CN115329323A - A service authorization method and system based on Python virtual machine - Google Patents

Abstract

The application provides a Python virtual machine-based service authorization method and a Python virtual machine-based service authorization system, wherein the method comprises the following steps: compiling the Python source code into a pyc file, symmetrically encrypting the Python source code and the Python source code, and providing the Python source code and the Python virtual machine to a software user; because symmetric encryption is used, all pyc files need to be decrypted only once and take a short time. And in order to prevent the Python virtual machine and the pyc file from being copied and transplanted together, the software provider also provides an authentication service realized by Go language for verifying the Web server where the Python virtual machine is located, wherein the Web server and the authentication service use asymmetric encryption for private http communication, thereby realizing the binding of the Web server and the software function and further improving the safety level of the scheme. Through the embodiment of the application, the system of the software user can finish the authorization and the authentication of the software without being networked to the server of the software provider, and the method and the system are suitable for the environment with higher requirements on the security of the system.

Description

A service authorization method and system based on Python virtual machine

technical field

The present application relates to the field of computer technology, in particular to a service authorization method and system based on a Python virtual machine, a computing device, and a computer-readable storage medium.

Background technique

In the prior art, due to the high-level language features of the Python language, it is naturally suitable for the development of server-side Web applications, and various Internet companies use the Python language as a development language for server-side applications. However, the Python language is an interpretation-based language. The programs developed by it are executed based on an interpreter. The source code of the program does not need to be compiled into bytecode, so the source code cannot be well protected and used for commercial activities. Therefore, most of the web applications developed based on Python in the prior art are free public services, internal services of enterprises or some open source projects. Therefore, there is an urgent need for a solution that can commercialize web applications developed in the Python language, and can deliver software products to customers safely and easily in specific scenarios.

Contents of the invention

In view of this, the embodiment of the present application provides a service authorization method and system based on a Python virtual machine, a computing device, and a computer-readable storage medium, so as to solve the technical defects existing in the prior art.

According to the first aspect of the embodiment of the present application, a service authorization method based on a Python virtual machine is provided, including:

Compile the Python source code into a pyc file, and encrypt the pyc file;

The Python virtual machine running on the web server decrypts the pyc file and loads the pyc file;

The Web server sends an authentication request to the authentication service; the authentication service authenticates the authentication request according to the permission file of the Web server;

The Web server receives the client's request and provides the Web service implemented in the pyc file; the Web server and the authentication service are all in an intranet environment.

According to the second aspect of the embodiment of the present application, a service authorization system based on a Python virtual machine is provided, including:

Python virtual machine deployed on the web server;

The Python virtual machine loads the pyc file after decrypting the encrypted pyc file;

An authentication server, the Web server sends an authentication request to an authentication service; the authentication service authenticates the authentication request according to the permission file of the Web server;

The Web server receives the client's request and provides the Web service implemented by the pyc file.

According to a third aspect of the embodiments of the present application, there is provided a computing device, including a memory, a processor, and computer instructions stored in the memory and operable on the processor, and the processor implements the computer instructions when executing the instructions. The steps of the service authorization method based on the Python virtual machine.

According to a fourth aspect of the embodiments of the present application, a computer-readable storage medium is provided, which stores computer instructions, and when the instructions are executed by a processor, the steps of the service authorization method based on a Python virtual machine are implemented.

In the embodiment of the present application, in order to realize the protection and commercialization of software based on the Python language, the developed Python source code is compiled into a pyc file, and the pyc file is symmetrically encrypted and provided to the software user. At the same time, the Python virtual machine with decryption function is provided to the software user. Due to the use of symmetric encryption, all pyc files only need to be decrypted once and the time is short, taking into account the effect of code protection and the efficiency of loading. And in order to prevent the Python virtual machine and pyc files from being copied and transplanted together, the software provider also provides an authentication service implemented by the Go language, which is used to verify the Web server where the Python virtual machine is located. Use asymmetric encryption for private http communication, thus realizing the binding of the Web server and the Web service implemented in Python language. Due to the use of asymmetric encryption, the verification request can be prevented from being intercepted and cracked, which further improves the security level of the scheme, and has higher security than the scheme based on pyc file and virtual machine encryption alone. Finally, through the embodiments of the present application, the system of the software user can complete the authorization and authentication of the software without being connected to the server of the software provider, which is suitable for environments with high requirements on system security.

Description of drawings

FIG. 1 is a structural block diagram of a computing device provided by an embodiment of the present application;

FIG. 2 is a schematic flow diagram of a service authorization method based on a Python virtual machine provided by an embodiment of the present application;

Fig. 3 is a schematic structural diagram of a service authorization system based on a Python virtual machine provided by an embodiment of the present application.

