CN111400673A

CN111400673A - Off-line authorization method and device for SDK deployment and electronic equipment

Info

Publication number: CN111400673A
Application number: CN202010357152.2A
Authority: CN
Inventors: 王建强; 顾友良; 苏鹏; 邹旭辉; 李创成
Original assignee: Guangzhou Ziweiyun Technology Co ltd
Current assignee: Guangzhou Ziweiyun Technology Co ltd
Priority date: 2020-04-29
Filing date: 2020-04-29
Publication date: 2020-07-10
Anticipated expiration: 2040-04-29
Also published as: CN111400673B

Abstract

The invention discloses an off-line authorization method for SDK deployment, which comprises the following steps: s1, acquiring a starting event of the SDK; s2, based on the starting event, the SDK generates a global unique identifier GUID; s3, the SDK sends a registration request to a service monitoring program, wherein the request comprises the global unique identifier GUID, the functional module and the IP address; s4, the service monitor encrypts the request to generate a key and sends the key to the SDK, wherein the key comprises: authorization expiration time, a global unique identifier GUID, an IP address and a functional module; and S5, the SDK verifies the key and runs the SDK when the key is verified correctly. The authorization method of the invention uses the global unique identifier, thereby overcoming the problem that a physical machine needs to be bound, ensuring the safety of the algorithm SDK and the rights and interests of an algorithm developer, and reducing the time and labor cost of a user.

Description

Off-line authorization method and device for SDK deployment and electronic equipment

Technical Field

The invention relates to the field of information security, in particular to an off-line authorization method for SDK deployment.

Background

At present, most scenes of an AI algorithm SDK program are deployed at a cloud end or an embedded end in a network online authorization mode, but under the condition that a public security intranet, a company intranet and the like are not networked, a client usually requires to deploy the program to a dedicated server of the client, and the method is not suitable. Therefore, an offline authorization is usually used to ensure the safety of the AI algorithm SDK program and the rights of the algorithm developer. The existing offline authorization mode is usually encrypted through a unique machine code or identification, the existing virtual machine, docker and other technologies can completely simulate the unique information of the hardware, the mode can break through the limitation of the machine, an authorization mechanism is bypassed, an SDK of an algorithm is copied and operated infinitely, and the rights and interests of an algorithm developer cannot be guaranteed; on the other hand, the existing offline authorization method needs to bind operating machines one by one, and when a user needs to replace a machine or a certain device in the machine, the user needs to re-extract the identification code, re-authorize the machine, and make the machine unfriendly.

The background description provided herein is for the purpose of generally presenting the context of the disclosure. Unless otherwise indicated herein, the material described in this section is not prior art to the claims in this application and is not admitted to be prior art by inclusion in this section.

Disclosure of Invention

Aiming at the technical problems in the related art, the invention provides an off-line authorization method for SDK deployment, which can conveniently carry out SDK authorization, can ensure the safety of an algorithm SDK and the rights and interests of an algorithm openers, and can reduce the time and labor cost of users.

In order to achieve the above technical object, an embodiment of the present invention provides an offline authorization method for SDK deployment, including the following steps:

s1, acquiring a starting event of the SDK;

s2, based on the starting event, the SDK generates a global unique identifier GUID;

s3, the SDK sends a registration request to a service monitoring program, wherein the request comprises the global unique identifier GUID, the functional module and the IP address;

s4, the service monitor encrypts the request to generate a key and sends the key to the SDK, wherein the key comprises: authorization expiration time, a global unique identifier GUID, an IP address and a functional module;

and S5, the SDK verifies the key and runs the SDK when the key is verified correctly.

Further, when the SDK is in operation, detecting the authorization expiration time of the secret key, and when the authorization expiration time is detected to be expired, re-authorizing; the re-authorization step is as follows: and the SDK applies for clearing the expiration time in the service monitor program from the service monitor program, regenerates the global unique identifier GUID and executes the steps S2-S5.

Further, the service monitoring program generates an expiration time and an identifier according to the registration request, and records the number of requests.

