Software authorization method and apparatus

Abstract

A software authorization method and apparatus, which relate to the field of communications. The method is applied to a local software authorization management system, wherein the local software authorization management system is used for managing target local software, and the local software authorization management system and the target local software are deployed in a local server. The method comprises: acquiring an authorization identifier of target local software, wherein the authorization identifier comprises a software identifier for indicating the target local software, and the target local software is any one of N pieces of local software managed by a local software authorization management system, N being a positive integer; on the basis of the authorization identifier, acquiring a first authorization certificate sent by a cloud, wherein the first authorization certificate is used for authorizing the target local software; and managing the target local software on the basis of the first authorization certificate. The present application is used for improving the efficiency of software authorization and reducing the cost of software authorization.

Description

Software authorization method and device

[0001] This application claims priority to Chinese Patent Application No. 202311235025.5, filed with the State Intellectual Property Office of China on September 22, 2023, entitled “A Method, System, and Device for Software Authorization,” the entire contents of which are incorporated herein by reference. This application also claims priority to Chinese Patent Application No. 202311717819.5, filed with the State Intellectual Property Office of China on December 13, 2023, entitled “A Method and Device for Software Authorization,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of communications, and in particular to a software authorization method and device. Background Art

[0003] The software subscription model provides software for a specified period of time. Before using the software, the business user (e.g., a company employee) must authorize the software. Traditionally, when launching the software, the business user manually enters an authorization code sent by the software provider. The software then decrypts the authorization code to obtain the corresponding license file.

[0004] However, when there are a large number of software, business objects need to spend a lot of time to frequently participate in the authorization process of each software. This will inevitably lead to incorrect input due to too many authorization codes received. For example, when authorizing software A, the business object may mistakenly enter the authorization code of software B into software A, or enter the correct authorization code (for example, "113") as an incorrect authorization code (for example, "123") during the manual input process. This means that the business object may need to enter it twice or even multiple times before the software can obtain the correct authorization code for decryption. This authorization method not only affects the authorization efficiency, but also leads to excessively high authorization costs.

[0005] Summary of the Invention

[0006] The present application provides a software authorization method and apparatus for improving the efficiency of software authorization and reducing the cost of software authorization.

[0007] In order to achieve the above objectives, this application adopts the following technical solutions.

[0008] In a first aspect, an embodiment of the present application provides a software authorization method, which is used for a local software authorization management system, where the local software authorization management system is used to manage target local software. The local software management system and the target local software are deployed on a local server, and the method includes: obtaining an authorization identifier of the target local software, where the authorization identifier includes a software identifier for indicating the target local software, where the target local software is any one of N local software managed by the local software authorization management system, where N is a positive integer; obtaining a first authorization certificate sent by the cloud based on the authorization identifier, where the first authorization certificate is used to authorize the target local software; and managing the target local software based on the first authorization certificate.

[0009] In the above method, when authorizing the target local software, the local software authorization management system can interact with the cloud to quickly obtain the first authorization certificate for authorizing the target local software based on the authorization identifier of the target local software, so as to manage the target local software based on the first authorization certificate. The entire authorization process greatly reduces human-computer interaction, which can reduce the time spent on manual participation, thereby effectively improving the efficiency of software authorization. In addition, since the number of local software managed by the local software authorization management system is N, this means that the embodiment of the present application can achieve unified management of multiple software through the intervention of the local software authorization management system, that is, there is no need to independently develop each local software separately, which can effectively avoid the waste of development resources and manpower, thereby reducing the cost of software authorization.

[0010] In one implementation, the method further includes: configuring the file permissions of the first authorization certificate to obtain a configured first authorization certificate, the file permissions including at least one of editable permissions or reading permissions, the configured first authorization certificate being used to manage the target local software; and storing the configured first authorization certificate.

[0011] In the above implementation, the local software authorization management system configures the file permissions of the first authorization certificate so that users cannot arbitrarily modify, delete, copy, view, etc. the first authorization certificate. This can prevent the first authorization certificate from being tampered with and effectively improve the security of the authorization certificate.

[0012] In one implementation, obtaining the authorization identifier of the target local software includes: displaying a management interface including N local software; and obtaining the authorization identifier of the target local software in response to a startup operation for the target local software among the N local software in the management interface.

[0013] In the above implementation method, a new software startup method is provided based on the software startup function of the local software authorization management system. That is, when authorizing any local software among N local software, there is no need to exit the local software authorization management system. Instead, you can directly respond to the startup operation of the target local software in the management interface of the local software authorization management system, thereby realizing unified login.

[0014] In one implementation, the authorization identifier includes an object identifier; the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0015] In the above implementation, since the object identifier included in the authorization identifier of the target local software is used to indicate the business object that logs into the local software authorization management system, this can more accurately identify the business object that uses the target local software, thereby ensuring that the first authorization certificate finally obtained is generated for the business object. In other words, if the business objects that log into the local software authorization management system are different, even if the same local server is used, the authorization certificates obtained by the local software authorization management system will also be different.

[0016] In one implementation, obtaining a first authorization certificate sent by the cloud based on the authorization identifier includes: searching in a local server based on the authorization identifier to obtain a search result; if the search result indicates that the search failed, generating a download request corresponding to the first authorization certificate, the download request including a request identifier, and the request identifier is used to indicate the association between the activation request and the download request of the target local software; sending the download request to the cloud; and receiving the first authorization certificate sent by the cloud.

[0017] In the above implementation, when determining the first authorization certificate, the local software authorization management system can first search locally, which means that the embodiment of the present application does not need to have Internet access at all times, that is, there is no need for the local software authorization management system to interact with the cloud at all times. Instead, the target local software can be used offline in a specific time period (i.e., within the validity period of the authorization certificate, for example, one week or one month, etc.). After the offline time ends, that is, when no valid authorization certificate is found locally, a download request needs to be sent to the cloud to obtain a new authorization certificate. This cloud-based authorization and offline use method can effectively solve the defect of the traditional software authorization method that requires timely Internet access. In addition, since the download request carries a request identifier, it can play a tracking role in the distributed system.

[0018] In one implementation, managing the target local software based on the first authorization certificate includes: verifying the validity of the first authorization certificate to obtain a verification result; when the verification result indicates that the verification is successful, sending an activation instruction to the target local software, the activation instruction is used to instruct the activation of the target local software.

[0019] In the above implementation, if the local software authorization management system has a verification function, then the local software authorization management system can directly send an activation instruction to the target local software without informing the target local software of the storage location of the first authorization certificate. In other words, the first authorization certificate will be invisible to the target local software, which will greatly reduce the number of times the first authorization certificate is exposed and more effectively improve the security of the first authorization certificate.

[0020] In one implementation, managing the target local software based on the first authorization certificate includes: sending the storage location of the first authorization certificate to the target local software; sending a verification instruction to the target local software, the verification instruction being used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

[0021] In the above implementation method, if the local software authorization management system does not have a verification function, then the local software authorization management system can inform the target local software of the storage location and verification instructions of the first authorization certificate, and the target local software will verify the validity of the first authorization certificate, thereby effectively saving the computing resources of the local software authorization management system.

[0022] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software in response to a download operation for the target local software.

[0023] In the above implementation, based on the software download function of the local software authorization management system, a new software download method is provided, that is, any one of N local software can be downloaded in the local software authorization management system, which will facilitate the management of the local software authorization management system.

[0024] In one implementation, the local software authorization management system is further used to store a mapping relationship; the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

[0025] In the above implementation, since the local software authorization management system stores the mapping relationship between the software installation package and the software identifier, the software identifier of the target local software can be quickly and accurately determined based on the mapping relationship corresponding to the installation path.

[0026] In one implementation, the method further includes: displaying a subscription interface provided by the trading platform, the subscription interface including the target local software; if the business object is the first object with software subscription rights, then in the subscription interface, responding to a business transaction operation for the target local software, determining the subscription data corresponding to the target local software, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; and synchronizing the subscription data corresponding to the target local software to the cloud through the trading platform.

[0027] In the above implementation, the local software authorization management system can achieve a one-stop experience for the organization to purchase, manage, and use software licenses by responding to the business transaction operations of the first object with software subscription rights (for example, a company's purchaser) for the target local software, that is, it realizes on-demand cancellation of license support, thereby effectively reducing the cost of software use by the organization and truly achieving on-demand purchase and use.

[0028] In one implementation, the method also includes: if the business object is a second object with organizational management authority, then in the authorization interface used for authorization management of N local software, displaying the authorization control corresponding to the target local software; responding to the trigger operation of the authorization control, displaying M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; responding to the authorization quantity change operation for a third object among the M objects, changing the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; and sending the second authorization quantity to the cloud.

[0029] In the above implementation, the local software management system can reasonably configure the device authorization quantity of members within the organization by responding to the authorization quantity change operation of a second object (for example, the administrator of the enterprise) on a certain object it manages, thereby effectively improving the convenience and efficiency of organizational management.

[0030] In a second aspect, an embodiment of the present application provides a software authorization method, which is used for target local software, including: sending activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; receiving an operation instruction returned by the local software authorization management system; if the operation instruction is a verification instruction, obtaining a storage location sent by the local software authorization management system, and managing based on the first authorization certificate in the storage location.

[0031] In the above method, the target local software can quickly obtain the operation instructions sent by the local software authorization management system by interacting with the local software authorization management system used to manage it, so that when the operation instruction is a verification instruction, the target local software can be quickly managed based on the first authorization certificate in the storage location. The entire process does not require manual input from the user, that is, it can effectively improve the efficiency of software authorization by reducing human-computer interaction and reduce the cost of authorization efficiency.

[0032] In one implementation, a software development kit (SDK) for data interaction is integrated into the target local software, and the SDK is used to receive the storage location sent by the local software authorization management system.

[0033] In the above implementation, by providing SDK and local software authorization management system, the workload of traditional software transformation is effectively reduced, and the transformation can be carried out quickly, thereby reducing the cost of software authorization.

[0034] In one implementation, if the operation instruction is a verification instruction, the storage location sent by the local software authorization management system is obtained, and management is performed based on the first authorization certificate in the storage location, including: if the operation instruction is a verification instruction, the storage location sent by the local software authorization management system is obtained through the SDK in the target local software; based on the SDK, the validity of the first authorization certificate in the storage location is verified to obtain a verification result; and activation is performed when the verification result indicates that the verification is successful.

[0035] In the above implementation method, it is necessary to verify the validity of the first authorization certificate in the storage location based on whether the SDK itself has the verification function. For example, when the SDK has the verification function, the SDK can verify the validity of the first authorization certificate, which will greatly save the resource computing power of the target local software itself. When the SDK does not have the verification function, the target local software itself can verify the validity of the first authorization certificate, so that the SDK can be flexibly set up.

[0036] In a third aspect, an embodiment of the present application provides a software authorization device, which is applied to a local software authorization management system. The local software authorization management system is used to manage target local software. The local software management system and the target local software are deployed on a local server. The software authorization device includes: a first acquisition unit, which is used to obtain an authorization identifier of the target local software, the authorization identifier includes a software identifier for indicating the target local software, and the target local software is any one of the N local software managed by the local software authorization management system, where N is a positive integer; a second acquisition unit, which is used to obtain a first authorization certificate sent by the cloud according to the authorization identifier, and the first authorization certificate is used to authorize the target local software; a management unit, which is used to manage the target local software according to the first authorization certificate.

[0037] In one implementation, the software authorization device also includes: a configuration unit, used to configure the file permissions of the first authorization certificate to obtain the configured first authorization certificate, the file permissions include at least one of editable permissions or reading permissions, and the configured first authorization certificate is used to manage the target local software; a storage unit, used to store the configured first authorization certificate.

[0038] In one implementation, a first acquisition unit is used to obtain the authorization identifier of the target local software, and includes: a display subunit, used to display a management interface including N local software; and an acquisition subunit, used to respond to a startup operation for the target local software among the N local software in the management interface and obtain the authorization identifier of the target local software.

