CN115801281A - Authorization method, electronic device, and computer-readable storage medium - Google Patents

Abstract

The application provides an authorization method, an electronic device and a computer readable storage medium, wherein the method comprises the following steps: configuring a plurality of types of digital certificates, wherein the digital certificates at least comprise a management type digital certificate and at least one type of common type digital certificate; issuing an authorization file to the terminal through the authority of the management digital certificate, and backing up the authorization file; acquiring an operation request reported by a terminal; verifying the validity of the first common digital certificate through the authorization file; under the condition that the first common digital certificate is legal, verifying the legality of the operation request through the first digital signature; and executing the operation corresponding to the operation request under the condition that the operation request is legal. According to the method, when the terminal authority needs to be changed, only the authority of the management-type digital certificate is needed to issue the authorization file to the terminal again, and the identity and the authority of each terminal are authenticated again according to the updated authorization file in the authentication stage, so that the flexibility of re-authorization when the terminal authority is changed is greatly improved.

Description

Authorization method, electronic device, computer readable storage medium

technical field

The present application relates to the technical field of online authorization, in particular to an authorization method, electronic equipment and a computer-readable storage medium.

Background technique

Under the current general trend of digital office, when enterprises and institutions implement digital office, they often need to build relevant digital management platforms to manage complicated businesses. However, large and complex digital management platforms are bound to be prone to single-person It is difficult for management to take into account all businesses, and multi-person management can easily lead to confusion of rights and responsibilities, multi-management and other chaos. It is necessary to refine tasks and set up multiple roles on the digital management platform to manage different businesses. For example, the management of shopping malls, industrial parks, or public streets requires the joint management of multiple roles such as network administrators, monitors, and fire inspectors. On the premise of ensuring security and authenticating the identities of business personnel, it is very important to grant corresponding operation rights to various roles. In the existing technology, the construction of a digital certificate management system based on PKI can realize the authentication of personnel identities at the same time. Grant its corresponding operation authority, however, the PKI (Public Key Infrastructure, public key infrastructure) mechanism needs to introduce a third-party organization for authentication, and its authorization flexibility is low when faced with changes in the authority of business personnel.

Contents of the invention

The main purpose of the embodiment of the present application is to propose an authorization method, electronic equipment and computer-readable storage medium. By classifying digital certificates, each type of digital certificate corresponds to a different operation authority, so as to realize the authentication of business terminals while granting Its corresponding operation authority improves the flexibility of re-authorization when the terminal authority changes.

In order to achieve the above purpose, the first aspect of the embodiment of the present application proposes an authorization method, the method includes:

Configure multiple types of digital certificates, wherein the digital certificates at least include management digital certificates and common digital certificates, and the management digital certificates correspond to the authority to issue authorization documents;

issuing an authorization file to at least one terminal through the authority of the management digital certificate, and backing up the authorization file, wherein the authorization file includes the general digital certificate and a corresponding digital signature;

Obtaining an operation request reported by the terminal, wherein the operation request carries a first common digital certificate and a first digital signature corresponding to the terminal;

Verifying the legitimacy of the first common digital certificate through the authorization file;

In the case that the first common type digital certificate is legal, verify the legality of the operation request through the first digital signature;

If the operation request is valid, the operation corresponding to the operation request is executed.

In some embodiments, the method also includes:

A preset decryption module is configured, and at least one of a first preset private key and a first preset public key is stored in the preset decryption module, wherein the first preset private key is used to decrypt the PCK file, so The first preset public key is used to verify the first digital signature.

In some embodiments, the method also includes:

Verify the legitimacy of the management digital certificate through the preset CA certificate;

In the case that the management-type digital certificate is legal, the validity of the first common-type digital certificate is verified through the authorization file.

In some embodiments, the verifying the legitimacy of the first common digital certificate through the authorization file includes:

Determine the legitimacy of the first common digital certificate according to the consistency between the common digital certificate stored in the authorization file and the first common digital certificate.