Further, the service monitor notifies the SDK to re-authorize upon detecting the expiration of the expiration time.

Further, when the SDK is terminated unexpectedly or quits normally, the occupation of the SDK is released by requesting to a service monitoring program.

Further, the service monitoring program detects whether the number of the SDKs of the registration request exceeds the allowed number, and if the number of the SDKs of the registration request exceeds the allowed number, the registration is not allowed.

The invention also realizes an off-line authorization device for SDK deployment, which comprises:

the starting acquisition unit is used for acquiring a starting event of the SDK;

an identifier generation unit, configured to generate, based on the start event, a globally unique identifier GUID by the SDK;

a registration request unit, configured to send a registration request to a service monitor by the SDK, where the request includes the global unique identifier GUID, a function module, and an IP address;

the key receiving unit is used for receiving a key and authorization expiration time, and the service monitoring program encrypts the request to generate the key and the authorization expiration time;

and the verification unit is used for verifying the key by the SDK and running the SDK when the key is verified correctly.

Further, the device further comprises a re-authorization device, and the re-authorization unit is configured to detect an authorization expiration time of the key when the SDK is running, and perform re-authorization when the authorization expiration time is detected to expire.

Further, the device further comprises an occupation removing unit, which is used for requesting the service monitoring program to release the occupation of the SDK when the SDK is terminated unexpectedly or quitted normally.

In addition, the invention also realizes an electronic device, which comprises a memory and a processor, wherein the memory stores computer program codes, and the processor executes the computer program codes to realize the SDK offline deployment authorization method.

The operation of the SDK is authorized by generating a global unique identifier, sending the information such as the global unique identifier, an IP address, a functional module and the like to a service monitoring program for registration, receiving an encrypted key returned by service monitoring and verifying the key. The SDK offline deployment authorization method uses the global unique identifier, thereby overcoming the problem that a physical machine needs to be bound, ensuring the safety of the algorithm SDK and the rights and interests of an algorithm developer, and reducing the time and labor cost of a user.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings without creative efforts.

Fig. 1 is a schematic diagram of a system architecture for offline SDK deployment authorization according to an embodiment of the present invention;

fig. 2 is a schematic diagram of an offline SDK deployment authorization method according to an embodiment of the present invention;

fig. 3 is a schematic diagram of an offline SDK deployment authorization apparatus according to an embodiment of the present invention;

fig. 4 is a schematic diagram of an offline SDK deployment authorization device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments that can be derived by one of ordinary skill in the art from the embodiments given herein are intended to be within the scope of the present invention.

Example one

Referring to fig. 1, the SDK offline deployment authorization system includes a plurality of SDK programs, which are SDK program 1, SDK program 2, SDK program 3, and SDK program 4; a service monitoring program and an intelligent chip; the service monitoring program runs in the intelligent chip and is used for protecting the service monitoring program so that the service monitoring program is difficult to decipher and copy. The SDK program of the present embodiment is deployed in a company intranet, which does not communicate with the internet. Those skilled in the art know that the embodiment is also applicable to other intranet environments, and in addition, the intranet environment does not mean that the whole intranet cannot access the internet at all, and only the network running the SDK cannot access the internet.

Fig. 2 is a flowchart of an offline authorization method for SDK deployment according to this embodiment. As shown in fig. 1, the offline authorization method for SDK deployment in this embodiment includes:

step S1, acquiring a starting event of the SDK;

the start event of the SDK may be any manner of invoking the SDK, such as clicking a specific button to start the SDK, or other applications needing to use the SDK to provide services, and so on.