[0039] In one implementation, the authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0040] In one implementation, the second acquisition unit is used to obtain the first authorization certificate sent by the cloud based on the authorization identifier, including: a search subunit, used to search in the local server based on the authorization identifier to obtain a search result; a generation subunit, used to generate a download request corresponding to the first authorization certificate if the search result indicates that the search failed, the download request includes a request identifier, and the request identifier is used to indicate the association between the activation request and the download request of the target local software; a first transceiver subunit, used to send the download request to the cloud; the first transceiver subunit is also used to receive the first authorization certificate sent by the cloud.

[0041] In one implementation, a management unit is used to manage the target local software based on a first authorization certificate, and includes: a verification subunit, used to verify the validity of the first authorization certificate and obtain a verification result; a second transceiver subunit, used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct the activation of the target local software.

[0042] In one implementation, a management unit is used to manage the target local software based on the first authorization certificate, and includes: a third transceiver subunit, used to send the storage location of the first authorization certificate to the target local software; the third transceiver subunit is also used to send a verification instruction to the target local software, and the verification instruction is used to instruct the validity verification of the first authorization certificate in the storage location.

[0043] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software in response to a download operation for the target local software.

[0044] In one implementation, the local software authorization management system is further used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier.

[0045] In one implementation, the software authorization device also includes: a display unit, which is used to display a subscription interface provided by the transaction platform, and the subscription interface includes the target local software; a determination unit, which is used to respond to a business transaction operation for the target local software in the subscription interface if the business object is the first object with software subscription authority, and determine the subscription data corresponding to the target local software, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; and a transceiver unit, which is also used to synchronize the subscription data corresponding to the target local software to the cloud through the transaction platform.

[0046] In one implementation, the software authorization device also includes: a display unit, which is used to display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software if the business object is a second object with organizational management authority; the display unit is also used to respond to the trigger operation of the authorization control and display the M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; a change unit is used to respond to the authorization quantity change operation for the third object among the M objects and change the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; the transceiver unit is also used to send the second authorization quantity to the cloud.

[0047] In a fourth aspect, an embodiment of the present application provides a software authorization device, which is applied to target local software and includes: a transceiver unit for sending activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; a transceiver unit for receiving an operation instruction returned by the local software authorization management system; a processing unit for obtaining a storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and managing based on the first authorization certificate in the storage location.

[0048] In one implementation, a software development kit (SDK) for data interaction is integrated into the target local software; the SDK is used to receive the storage location sent by the local software authorization management system.

[0049] In one implementation, a processing unit is used to obtain a storage location sent by a local software authorization management system if the operation instruction is a verification instruction, and to manage based on the first authorization certificate in the storage location, including: a processing unit is used to obtain the storage location sent by the local software authorization management system through the SDK in the target local software if the operation instruction is a verification instruction; a processing unit is used to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; and a processing unit is used to activate when the verification result indicates that the verification is successful.

[0050] In a fifth aspect, an embodiment of the present application provides a software authorization device, comprising a memory and a processor, the memory being used to store computer instructions, and the processor being used to call and execute computer instructions from the memory to implement a method as in the first aspect or any one of the implementations of the first aspect, or to implement a method as in the second aspect or any one of the implementations of the second aspect.

[0051] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a processor, a method as in the first aspect or any one of the implementation methods in the first aspect is implemented, or a method as in the second aspect or any one of the implementation methods in the second aspect is implemented.

[0052] In a seventh aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed on a processor, the computer program product is used to implement a method as in the first aspect or any one of the implementations of the first aspect, or to implement a method as in the second aspect or any one of the implementations of the second aspect.

[0053] The technical effects produced by any implementation method in the above-mentioned second to seventh aspects and each aspect can refer to the above-mentioned first aspect and the corresponding implementation method in the first aspect, and the repetitions will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG1 is a schematic diagram of a network architecture provided in an embodiment of the present application;

[0055] FIG2 is a first schematic diagram of a scenario deployment for software authorization provided by an embodiment of the present application;

[0056] FIG3 is a second schematic diagram of a scenario deployment for software authorization provided in an embodiment of the present application;

[0057] FIG4 is a third schematic diagram of a scenario deployment for software authorization provided in an embodiment of the present application;

[0058] FIG5 is an interaction diagram of a method for software authorization provided in an embodiment of the present application;

[0059] FIG6 is a schematic diagram of a method for verifying a business object provided in an embodiment of the present application;

[0060] FIG7 is a schematic diagram of an interface switching for software management provided in an embodiment of the present application;

[0061] FIG8 is a schematic diagram of a process for performing software management according to an embodiment of the present application;

[0062] FIG9 is a first schematic diagram of a method for software authorization provided in an embodiment of the present application;

[0063] FIG10 is a first interactive diagram of software management provided by an embodiment of the present application;

[0064] FIG11 is a second interactive diagram for software management provided in an embodiment of the present application;

[0065] FIG12 is a third interactive diagram for software management provided in an embodiment of the present application;

[0066] 13 is a schematic diagram of an interface switching for authorization management of members within an organization provided in an embodiment of the present application;

[0067] FIG14 is a second schematic diagram of a method for software authorization provided in an embodiment of the present application;

[0068] FIG15 is a structural diagram of a software authorization device according to an embodiment of the present application;

[0069] FIG16 is a second structural diagram of a software authorization device provided in an embodiment of the present application;

[0070] FIG17 is a third structural diagram of a software authorization device provided in an embodiment of the present application;

[0071] FIG18 is a fourth structural diagram of a software authorization device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In order to facilitate the clear description of the technical solutions in the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit differences. At the same time, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0073] To facilitate understanding of the technical solutions provided by the embodiments of the present application, a brief introduction to the relevant technologies is first given.

[0074] In current technical solutions, traditional software licensing methods include two types: license file-based licensing and internet-based licensing (e.g., Software as a Service (SaaS)). License file-based licensing often requires business entities to participate in the software licensing process. License file generation, purchase, and activation cannot be a one-stop experience, requiring device fingerprint collection, entry of device fingerprint information during purchase, offline license file delivery (e.g., via email, download link, or physical media), and manual import of license files. This means that the current license file method, lacking integration with transaction systems, relies solely on manual renewal, resulting in a non-automated "pseudo-subscription" model. Furthermore, in enterprise 2B scenarios, due to the lack of license authorization management and automated distribution mechanisms, manual processes often rely on manual labor. This not only significantly impacts licensing efficiency but also makes it difficult to ensure a consistent, on-demand subscription experience for users.

[0075] Although the SaaS model authorization method can verify the legitimacy of the software and authorize its use on the Internet, this authorization method requires the software to maintain a connection with the server at all times. In special scenarios such as unstable networks and high security requirements (for example, industrial environments), it is often not applicable due to the lack of conditions for constant Internet access. In other words, this authorization method requires a large cost to provide and maintain a relatively stable network environment.

[0076] It can be seen that traditional software licensing methods either have low licensing efficiency or high licensing costs. Therefore, how to support low-cost and high-efficiency software license subscription methods is a very necessary and challenging task.

[0077] In order to solve the above problems, an embodiment of the present application provides a new software authorization method, in which a local software authorization management system can be used to manage target local software (for example, CAD drawing software), and the target local software and the local software authorization management system are deployed on a local server, wherein the target local software is any one of the N local software managed by the local software authorization management system, and N is a positive integer. It can be understood that the local software authorization management system can obtain the authorization identifier of the target local software, and the authorization identifier includes a software identifier for indicating the target local software. Furthermore, the local software authorization management system can obtain a first authorization certificate (for example, a license file) sent by the cloud based on the authorization identifier, and then manage the target local software based on the first authorization certificate, and the first authorization certificate can be used to authorize the target local software.

[0078] In an embodiment of the present application, when authorizing the target local software, the local software authorization management system can interact with the cloud to quickly obtain a first authorization certificate for authorizing the target local software based on the authorization identifier of the target local software, so as to manage the target local software based on the first authorization certificate. The entire authorization process greatly reduces human-computer interaction, which can reduce the time spent on manual participation, thereby effectively improving the efficiency of software authorization. In addition, since the number of local software managed by the local software authorization management system is N, this means that the embodiment of the present application can achieve unified management of multiple local software through the intervention of the local software authorization management system, that is, there is no need to independently develop each local software separately, which can effectively avoid the waste of development resources and manpower, thereby reducing the cost of software authorization.

[0079] Among them, since the new software authorization method provided by the embodiments of the present application can place the management and distribution of software authorization in the cloud, this means that this new software authorization method involves the field of cloud technology. Among them, cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and network within a wide area network or local area network to realize the calculation, storage, processing, and sharing of data. Cloud technology is a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the application of cloud computing business model. It can form a resource pool that can be used on demand and is flexible and convenient. Cloud computing technology will become an important support. The backend services of technical network systems require a large amount of computing and storage resources, such as video websites, image websites, and more portal websites. With the rapid development and application of the Internet industry, in the future, each item may have its own identification mark, and all need to be transmitted to the backend system for logical processing. Data of different levels will be processed separately. All kinds of industry data require strong system backend support, which can only be achieved through cloud computing.

[0080] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to access computing power, storage space, and information services as needed. The network that provides these resources is called the "cloud." To users, these resources appear infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for on a pay-per-use basis.

[0081] As a provider of cloud computing infrastructure, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) is established. Various types of virtual resources are deployed in the resource pool for external customers to choose and use. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0082] Based on logical functional divisions, the PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and the SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. SaaS can also be deployed directly on top of IaaS. PaaS is a platform for software execution, such as databases and web containers. SaaS is a variety of business software, such as web portals and text messaging tools. Generally speaking, SaaS and PaaS are upper layers relative to IaaS.

[0083] The following describes the network architecture for applying the software authorization method provided in the embodiments of the present application:

[0084] Please refer to Figure 1, which is a schematic diagram of a network architecture provided in an embodiment of the present application. As shown in Figure 1, the network architecture can connect the services of the trading platform and independent software vendors (ISVs). The network architecture can specifically include servers deployed locally (for example, the local server 10 shown in Figure 1) and servers deployed in the cloud (for example, the management server 11 and the business server 12 shown in Figure 1).

[0085] The local server 10 may be a local server used by a business object, where the business object refers to an object in an organization, such as an enterprise employee, enterprise administrator, enterprise purchaser, or student. As shown in FIG1 , the local server 10 may be deployed with a local software authorization management system and N local software (also known as desktop tool software), where N is a positive integer. The local software authorization management system may also be referred to as a desktop tool management client (SCDesk), and the N local software may specifically include local software A, local software B, ..., and local software N.

[0086] The local software here can refer to stand-alone software or non-stand-alone software, and this is not limited here. It is understandable that the local software here can be a program independent of the local software authorization management system, such as drawing software (e.g., CAD software), chip design software (e.g., EDA software), simulation software (e.g., CAE software), or an embedded subroutine integrated into the local software authorization management system. For example, it does not need to be downloaded to the local server 10, but exists in the local software authorization management system in the form of a small program, etc. The existence form of the local software is not limited here.

[0087] It can be understood that the local software authorization management system can be used to uniformly manage each local software among N local software. For example, the embodiment of the present application can download or log in to any local software among the N local software by using the local software authorization management system, and can also interact with the cloud in a unified manner by using the local software authorization management system.

[0088] In order to improve the efficiency of subsequently determining the software identifier of the local software to be authorized, after downloading N local software, the local server 10 in the embodiment of the present application can use the local software authorization management system to store the mapping relationships corresponding to these N local software. For example, the mapping relationship corresponding to local software A is used to associate the software identifier of local software A with the installation path of the software installation package of local software A. For ease of understanding, please refer to Table 1, which is a schematic table including multiple mapping relationships provided in the embodiment of the present application. As shown in Table 1:

[0089] Table 1

[0090] As shown in FIG1 , a management server 11 (e.g., a SaaS service center / organization management service) can be used to provide subscription software management services. The management server 11 can be an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services. The embodiments of this application do not limit the number of servers.

[0091] In order to better achieve high availability of the system, the embodiment of the present application can take a management server deployed in the cloud as an example to illustrate a new software authorization method based on cloud computing technology. Among them, the subscription software management module in the management server 11 can not only be used to manage software authorization and software installation packages, but also to transmit data with the trading platform (for example, a cloud store). Among them, the trading platform here is mainly responsible for ISV authentication, transaction billing, software asset custody, etc.

