes:

[0021] The authentication module updates the license label table stored in Redis and sets the license label associated with the license to be verified to invalid;

[0022] The license label table records license labels corresponding to applications.

[0023] Optionally, it also includes:

[0024] The gateway intercepts the access request initiated by the business service, and queries the license label table to determine the license label of the application associated with the intercepted business service;

[0025] If the license tag is valid, responding to the access request;

[0026] If the license tag is invalid or the application associated with the intercepted business service cannot be found or the license tag cannot be found, the access request will be rejected and a prompt indicating that authentication is required will be returned to the front end for display. At the same time, a service of jumping to the Web authentication page will be provided on the front end.

[0027] Optionally, the machine code table also records the latest update time and authentication status of the machine code;

[0028] After receiving the machine code reported by the business service, the management module updates the machine code table of the application associated with the business service, including:

[0029] After receiving the machine code reported by the business service, the management module checks the machine code table of the application associated with the business service to determine whether the machine code already exists;

[0030] If it already exists, then update the latest update time of the machine code in the machine code table;

[0031] If it does not exist, a new record about the machine code and its corresponding business service is added to the machine code table, and its authentication status is marked as unauthenticated.

[0032] Optionally, marking its authentication status as unauthenticated, and then further comprising:

[0033] Returns the prompt that requires authentication to the front end for display, and provides a service for jumping to the Web authentication page on the front end.

[0034] Optionally, after providing a service of jumping to a web authentication page on the front end, the method further includes:

[0035] The authentication module obtains the original license content entered by the administrator through the Web authentication page;

[0036] The authentication module obtains the machine code Key generated by the management module according to the machine code table of the corresponding application by calling the management module;

[0037] The authentication module encrypts the original license content using the obtained machine code Key to generate the license for the application;

[0038] The authentication module marks the authentication status of all machine codes in the machine code table of the application as authenticated by calling the management module.

[0039] Optionally, a machine code timing verification task is provided in the authentication module, and the machine code timing verification task performs machine code verification by regularly calling the management module;

[0040] The machine code verification includes:

[0041] The management module checks the latest update time corresponding to the machine code whose authentication status is marked as authenticated in the machine code table;

[0042] If the update is not completed within the preset time, the authentication module will be prompted;

[0043] The authentication module sets the license of the application corresponding to the machine code table to invalid according to the prompt.

[0044] Another technical solution provided by the present invention is:

[0045] Distributed authorization and authentication system, including management module, authentication module, gateway, Redis, database, web page service and business service;

[0046] The management module is configured to implement the steps performed by the management module in the above authorization and authentication method;

[0047] The authentication module is configured to implement the steps performed by the authentication module in the above authorization authentication method;

[0048] The gateway is configured to implement the steps performed by the gateway in the above-mentioned authorization and authentication method;

[0049] The Redis is configured to store a license label table, wherein the license label table records license labels corresponding to the application;

[0050] The database is configured to store a machine code table corresponding to each application, wherein the machine code table records the machine code and its corresponding business service, the latest update time, and the authentication status;

[0051] The Web page service is configured to be called by the authentication module and provide a Web authentication page service at the front end.

[0052] Optionally, the system can be deployed on a virtual machine, a physical machine, a private cloud, a hybrid cloud, or a container.

[0053] The beneficial effects of the present invention are: through a modular distributed architecture, the present invention achieves decentralized application business service management and application license verification. This not only eliminates single point failure risks and ensures business continuity, but also supports dynamic scalability and high concurrency, provides multiple security protections and anti-tampering capabilities, supports automated operations and efficient management, and is compatible with virtual machines, physical machines, private clouds, hybrid clouds, containers, and other environments, demonstrating strong adaptability and compatibility. Thus, the present invention provides a new application authorization and authentication solution that significantly improves the availability, security, and scalability of the authorization and authentication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A flowchart of an authorization and authentication method for an electric meter data analysis system provided in the first embodiment of the present invention;

[0055] Figure 2 A schematic diagram of a process for a gateway to process a business service request in an authorization and authentication method for an electric meter data analysis system provided in a second embodiment of the present invention;

[0056] Figure 3 This is a flowchart of a first specific implementation method of the gateway determining whether the license of the application associated with the intercepted access request is valid in the second embodiment of the present invention;