S2, based on the starting event, the SDK generates a Global Unique Identifier (GUID);

the total number of GUIDs generated by any computer or computer cluster will not generate two identical GUIDs, which is up to 2^128(3.4 × 10^38), so the probability of generating two identical GUIDs randomly is very small, and non-random parameters (such as time) can be added to the algorithm generating the GUIDs to ensure that the repeated situation will not occur.

and the service monitoring program operates an encryption algorithm customized by a developer to encrypt the request information and returns an encrypted key. The key comprises encrypted authorization expiration time, an IP address, a globally unique identifier GUID and function module information. Before returning the key, the service monitoring program also records information such as the key expiration time, the request number, the globally unique identifier GUID, the function module and the like, and the recorded information is also encrypted, wherein the key expiration time is the same as the authorization expiration time. The global unique identifier GUID is an identifier of a unique identity of the technology, so that each key has great randomness and uniqueness, and a user is difficult to crack and the rights and interests of developers are protected.

S5, the SDK verifies the key, and when the key is verified correctly, the SDK is operated.

When the SDK program runs, the encryption key is decrypted by using a developer decryption algorithm, the authorized expiration time is obtained, timing is started, in addition, whether the information such as the global unique identifier GUID and the IP address obtained by the decryption key is consistent with the information generated when the SDK request is generated or not is compared, and if the information is not consistent with the information, the SDK program cannot run.

In the embodiment, the global unique identifier is generated when the SDK runs, the information such as the global unique identifier, the IP address, the function module and the like is sent to the service monitoring program for registration, and the encrypted key returned by the service monitoring program is received to verify the key, so that the running of the SDK is authorized. The embodiment uses the global unique identifier, thereby overcoming the problem that a physical machine needs to be bound, ensuring the safety of the algorithm SDK and the rights and interests of an algorithm developer, and reducing the time and labor cost of a user.

Further, in the running process of the SDK, the SDK program may continuously detect expiration time of its own secret key, and when detecting that the self authorization time expires, the SDK program needs to actively apply for clearing the expiration time in the service program and re-authorize the service program, otherwise, the SDK program terminates running; the re-authorization step is as follows: and the SDK applies for clearing the expiration time in the service monitor program from the service monitor program, regenerates the global unique identifier GUID and executes the steps S2-S5.

Further, the service monitoring program also counts the key expiration time, when the key expiration time expires, the service monitoring program will forcibly terminate the SDK program and re-authorize, otherwise, the SDK program terminates the operation.

Further, when the SDK program is terminated unexpectedly or quitted normally, the service monitor program needs to be requested to release the SDK occupation actively, otherwise, the service monitor program always records the occupation of the SDK program, each time the SDK program is started, the service monitor program needs to be verified whether the SDK program is occupied or not, and whether the SDK program conforms to the request number set by the developer or not, and if the SDK program does not conform to the request number, the SDK program cannot be started.

The service monitor identifies the SDK by a globally unique identifier GUID generated by said SDK, e.g. the service monitor is recorded by:

6F9619FF-8B86-D011-B42D-00C04FC964FF, 200.

The first item is a global unique identifier GUID, the second item 200 represents that the SDK is authorized for 200 hours of use time, the last item occupation table is in the current SDK occupation, the occupied state is marked as occupied after the SDK is successfully registered, and the state is modified to be not occupied when the SDK is accidentally quitted or normally quitted and a service monitoring program is requested to be released.

Those skilled in the art know that occupancy and non-occupancy can be identified by using, for example, 1 and 0, and the embodiment is not particularly limited as long as two states of occupancy and non-occupancy can be distinguished.

Further, the service monitor may obtain the number of running SDKs according to the globally unique identifier, when the service monitor limits the number of running SDKs, the SDKs may limit the running of the SDKs by comparing whether the number of running SDKs exceeds the service monitor limit SDK running number at each running time, for example, the number of running SDKs does not exceed the service monitor limit SDK running number, and the SDKs are allowed to run, otherwise the SDKs are not run, and fraudulent running by copying the client SDKs is prevented, and even if the user runs the SDKs by completely simulating hardware information, the SDKs cannot run a large number of SDK programs without limitation, and the number of running SDK programs depends on the number allowed by the service monitor.

Example two

Referring to fig. 3, the present embodiment provides an offline authorization apparatus for SDK deployment, which includes:

Further, the device further comprises an occupation removing unit, configured to request the service monitor program to release occupation of the SDK when the SDK terminates unexpectedly or exits normally.