[0092] As shown in Figure 1, the business server 12 can be an independent ISV server, used to provide business services (for example, certificate generation service, metering service) for N local software respectively, or it can refer to a server cluster including N ISV servers, and one ISV server is used to provide corresponding business services for one local software. There is no limit on the number of ISV servers included in the business server 12.

[0093] It should be understood that the embodiment of the present application can be connected to the cloud through the local software authorization management system to complete the online periodic issuance and update of the license file, thereby realizing a high-efficiency, low-cost software authorization method. For example, when authorizing any local software shown in Figure 1 (for example, local software A), the embodiment of the present application can quickly obtain the first authorization certificate for authorizing the local software A based on the authorization identifier of the local software A through the interaction between the local software authorization management system and the cloud. Among them, the authorization identifier of the local software A can include the software identifier (Application ID, appid) of the local software A, the device fingerprint corresponding to the local server 10, and the object identifier (for example, login account) used by the business object to log in to the local software authorization management system. The object identifier is obtained after the business object is authorized, and the acquisition of the object identifier needs to comply with the relevant laws, regulations and standards of the relevant countries and regions. Further, the local software authorization management system can manage the local software A based on the first authorization certificate. The entire authorization process does not require manual participation, and there is no need to independently develop the local software A. This can not only effectively improve the efficiency of software authorization, but also reduce the cost of software authorization.

[0094] Among them, for the network architecture shown in Figure 1, the embodiment of the present application can be implemented using different deployment methods. The following will further introduce each deployment method:

[0095] Please refer to Figure 2, which is a schematic diagram of a scenario deployment for software authorization provided by an embodiment of the present application. As shown in Figure 2, the management server, transaction platform and business server (i.e., ISV server) in the embodiment of the present application are deployed independently. Among them, the embodiment of the present application involves three types of objects, which may specifically include a first object, a second object and an asset management object of a software developer. The first object refers to an object with software subscription authority (for example, a purchaser of a certain enterprise), which is used to perform business transaction operations (purchase operations, renewal operations, or cancellation operations) on a certain local software, and the second object refers to an object with organizational management authority (for example, an administrator of a certain enterprise), which is used to perform software license management for members within the organization. Among them, the first object and the second object here can be the same object or different objects, and they will not be limited here.

[0096] It is understandable that the management server here can adopt a public cloud (Public Cloud) logical multi-tenancy method to serve multiple organizations. Among them, the public cloud usually refers to a cloud that a third-party provider provides to users and can be used. The public cloud is generally available through the Internet and may be free or low-cost. The core attribute of the public cloud is shared resource services. There are many instances of this cloud that can provide services throughout the entire open public network today. The services provided by the management server may include software download services, organization authorization services (for example, enterprise authorization services), account management services, and software version management services.

[0097] Among them, the services provided by the trading platform may include trading services, docking services for software developers (i.e., ISV services), software asset management services, and product listing services. Each software developer's asset management object can list its corresponding local software through the trading platform. Since the trading platform can present the supply and purchase fulfillment of local software to buyers and sellers in real time, this can not only provide buyers and sellers with visual product order information viewing, service supervision and other functions, but also enable software suppliers (e.g., asset management objects) to pay attention to the supply and sales of local software in real time, and adjust supply and marketing strategies in a timely manner. It also allows buyer users (e.g., the first object) to not worry about accidentally exceeding the limit, but to renew or cancel subscriptions in a timely manner by promptly discovering the usage of the purchased license, so as to achieve on-demand purchases.

[0098] Each business server can be deployed independently (for example, using a Docker container in the cloud). This deployment approach ensures that each business server is independently decoupled and does not affect each other. Software developers are primarily responsible for service operations and maintenance, environment setup, and other aspects. As shown in Figure 2, each business server corresponds to a different software developer. Specifically, this may include a business server corresponding to Software Developer 1, a business server corresponding to Software Developer 2, and so on, and a business server corresponding to Software Developer N. Each business server can provide services such as connection to the trading platform, certificate generation, and metering.

[0099] Please refer to Figure 3, which is a second schematic diagram of a scenario deployment for software authorization provided by an embodiment of the present application. As shown in Figure 3, the embodiment of the present application can host the capabilities of the business server (for example, the ISV server) and automatically deploy it by the trading platform.

[0100] The management server described in FIG2 is similar to the management server described above and is deployed on a public cloud to serve multiple organizations. A second entity (e.g., an administrator of a company) can manage software licenses for members of the organization by interacting with the management server.

[0101] Among them, the trading platform shown in Figure 3 can also be deployed on a public cloud, and the first object (for example, a purchaser of a certain enterprise) can interact with the trading platform to perform business transaction operations such as purchasing, renewing, or canceling a certain local software. It should be noted that in addition to providing transaction services, docking services for software developers, software asset management services, and product listing services, the trading platform shown in Figure 3 also provides a license management (License Manger) automated deployment service. Among them, the license management automated deployment service can be used to automatically deploy local software hosted by software developers and the license management corresponding to the local software.

[0102] For example, after the asset management object of the software developer shown in Figure 3 packages the relevant functions of the ISV server (such as making them into container images) and hosts them on the trading platform, the trading platform can automatically deploy services based on license management and automatically deploy related service instances.

[0103] For the description of the three types of objects, the services provided by the management server, the services provided by the transaction platform, and the services provided by each business server in the embodiment of the present application, please refer to the description in Figure 2 above, and will not be further elaborated here.

[0104] Since the deployment method of the embodiment of the present application is to host the relevant functions of the business server on the trading platform, when any local software is subsequently authorized, its corresponding authorization certificate can be quickly obtained directly from the trading platform, which will further speed up service construction, reduce network delays, and thus reduce costs.

[0105] Please refer to Figure 4, which is a schematic diagram of a scenario deployment for software authorization provided by an embodiment of the present application. As shown in Figure 4, the embodiment of the present application can, based on the deployment method shown in Figure 3 above, deploy the management server (for example, a SaaS service center) downward, that is, not only can the capabilities of the business server (for example, the ISV server) be hosted and automatically deployed by the transaction platform, but the management server also needs to be deployed to the organization's computer room (for example, a company's computer room) and be exclusively used by the organization.

[0106] As shown in Figure 4, the second object (for example, the administrator of a certain enterprise) can manage software licenses for members within the organization by interacting with the management server. When the management server and the trading platform are transmitting data, the transmitted data can be encrypted to ensure the security of the transmitted data. During the data transmission process, connections at different levels can be included, specifically data plane connections and management plane connections. Among them, the data plane connection can not only be used for the organization to upload local data on demand (for example, the basic information of each member in a certain enterprise) to meet data security compliance and autonomous control requirements, but also for sending management instructions from the cloud and receiving return information locally. The management plane connection can be used not only to issue version upgrade packages / software installation packages for local software, but also for two-way operation and maintenance detection.

[0107] It should be noted that the local data here can be basic information of members in an organization, such as the department, position, device authorization, software usage rights, object identification, etc. of an enterprise employee. In the specific implementation of this application, when the above embodiments of this application are applied to specific products or technologies, the user's permission or consent is required, and the collection, use and processing of relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0108] The transaction platform shown in FIG4 can be deployed on a public cloud, and the first object (for example, a purchaser of a certain enterprise) can interact with the transaction platform to perform business transaction operations such as purchasing, renewing, or canceling a certain local software.

[0109] The description of the three types of objects, the services provided by the management server, the services provided by the transaction platform, and the services provided by each business server in the embodiment of the present application will not be further elaborated here. For details, please refer to the description in Figures 2 and 3 above.

[0110] Since the deployment method of the embodiment of the present application is to deploy the management server down to the organization's computer room, this will enable local software and data to run and store locally, and by combining the rich automated operation and maintenance tools of the public cloud, it can flexibly meet the needs of the organization.

[0111] Of course, in addition to the deployment methods provided in Figures 2, 3, and 4 above, the software authorization method of the embodiment of the present application can also be other deployment methods, such as deploying a trading platform that automatically deploys business server-related functions and a management server together. In other words, the services provided by the management server, the services provided by the trading platform, and the related services corresponding to N local software can all be deployed together. The embodiment of the present application will not provide examples of deployment methods one by one.

[0112] Among them, the specific implementation method of the embodiment of the present application for efficiently and low-costly authorizing local software through the interaction between the local software authorization management system and the cloud can be referred to the embodiment methods corresponding to Figures 5 to 14 below.

[0113] Further, please refer to Figure 5, which is an interactive diagram of a method for software authorization provided by an embodiment of the present application. As shown in Figure 5, the method can be jointly executed by a local software authorization management system deployed on a local server, the target local software, and a server deployed in the cloud (also known as a cloud server), wherein the local server here can be the local server 10 shown in Figure 1 above, and the cloud server can include the management server 11 shown in Figure 1 above. The method can at least include S101-S107:

[0114] S101: The target local software sends activation information of the target local software to the local software authorization management system.

[0115] The target local software here is any one of the N local software managed by the local software authorization management system (for example, the local software A shown in Figure 1 above), and N is a positive integer. The activation information here may include the software identifier of the target local software and the device fingerprint corresponding to the local server. The software identifier here can be used to uniquely indicate the target local software; the device fingerprint here can be used to uniquely identify the device characteristics of the local server or a unique device identifier, such as a media access control address (for example, Media Access Control Address, MAC address).

[0116] The target local software may be integrated with a software development kit (SDK) for data interaction. The SDK can be a development function library provided to the target local software. In essence, it is a collection of files of interface APIs that provide services for the target local software. It can also be understood that software developers can access these files and call the relevant interfaces therein to collect corresponding data. The SDK can be used to receive the storage location sent by the local software authorization management system. For example, the SDK can obtain the storage location sent by the local software authorization management system through communication with the local software authorization management system (for example, socket communication).

[0117] It should be understood that when a business object executes a startup operation on a target local software, the target local software can respond to the startup operation, call the SDK's activation function, and attempt to activate. In the embodiments of the present application, the startup operation here refers to a trigger operation for starting the target local software. The trigger operation can be a contact operation such as a click or a long press, or a non-contact operation such as a voice or gesture, and will not be limited here.

[0118] Among them, when the target local software and the local software authorization management system belong to two independent applications, the startup operation here can refer to the trigger operation performed by the business object in the management interface provided by the local software authorization management system on the target local software among N local software, or it can refer to the trigger operation performed by the business object directly on the software icon of the target local software on the local server, which will not be limited here.

[0119] Since the local software authorization management system can install the target local software based on the software installation package corresponding to the target local software when responding to the download operation for the target local software, and can also establish a mapping relationship between the installation path of the software installation package of the target local software and the software identifier after the installation is completed, and store the mapping relationship, the SDK can obtain the execution file path of the loading process (i.e., the installation path of the software installation package of the target local software) through the operating system (OS) when attempting to activate, and can then quickly and accurately determine the software identifier of the target local software through the mapping relationship corresponding to the installation path. At the same time, the SDK can also obtain the device fingerprint through the operating system.

[0120] Furthermore, the target local software can determine the software identification and device fingerprint as the activation information of the target local software, and then send the activation information to the local software authorization management system. For example, the target local software can generate an activation request carrying activation information, and then send the activation request to the local software authorization management system through communication between the SDK and the local software authorization management system (for example, socket communication). The activation request here refers to a service request generated by the target local software for activating the target local software.

[0121] S102: The local software authorization management system obtains the authorization identifier of the target local software.

[0122] Specifically, after the local software authorization management system obtains the activation information (including software identification and device fingerprint) sent by the target local software, it can determine the object identification and request identification respectively, and then determine the software identification, device fingerprint, object identification and request identification as the authorization identification of the target local software. Among them, the object identification here can be used to uniquely indicate the business object that logs into the local software authorization management system. The request identification here is generated by the cloud server when it first receives the activation request of the business object for the target local software. The request identification can be used to indicate the association between the activation request of the target local software and the download request of the target local software. The download request here refers to the business request generated by the local authorization management system for obtaining the first authorization certificate.

[0123] For the target local software, the activation request and the download request are asynchronous. When the local authorization management system receives the activation request for the first time, the cloud server (for example, the management server) can return a request identifier to the local authorization management system. In this way, the local authorization management system needs to carry the request identifier when it requests the authorization certificate of the target local software in subsequent regular cycles. When the cloud server obtains the authorization certificate, it will also associate the authorization certificate with the request identifier and save it. That is, the entire request identifier is used in the authorization process of the target local software, thereby playing a tracking role in the distributed system.