In some embodiments, the authorization file further includes a preset digest algorithm, the preset digest algorithm is used to generate a digest of the common digital certificate, and the legitimacy of the operation request is verified by the digital signature include:

generating a first digest of the first common digital certificate through a preset digest algorithm;

Decrypting the first digital signature by using a first preset public key to obtain a second digest;

Determine the legality of the operation request according to the consistency between the first digest and the second digest.

In some embodiments, it is characterized in that the method also includes:

Send a certificate issuance request to Security Center;

Receiving the PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is a file obtained by encrypting the P12 digital envelope using the first preset public key;

The PCK file is decrypted by the first preset private key to obtain the P12 digital envelope, wherein the P12 digital envelope includes at least a management digital certificate and at least one type of the general digital certificate;

Extract and save various types of digital certificates from the P12 digital envelope.

In some embodiments, the digital certificate further includes an audit-type digital certificate, and the audit-type digital certificate corresponds to an operation authority for viewing log information of the terminal.

In some embodiments, the digital certificate includes at least a user item or an extension item, and the method further includes:

determining the type of the digital certificate through the user item in the digital certificate;

or

The type of the digital certificate is determined through an extension item in the digital certificate.

The second aspect of the embodiments of the present application proposes an electronic device, including: a memory, a processor, and a computer program stored in the memory and operable on the processor, wherein when the processor executes the computer program Implement the authorization method described in any one of the embodiments of the first aspect.

The third aspect of the embodiments of the present application proposes a computer-readable storage medium, which is characterized in that the computer-readable storage medium stores one or more programs, and the one or more programs can be processed by one or more The device runs to implement the authorization method described in any one of the embodiments of the first aspect.

The authorization method, electronic device, and computer-readable storage medium proposed in the embodiments of the present application include: configuring multiple types of digital certificates, wherein the digital certificates at least include management type digital certificates and common type digital certificates, and the management type The digital certificate corresponds to the authority to issue the authorization file; through the authority of the management digital certificate, the authorization file is issued to at least one terminal, and the authorization file is backed up, wherein the authorization file includes the general digital certificate and the corresponding digital certificate. signature; obtaining an operation request reported by the terminal, wherein the operation request carries a first common digital certificate and a first digital signature corresponding to the terminal; verifying the identity of the first common digital certificate through the authorization file Legitimacy: in the case that the first common type digital certificate is legal, verify the legitimacy of the operation request through the first digital signature; in the case that the operation request is legal, execute the corresponding operation request operate. In this application, multiple types of digital certificates are pre-configured locally, including management digital certificates and various common digital certificates. The management digital certificates correspond to the authority to issue authorization files to the terminal. After the terminal obtains the authorization file, Complete the confirmation of the terminal identity. When the terminal needs to perform an operation, it will report the operation request to the system. The operation request will carry the first common digital certificate corresponding to the terminal identity and the corresponding first digital signature. After receiving the operation request, first verify the legitimacy of the first common digital certificate corresponding to the terminal through the authorization file backed up by the system. If it is legal, it means that the terminal is authorized by the system, and then verify the legitimacy of the operation request through the first digital signature. If the verification is successful, it means that the operation request is sent by the terminal corresponding to the first ordinary digital certificate, and the operation request is legal and can be executed. Based on the method proposed in the embodiment of this application, when the identity of the terminal changes and the authority of the terminal needs to be modified, it is only necessary to re-issue the authorization file to each terminal through the authority of the management digital certificate. After the authorization file is re-issued, the local backup The authorization file is also updated accordingly. Therefore, if a terminal uses the identity of the first digital certificate before the update to report the operation request, the verification will fail. Based on this, on the premise of ensuring the credibility of the authorization chain of trust, greatly improved Flexibility to re-authorize when terminal identity changes.