[0057] Figure 4 This is a schematic diagram of the process of re-authorizing an application license in the second embodiment of the present invention;

[0058] Figure 5 This is a schematic diagram of the process of managing the machine code table by the management module in the third embodiment of the present invention;

[0059] Figure 6 This is a flow chart of the authentication module performing the machine code timing verification task in the fourth embodiment of the present invention;

[0060] Figure 7 A schematic diagram of the composition and connection of a distributed authorization and authentication system provided in Example 5 of the present invention;

[0061] Figure 8 This is a schematic diagram of the interaction between the service registration module and the management module in some specific implementations of the fifth embodiment of the present invention;

[0062] Figure 9 Schematic diagram of interaction between the management module and the management layer through the encryption layer in some further specific implementations of the fifth embodiment of the present invention;

[0063] Figure 10 This is a logic diagram of license self-authentication of an authentication module in a specific implementation of the fifth embodiment of the present invention. DETAILED DESCRIPTION

[0064] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0065] The key concept of the present invention is to achieve decentralized application license verification and application business service management through a modular distributed architecture.

[0066] Explanation of technical terms involved in the present invention:

[0067] Application: The electric meter data analysis system is a system that uses modern information technology to collect, process and analyze electric meter data. It mainly uses the Internet of Things, cloud computing and big data technologies to achieve comprehensive management and in-depth analysis of electric meter data to support intelligent management and decision-making in the power industry.

[0068] Business service: Each network request of the application may be sent to a different business service. The business service is responsible for filtering, querying, assembling results, and returning the data required by the application.

[0069] Machine code: The unique machine identification code of the host machine where the application is installed.

[0070] Machine code Key: It is generated by the management module based on all the machine codes in a specific machine code table, using a specific encryption method (machine code assembly combination) and encryption algorithm (such as MD5 algorithm). It needs to be exposed to the outside world and is used to verify the validity of the license or encrypt the original license content to generate a license.

[0071] License: that is, license,

[0072] Original license content: A string encrypted by the software company using Base64. After decryption, its content contains information such as the license time and license period, which is used to verify whether the license is available for use.

[0073] Redis: refers to the Redis database, a high-performance key-value storage database that supports multiple data structures (such as strings, hashes, lists, sets, ordered sets, etc.) and has in-memory storage and persistence mechanisms. Example 1

[0074] Please refer to Figure 1 , this embodiment provides an authorization and authentication method for an electric meter data analysis system.

[0075] like Figure 1 As shown, the authorization and authentication method of the electric meter data analysis system includes at least the following steps A1 to A5:

[0076] A1. After all business services are started, the unique machine code of the host machine is automatically detected and reported to the management module.

[0077] A2. After receiving the machine code reported by the business service, the management module updates the machine code table of the application according to the application associated with the business service.

[0078] The management module stores a machine code table in the database that can only be queried and called by the management module. The machine code table uniquely corresponds to each application, that is, each application uniquely corresponds to a machine code table; a machine code table stores the machine codes corresponding to all business services associated with an application.

[0079] In this embodiment, updating the machine code table at least includes the following: querying the machine code table of the application to determine whether the currently received machine code already exists in the table; if not, adding a record about the machine code to the table.

[0080] A3. The authentication module requests the management module to obtain the machine code key of the application associated with the license to be verified based on the license timing verification task or the license verification interface call.

[0081] The license timing verification task refers to a license self-verification task that is triggered by the authentication module at regular intervals, and is used to regularly self-verify a previously verified license to ensure the validity of the license.

[0082] The license verification interface call refers to an internal request initiated by the management module or another module (such as a subsequent gateway module) to verify the validity of a specified license. Because the license verification interface can only be called through internal requests, the legitimacy of the caller is guaranteed, ensuring the accuracy of the license verification results.

[0083] The machine code Key is generated by the management module, specifically by the encryption layer of the management module according to a specific machine code table.

[0084] In particular, in this embodiment, the license generation algorithm logic can be simply summarized as follows: generating a corresponding machine code key based on the application's machine code table; and encrypting the application's original license content using the machine code key to generate the application's license.

[0085] It can be understood that in this embodiment, the following association relationship can be summarized: business service-application-machine code table-machine code key-license.