EXAMPLE III

Referring to fig. 4, the present embodiment provides a schematic structural diagram of an SDK offline deployment authorization device 20. The SDK offline deployment authorization apparatus 20 of this embodiment comprises a processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21, when executing the computer program, implements the steps in the above-mentioned SDK offline deployment authorization method embodiment, for example, step S1 shown in fig. 2. Alternatively, the processor 21 implements the functions of the modules/units in the above-described device embodiments when executing the computer program.

Illustratively, the computer program may be divided into one or more modules/units, which are stored in the memory 22 and executed by the processor 21 to accomplish the present invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution process of the computer program in the SDK offline deployment authorization apparatus 20.

The SDK offline deployment authorization device 20 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will appreciate that the schematic diagram is merely an example of the SDK offline deployment authorization device 20, and does not constitute a limitation of the SDK offline deployment authorization device 20, and may include more or less components than those shown, or combine some components, or different components, for example, the SDK offline deployment authorization device 20 may further include an input-output device, a network access device, a bus, etc.

The Processor 21 may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic device, discrete hardware component, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, and the processor 21 is a control center of the SDK offline deployment authorization apparatus 20, and various interfaces and lines are used to connect various parts of the entire SDK offline deployment authorization apparatus 20.

The memory 22 may be used to store the computer programs and/or modules, and the processor 21 implements various functions of the SDK offline deployment authorization apparatus 20 by running or executing the computer programs and/or modules stored in the memory 22 and calling data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. In addition, the memory 22 may include high speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), at least one magnetic disk storage device, a Flash memory device, or other volatile solid state storage device.

The modules/units integrated by the SDK offline deployment authorization apparatus 20 may be stored in a computer-readable storage medium if they are implemented in the form of software functional units and sold or used as independent products. Based on such understanding, all or part of the flow of the method according to the above embodiments may be implemented by a computer program, which may be stored in a computer readable storage medium and used by the processor 21 to implement the steps of the above embodiments of the method. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, etc. It should be noted that the computer readable medium may contain content that is subject to appropriate increase or decrease as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media does not include electrical carrier signals and telecommunications signals as is required by legislation and patent practice.

It should be noted that the above-described device embodiments are merely illustrative, where the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. In addition, in the drawings of the embodiment of the apparatus provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, and may be specifically implemented as one or more communication buses or signal lines. One of ordinary skill in the art can understand and implement it without inventive effort.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims

1. An off-line authorization method for SDK deployment is characterized by comprising the following steps:

s1, acquiring a starting event of the SDK;

2. The method of claim 1, the SDK, when run, detecting an authorization expiration time for the key, and re-authorizing when the authorization expiration time is detected to expire; the re-authorization step is as follows: and the SDK applies for clearing the expiration time in the service monitor program from the service monitor program, regenerates the global unique identifier GUID and executes the steps S2-S5.

3. The method of claim 1, wherein the service monitor generates an expiration time, an identifier, and records a number of requests based on the registration request.

4. The method of claim 2, the service monitor notifying the SDK for re-authorization upon detecting the expiration of the expiration time.

5. The method of claim 1, requesting a service monitor to release occupancy of the SDK when the SDK terminates unexpectedly or exits normally.

6. The method of claim 5, wherein the service monitor detects whether the number of SDKs requested for registration exceeds an allowed number, and if so, disallows registration.

7. An offline authorization apparatus for SDK deployment, comprising:

8. The apparatus of claim 7, further comprising means for reauthorizing, when the SDK is running, to detect an authorization expiration time of the key, and when the authorization expiration time is detected, to perform reauthorization.

9. The apparatus of claim 7, further comprising an occupancy release unit to request release of occupancy of the SDK from a service monitor when the SDK terminates unexpectedly or exits normally.

10. An electronic device comprising a memory, a processor having computer program code stored thereon, the processor executing the computer program code for implementing the method according to claims 1-6.