Description of drawings

FIG. 1 is a flowchart of an authorization method provided by an embodiment of the present application;

Fig. 2 is a schematic diagram of an authorization method provided by an embodiment of the present application;

Fig. 3 is a subflow chart of an authorization method provided by an embodiment of the present application;

Fig. 4 is a subflow chart of an authorization method provided by an embodiment of the present application;

Fig. 5 is a subflow chart of an authorization method provided by an embodiment of the present application;

Fig. 6 is a schematic diagram of an authorization method provided by an embodiment of the present application;

Fig. 7 is a schematic diagram of an electronic device provided by an embodiment of the present application.

The accompanying drawings are used to provide a further understanding of the technical solution of the present application, and constitute a part of the specification, and are used together with the embodiments of the present application to explain the technical solution of the present application, and do not constitute a limitation to the technical solution of the present application.

Detailed ways

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, not to limit the present application.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application, and are not intended to limit the present application.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, means, steps, etc. may be employed. In other instances, well-known methods, apparatus, implementations, or operations have not been shown or described in detail to avoid obscuring aspects of the present disclosure.

The authorization method provided in the embodiment of the present application can be applied to a terminal or a server, and can also be software running on the terminal or the server. In some embodiments, the terminal can be a smart phone, a tablet computer, a notebook computer, a desktop computer, or a smart watch; the server end can be configured as an independent physical server, or as a server cluster composed of multiple physical servers or as a distributed The system can also be configured to provide basic cloud computing such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The cloud server of the service; the software can be an application that realizes the authorization method, etc., but is not limited to the above forms.

Embodiments of the present disclosure may be used in numerous general purpose or special purpose computer system environments or configurations. Examples: personal computers, server computers, handheld or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, including A distributed computing environment for any of the above systems or devices, etc. This application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote storage media including storage devices.

Referring to Fig. 1, Fig. 1 is an authorization method proposed by the embodiment of the present application, including but not limited to the following steps S101 to S106.

Step S101, configuring multiple types of digital certificates, wherein the digital certificates include at least management digital certificates and at least one type of common digital certificates, and the management digital certificates correspond to the authority to issue authorization documents to terminals;

Step S102, issuing an authorization file to at least one terminal through the authority of the management digital certificate, and backing up the authorization file, wherein the authorization file includes a common digital certificate and a corresponding digital signature;

Step S103, obtaining the operation request reported by the terminal, wherein the operation request carries the first common digital certificate and the first digital signature corresponding to the terminal;

Step S104, verifying the legitimacy of the first common digital certificate through the authorization file;

Step S105, in the case that the first common digital certificate is legal, verify the legitimacy of the operation request through the first digital signature;

Step S106, if the operation request is legal, perform the operation corresponding to the operation request.

In some embodiments, multiple types of digital certificates are pre-configured on the system side, including at least management digital certificates and at least one common digital certificate. It can be understood that each type of digital certificate corresponds to a different terminal role, thus That corresponds to different permissions. It should be pointed out that, referring to Figure 2, the management digital certificate corresponds to the authority to issue an authorization file to the terminal. After receiving the authorization file, the terminal will determine the identity and corresponding authority according to the authorization file.

In some embodiments, after the system side determines the digital certificate to be issued based on business requirements, it will package the digital certificate and the corresponding digital signature into an authorization file, and then issue the authorization file to at least one terminal through the authority of the management digital certificate. The authorization file is backed up locally in the system so that after receiving the operation request reported by the terminal, the legitimacy of the operation request can be gradually verified based on the authorization file.

In some embodiments, after receiving the authorization file, the terminal will report the operation request to the system after clarifying the terminal's own identity and corresponding authority. Specifically, the operation request will carry the first common type number used to authenticate the terminal A certificate and a first digital signature for verifying whether the operation request is sent by the terminal.