[0086] Therefore, in this embodiment, the verification of the license requires the use of the machine code key of the application associated with the license to be verified; therefore, it is necessary to request the management module to obtain the latest machine code key of the application corresponding to the license to be verified.

[0087] A4. The management module encrypts the machine code table of the application, generates the machine code Key of the application, and returns it.

[0088] In this embodiment, the management module's encryption layer uses a specific encryption algorithm to encrypt all machine codes in an application's machine code table to generate a machine code key corresponding to that application. In other words, if the machine codes stored in an application's machine code table change, such as adding a new machine code, modifying one, or deleting a machine code, the machine code key generated by the subsequent encryption will also change.

[0089] In some specific embodiments, the step A4 specifically includes:

[0090] The management module requests the database to obtain the machine code table of the application associated with the license to be verified; the machine codes returned by the database are sorted, and the management module will assemble the received machine codes according to the sorting; then use a specific encryption algorithm, such as the MD5 encryption algorithm, to encrypt the assembled combination result and generate the corresponding machine code key.

[0091] A5. The authentication module verifies the license to be verified based on the received machine code Key.

[0092] In this embodiment, based on the above-mentioned license generation algorithm logic, it can be seen that the license verification logic is: use the machine code Key corresponding to the application associated with the license to be verified to perform a decryption operation on the license to be verified, and determine whether the original license content corresponding to the application can be successfully decrypted.

[0093] In some specific embodiments, the above step A5 specifically includes:

[0094] A5-1. The authentication module decrypts the license to be verified using the received machine code Key;

[0095] If the decryption is successful, the license to be verified is determined to be valid;

[0096] If the decryption fails, it means that the license to be verified or the machine code table has been tampered with, and the license to be verified is determined to be invalid.

[0097] In some further specific implementations, corresponding to the result of decryption failure in step A5-1, that is, determining that the license to be verified is invalid, the method further includes:

[0098] A5-2. The authentication module updates the license label table stored in Redis, and sets the license label of the application associated with the license to be verified to invalid; wherein the license label table records the license label corresponding to the application.

[0099] Here, the authentication module will maintain a license tag table in the Redis database that supports its editing. The license tag table records the license tags corresponding to all applications; the license tags are used to identify whether the license is valid.

[0100] As a specific example, the license tag may use "false" to indicate that the corresponding license is "invalid", and use "true" to indicate that the corresponding license is "valid".

[0101] By using the license tag table stored in the Redis database, authorized queryers of the license tag table, such as the subsequent Getway gateway, can efficiently and quickly determine the validity of an application's license without having to perform a license verification step. This allows for efficient and rapid authorization and authentication, significantly improving efficiency, shortening service response times, and significantly optimizing the user experience. See step A6 below for details.

[0102] In this embodiment, the license verification triggered by the "periodic verification task based on the license" described in step A3 above will loop through steps A3-A5 above, and the authentication module will verify the licenses corresponding to all applications one by one.

[0103] The license verification triggered by the "license verification interface call" described in step A3 above only requires executing steps A3-A5 once, and the authentication module can perform targeted verification on the specified license.

[0104] In steps A1 to A5 of this embodiment, the cooperation between the management module and the authentication module realizes decentralized application business service management and application license verification in a distributed processing manner. This not only eliminates single points of failure and ensures business continuity, but also supports dynamic node expansion and high concurrency. Furthermore, it has multiple security protections (machine code specific encryption method + license self-verification) and anti-tampering capabilities, which can always ensure the validity of the license. In addition, it has strong adaptability and compatibility, and is compatible with multiple types of environments such as private cloud, hybrid cloud and containerized environment. Example 2

[0105] This embodiment further expands upon the first embodiment and specifically describes the processing of business service requests.

[0106] The authorization and authentication method of the electric meter data analysis system provided in this embodiment is as follows: Figure 2 As shown, the method further includes the following steps B1 to B2:

[0107] B1. When any business service of any application initiates an access request, the gateway will intercept the access request.

[0108] It is understandable that all access requests initiated by the business services of any application need to be released by the gateway; and the gateway will only release the access request if it determines that the license of the application associated with the intercepted access request is valid.

[0109] B2. The gateway determines whether the license of the application associated with the intercepted access request is valid; if valid, the gateway responds to the access request; if invalid, the gateway rejects the access request.