[0124] Furthermore, the local software authorization management system can search the local server based on the authorization identifier of the target local software to obtain the search result. For example, if the local server has a file storage space (e.g., a local safe) for storing the authorization certificates of each local software, then when the local software authorization management system obtains the authorization identifier of the target local software, it can search in the file storage space and implement an online subscription model by rotating the authorization certificates.

[0125] If the authorization certificate of the target local software exists in the file storage space, and the authorization certificate of the target local software is valid, the search result can be determined to be a result indicating a successful search. At this time, the embodiment of the present application can determine this valid authorization certificate as the first authorization certificate for authorizing the target local software, and then directly jump to step S106. This means that the embodiment of the present application does not need to have Internet access at all times, that is, there is no need for the local software authorization management system to interact with the cloud at all times, but the target local software can be used offline in a specific time period (i.e., within the validity period of the authorization certificate, for example, one week or one month, etc.).

[0126] If the target local software's authorization certificate exists in the file storage space but is invalid, or if the target local software's authorization certificate does not exist in the file storage space, the query result is determined to indicate a search failure. This means that after the offline time expires, i.e., if no valid authorization certificate is found locally, step S103 is continued to interact with the cloud to obtain the first authorization certificate sent by the cloud. This entire process does not require the user to install and maintain complex authorization management software.

[0127] S103, the local software authorization management system sends the authorization identifier of the target local software to the cloud.

[0128] For example, the local software authorization management system may generate a download request corresponding to the first authorization certificate and send the download request to the cloud, wherein the download request may carry the authorization identifier (software identifier, device fingerprint, object identifier, and request identifier) ​​of the target local software.

[0129] S104: The cloud server obtains a first authorization certificate.

[0130] Specifically, since the cloud server can provide business services for data exchange with software developers corresponding to N local software, upon obtaining the authorization identifier of the target local software, the cloud server can determine the business service (i.e., the target service) corresponding to the software identifier from these N business services. The target service may be deployed in a business server included in the cloud server, or directly in a management server included in the cloud server. The deployment method of the target service is not limited here. Furthermore, the cloud server can obtain first authorization data sent by the target service. The first authorization data may include a first authorization certificate for authorizing the target local software, and structured information corresponding to the first authorization certificate. The first authorization certificate may include a device fingerprint, a digital signature, an expiration date, and a feature set. The feature set refers to enhanced / advanced functional features of the software, such as advanced 3D drawing capabilities. The structured information may include a request identifier and an expiration date. The expiration date in the structured information can be displayed in the local software authorization management system, allowing business entities to quickly determine when the target local software expires, thereby eliminating the need to read the first authorization certificate.

[0131] Among them, the organization where the business object is located may include a first object (i.e., an object with software subscription permissions, for example, a purchaser of a certain enterprise) and a second object (i.e., an object with organizational management permissions, for example, an administrator of a certain enterprise). The first object and the second object here can be the same object or different objects, and they will not be limited here.

[0132] It is understandable that if the cloud server includes a management server and a target server that provides target services, and the management server and the target server are both able to synchronize the subscription data sent by the trading platform, the trading platform and the target server can be connected so that the authorization certificate generated by the target server can be exchanged based on the subscription data. The subscription data refers to the order information generated by the trading platform in response to the business transaction operation (for example, a trigger operation for purchase, renewal or cancellation) performed by the first object on the target local software. The order information can specifically include an order identifier (for example, an order number), a product identifier, the number of subscriptions, a cycle, the number of cycles, the expiration time of the cycle, etc.

[0133] In addition, the management server may also store the configuration information determined by the second object for all members within the organization. The configuration information here may refer to the device authorization quantity reasonably configured by the second object for members within the organization based on the number of subscriptions to the target local software (for example, 100 sets). The device authorization quantity is used to indicate the number of devices allowed to be used by the same member. For example, if the target local software is drawing software, the second object may configure the device authorization quantity for employees in the design department to 3, and the device authorization quantity for other employees who do not use drawing software to 0.

[0134] Based on this, after obtaining the authorization identifier of the target local software, the management server can verify the business object based on the subscription data and configuration information stored in the management server to determine the object verification result of the business object. If the object verification result indicates verification success, the management server can request a first authorization certificate from the target server. Optionally, if the object verification result indicates verification failure, there is no need to request the target server to generate a first authorization certificate. Instead, a notification message indicating activation failure is sent directly to the local software authorization management system.

[0135] Among them, the object verification result here may include a first verification result, a second verification result, and a third verification result. The first verification result can be used to indicate whether the current authorization amount of the business object reaches the device authorization amount when the subscription data is in a normal state; the second verification result can be used to indicate whether the business object corresponding to the object identifier is a member of the organization; the third verification result can be used to indicate whether the current usage number of the organization corresponding to the object identifier reaches the subscription number. It should be understood that if any one of the first verification result, the second verification result, or the third verification result indicates a verification failure, it is determined that the object verification result indicates a verification failure. If the first verification result, the second verification result, and the third verification result all indicate a verification success, it is determined that the object verification result indicates a verification success.

[0136] Because the management server, trading platform, and target server provide different services, the three verification results described above can be handled by different verification devices to better meet actual business needs. For example, in this embodiment of the application, the management server can determine the first verification result, the trading platform can determine the second verification result, and the target server can determine the third verification result.

[0137] For ease of understanding, further reference is made to Figure 6, which is a schematic diagram of a method for verifying a business object provided by an embodiment of the present application. As shown in Figure 6, the method involves a management server, a trading platform, and a target server corresponding to the target local software.

[0138] Among them, after obtaining the authorization identifier of the target local software, the management server can execute step S201, and verify the business object based on the authorization identifier of the target local software to obtain a first verification result. Exemplarily, the management server can first determine the first information corresponding to the software identifier and the second information corresponding to the software identifier. Among them, the first information here can be used to indicate the subscription data corresponding to the target local software. The second information here can be used to indicate the device authorization quantity corresponding to the object identifier (for example, 3 units). Further, the management server can verify the business object based on the subscription data and the device authorization quantity to obtain a first verification result, and then determine the object verification result corresponding to the business object based on the first verification result.

[0139] If the first verification result indicates that the subscription data is in a normal state and the current authorized quantity of the business object (for example, 3 units) has reached the device authorization quantity (that is, the verification failed), the management server can directly determine that the object verification result indicates a verification failure, and then send a notification message to the local software authorization management system to indicate an activation failure.

[0140] Optionally, if the first verification result indicates that the subscription data is normal and the current authorized quantity of the business object (e.g., 2 devices) does not reach the device authorization quantity (i.e., verification is successful), the management server may execute step S202 to forward the authorization identifier of the target local software to the trading platform, so that the trading platform executes step S203 to verify the business object based on the authorization identifier of the target local software and obtain a second verification result. The management server may receive the second verification result for the business object from the trading platform and, based on the second verification result, determine the object verification result corresponding to the business object.

[0141] If the second verification result indicates that the business object corresponding to the object identifier is not a member of the organization (for example, the business object has resigned), the trading platform may send the second verification result indicating a verification failure to the management server. Upon receiving the second verification result, the management server may determine, based on the second verification result, that the object verification result indicates a verification failure, and then send a notification message indicating an activation failure to the local software authorization management system.

[0142] If the second verification result indicates that the business object corresponding to the object identifier belongs to a member of the organization, the trading platform determines that the second verification result indicates successful verification. At this point, the trading platform may execute step S204 to send the authorization identifier of the target local software to the target server, causing the target server to execute step S205 to verify the business object and obtain a third verification result. Furthermore, the target server may execute steps S206 and S207 to send the third verification result to the management server via the trading platform.

[0143] If the third verification result indicates that the number of units currently in use (e.g., 80 units) of the organization corresponding to the object identifier has reached the subscribed number (i.e., verification failed), the management server may determine, based on the third verification result indicating verification failure, that the object verification result indicates verification failure, and further send a notification message indicating activation failure to the local software authorization management system. If the third verification result indicates that the number of units currently in use (e.g., 80 units) of the organization corresponding to the object identifier has not reached the subscribed number (i.e., verification succeeded), the management server may determine, based on the third verification result indicating verification success, that the object verification result indicates verification success.

[0144] It is understandable that when the third verification result indicates that the verification is successful, the target server can also execute step S208 to generate a first authorization certificate for the business object, and then execute steps S209-S210 to send the first authorization certificate to the management server through the transaction platform.

[0145] S105: The cloud server sends the first authorization certificate to the local software authorization management system.

[0146] S106: The local software authorization management system sends an operation instruction determined according to the first authorization certificate to the target local software.

[0147] The operation instruction here is a verification instruction or an activation instruction. The verification instruction is generated by the local software authorization management system when it does not have the verification function; while the activation instruction is generated by the local software authorization management system when it has the verification function and determines that the first authorization certificate is valid.

[0148] It should be understood that when the local software authorization management system receives the first authorization certificate, it may store the first authorization certificate. For example, the local software authorization management system may directly store the first authorization certificate in a local database.

[0149] Optionally, to improve the security of the first authorization certificate, the local software authorization management system may configure the file permissions of the first authorization certificate, thereby obtaining the configured first authorization certificate and then storing the configured first authorization certificate. The file permissions may include at least one of an edit permission and a read permission; the configured first authorization certificate may also be used to manage the target local software.

[0150] For example, the local software authorization management system can save the first authorization certificate to a local safe. It is understandable that the local safe configures the file permissions of the folder (user-configurable) of a specific path through some underlying mechanisms of the operating system, and ultimately achieves that the user cannot modify, delete, and other operations at will. For example, before the input / output data operation (Input / Output operation, I / O operation) reaches the file system, the filter driver of the file system can intercept the I / O operation, and by switching in and rewriting related callbacks (such as file modification, deletion, copying, viewing, etc.), the user cannot modify, delete, copy, view, and other operations on the first authorization certificate (for example, License file). Only the relevant applications in the whitelist have the permission to open, etc., so as to achieve the protection function of the License file.

[0151] Among them, in an operating system (e.g., a Windows system), one of the most common and powerful places to insert a filter driver is on the file system. File system filter drivers (e.g., minifilters) intercept I / O operations (from applications and the system itself) before they reach the file system. For example, minifilter callbacks can include PreOperation callbacks and PostOperation callbacks. The PreOperation callback is called before each I / O operation of a specified type is passed to the file system. PostOperation is called after the file system processes a specific type of I / O operation.

[0152] It should be understood that when the local software authorization management system does not have a verification function, the local software authorization management system not only needs to send a verification instruction to the target local software, but also needs to send the storage location associated with the first authorization certificate to the target local software, so that the target local software can verify the validity of the first authorization certificate in the storage location based on the verification instruction.

[0153] When the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate and obtain a verification result. When the verification result indicates that the verification is successful, an activation instruction is generated, and the activation instruction can be sent to the target local software. For example, if the digital signature in the first authorization certificate here is obtained by the software supplier of the target local software based on its own private key, after encrypting the first summary information (obtained by using a certain summary algorithm to perform hash calculation on the certificate contents such as the device fingerprint, expiration time and feature set) then, when the local software authorization management system verifies the validity of the first authorization certificate, it needs to first obtain the public key of the software supplier corresponding to the target local software, and then decrypt the digital signature based on the public key to obtain the first summary information. Then, the local software authorization management system needs to use the same summary algorithm as the software supplier to perform hash calculation on the certificate contents such as the device fingerprint, expiration time and feature set to obtain the second summary information, and then the first summary information can be compared with the second summary information. When it is determined that the first summary information is consistent with the second summary information, the local software authorization management system can generate a verification result indicating successful verification; when it is determined that the first summary information is inconsistent with the second summary information, the local software authorization management system can generate a verification result indicating failed verification.

[0154] In an embodiment of the present application, if the local software authorization management system has a verification function, the first authorization certificate will be invisible to the target local software, which will greatly reduce the number of times the first authorization certificate is exposed and more effectively improve the security of the first authorization certificate.

[0155] S107, the target local software is managed based on the operation instruction.