Detailed ways

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the application. However, the present application can be implemented in many other ways different from those described here, and those skilled in the art can make similar promotions without violating the connotation of the present application. Therefore, the present application is not limited by the specific implementation disclosed below.

Terms used in one or more embodiments of the present application are for the purpose of describing specific embodiments only, and are not intended to limit the one or more embodiments of the present application. As used in one or more embodiments of this application and the appended claims, the singular forms "a", "the", and "the" are also intended to include the plural forms unless the context clearly dictates otherwise. It should also be understood that the term "and/or" used in one or more embodiments of the present application refers to and includes any and all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of the present application, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second, and similarly, second may also be referred to as first, without departing from the scope of one or more embodiments of the present application. Depending on the context, the word "if" as used herein may be interpreted as "in response to a determination."

In this application, a service authorization method and system based on a Python virtual machine, a computing device, and a computer-readable storage medium are provided, which will be described in detail in the following embodiments one by one.

FIG. 1 shows a structural block diagram of a computing device 100 according to an embodiment of the present application. Components of the computing device 100 include, but are not limited to, a memory 110 and a processor 120 . The processor 120 is connected to the memory 110 through the bus 130, and the database 150 is used for storing data.

Computing device 100 also includes access device 140 that enables computing device 100 to communicate via one or more networks 160 . Examples of these networks include the Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or a combination of communication networks such as the Internet. Access device 140 may include one or more of any type of network interface (e.g., a network interface card (NIC)), wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, Worldwide Interoperability for Microwave Access ( Wi-MAX) interface, Ethernet interface, Universal Serial Bus (USB) interface, cellular network interface, Bluetooth interface, Near Field Communication (NFC) interface, etc.

In an embodiment of the present application, the above-mentioned components of the computing device 100 and other components not shown in FIG. 1 may also be connected to each other, for example, through a bus. It should be understood that the structural block diagram of the computing device shown in FIG. 1 is only for the purpose of illustration, rather than limiting the scope of the application. Those skilled in the art can add or replace other components as needed.

Computing device 100 may be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile telephones (e.g., smartphones), ), wearable computing devices (eg, smart watches, smart glasses, etc.), or other types of mobile devices, or stationary computing devices such as desktop computers or PCs. Computing device 100 may also be a mobile or stationary server.

Next, a service authorization method based on a Python virtual machine provided by an embodiment of the present application is described. Referring to FIG. 2, FIG. 2 shows a flow chart of a service authorization method based on a Python virtual machine provided according to an embodiment of the present application, including Step 202 to step 208.

Step 202: Compile the Python source code into a pyc file, and encrypt the pyc file.

In a feasible implementation manner, the software provider first compiles the program source code implemented by the Python language into a pyc file. Among them, the pyc file is a binary file, which is a file generated by compiling the source code file of the Python language, that is, the py file. It is a bytecode file, and the loading speed is improved compared with the py file; and the pyc file It is cross-platform and executed by the Python virtual machine on each platform.

However, although the pyc file is a bytecode file, there are still decompilation tools that can restore it to the source code. Therefore, in order to protect the source code, the pyc file needs to be further encrypted.

In a feasible implementation, the software provider uses an encryptor to perform symmetric encryption on the pyc file. Symmetric encryption is an encryption method that uses the same key for encryption and decryption. The sender uses the key to encrypt plaintext data into encrypted files. After receiving the ciphertext, the receiver uses the same key to decrypt the ciphertext into plaintext for reading. Symmetric encryption has the advantages of small amount of encryption calculation and high speed, and is suitable for the scenario of encrypting a large amount of data. By encrypting the pyc file, it is prevented from being restored to the source code by the decompilation tool.

Step 204: the Python virtual machine running on the web server decrypts the pyc file and loads the pyc file.

In a feasible implementation manner, the software provider provides the Python virtual machine and the encrypted pyc file to the software user. Since the pyc file is encrypted, the user cannot easily decompile it to obtain the source code. The software user deploys the Python virtual machine on the web server. When the software starts, the Python virtual machine uses the key to decrypt the pyc file. After the decryption is successful, the pyc file is executed to complete the loading of the pyc file. Among them, when the Python virtual machine loads the encrypted pyc file, it uses the preset key to decrypt it. Due to the use of symmetric encryption, all pyc files only need to be decrypted once and take a short time, taking into account the encryption effect and code loading efficiency.

Step 206: the Web server sends an authentication request to the authentication service; the authentication service authenticates the authentication request according to the permission file of the Web server.