[0110] In this embodiment, the above step B2 has at least the following two specific implementation methods:

[0111] In a first specific embodiment, the above step B2 is as follows Figure 3 As shown, specifically including:

[0112] B2-1. The gateway initiates a request to the authentication module to verify the license of the application corresponding to the intercepted access request by calling the license verification interface of the authentication module.

[0113] Here, after receiving the request initiated by the gateway, the authentication module will execute steps A3-A5 described in the first embodiment, using the license corresponding to the access request intercepted by the gateway as the license to be verified.

[0114] Specifically, the steps performed are as follows:

[0115] A3', the authentication module calls the license verification interface and requests the management module to obtain the machine code key of the application corresponding to the access request intercepted by the gateway.

[0116] A4. The management module encrypts the machine code table of the application, generates the machine code Key of the application, and returns it.

[0117] A5. The authentication module verifies the license to be verified based on the received machine code key. Specifically, it decrypts the license corresponding to the access request intercepted by the gateway. If the decryption is successful, the license is considered valid; if the decryption fails, the license is considered invalid.

[0118] B2-2. The gateway determines whether to respond to or reject the access request based on the license verification result of the authentication module.

[0119] It can be understood that in the first specific implementation method mentioned above, every time an access request for a business service is received, it is necessary to immediately carry out a complete license verification process through the interaction of the gateway, authentication module and management module to accurately confirm the current validity of the license of the associated application, thereby ensuring the accuracy of application authorization authentication.

[0120] In a second specific implementation manner, the above step B2 specifically includes:

[0121] The gateway queries the Redis license tag table based on the application associated with the intercepted access request to determine the license tag status of the application;

[0122] If the license tag is valid, responding to the intercepted access request;

[0123] If the license tag is invalid, or the record of the application associated with the intercepted access request cannot be found in the license tag table, or the license tag record corresponding to the application associated with the intercepted access request cannot be found in the license tag table, then the intercepted access request will be rejected.

[0124] It will be appreciated that the second specific implementation described above is based on step A5-2 described in Example 1, namely, pre-storing a continuously updated license tag table in Redis. The gateway can then efficiently and quickly determine the availability of the application associated with the intercepted access request based solely on the license tag table. This second specific implementation utilizes a Redis + gateway-linked circuit breaker mechanism, enabling immediate and simultaneous response.

[0125] It should be noted that, regardless of whether the first or second specific implementation method is adopted, based on the license timing verification task described in steps A3 to A5 in Example 1, the validity of the license corresponding to each application will be continuously and dynamically updated, thereby ensuring the validity of the application license; and thus the accuracy of the gateway's application license verification is also guaranteed.

[0126] In some specific implementations of this embodiment, when the gateway determines that an application currently cannot pass the license verification, it will also provide a service for regenerating the license of the application in the form of a Web authentication page on the front end.

[0127] Specifically, in the above step B2, after rejecting the intercepted access request, as follows Figure 4 As shown, the following steps C1 to C5 are also included:

[0128] C1. Return a prompt indicating that the application license needs to be authenticated to the front-end display, and provide a service on the front-end to jump to the web authentication page.

[0129] C2. If the authentication module can obtain the original license content entered by the administrator through the Web authentication page, then execute step C3; otherwise, it is determined that the current application cannot pass the license verification and the process ends;

[0130] C3. The authentication module calls the management module to obtain the machine code key generated by the management module according to the machine code table of the application to be authenticated;

[0131] Here, the specific manner in which the management module generates the corresponding machine code Key according to the machine code of the application to be authenticated will not be described in detail. For details, please refer to step A4 in the first embodiment.

[0132] C4. The authentication module uses the obtained machine code Key to encrypt the original license content of the application to be authenticated, and generates a license for the application to be authenticated.

[0133] Here, if a license label table is stored in Redis, it also includes:

[0134] C5. Add a new record in the license tag table corresponding to the above-mentioned application to be authenticated and its license tag (set to valid).