[0156] Exemplarily, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software has a verification function, the SDK verifies the validity of the first authorization certificate in the storage location, obtains a verification result, and sends the verification result to the target local software, so that the target local software is activated when it determines that the verification result indicates that the verification is successful.

[0157] Optionally, if the operation instruction is a verification instruction and the software development kit (SDK) in the target local software does not have verification functionality, the SDK may send the storage location to the target local software. Furthermore, the target local software may invoke a software license verification module in the target local software, verify the validity of the first authorization certificate based on the software license verification module, obtain a verification result, and activate the software if the verification result indicates successful verification.

[0158] Optionally, if the operation instruction is an activation instruction, the target local software can be directly activated.

[0159] Among them, the process of SDK verifying the validity of the first authorization certificate in the embodiment of the present application, and the process of the target local software verifying the validity of the first authorization certificate, can both refer to the process of the local software authorization management system verifying the validity of the first authorization certificate, and will not be repeated here.

[0160] For ease of understanding, please further refer to Figure 7, which is a schematic diagram of an interface switching for software management provided in an embodiment of the present application. As shown in Figure 7, interface J1 can be a management interface provided by a local software authorization management system, and the interface J1 can include N local software, where N is a positive integer. Here, 3 can be taken as an example, and specifically can include local software A, local software B, and local software C. Among them, interface J1 can also include a control K1 (for example, an "open" control) and a control K2 (for example, an "install" control). The control K1 here can be a business control for indicating the startup of the software, and the control K2 can be a business control for indicating the installation of the software.

[0161] In addition, in order to enhance the user experience, the local software authorization management system also has the function of reminding local software that is about to expire. For example, a prompt message indicating that the software is about to expire is displayed in the prompt area of ​​the interface J1 (for example, area Q1 shown in FIG7 ), so that the business object can quickly know the local software that is about to expire. For another example, the embodiment of the present application can also display the prompt message in the functional interface of the local software that is about to expire. Among them, the prompt message here can be a text message such as "The authorization certificate of your local software B will expire in 7 days. In order not to affect your normal use, please contact the enterprise administrator in time for renewal processing." Of course, the prompt message can also be a picture message or a video message, which will not be limited here.

[0162] As shown in FIG7 , an embodiment of the present application can display an expiration date label on the software icon of the local software that is about to expire in interface J1. The expiration date label can be a label such as "Expires in 7 days" displayed on the software icon of local software B. An embodiment of the present application can also describe the software functions of each local software. For example, information briefly describing the software functions of local software C is displayed in area Q2 shown in FIG7 .

[0163] It should be understood that in interface J1, the local software authorization management system can respond to the startup operation of the target local software (for example, local software A) among the three local software, and then refer to the description of steps S101 to S107 in the embodiment corresponding to Figure 5 above to obtain the authorization identifier of the target local software, and based on the authorization identifier of the target local software, obtain the first authorization certificate sent by the cloud, and then manage the target local software based on the first authorization certificate.

[0164] For example, when the business object can execute a startup operation on the control K1 of the local software A, the local software authorization management system can respond to the startup operation and display the interface J2 (i.e., the authorization waiting interface). The interface J2 can display the progress animation corresponding to the software activation process and the progress information corresponding to the software activation process (e.g., the information in area Q3 shown in FIG7 ).

[0165] If the validation result obtained from validating the authorization certificate of local software A indicates successful validation, this means that the embodiment of the present application can successfully activate local software A. In this case, the activation result interface displayed by the local server is the functional interface of local software A. If the validation result obtained from validating the authorization certificate of local software A indicates a validation failure, or if the object verification result determined by the local software authorization management system during verification of the business object indicates a verification failure, this means that the embodiment of the present application failed to successfully activate local software A. In this case, the activation result interface displayed by the local server is interface J3 shown in Figure 7. Region Q4 of interface J3 may include the reason for the activation failure and the method for handling the activation failure.

[0166] It should be noted that the interfaces and controls shown in FIG7 are merely some forms of expression for reference. In actual business scenarios, developers can make relevant designs based on product requirements. The embodiments of this application do not limit the specific forms of the interfaces and controls involved.

[0167] It can be seen that the new software authorization method based on cloud computing technology provided by the embodiment of the present application, by placing the management and distribution of software authorization on the cloud, users / enterprise leaders / enterprise administrators only need to purchase on the trading platform, and need to be connected to the Internet when activating. It can be used offline for a specific time period (such as a week, month, etc.). Users only need to activate once within a certain period, and do not need to activate every time they open the software. Compared with the traditional software authorization method, the embodiment of the present application can use cloud authorization and offline use on demand to realize purchase, automatic renewal or cancellation of software authorization at any time as needed, without the need to maintain a real-time connected network condition, thereby improving the flexibility of software authorization and expanding the scope of application of software authorization. In addition, since the first authorization certificate is generated in the cloud, in an enterprise-oriented scenario, the enterprise administrator can authorize the device and ensure the legal use of the software through signature authentication on the corresponding device, and protect the first authorization certificate through a local safe mechanism, thereby improving anti-tampering capabilities and improving security.

[0168] For ease of understanding, please further refer to Figure 8, which is a schematic diagram of a process flow for software management provided by an embodiment of the present application. As shown in Figure 8, the process involved in the embodiment of the present application may include a software download process and a software activation process. The software download process may include steps S301-S304, and the software activation process may include steps S305-S316.

[0169] In the software download process, the business object can execute step S301 and perform a download operation on the target local software in the management interface provided by the local software authorization management system to request downloading the software installation package of the target local software. For example, the business object can perform a download operation on the control K2 in the interface J1 shown in Figure 7 to request downloading the local software C.

[0170] When responding to the download operation, the local software authorization management system can execute step S302, call the download software package interface, and send the software identifier corresponding to the target local software to the cloud to request the cloud to download the software installation package that matches the software identifier. Furthermore, the cloud can execute step S303 to send the software installation package that matches the software identifier to the local software authorization management system. At this time, the local software authorization management system can execute step S304 to persist the installation information in the local database, that is, establish a mapping relationship between the installation path of the software installation package and the software identifier, and store the mapping relationship in the local database so that the software identifier can be quickly obtained later.

[0171] In the software activation process, the business object can execute step S305 to perform a startup operation on the target local software. When the target local software responds to the startup operation, step S306 is executed to call the activation function of the software development kit SDK to attempt activation. Furthermore, the software development kit can execute step S307 to obtain the activation information of the target local software through the operating system. The activation information here may include the software identifier of the target local software and the device fingerprint corresponding to the local server. Then, the software development kit can execute step S308 to send activation information to the local software authorization management system through communication with the local software authorization management system to request the local software authorization management system to determine the first authorization certificate of the target local software.

[0172] After receiving the activation information of the target local software, the local software authorization management system can determine the object identifier and the request identifier respectively, and then determine the software identifier, device fingerprint, object identifier and request identifier as the authorization identifier of the target local software. Then, based on the authorization identifier of the target local software, a local search can be performed in the file storage space in the local server (for example, a local safe or a local database) to obtain the search result. If the search result indicates that there is an authorization certificate for the target local software in the local safe, but the authorization certificate in the local safe is invalid, or the authorization certificate for the target local software does not exist in the local safe, it means that the search result indicates that the search failed. At this time, the local software authorization management system can execute step S309 and request the cloud to generate a first authorization certificate, that is, the local software authorization management system can generate a download request for managing the target local software and send the download request to the cloud. The download request can include the authorization identifier of the target local software.

[0173] Furthermore, when the cloud determines that the object verification result of the business object indicates successful verification, it can execute step S310 to send first authorization data including a first authorization certificate and structured information to the local software authorization management system. The first authorization certificate here can include a device fingerprint, a digital signature, an expiration date, and a feature set. The structured information can include a request identifier and a validity period.

[0174] At this point, the local software authorization management system can execute step S311 to save the first authorization certificate and the structured information to a file storage space. The file storage space can be a local database corresponding to the local server or a local safe. Furthermore, the local software authorization management system can manage the target local software based on the first authorization certificate.

[0175] For example, if the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate and obtain a verification result. If the verification result indicates that the verification is successful, the local software authorization management system can send an activation instruction to the target local software; the activation instruction is used to instruct the target local software to activate. If the verification result indicates that the verification fails, a notification message indicating that the activation failed is sent to the target local software.

[0176] If the local software authorization management system does not have a verification function, the local software authorization management system needs to execute step S312 and send the storage location of the first authorization certificate to the target local software through the software development kit. At the same time, the local software authorization management system also needs to send a verification instruction to the target local software. The verification instruction here can be used to instruct the validity of the first authorization certificate in the storage location to be verified.

[0177] It is understandable that when the software development kit receives the storage location of the first authorization certificate, it needs to execute step S313 to determine whether the software development kit itself has the verification function. If the software development kit has the verification function, the software development kit can execute steps S314-S315 to verify the validity of the first authorization certificate in the storage location, obtain the verification result, and send the verification result to the target local software so that the target local software can be activated when it is determined that the verification result indicates that the verification is successful. Optionally, if the software development kit does not have the verification function, the software development kit can execute step S316 to send the storage location to the target local software so that the target local software can verify the validity of the first authorization certificate in the storage location based on its own software license verification module, obtain the verification result, and activate when it is determined that the verification result indicates that the verification is successful.

[0178] The specific implementation of steps S305-S316 can be found in the description of S101-S107 in the embodiment corresponding to FIG5 , and will not be repeated here.

[0179] The following describes the method provided in the embodiment of the present application from the perspective of a single network device in conjunction with the accompanying drawings.

[0180] Please refer to Figure 9, which is a schematic diagram of a method for software authorization provided by an embodiment of the present application. As shown in Figure 9, the method is used in a local software authorization management system, which can be used to manage target local software. The local software management system and the target local software are deployed on a local server. The method may at least include S401-S403:

[0181] S401, obtaining the authorization identifier of the target local software.

[0182] The authorization identifier of the target local software may include a software identifier, a device fingerprint, an object identifier, and a request identifier. The software identifier is used to indicate the target local software; the device fingerprint can be used to uniquely identify the device characteristics or unique device identifier of the local server; the object identifier can be used to uniquely indicate the business object that logs into the local software authorization management system; the request identifier is generated when the management server first receives an activation request from the business object for the target local software. The request identifier can be used to indicate the association between the activation request for the target local software and the download request for the target local software. The target local software is any one of the N local software managed by the local software authorization management system; N is a positive integer.

[0183] S402: Obtain the first authorization certificate sent by the cloud according to the authorization identifier.

[0184] Specifically, the local software authorization management system can perform a local search on the local server based on the authorization identifier of the target local software and obtain a search result. If the search result indicates that the search failed, the local software authorization management system can generate a download request for managing the target local software, and then send the download request to the cloud to receive the first authorization certificate sent by the cloud. The download request may include the request identifier. The first authorization certificate here can be used to authorize the target local software.

[0185] Since the first authorization certificate can include device fingerprints, digital signatures, expiration dates, and feature sets, authorizing the target local software means determining whether the business object currently logged into the local software authorization management system can use it normally. It can be understood that the goal of authorization is to allow the business object to use the target local software in accordance with the purchased license, mainly involving the number of copies of the local software installed, the validity period of the local software, the scope of application, and functional modules. The emergence of software authorization technology, especially cloud authorization technology, has addressed the needs of software developers for digital, automated, and manageable software sales, and is a model for the integration of software authorization technology and "Internet Plus".

[0186] S403: Manage the target local software according to the first authorization certificate.

[0187] Specifically, if the local software authorization management system has a verification function, the local software authorization management system can verify the validity of the first authorization certificate and obtain a verification result. When the verification result indicates that the verification is successful, an activation instruction is sent to the target local software, so that the target local software activates the target local software when executing the activation instruction to display the functional interface of the target local software; when the verification result indicates that the verification fails, a notification message indicating the activation failure is sent to the target local software, so that the target local software displays the notification message (for example, displayed in the interface J3 shown in Figure 7 above), thereby causing the business object to be unable to enter the target local software. In other words, the management here refers to deciding whether the target local software is successfully activated based on the verification result of the first authorization certificate.

[0188] Optionally, if the local software authorization management system does not have a verification function, the local software authorization management system can send the storage location of the first authorization certificate to the target local software, or send a verification instruction to the target local software, so that the target local software or the software development kit of the target local software can verify the validity of the first authorization certificate in the storage location.