In a feasible implementation, when the Python program in the pyc file is started in the Python virtual machine, the current Web server needs to be verified, otherwise, based on the portability of Python, the Python virtual machine and the pyc file can be Copying and porting to any computer makes it impossible to realize the requirements of commercialization.

Therefore, when the Python program is started in the Python virtual machine, the Web server where the Python virtual machine is located sends an authentication request to an authentication service, and the authentication service authenticates the authentication request according to the license file of the Web server. Therefore, before the authentication request is authenticated through the authentication service, the license file of the Web server of the software user needs to be obtained.

Specifically, run the authorization tool provided by the software provider on the Web server of the software user in advance to obtain the hardware information of the Web server; the software provider uses the authorization management tool to perform asymmetric encryption based on the above hardware information and pre-authorized content to obtain The license file License belonging to the Web server; and then the license file is provided to the software user and deployed in a location that the authentication service can access to authenticate the authentication request of the corresponding Web server. When the authentication is successful, the Web server starts to provide services.

Further, the authentication service uses the public key to verify the license file and confirm the authorized content;

Furthermore, asymmetric encryption is used between the Web server and the authentication service for private http communication, so as to realize the verification and authorization of the Web service implemented in the Python language running on the Web server. By performing asymmetric encryption on the authentication service, requests can be prevented from being intercepted and cracked, further improving the security level of the solution

Further, the authentication service is implemented by Go language. Since the Go language needs to be compiled and executed, which is not easy to be cracked, the authentication function is implemented based on this service, which has higher security than the scheme based solely on pyc file and virtual machine encryption.

In another feasible implementation manner, when the running time of the service on the Web server reaches the expected time period, the authentication request is resent to the authentication service to determine the latest authorization information of the Web server. For example, when the authorization period of the license file of the web server is 1 year, after 1 year, the Python program running on the web server re-initiates a verification request to verify whether the web server has updated the license file.

Step 208: the web server receives requests from various clients, and provides web services realized by pyc files; both the web server and the authentication service are in the intranet environment.

In some scenarios in the prior art, due to security requirements, some important computer systems usually run on the intranet and are isolated from the Internet, such as the operation and maintenance management system and log management system within the enterprise, so the traditional system based on The commercial software authorization method of online authentication cannot be carried out under this condition.

In a feasible implementation of this application, both the web server and the authentication service running the Python virtual machine can be deployed in the intranet environment, and can be completed in the intranet according to the license file of the web server provided by the software provider. Commercial licenses do not require networking to the software provider's license server. After the web server passes the verification, it can receive requests from each client, and provide web services implemented by pyc files through the Python virtual machine.

In the above-mentioned embodiments of the present application, in view of the difficulty in source code protection and commercialization of software developed by Python in the prior art, the software provider compiles the developed Python source code into a pyc file, and executes the pyc file After symmetrical encryption, it is provided to the software user. At the same time, the Python virtual machine with decryption function is provided to the software user. When the software starts, the Python virtual machine uses the key to decrypt the pyc file, and the pyc file can only be executed after the decryption is successful. Due to the use of symmetric encryption, all pyc files only need to be decrypted once and take a short time, taking into account the effect of code protection and the efficiency of loading. Further, in order to prevent the Python virtual machine and pyc files from being copied and transplanted together, the software provider also provides an authentication service implemented by the Go language to verify the Web server where the Python virtual machine is located. This authentication service uses public key authentication The Web server licenses the file and confirms the authorized content. The Web server and the authentication service use asymmetric encryption for private http communication, thereby realizing the verification and authorization of the Web service implemented in Python language running on a specific Web server. Due to the use of asymmetric encryption, the verification request can be prevented from being intercepted and cracked, which further improves the security level of the scheme; the authentication service is implemented through the Go language. Since the Go language needs to be compiled, using the authentication service combined with file encryption is more efficient than using the authentication service alone. The scheme of pyc file and virtual machine encryption has higher security. Finally, through the embodiments of the present application, the system of the software user can complete the authorization and authentication of the software without being connected to the server of the software provider, which is suitable for an environment requiring high system security.

Corresponding to the above method embodiments, the present application also provides an embodiment of a service authorization system based on a Python virtual machine, the system runs in an intranet environment, including:

Python virtual machine deployed on the web server;

The Python virtual machine decrypts the encrypted pyc file and loads the pyc file;

Authentication server, the Web server sends an authentication request to the authentication server; the authentication server authenticates the authentication request according to the permission file of the Web server;

The web server receives requests from various clients and provides web services implemented by pyc files.