[0135] The authorization and authentication method of the electric meter data analysis system provided in this embodiment realizes decentralized application business service management, application license verification, and access request processing in a distributed processing manner through the cooperation of the gateway, management module, and authentication module. In addition to the advantages of the first embodiment, it also has the advantages of automated operation and maintenance and efficient management. Not only does it centrally manage license activation and updates through web pages, simplifying the operating process, improving operation and maintenance efficiency, and realizing a unified authentication interface; but it also combines Redis cache with database persistence to achieve millisecond-level synchronization of authorization status, avoid data inconsistency problems, and achieve global status synchronization. Example 3

[0136] This embodiment further expands upon the first or second embodiment, specifically refining the machine code table therein to further improve the authorization and authentication method.

[0137] In this embodiment, the machine code table also records the machine code's most recent update date and authentication status. The most recent update date refers to the time of the machine code's most recent update. The authentication status indicates whether the machine code participates in the generation of the associated application's license, i.e., the generation of the machine code key. It will be understood that if the machine code is newly added, its authentication status is unauthenticated. If the machine code participates in the generation of the machine code key and successfully activates the associated application's license based on the machine code key, its authentication status is authenticated.

[0138] In this embodiment, step A2 in the above embodiment 1, that is, after the management module receives the machine code reported by the business service, it updates the machine code table of the application associated with the business service, such as Figure 5 As shown, specifically including the following:

[0139] A2-1. After receiving the machine code reported by the business service, the management module will query the machine code table of the application associated with the business service through its management layer using the machine code as a query parameter to determine whether the machine code already exists.

[0140] A2-2. If the reported machine code has already been saved, it means that the business service and its host machine (machine code) have been registered. You only need to update the latest update time of the machine code in the queried machine code table;

[0141] A2-3. If the reported machine code does not exist, a record of the machine code and its corresponding business service is added to the queried machine code table, and its authentication status is marked as unauthenticated.

[0142] Based on the description of the "License Generation Algorithm Logic" and "License Verification Logic" in Example 1, it can be seen that if the machine code table corresponding to an application changes (such as the addition of a new record or tampering mentioned above), the corresponding machine code key will also change, and the corresponding application license will also change. At the same time, the machine code key will be unable to successfully decrypt the original application license. Therefore, if the machine code corresponding to an application changes, subsequent license verification for that application will inevitably fail. Consequently, all access requests initiated by business services of that application will be denied. The application will only be available after the administrator reactivates the application license (i.e., regenerates the license based on the new machine code table with the administrator's authorization).

[0143] In some implementations of this embodiment, when the management module edits the machine code table, such as by adding a new record to the machine code table, causing the license of the application associated with the machine code table to become invalid, a service for regenerating the application license is immediately provided on the front end in the form of a web authentication page. Because the licenses of the associated applications are automatically and dynamically updated upon any changes to the machine code table, the validity of the application licenses, particularly the license tag table relied upon by the gateway for rapid authentication, is always guaranteed.

[0144] Specifically, after the above steps A2-3, if Figure 5 As shown, it also includes steps C1 to C4 described in Example 1, and steps A2-4 described below. The specific contents of steps C1 to C4 will not be repeated here, and for details, please refer to the description of Example 1.

[0145] In particular, this embodiment starts the process of updating the license of the associated application as soon as the machine code table changes; therefore, even if the specific content of the license is updated, its validity can be maintained, so there is no need to update the license tag table in Redis.

[0146] The steps A2-4 are specifically as follows:

[0147] A2-4. The authentication module calls the management module to mark the authentication status of all machine codes in the machine code table corresponding to the application with the updated license as authenticated.

[0148] Here, since the license update is generated based on the changed machine code table; therefore, the license updated under the administrator's authorization is valid, which indicates that the changed machine code table is also valid; furthermore, the authentication status of all machine codes in the changed machine code table should be "authenticated".

[0149] In some specific implementations of this embodiment, even if the management module edits the machine code table to change the machine code table, causing the license of the application associated with the machine code table to become invalid, the license is still updated by waiting for the license timing verification task.

[0150] Here, the license timing verification task performed by the authentication module will be able to regularly start the self-verification process for all applied licenses, and when the license verification fails, renew the license with the administrator's authorization to maintain the validity of the license as much as possible.