[0189] It should be understood that the local software authorization management system in the embodiments of the present application can not only be used to install the target local software based on the software installation package corresponding to the target local software when responding to a download operation for the target local software, but also be used to store a mapping relationship. Among them, the mapping relationship can be used to associate the installation path of the software installation package with the software identifier corresponding to the target local software, so that the software identifier can be quickly found based on the installation path, thereby improving the efficiency of software authorization.

[0190] The specific implementation of steps S401 to S404 can be found in the description of steps S102 to S106 in the embodiment corresponding to FIG5 , and will not be repeated here.

[0191] It can be understood that when the business object corresponding to the local server is the first object with software subscription rights, the business object can realize a one-stop experience for the organization to purchase, manage, and use software licenses, thereby improving the experience of the organization, its members, and software suppliers, making the entire delivery and use process easier to trace and control.

[0192] For example, the local software authorization management system can be used to display the subscription interface provided by the trading platform. The subscription interface here may include the target local software. If the business object is the first object with software subscription rights, then in the subscription interface, the local software authorization management system can respond to the business transaction operation for the target local software, determine the subscription data corresponding to the target local software, and then synchronize the subscription data corresponding to the target local software to the cloud through the trading platform. The business transaction operation here is a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software.

[0193] For ease of understanding, further, please refer to Figure 10, which is an interactive schematic diagram for software management provided by an embodiment of the present application. As shown in Figure 10, the interactive schematic diagram here may specifically involve members within the organization, a first object within the organization (for example, a purchaser of an enterprise), a trading platform, a management server, a target server, and a local software authorization management system and target local software deployed on a local server. Among them, the interactive schematic diagram may include a software purchase process and a software activation process. Among them, the software purchase process here may include steps S11-step S13, and the software activation process may include steps S14-step S22.

[0194] During the software purchase process, a first party within an organization can perform a purchase operation for the target local software in the subscription interface provided by the trading platform, so that the trading platform generates subscription data (i.e., purchase information) corresponding to the target local software in response to the purchase operation. The trading platform can then execute steps S12 and S13 to synchronize the purchase information with the target server deployed in the cloud and the management server deployed in the cloud, respectively.

[0195] In the software activation process, members within the organization can execute step S14 to perform a startup operation on the target local software, such as starting the target local software through the local software authorization management system or directly starting the target local software. Then, the local software authorization management system can obtain the authorization identifier of the target local software locally, and when a valid first authorization certificate is not found locally, it can execute step S15 to send the authorization identifier of the target local software to the management server. At this time, the management server can verify the members within the organization based on the authorization identifier of the target local software to obtain a first verification result. When the first verification result indicates that the verification is successful, the management server can execute step S16 to send the authorization identifier of the target local software to the trading platform, so that the trading platform verifies the business object based on the authorization identifier of the target local software to obtain a second verification result. When the second verification result indicates that the verification is successful, the trading platform can execute step S17 to send the authorization identifier of the target local software to the target server, so that the target server verifies the business object to obtain a third verification result. When the third verification result indicates that the verification is successful, the target server can generate a first authorization certificate and structured information corresponding to the first authorization certificate for the business object, and then execute steps S18-S20 to send the first authorization data including the first authorization certificate and structured information to the local software authorization management system through the trading platform and the management server.

[0196] At this point, the local software authorization management system may execute step S21 to send an operation instruction (e.g., an activation instruction / verification instruction) to the target local software, so that the target local software executes the operation instruction. If the verification result of the validity verification of the first authorization certificate indicates that the verification is successful, the target local software may execute step S22 to display a functional interface of the target local software.

[0197] Further, please refer to Figure 11, which is a second interactive diagram for software management provided by an embodiment of the present application. As shown in Figure 11, the interactive diagram here may specifically involve members within the organization, a first object within the organization (for example, a purchaser of an enterprise), a trading platform, a management server, a target server, and a local software authorization management system deployed on a local server and target local software. Among them, the interactive diagram may include a software renewal process and a software activation process. Among them, the software renewal process here may include steps S31-step S33, and the software activation process may include steps S34-step S42.

[0198] During the software renewal process, a first party within an organization can execute a renewal operation for the target local software in the subscription interface provided by the trading platform, so that the trading platform, in response to the renewal operation, generates subscription data (i.e., renewal information) corresponding to the target local software. The trading platform can then execute steps S32 and S33 to synchronize the renewal information to the target server deployed in the cloud and the management server deployed in the cloud, respectively.

[0199] The software activation process shown in FIG. 11 may refer to the software activation process shown in FIG. 10 , and will not be described in detail here.

[0200] Further, please refer to Figure 12, which is a third interactive diagram for software management provided by an embodiment of the present application. As shown in Figure 12, the interactive diagram here may specifically involve members within the organization, a first object within the organization (for example, a purchaser of an enterprise), a trading platform, a management server, a target server, a local software authorization management system deployed on the local server, and the target local software.

[0201] It is understandable that this cancellation scenario often occurs when a member within an organization has activated the target local software based on the first authorization certificate of the target local software, and the first object within the organization performs an unsubscription or deactivation (device change) scenario for the target local software. For example, the first object within the organization can perform a cancellation operation on the target local software in the subscription interface provided by the trading platform, so that the trading platform generates subscription data (i.e., cancellation information) corresponding to the target local software when responding to the cancellation operation. Then, the trading platform can execute steps S52-S53 to synchronize the cancellation information to the target server deployed in the cloud and the management server deployed in the cloud, respectively.

[0202] At this time, when the members in the organization execute step S54 and perform the startup operation for the target local software, the local software authorization management system can call the certificate refresh interface to obtain the authorization identifier of the target local software locally, and then execute step S55 to send the authorization identifier of the target local software to the management server. At this time, the management server can verify the members in the organization based on the authorization identifier of the target local software to obtain a first verification result. Since the management server has synchronized the cancellation information corresponding to the target local software, the first verification result here indicates that the subscription data is in an abnormal state (for example, a state indicating that the target local software has been canceled / unsubscribed). At this time, the management server needs to obtain the second authorization certificate generated by the target server for the members in the organization, and then send the second authorization certificate to the local software authorization management system to receive the cancellation success message returned by the local software authorization management system for the target local software. Among them, the cancellation success message here can be used to indicate that the activation instruction for the target local software has been successfully canceled.

[0203] Specifically, if the first verification result indicates that the subscription data is in an abnormal state, the management server may execute steps S56 and S57 to transmit the authorization identifier of the target local software to the target server via the trading platform. The target server, based on the authorization identifier of the target local software and the previously synchronized subscription data, may generate a second authorization certificate and structured information corresponding to the second authorization certificate for each member of the organization. Furthermore, the target server may execute steps S58 and S50 to transmit the second authorization data, including the second authorization certificate and its structured information, to the local software authorization management system via the trading platform and the management server.

[0204] At this point, the local software authorization management system may execute step S52 to send an operation cancellation instruction (i.e., an instruction to cancel the activation instruction / verification instruction) to the target local software, so that the target local software generates a cancellation success message after executing the operation cancellation instruction. The target server may then execute steps S52-S55 to forward the cancellation success message to the local software authorization management system, the management server, the trading platform, and the target server, respectively.

[0205] It can be seen from this that the local software authorization management system can cancel the corresponding software license of the activated device through negotiation with the trading platform, the target server, and the management server. This scenario requires the user to be connected to the Internet during the cancellation process, and the cancellation process is completed only after confirming with the cloud that the cancellation is complete. Otherwise, the cancellation process fails. The trading platform can use this rule to constrain the organization / members within the organization to stay connected to the Internet during the cancellation process. Under the condition of being connected to the Internet, a new authorization certificate (i.e., the second authorization certificate) is obtained again through interaction with the management server, the trading platform, and the target server. Among them, the validity period of the second authorization certificate may be an expired time.

[0206] It is understandable that when the business object is a second object with organization management authority, the business object can be used to manage M objects within the organization, where M is a positive integer, wherein the second object and the M objects belong to the same organization.

[0207] For example, the local software authorization management system can display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software. When the second object performs a trigger operation on the authorization control corresponding to the target local software, the local software authorization management system can respond to the trigger operation and display the M objects managed by the second object. Among them, these M objects can be displayed in the bottom area of ​​the authorization interface in the form of a floating window, a mask, or a semi-transparent form, or they can be displayed in a shrinkable interface that can change the display size by dragging and dropping, and the size of the interface is smaller than the authorization interface. Furthermore, the second object can perform an authorization quantity change operation (an operation for changing the device authorization quantity of the third object) on any one of the M objects (i.e., the third object). When the local software authorization management system responds to the authorization quantity change operation, the device authorization quantity of the third object in the target local software is changed from the first authorization quantity to the second authorization quantity, and then the second authorization quantity can be sent to the cloud.

[0208] For ease of understanding, please further refer to Figure 13, which is a schematic diagram of an interface switching for authorization management of members within an organization provided in an embodiment of the present application. As shown in Figure 13, interface J4 refers to an authorization interface for authorization management of N local software, where N is a positive integer. Here, 3 can be taken as an example, specifically including local software A, local software B, and local software C. Among them, each local software corresponds to an authorization control (for example, a "member authorization" control).

[0209] When the second object (for example, the administrator of a certain enterprise) performs a trigger operation on the authorization control (control K3 shown in Figure 13) corresponding to the local software A, the local software authorization management system can respond to the trigger operation and display interface J5. Among them, the interface J5 can be a sub-interface (for example, a pop-up window) displayed independently on the interface J4. As shown in Figure 13, the interface J5 can include M objects managed by the second object (for example, members within a department). It can be understood that the interface J5 can be displayed according to the organizational structure, or it can default to displaying the earliest member to be configured, and the operable area (for example, a selected check box) corresponding to the activated member (for example, object b) can be grayed out.

[0210] In addition, the interface J5 may also include subscription data corresponding to the local software A (e.g., order number, number of subscriptions, number of unallocated copies, etc.), so as to prompt the second object to reasonably configure the members within the organization. It should be noted that when the second object reduces the device authorization quantity of a member, the condition that the device authorization quantity is greater than or equal to the number of activated copies of the member must be met. When adding a new member or increasing the device authorization quantity of an existing member, the condition that the device authorization quantity is greater than or equal to 1 must be met when the unallocated quantity is greater than 0.

[0211] It should be understood that the second object needs to first select the object to be configured (i.e., the third object, for example, object a and object c) in the member selection area (for example, area Q5) in the interface J5, and then when the selected object is displayed in the member authorization area (for example, area Q6), the second object can perform authorization quantity change operations for object a and object c respectively, for example, changing the device authorization quantity of object a to 4 and changing the device authorization quantity of object c to 2.

[0212] After reconfiguring the device authorization amounts of object a and object c, the second object can perform a trigger operation on the confirmation control in interface J5 (for example, the "OK" control shown in control K4), thereby causing the local software authorization management system to display interface J6 in response to the trigger operation. The interface J6 can also be a sub-interface (for example, a pop-up window) displayed independently on interface J4. As shown in Figure 13, the interface J6 can include changes in the device authorization amount of object a (for example, an increase from 3 to 4) and changes in the device authorization amount of object c (for example, a decrease from 5 to 2), so that the second object can reconfirm whether to authorize the above-mentioned objects a and c.

[0213] After confirming that the second object is correct, it can trigger the authorization confirmation control in interface J6 (for example, the "OK" control shown in control K5). In response to the trigger operation, the local software authorization management system determines that the device authorization quantity of object a is changed from the first authorization quantity (for example, 3) to the second authorization quantity (for example, 4), and the device authorization quantity of object c is changed from the first authorization quantity (for example, 5) to the second authorization quantity (for example, 2). The local software authorization management system can then send the second authorization quantity of object a and the second authorization quantity of object c to the cloud.

[0214] Please refer to Figure 14, which is a second schematic diagram of a method for software authorization provided by an embodiment of the present application. As shown in Figure 14, the method is used for target local software. The method may at least include S501-S503:

[0215] S501: Send activation information of the target local software to the local software authorization management system.

[0216] The activation information may include the software identifier of the target local software and the device fingerprint corresponding to the local server. The software identifier may be used to uniquely identify the target local software; the device fingerprint may be used to uniquely identify the device characteristics or unique device identifier of the local server, such as a media access control address (MAC address). A local software authorization management system may be used to manage the target local software.