It is understandable that, in order to prevent the system from performing wrong operations after receiving an operation request reported by an illegal terminal, the terminal will carry the first common digital certificate used to prove the identity of the terminal in the reported operation request, and the system will receive the operation request reported by the terminal. After the operation request, the legitimacy of the first ordinary digital certificate will be verified first through the local backup authorization file, thereby verifying the identity of the terminal. Specifically, the backup authorization file stores various ordinary digital certificates issued by the system to the terminal , by comparing whether the first common digital certificate is the same as the common digital certificate stored in the authorization file, if they are the same, it means that the first common digital certificate is issued by the system to the terminal after being authenticated by the management digital certificate, The first common digital certificate is legal; if it is not the same, that is, the first common digital certificate has not been certified by the management digital certificate or the first management digital certificate has been tampered with, then the first common digital certificate If it is illegal, it means that the system has not authorized the terminal, and the terminal is an illegal terminal. Based on this, it directly refuses to execute the reported operation request.

In the case that the first common type digital certificate is legal, it means that the terminal is authorized by the system. After the operation request message is generated, the operation request message needs to be signed. Specifically, the digest of the first common digital certificate can be generated through a preset digest algorithm, and the digest is encrypted with a pre-configured private key to generate and The terminal's first common digital certificate corresponds to a digital signature. It is understandable that since the network attacker cannot know the digest algorithm and preset private key used in advance, it cannot generate a correct digital signature. Based on this, after the system receives the operation request reported by the terminal and determines that the terminal is legal, it needs to verify the signature of the operation request to prove that the operation request is reported by a legal operator through the terminal. When all the above verifications are passed, the operation request can be proved to be completely legal, and the system can execute the operation request.

In some embodiments, the authorization file contains a timestamp or a monotonic serial number to support the dynamic update of the authorization file, and the verifier only recognizes the largest monotonic serial number. Based on this, if the authorization file is tampered with, its timestamp or monotonic serial number It will also be updated, and the verifier will find that the authorization file has been tampered with during the verification, which will cause the verification to fail and the authorization will be rejected. Based on this, the reliability of the trust chain will be further improved.

In the embodiment of this application, by pre-configuring multiple types of digital certificates locally, including management digital certificates and various common digital certificates, where the management digital certificates correspond to the authority to issue authorization files to the terminal, the terminal obtains the authorization file Finally, the confirmation of the terminal identity is completed. When the terminal needs to perform an operation, it will report an operation request to the system. The operation request will carry the first common digital certificate corresponding to the terminal identity and the corresponding first digital signature. After receiving the operation request, the system first verifies the legality of the first common digital certificate corresponding to the terminal through the authorization file backed up by the system. If it is legal, it means that the terminal is authorized by the system, and then verifies the operation request through the first digital signature. If the verification is successful, it means that the operation request is sent by the terminal corresponding to the first ordinary digital certificate, and the operation request is legal and can be executed. Based on the method proposed in the embodiment of this application, when the identity of the terminal changes and the authority of the terminal needs to be modified, it is only necessary to re-issue the authorization file to each terminal through the authority of the management digital certificate. After the authorization file is re-issued, the local backup The authorization file is also updated accordingly. Therefore, if a terminal uses the identity of the first digital certificate before the update to report the operation request, the verification will fail. Based on this, when it is necessary to change the terminal authority, it only needs to pass the management digital certificate in the system. The authority of the certificate can re-issue the authorization file to each terminal without re-issuing the digital certificate and authenticating the identity to the third-party certification authority, which greatly improves the flexibility of re-authorization when the authority changes.

In some embodiments, referring to FIG. 3 , the authorization method further includes but not limited to the following steps S301 to S303.

Step S301, verifying the legitimacy of the management digital certificate through the preset CA certificate;

Step S302, if the management digital certificate is legal, verify the legality of the first general digital certificate through the authorization file.

It is understandable that the validity of management digital certificates can be verified through CA certification services provided by third-party certification bodies, proving that management digital certificates are issued by CA certification bodies, which can reduce the risk of network attackers using forged management digital certificates to log in to the system. Thereby the risk of authenticating illegal first common class digital certificates. Specifically, the management digital certificate can be verified through the corresponding digital signature of the management digital certificate. Since the digital signature is obtained by digesting the management certificate through the preset digest algorithm and then signing it with the private key, through the preset CA The public key provided by the certificate decrypts the signature, restores it to a digest, and then generates the digest of the management digital certificate through the same digest algorithm. Since the digests generated by using the same digest algorithm for the same content are exactly the same, once the content is different Similarly, the generated abstract will also change accordingly. By comparing whether the decrypted abstract is exactly the same as the abstract generated by the abstract algorithm, you can verify whether the management digital certificate has been tampered with, and realize the verification of the management digital certificate. Signature to verify the legitimacy of the management digital certificate.