[0151] It can be understood that in this embodiment, due to the change in the machine code table, the license of the associated application will become invalid. Therefore, when the authentication layer of the authentication module performs the license timer verification task, the machine code key generated based on the changed machine table will not be able to decrypt the original license, and the original license will be deemed invalid. Subsequently, the authentication module will synchronously update the license label of the above application in the license label table in Redis to "invalid". Thereafter, when the gateway intercepts an access request initiated by any application service in the above application, it will reject the access request. Afterwards, the gateway will execute steps C1 to C5 described in the above embodiment 2, regenerate the license with the administrator's authorization, and automatically update the license label table in Redis. In addition, the above steps A2-4 will also be executed to complete the update of the authentication status in the corresponding machine code table.

[0152] The above specific implementation method directly uses the original license timing verification task to update the license, which has the effect of simplifying the process and reducing the system burden to a certain extent. Example 4

[0153] This embodiment further expands upon any one of the first to third embodiments, adding a machine code timing verification task to ensure the validity of the machine code.

[0154] In this embodiment, the authorization and authentication method of the electric meter data analysis system is as follows: Figure 6 As shown, it also includes:

[0155] D1. The authentication module is provided with a machine code timing verification task, which executes the machine code verification process by regularly calling the management module;

[0156] The machine code verification process includes:

[0157] D1-1. The management module checks the latest update time corresponding to each machine code in the machine code table whose authentication status is marked as authenticated.

[0158] D1-2. If the currently checked machine code has not been updated within the preset time, the authentication module will be prompted;

[0159] Here, the preset time may be any pre-set time period, such as 1 day, 3 days, 7 days, 15 days, 30 days, etc.

[0160] D1-3. The authentication module sets the license associated with the application corresponding to the currently checked machine code table to be invalid according to the prompt.

[0161] Preferably, in the case where a license label table is stored in Redis, the authentication module sets the license to be invalid, and further includes setting the license label of the corresponding application in the license label table to be invalid.

[0162] It can be seen that in this embodiment, if one of the machine codes of an application has not been updated for a certain period of time, it is considered that its service has been migrated or stolen, and the application needs to be re-authorized, that is, the license needs to be regenerated before the application can be used normally. Otherwise, all access requests initiated by the business services of the application will be rejected.

[0163] In some specific implementations of this embodiment, all business services will use heartbeat connections to connect to the machine code verification service of the management module; the machine code verification service will update the latest update time of the machine code accordingly, that is, the time point when the machine code was last received.

[0164] Preferably, the above-mentioned machine code verification process is also performed through the above-mentioned machine code verification service.

[0165] In some further specific implementations of this embodiment, all business services will be connected to a service registration module; during the operation of the business service, the service registration module will periodically detect the machine code of the host machine of the business service and report the detected machine code to the management module; the management module will uniformly manage the received machine code, including determining whether it is a newly registered (i.e., newly added) machine code or an existing machine code, and refreshing the machine code table with the latest update time of the machine code. Example 5

[0166] This embodiment further expands upon any one of the above-mentioned embodiments 1 to 4, and provides a distributed authorization and authentication system.

[0167] like Figure 7 As shown, the distributed authorization and authentication system provided in this embodiment includes a management module, an authentication module, a gateway, Redis, a database, a Web page service, and a business service.

[0168] The management module is configured to implement the steps performed by the management module in the authorization and authentication method described in any of the above embodiments;

[0169] The authentication module is configured to implement the steps performed by the authentication module in the authorization authentication method described in any of the above embodiments;

[0170] The gateway is configured to implement the steps performed by the gateway in the authorization and authentication method described in any of the above embodiments;

[0171] The Redis is configured to store a license label table, wherein the license label table records license labels corresponding to the application;

[0172] The database is configured to store a machine code table corresponding to each application, wherein the machine code table records the machine code and its corresponding business service, the latest update time, and the authentication status;

[0173] The Web page service is configured to be called by the authentication module and provide a Web authentication page service at the front end.

[0174] In some specific implementations of this embodiment, the authorization and authentication system includes a service registration module; the interaction between the service registration module and the management module is shown as follows: Figure 8 shown.

[0175] In some specific implementations of this embodiment, the management module includes a management layer and an encryption layer; the management layer is used to uniformly manage the received machine code; the encryption layer is used to generate the machine code key. The management module interacts with the management layer through the encryption layer, and the interaction of the encryption layer to generate the machine code key is shown in the following figure. Figure 9 shown.

[0176] In some further specific implementations of this embodiment, the authentication module includes a generation layer and an authentication layer.