[0217] S502: Receive an operation instruction returned by the local software authorization management system.

[0218] The operation instruction here is a verification instruction or an activation instruction. The verification instruction is generated by the local software authorization management system when it does not have the verification function; while the activation instruction is generated by the local software authorization management system when it has the verification function and determines that the first authorization certificate is valid.

[0219] S503: If the operation instruction is a verification instruction, obtain the storage location sent by the local software authorization management system, and manage based on the first authorization certificate in the storage location.

[0220] Specifically, if the operation instruction is a verification instruction, the target local software obtains the storage location sent by the local software authorization management system through the SDK in the target local software. The target local software can verify the validity of the first authorization certificate in the storage location based on the SDK, obtain a verification result, and activate it if the verification result indicates successful verification.

[0221] Exemplarily, if the operation instruction is a verification instruction, and the software development kit SDK in the target local software has a verification function, the SDK verifies the validity of the first authorization certificate in the storage location, obtains a verification result, and sends the verification result to the target local software, so that the target local software is activated when it determines that the verification result indicates that the verification is successful.

[0222] Optionally, if the operation instruction is a verification instruction and the software development kit (SDK) in the target local software does not have verification functionality, the SDK may send the storage location to the target local software. Furthermore, the target local software may invoke a software license verification module in the target local software, verify the validity of the first authorization certificate based on the software license verification module, obtain a verification result, and activate the software if the verification result indicates successful verification.

[0223] The specific implementation of S501-S503 can be found in the description of S101-S107 in the embodiment corresponding to FIG5 , and will not be repeated here.

[0224] As can be seen, the business objects in the embodiments of the present application do not need to install and maintain complex authorization management software. They only need to connect to the cloud via the Internet after the offline time ends to use the software, which effectively improves the simplicity of software authorization. In addition, the embodiments of the present application can effectively reduce the workload of traditional software modification through the software SDK and local software authorization management system. For enterprises, software licenses can be subscribed according to the actual needs of users, avoiding the fixed costs and waste in traditional software authorization methods, thereby effectively reducing the cost of software authorization.

[0225] Further, referring to Figure 15 , Figure 15 is a schematic diagram of the structure of a software authorization device provided in an embodiment of the present application. As shown in Figure 15 , the software authorization device 1 may include at least one of a first acquisition unit 1501, a second acquisition unit 1502, and a management unit 1503. These units may perform the response functions of the various devices in the above-described method embodiments.

[0226] In a possible implementation, the software authorization device 1 can be used to implement the functions of the local software authorization management system in Figure 9. The local software authorization management system is used to manage target local software, and the local software management system and the target local software are deployed on a local server.

[0227] Specifically, the first acquisition unit 1501 is used to obtain the authorization identifier of the target local software, where the authorization identifier includes a software identifier used to indicate the target local software. The target local software is any one of the N local software managed by the local software authorization management system, where N is a positive integer; the second acquisition unit 1502 is used to obtain the first authorization certificate sent by the cloud based on the authorization identifier, where the first authorization certificate is used to authorize the target local software; the management unit 1503 is used to manage the target local software based on the first authorization certificate.

[0228] The specific implementation of the first acquisition unit 1501, the second acquisition unit 1502 and the management unit 1503 can be found in the description of steps S401 to S403 in the embodiment corresponding to FIG9 , and will not be further described here. In addition, the description of the beneficial effects of adopting the same method will not be repeated.

[0229] Further, please refer to Figure 16, which is a second structural diagram of a software authorization device provided in an embodiment of the present application. As shown in Figure 16, the software authorization device 2 may include at least one of a first acquisition unit 1601, a second acquisition unit 1602, a management unit 1603, a configuration unit 1604, a storage unit 1605, a display unit 1606, a determination unit 1607, a transceiver unit 1608, and a change unit 1609. These units can perform the response functions of each device in the above method embodiment.

[0230] In a possible implementation, the software authorization device 2 can be used to implement the functions of the local software authorization management system in Figure 9. The local software authorization management system is used to manage target local software, and the local software management system and the target local software are deployed on a local server.

[0231] Specifically, the first acquisition unit 1601 is used to obtain the authorization identifier of the target local software, where the authorization identifier includes a software identifier used to indicate the target local software. The target local software is any one of the N local software managed by the local software authorization management system, where N is a positive integer; the second acquisition unit 1602 is used to obtain the first authorization certificate sent by the cloud based on the authorization identifier, where the first authorization certificate is used to authorize the target local software; the management unit 1603 is used to manage the target local software based on the first authorization certificate.

[0232] In one implementation, the software authorization device also includes: a configuration unit 1604, which is used to configure the file permissions of the first authorization certificate to obtain the configured first authorization certificate, the file permissions include at least one of editable permissions or reading permissions, and the configured first authorization certificate is used to manage the target local software; a storage unit 1605, which is used to store the configured first authorization certificate.

[0233] In one implementation, the first obtaining unit 1601 is used to obtain the authorization identifier of the target local software, and includes: a display subunit 16011 and an obtaining subunit 16012 .

[0234] The display subunit 16011 is used to display a management interface including N local software; the acquisition subunit 16012 is used to respond to the startup operation of the target local software among the N local software in the management interface and obtain the authorization identifier of the target local software.

[0235] In one implementation, the authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into a local software authorization management system.

[0236] In one implementation, the second obtaining unit 1602 is used to obtain the first authorization certificate sent by the cloud according to the authorization identifier, and includes: a searching subunit 16021 , a generating subunit 16022 and a first transceiver subunit 16023 .

[0237] The search sub-unit 16021 is used to search in the local server according to the authorization identifier to obtain a search result; the generation sub-unit 16022 is used to generate a download request corresponding to the first authorization certificate if the search result indicates that the search failed, and the download request includes a request identifier, which is used to indicate the association between the activation request and the download request of the target local software; the first transceiver sub-unit 16023 is used to send the download request to the cloud; the first transceiver sub-unit 16023 is also used to receive the first authorization certificate sent by the cloud.

[0238] In one implementation, the management unit 1603 is used to manage the target local software according to the first authorization certificate, and includes: a verification subunit 16031 and a second transceiver subunit 16032 .

[0239] The verification subunit 16031 is used to verify the validity of the first authorization certificate and obtain a verification result; the second transceiver subunit 16032 is used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct the activation of the target local software.

[0240] In one implementation, the management unit 1603 is used to manage the target local software according to the first authorization certificate, and includes: a third transceiver subunit 16033.

[0241] The third transceiver subunit 16033 is used to send the storage location of the first authorization certificate to the target local software; the third transceiver subunit 16033 is also used to send a verification instruction to the target local software, and the verification instruction is used to instruct to verify the validity of the first authorization certificate in the storage location.

[0242] In one implementation, the local software authorization management system is further configured to install the target local software based on a software installation package corresponding to the target local software in response to a download operation for the target local software.

[0243] In one implementation, the local software authorization management system is further used to store a mapping relationship; the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

[0244] In one implementation, the software authorization device also includes: a display unit 1606, which is used to display a subscription interface provided by the transaction platform, the subscription interface includes the target local software; a determination unit 1607, which is used to respond to a business transaction operation for the target local software in the subscription interface if the business object is the first object with software subscription authority, and determine the subscription data corresponding to the target local software, the business transaction operation being a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; and a transceiver unit 1608, which is also used to synchronize the subscription data corresponding to the target local software to the cloud through the transaction platform.

[0245] In one implementation, the software authorization device also includes: a display unit 1606, which is also used to display the authorization control corresponding to the target local software in the authorization interface for authorization management of N local software if the business object is a second object with organizational management authority; the display unit 1606 is also used to respond to the trigger operation on the authorization control and display the M objects managed by the second object, M is a positive integer, and the second object and the M objects belong to the same organization; the change unit 1609 is used to respond to the authorization quantity change operation for the third object among the M objects, and change the device authorization quantity of the third object in the target local software from the first authorization quantity to the second authorization quantity; the transceiver unit 1606 is also used to send the second authorization quantity to the cloud.

[0246] The specific implementations of the first acquisition unit 1601, the second acquisition unit 1602, the management unit 1603, the configuration unit 1604, the storage unit 1605, the display unit 1606, the determination unit 1607, the transceiver unit 1608, and the change unit 1609 can be found in the description of steps S401 to S403 in the embodiment corresponding to FIG. 9 , and will not be further described here. Furthermore, the description of the beneficial effects of employing the same method will not be repeated here.

[0247] Further, referring to Figure 17, Figure 17 is a third structural diagram of a software authorization device provided in an embodiment of the present application. As shown in Figure 17, the software authorization device 3 may include at least one of a transceiver unit 1701 and a processing unit 1702. These units may perform the response functions of each device in the above method embodiment.

[0248] In a possible implementation, the software authorization device 3 can be used to implement the functions of the target local software in FIG14 .

[0249] Specifically, the transceiver unit 1701 is used to send activation information of the target local software to the local software authorization management system. The local software authorization management system is used to manage the target local software. The activation information of the target local software includes a software identifier, which is used to indicate the target local software; the transceiver unit 1701 is used to receive an operation instruction returned by the local software authorization management system; the processing unit 1702 is used to obtain a storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location.

[0250] In one implementation, a software development kit (SDK) for data interaction is integrated into the target local software, and the SDK is used to receive the storage location sent by the local software authorization management system.

[0251] In one implementation, the processing unit 1702 is used to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location, including: the processing unit 1702 is specifically used to obtain the storage location sent by the local software authorization management system through the SDK in the target local software if the operation instruction is a verification instruction; the processing unit 1702 is specifically used to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; the processing unit 1702 is specifically used to activate when the verification result indicates that the verification is successful.

[0252] The specific implementation of the transceiver unit 1701 and the processing unit 1702 can be found in the description of steps S501 to S503 in the embodiment corresponding to FIG14 , which will not be described in detail here.

[0253] Further, referring to Figure 18, Figure 18 is a fourth structural diagram of a software authorization device provided in an embodiment of the present application. As shown in Figure 18, specifically, the software authorization device 4 can be used to implement the functions of the local software authorization management system in Figure 9, or the software authorization device 4 can be used to implement the functions of the target local software in Figure 14.

[0254] Referring to Figure 18 , the software authorization device 4 includes all or part of the hardware of a processor 1801, a communication interface 1802, and a memory 1803. The number of processors 1801 in the software authorization device 4 may be one or more, with Figure 18 using a single processor as an example. In this embodiment of the present application, the processor 1801, the communication interface 1802, and the memory 1803 may be connected via a bus system or other means, with Figure 18 using a bus system 1804 as an example.

[0255] Processor 1801 may be a central processor unit (CPU), a network processor (NP), or a combination of a CPU and an NP. Processor 1801 may also include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0256] The communication interface 1802 is used to receive and send data. Specifically, the communication interface 1802 may include a receiving interface and a sending interface. The receiving interface may be used to receive data, and the sending interface may be used to send data. The number of the communication interface 1802 may be one or more.

[0257] Memory 1803 may include volatile memory, such as random-access memory (RAM); memory 3003 may also include non-volatile memory, such as flash memory, hard disk drive (HDD) or solid-state drive (SSD); memory 1803 may also include a combination of the above types of memory.

[0258] Optionally, the memory 1803 stores an operating system and programs, executable modules or data structures, or subsets thereof, or extended sets thereof, wherein the programs may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks. The processor 1801 can read the programs in the memory 1803 to implement the methods provided in the embodiments of the present application.

[0259] The memory 1803 may be a storage device in the software authorization device 4 , or may be a storage device independent of the software authorization device 4 .

[0260] Bus system 1804 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. Bus system 3004 may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG18 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0261] In some possible embodiments, the above-mentioned software authorization device can be implemented as a virtualized device. For example, the virtualized device can be a virtual machine (VM) running a program for performing software authorization functions, and the virtual machine is deployed on a hardware device (for example, a physical server). A virtual machine refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. The virtual machine can be configured as a software authorization device. For example, the functions of the software authorization device can be implemented based on a general physical server in combination with network function virtualization (NFV) technology. Those skilled in the art can virtualize a software authorization device with the above-mentioned functions on a general physical server in combination with NFV technology by reading this application, and will not be repeated here.