The foregoing is a schematic solution of a service authorization system based on a Python virtual machine in this embodiment. It should be noted that the technical solution of this system belongs to the same idea as the above-mentioned technical solution of a service authorization method based on a Python virtual machine. A description of the technical solution of the service authorization method for the virtual machine.

An embodiment of the present application also provides a computing device, including a memory, a processor, and computer instructions stored in the memory and operable on the processor. When the processor executes the instructions, the above-mentioned one based on The steps of the service authorization method for the Python virtual machine.

The foregoing is a schematic solution of a computing device in this embodiment. It should be noted that the technical solution of the computing device belongs to the same idea as the technical solution of the above-mentioned service authorization method based on the Python virtual machine. A description of the technical solution of the service authorization method for the Python virtual machine.

An embodiment of the present application also provides a computer-readable storage medium, which stores computer instructions, and when the instructions are executed by a processor, the steps of the service authorization method based on the Python virtual machine as described above are implemented.

The foregoing is a schematic solution of a computer-readable storage medium in this embodiment. It should be noted that the technical solution of the storage medium belongs to the same idea as the technical solution of the above-mentioned service authorization method based on the Python virtual machine. A description of the technical solution of the service authorization method for the Python virtual machine.

The foregoing describes specific embodiments of the present application. Other implementations are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain embodiments.

The computer instructions include computer program code, which may be in source code form, object code form, executable file or some intermediate form, and the like. The computer-readable medium may include: any entity or system capable of carrying the computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory) , Random Access Memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, computer-readable media Excludes electrical carrier signals and telecommunication signals.

It should be noted that, for the sake of simplicity of description, the aforementioned method embodiments are expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the described action sequence. Depending on the application, certain steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

The preferred embodiments of the present application disclosed above are only used to help clarify the present application. Alternative embodiments are not exhaustive in all detail, nor are the inventions limited to specific implementations described. Obviously, many modifications and changes can be made according to the content of this application. This application selects and specifically describes these embodiments in order to better explain the principles and practical applications of this application, so that those skilled in the art can well understand and use this application. This application is to be limited only by the claims, along with their full scope and equivalents.

Claims (10)

1. A service authorization method based on a Python virtual machine, characterized in that, comprising: Compile the Python source code into a pyc file, and encrypt the pyc file; The Python virtual machine running on the web server decrypts the pyc file and loads the pyc file; The Web server sends an authentication request to the authentication service; the authentication service authenticates the authentication request according to the permission file of the Web server; The Web server receives the client's request and provides the Web service implemented in the pyc file; the Web server and the authentication service are all in an intranet environment. 2. The method according to claim 1, wherein said authentication service comprises: Run the authorization tool on the Web server to obtain the hardware information of the Web server; According to the hardware information and pre-authorized content, the software provider uses the authorization management tool to perform asymmetric encryption to obtain the license file of the Web server; so that the authentication service can access the license file. 3. The method according to claim 1, wherein, encrypting the pyc file comprises: The pyc file is encrypted symmetrically with an encryptor. 4. The method according to claim 1, wherein the sending of the authentication request by the Web server to the authentication service comprises: When the Python program starts in the Python virtual machine, send an authentication request to the authentication service; or, When the expected time period is reached, the authentication request is resent to the authentication service. 5. The method according to claim 1, wherein the authenticating the authentication request by the authentication service according to the permission file of the Web server comprises: The authentication service uses the public key to verify the license file and confirm the authorized content; Asymmetric encryption is used for private http communication between the web server and the authentication service. 6. The method according to claim 1, wherein the authentication service is implemented by Go language. 7. A service authorization system based on a Python virtual machine, running in an intranet environment, is characterized in that, comprising: Python virtual machine deployed on the web server; The Python virtual machine loads the pyc file after decrypting the encrypted pyc file; An authentication server, the Web server sends an authentication request to an authentication service; the authentication service authenticates the authentication request according to the permission file of the Web server; The Web server receives the client's request and provides the Web service implemented by the pyc file. 8. The system according to claim 7, wherein the method for obtaining the license file is: Run the authorization tool on the web server to obtain the hardware information of the server; According to the hardware information and authorization content, the software provider uses the authorization management tool to perform asymmetric encryption to obtain the corresponding license file; so that the authentication service can access the license file. 9. A computing device, comprising a memory, a processor, and computer instructions stored on the memory and operable on the processor, wherein any one of claims 1-6 is realized when the processor executes the instructions The steps of the method. 10. A computer-readable storage medium storing computer instructions, wherein the steps of the method according to any one of claims 1-6 are implemented when the instructions are executed by a processor.

Images