[0177] The generation layer is used to generate the application license. Specifically, when the application is initially unauthenticated, it provides a license input interface (i.e., the original license content input interface) through a web page service; obtains the original license content entered by the administrator; and then uses the machine code key (generated by the management module) as the encryption basis, combined with the original license content, to encrypt the final license using the AES algorithm.

[0178] The authentication layer is used to verify the application's license. It uses the same method for both routine checks (i.e., scheduled license verification tasks) and API calls (i.e., license verification API calls): obtaining the machine code key returned by the management module, decrypting the license using AES and the machine code key, and verifying the license contents to determine whether the current application is still legal.

[0179] As a specific implementation method, Figure 10 As shown, the license self-authentication logic when the authentication layer of the authentication module performs the license periodic verification task specifically includes:

[0180] If the license to be verified fails AES decryption, it can be determined that the license content or the corresponding application's machine code table has been tampered with. The license tag of the application in Redis is immediately set to false. After that, all business service requests initiated by the application will return the service authentication identifier to the front-end interface when passing through the gateway. The gateway will also jump to the authentication page through the web service, requiring re-authorization of the application.

[0181] In particular, the distributed authorization and authentication system provided in this embodiment is not limited to use in virtual machine environments; it can be used in physical machines and private clouds, hybrid clouds, containers and other environments, upgrading from virtual machine authorization control to a service-level authentication system to adapt to modern cloud architectures.

[0182] This embodiment combines a distributed architecture, dynamic heartbeat detection, multiple encryption verifications, and automated operation and maintenance mechanisms to build a highly available, secure, and scalable license authentication system. This system can completely resolve the single point of failure, performance bottlenecks, and security risks of traditional license authentication solutions. Furthermore, it is particularly suitable for cloud computing, edge computing, and large-scale microservice scenarios, providing a standardized, lightweight solution for enterprise software authorization management and possessing significant commercial application value.

[0183] In summary, the authorization and authentication method and distributed authorization and authentication system of the electric meter data analysis system provided by the present invention can achieve the following beneficial effects through innovative modular design and decentralized authentication mechanism:

[0184] 1. Eliminate single points of failure and ensure business continuity

[0185] Through distributed service registration and machine code management mechanisms, authorization information is stored in multiple nodes in a dispersed manner, avoiding reliance on a single centralized server. Even if some nodes fail or are attacked, the system can still complete authorization verification through the remaining nodes, ensuring continuous business operation and improving reliability by more than 90%.

[0186] 2. Dynamic scalability and high concurrency support

[0187] The service registration module supports dynamic node access and heartbeat detection. Combined with the asynchronous refresh mechanism of the management module, it can flexibly adapt to the needs of node increase and decrease under the microservice architecture. At the same time, through sharding verification and parallel processing, the system's throughput in high-concurrency scenarios is 3-5 times higher than traditional solutions, effectively breaking through performance bottlenecks.

[0188] 3. Multiple security protection and anti-tampering capabilities

[0189] Machine code encryption: Use MD5 hash algorithm to generate a unique machine code key to effectively prevent forgery and tampering.

[0190] License self-verification: End-to-end data protection is achieved through AES encryption / decryption. Any illegal modification will trigger an immediate invalidation mechanism (such as Redis tag interception), ensuring that illegal authorization cannot penetrate the system.

[0191] Theft monitoring: Machine code self-verification based on heartbeat connections can monitor node status in real time. If it is detected that the authorized machine code has not been updated for a long time (such as service migration or theft), it will automatically mark and block illegal access, reducing the risk of theft by more than 80%.

[0192] 4. Automated operation and maintenance and efficient management

[0193] Service registration automation: Automatically detect and report machine codes when business services are started, reducing manual configuration errors.

[0194] Unified authentication interface: Centrally manage license activation and updates through the web page, simplifying the operation process and improving operation and maintenance efficiency.

[0195] Global state synchronization: Combining Redis cache and database persistence to achieve millisecond-level synchronization of authorization status and avoid data inconsistency issues.

[0196] 5. Adaptability and compatibility

[0197] The system is compatible with private cloud, hybrid cloud and containerized environments, supports mainstream orchestration tools such as Kubernetes, and can be seamlessly integrated into the company's existing IT infrastructure to reduce deployment costs.