[0262] It should be noted that the software authorization device mentioned in the embodiments of the present application can be a local software authorization management system deployed by a local server, can be the target local software deployed by the local server, or can be a chip used to implement the method of the present application, and the embodiments of the present application do not specifically limit this. When the software authorization device is a chip, the software authorization device can be used to perform the receiving or sending operations by the interface circuit in the chip, and can be used to perform the processing operations by the processor in the chip.

[0263] In a specific implementation, an embodiment of the present application further provides a chip comprising a processor and an interface circuit, wherein the interface circuit is configured to receive instructions and transmit them to the processor; and the processor is configured to execute the operations of each software authorization device in the aforementioned software authorization method. The processor is coupled to a memory configured to store programs or instructions. When the programs or instructions are executed by the processor, the chip implements any of the aforementioned method embodiments.

[0264] Optionally, there may be one or more processors in the chip. The processor may be implemented in hardware and / or software. When implemented in hardware, the processor may be a logic circuit, an integrated circuit, etc. When implemented in software, the processor may be a general-purpose processor implemented by reading software code stored in a memory.

[0265] Optionally, the chip may include one or more memories. The memory may be integrated with the processor or may be provided separately from the processor, which is not limited in this application. For example, the memory may be a non-transient processor, such as a read-only memory (ROM), which may be integrated with the processor on the same chip or provided on separate chips. This application does not specifically limit the type of memory or the configuration of the memory and the processor.

[0266] Exemplarily, the chip may be a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a system on chip (SoC), a central processor unit (CPU), a network processor (NP), a digital signal processor (DSP), a microcontroller unit (MCU), a programmable logic device (PLD), or other integrated chips.

[0267] An embodiment of the present application also provides a computer-readable storage medium, including instructions or a computer program, which, when executed on a processor, enables the processor to execute the software authorization method provided in the above embodiment.

[0268] An embodiment of the present application further provides a computer program product comprising instructions or a computer program, which, when executed on a processor, enables a software authorization device to execute the software authorization method provided in the above embodiment.

[0269] The terms "first," "second," "third," "fourth," and the like (if any) in the specification and claims of this application and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequential sequence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0270] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0271] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of units is only a logical business division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0272] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0273] Those skilled in the art will appreciate that, in one or more of the examples above, the services described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these services may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one location to another. Storage media may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0274] The above specific implementation methods further describe in detail the purpose, technical solutions and beneficial effects of this application. It should be understood that the above are only specific implementation methods of this application.

[0275] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A software authorization method, characterized in that: The method is used for a local software authorization management system, the local software authorization management system is used to manage target local software, the local software management system and the local software are deployed on a local server, and the method includes: Obtaining an authorization identifier of the target local software, the authorization identifier including a software identifier for indicating the target local software, the target local software being any one of N local software managed by the local software authorization management system, where N is a positive integer; According to the authorization identifier, obtaining a first authorization certificate sent by the cloud, where the first authorization certificate is used to authorize the target local software; The target local software is managed according to the first authorization certificate.

2. The method according to claim 1, characterized in that The method further comprises: configuring the file permissions of the first authorization certificate to obtain a configured first authorization certificate, wherein the file permissions include at least one of an edit permission or a read permission, and the configured first authorization certificate is used to manage the target local software; The configured first authorization certificate is stored.

3. The method according to claim 1 or 2, characterized in that: The authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into the local software authorization management system.

4. The method according to any one of claims 1 to 3, characterized in that: The step of obtaining, according to the authorization identifier, a first authorization certificate sent by the cloud, includes: Searching in the local server according to the authorization identifier to obtain a search result; If the search result indicates that the search fails, generating a download request corresponding to the first authorization certificate, the download request including a request identifier, the request identifier being used to indicate an association relationship between the activation request of the target local software and the download request; Sending the download request to the cloud; Receive the first authorization certificate sent by the cloud.

5. The method according to any one of claims 1 to 4, characterized in that: The managing the target local software according to the first authorization certificate includes: Verifying the validity of the first authorization certificate to obtain a verification result; When the verification result indicates that the verification is successful, an activation instruction is sent to the target local software, where the activation instruction is used to instruct to activate the target local software.

6. The method according to any one of claims 1 to 5, characterized in that: The managing the target local software according to the first authorization certificate includes: Sending the storage location of the first authorization certificate to the target local software; A verification instruction is sent to the target local software, where the verification instruction is used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

7. The method according to any one of claims 1 to 6, characterized in that: The local software authorization management system is also used to install the target local software based on the software installation package corresponding to the target local software when responding to a download operation for the target local software.

8. The method according to claim 7, characterized in that The local software authorization management system is also used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Displaying a subscription interface provided by a trading platform, wherein the subscription interface includes the target local software; If the business object is a first object with software subscription rights, then in the subscription interface, a response to the target local software determining the subscription data corresponding to the target local software by performing a business transaction operation on the target local software, wherein the business transaction operation is a purchase operation on the target local software, a renewal operation on the target local software, or a cancellation operation on the target local software; The subscription data corresponding to the target local software is synchronized to the cloud through the transaction platform.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: If the business object is a second object with organizational management authority, then in the authorization interface for authorization management of the N local software, an authorization control corresponding to the target local software is displayed; In response to a trigger operation on the authorization control, M objects managed by the second object are displayed, where M is a positive integer, and the second object and the M objects belong to the same organization; In response to an authorization quantity change operation on a third object among the M objects, changing the device authorization quantity of the third object in the target local software from a first authorization quantity to a second authorization quantity; The second authorization amount is sent to the cloud.

11. A software authorization method, characterized in that: The method is used for target local software, comprising: Sending activation information of the target local software to a local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate the target local software; Receiving an operation instruction returned by the local software authorization management system; If the operation instruction is a verification instruction, a storage location sent by the local software authorization management system is obtained, and management is performed based on the first authorization certificate in the storage location.

12. The method according to claim 11, characterized in that The target local software is integrated with a software development kit SDK for data interaction, and the SDK is used to receive the storage location sent by the local software authorization management system.

13. The method according to claim 11 or 12, characterized in that: If the operation instruction is a verification instruction, obtaining the storage location sent by the local software authorization management system, and managing based on the first authorization certificate in the storage location, including: If the operation instruction is a verification instruction, obtaining the storage location sent by the local software authorization management system through the SDK in the target local software; Based on the SDK, verify the validity of the first authorization certificate in the storage location to obtain a verification result; The activation is performed when the verification result indicates that the verification is successful.

14. A software authorization device, characterized in that: The software authorization device is applied to a local software authorization management system, the local software authorization management system is used to manage target local software, the local software management system and the target local software are deployed on a local server, and the software authorization device includes: A first acquisition unit, configured to acquire an authorization identifier of the target local software, wherein the authorization identifier includes a software identifier for indicating the target local software, and the target local software is any one of N local software managed by the local software authorization management system, where N is a positive integer; A second acquisition unit, configured to acquire, according to the authorization identifier, a first authorization certificate sent by the cloud, wherein the first authorization certificate is used to authorize the target local software; A management unit is used to manage the target local software according to the first authorization certificate.

15. The software authorization device according to claim 14, characterized in that: The software authorization device also includes: a configuration unit, configured to configure the file permissions of the first authorization certificate to obtain a configured first authorization certificate, wherein the file permissions include at least one of an edit permission or a read permission, and the configured first authorization certificate is used to manage the target local software; The storage unit is used to store the configured first authorization certificate.

16. The software authorization device according to claim 14 or 15, characterized in that: The authorization identifier includes an object identifier, and the object identifier is used to indicate a business object for logging into the local software authorization management system.

17. The software authorization device according to any one of claims 14 to 16, characterized in that: The second acquisition unit is used to acquire the first authorization certificate sent by the cloud according to the authorization identifier, including: A search subunit, configured to search in the local server according to the authorization identifier to obtain a search result; a generating subunit, configured to generate a download request corresponding to the first authorization certificate if the search result indicates that the search fails, the download request including a request identifier, the request identifier being used to indicate an association relationship between the activation request for the target local software and the download request; A first transceiver subunit, used to send the download request to the cloud; The first transceiver subunit is further used to receive the first authorization certificate sent by the cloud.

18. The software authorization device according to any one of claims 14 to 17, characterized in that: The management unit is used to manage the target local software according to the first authorization certificate, including: A verification subunit, used to verify the validity of the first authorization certificate and obtain a verification result; The second transceiver subunit is used to send an activation instruction to the target local software when the verification result indicates that the verification is successful, and the activation instruction is used to instruct to activate the target local software.

19. The software authorization device according to any one of claims 14 to 18, characterized in that: The management unit is used to manage the target local software according to the first authorization certificate, including: A third transceiver subunit is used to send the storage location of the first authorization certificate to the target local software; The third transceiver subunit is further used to send a verification instruction to the target local software, where the verification instruction is used to instruct the target local software to verify the validity of the first authorization certificate in the storage location.

20. The software authorization device according to any one of claims 14 to 19, characterized in that: The local software authorization management system is also used to install the target local software based on the software installation package corresponding to the target local software when responding to a download operation for the target local software.

21. The software authorization device according to claim 20, characterized in that: The local software authorization management system is also used to store a mapping relationship, where the mapping relationship is used to associate the installation path of the software installation package with the software identifier of the target local software.

22. The software authorization device according to any one of claims 14 to 21, characterized in that: The software authorization device also includes: A display unit, used to display a subscription interface provided by the trading platform, wherein the subscription interface includes the target local software; a determination unit, configured to determine, in the subscription interface, subscription data corresponding to the target local software in response to a business transaction operation for the target local software if the business object is a first object having software subscription rights, wherein the business transaction operation is a purchase operation for the target local software, a renewal operation for the target local software, or a cancellation operation for the target local software; The transceiver unit is also used to synchronize the subscription data corresponding to the target local software to the cloud through the transaction platform.

23. The software authorization device according to any one of claims 14 to 22, characterized in that: The software authorization device also includes: The display unit is further configured to display the authorization control corresponding to the target local software in the authorization interface for performing authorization management on the N local software if the business object is a second object with organizational management authority; The display unit is further used to respond to a trigger operation on the authorization control and display M objects managed by the second object, where M is a positive integer, and the second object and the M objects belong to the same organization; A changing unit, configured to respond to an authorization quantity change operation on a third object among the M objects, and change the device authorization quantity of the third object in the target local software from a first authorization quantity to a second authorization quantity; The transceiver unit is further configured to send the second authorization amount to the cloud.

24. A software authorization device, characterized in that: The software authorization device is applied to the target local software, including: The transceiver unit is used to send the activation information of the target local software to the local software authorization management system, the local software authorization management system is used to manage the target local software, the activation information of the target local software includes a software identifier, and the software identifier is used to indicate indicating the target local software; The transceiver unit is used to receive the operation instruction returned by the local software authorization management system; The processing unit is configured to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and perform management based on the first authorization certificate in the storage location.

25. The software authorization device according to claim 24, characterized in that: The target local software is integrated with a software development kit SDK for data interaction, and the SDK is used to receive the storage location sent by the local software authorization management system.

26. The software authorization device according to claim 24 or 25, characterized in that: The processing unit is configured to obtain the storage location sent by the local software authorization management system if the operation instruction is a verification instruction, and manage based on the first authorization certificate in the storage location, including: The processing unit is specifically configured to obtain, through the SDK in the target local software, a storage location sent by the local software authorization management system if the operation instruction is a verification instruction; The processing unit is specifically configured to verify the validity of the first authorization certificate in the storage location based on the SDK to obtain a verification result; The processing unit is specifically configured to be activated when the verification result indicates that the verification is successful.

27. A software authorization device, characterized in that: It comprises a memory and a processor, wherein the memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to implement the method as claimed in any one of claims 1 to 10, or to implement the method as claimed in any one of claims 11 to 13.

28. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the method according to any one of claims 1 to 10 is implemented, or the method according to any one of claims 11 to 13 is implemented.

29. A computer program product, characterized in that The computer program product comprises instructions, which, when executed on a processor, are used to implement the method according to any one of claims 1 to 10, or to implement the method according to any one of claims 11 to 13.

Images