[0198] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. The authorization and authentication method of the electric meter data analysis system is characterized in that: include: Generate the corresponding machine code Key according to the applied machine code table; Use the machine code key to encrypt the original license content of the application to generate the application license; After receiving the machine code reported by the business service, the management module updates the machine code table of the application associated with the business service; wherein the machine code table records the machine code and its corresponding business service; The authentication module requests the management module to obtain the machine code key of the application associated with the license to be verified based on the license timing verification task or the license verification interface call; The management module encrypts the machine code table of the application, generates the machine code Key of the application and returns it; The authentication module verifies the license to be verified based on the received machine code Key; The authentication module verifies the license to be verified based on the received machine code Key, including: The authentication module decrypts the license to be verified using the received machine code Key; If the decryption is successful, the license to be verified is determined to be valid; If the decryption fails, the license to be verified is determined to be invalid.

2. The authorization and authentication method of the electric meter data analysis system according to claim 1, characterized in that: After determining that the license to be verified is invalid, the method further includes: The authentication module updates the license label table stored in Redis and sets the license label associated with the license to be verified to invalid; The license label table records license labels corresponding to applications.

3. The authorization and authentication method of the electric meter data analysis system according to claim 2, characterized in that: Also includes: The gateway intercepts the access request initiated by the business service, and queries the license label table to determine the license label of the application associated with the intercepted business service; If the license tag is valid, responding to the access request; If the license tag is invalid or the application associated with the intercepted business service cannot be found or the license tag cannot be found, the access request will be rejected and a prompt indicating that authentication is required will be returned to the front end for display. At the same time, a service of jumping to the Web authentication page will be provided on the front end.

4. The authorization and authentication method of the electric meter data analysis system according to claim 1, wherein: The machine code table also records the latest update time and authentication status of the machine code; After receiving the machine code reported by the business service, the management module updates the machine code table of the application associated with the business service, including: After receiving the machine code reported by the business service, the management module checks the machine code table of the application associated with the business service to determine whether the machine code already exists; If it already exists, then update the latest update time of the machine code in the machine code table; If it does not exist, a new record about the machine code and its corresponding business service is added to the machine code table, and its authentication status is marked as unauthenticated.

5. The authorization and authentication method of the electric meter data analysis system according to claim 4, characterized in that: and marking its authentication status as unauthenticated, and thereafter, further comprising: Returns the prompt that requires authentication to the front end for display, and provides a service for jumping to the Web authentication page on the front end.

6. The authorization and authentication method of the electric meter data analysis system according to claim 3 or 5, characterized in that: The service of jumping to the web authentication page is provided on the front end, and then further includes: The authentication module obtains the original license content entered by the administrator through the Web authentication page; The authentication module obtains the machine code Key generated by the management module according to the machine code table of the corresponding application by calling the management module; The authentication module encrypts the original license content using the obtained machine code Key to generate the license for the application; The authentication module marks the authentication status of all machine codes in the machine code table of the application as authenticated by calling the management module.

7. The authorization and authentication method of the electric meter data analysis system according to claim 4, characterized in that: Also includes: The authentication module is provided with a machine code timing verification task, which performs machine code verification by regularly calling the management module; The machine code verification includes: The management module checks the latest update time corresponding to the machine code whose authentication status is marked as authenticated in the machine code table; If the update is not completed within the preset time, the authentication module will be prompted; The authentication module sets the license of the application corresponding to the machine code table to invalid according to the prompt.

8. Distributed authorization and authentication system, characterized in that: Including management module, authentication module, gateway, Redis, database, web page service and business service; The management module is configured to implement the steps performed by the management module in the authorization and authentication method according to any one of claims 1 to 7; The authentication module is configured to implement the steps performed by the authentication module in the authorization authentication method according to any one of claims 1 to 7 above; The gateway is configured to implement the steps performed by the gateway in the authorization and authentication method according to claim 3; The Redis is configured to store a license label table, wherein the license label table records license labels corresponding to the application; The database is configured to store a machine code table corresponding to each application, wherein the machine code table records the machine code and its corresponding business service, the latest update time, and the authentication status; The Web page service is configured to be called by the authentication module and provide a Web authentication page service at the front end.

9. The distributed authorization and authentication system according to claim 8, wherein: The system can be deployed on a virtual machine, physical machine, private cloud, hybrid cloud or container.

Images