In some embodiments, referring to FIG. 4 , the authorization method further includes but not limited to the following steps S401 to S403.

Step S401, generating the first abstract of the first common digital certificate through a preset abstract algorithm;

Step S402, decrypting the first digital signature with the first preset public key to obtain the second digest;

Step S403, determine the legitimacy of the operation request according to the consistency between the first digest and the second digest.

It can be understood that a preset digest algorithm is also stored in the authorization file, and the preset digest algorithm is the digest algorithm used when generating the corresponding digital signature through the first common digital certificate, and the digital signature is passed through the preset digest algorithm. The digest algorithm generates the digest of the first ordinary digital certificate, and then encrypts it with the private key. After receiving the operation request, the system decrypts the first signature carried in the operation request with the public key to obtain the corresponding second digest. The second digest is compared with the first digest of the first common digital certificate generated by the preset digest algorithm. If the first digest is exactly the same as the second digest, it means that the first digital signature is legal. The operation request It is reported after being authenticated and signed by the terminal, and can be executed. If the first digest is different from the second digest, it means that the first digital signature is illegal, the operation request has not passed the terminal authentication, and the system refuses to execute it.

Referring to Fig. 5, in some embodiments, the authorization method further includes but not limited to the following steps S501 to S504.

Step S501, sending a certificate issuance request to the security center;

Step S502, receiving the PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is a file obtained by encrypting the P12 digital envelope using the first preset public key;

Step S503, decrypting the PCK file with the first preset private key to obtain a P12 digital envelope, wherein the P12 digital envelope includes at least a management digital certificate and at least one general digital certificate;

Step S504, extract and save various digital certificates from the P12 digital envelope.

In some embodiments, the system can send a certificate issuance request through a communication channel established with the security center, such as sending a certificate to the security center through an email or a communication link dedicated to sending certificate issuance requests established between the system and the security center Issue the request.

In some embodiments, after receiving the certificate issuance request from the system, the security center will determine the type of digital certificate to be issued according to the certificate issuance request, and package various digital certificates into P12 digital envelopes, and then P12 digital envelopes Encrypt the PCK file to obtain the PCK file, and send the PCK file to the system through mail or a communication link established between the system and the system for sending the PCK file. Digital certificates include at least management digital certificates and ordinary certificates. class digital certificate.

In some embodiments, by preconfiguring the USB Dongle in the system and storing the first preset private key therein, after receiving the PCK file, the PCK file is decrypted by the first preset private key to obtain the P12 digital envelope, It is understandable that in order to ensure that the P12 digital envelope will not be leaked due to network attacks and hijacked data packets by hackers, or the forged digital certificate returned after the hacker intercepts the certificate issuance request will allow network attackers to use In the case of authorization with a pre-backed forged digital certificate, etc., you can generate a PCK file by encrypting the P12 digital envelope with a preset public key in the security center, and pre-configure the first preset corresponding to the preset public key in the security center in the system. Set the private key, when the system receives the PCK file, use the first preset private key to decrypt the PCK file, so as to restore it into a P12 digital envelope and obtain the digital certificate in it. Specifically, it can be generated by the RSA algorithm or RSA2 algorithm The first preset public key and the first preset private key are encrypted by using the public key in the security center and decrypted by the private key in the system. Also, because they do not have the corresponding first preset private key, they cannot decrypt the PCK file to obtain the digital certificate, thereby ensuring the security in the process of issuing the digital certificate.

In the embodiment of this application, by reporting the certificate issuance request to the security center, and receiving the PCK file fed back by the security center based on the certificate issuance request, in the process, the security center encapsulates the digital certificate into a P12 digital envelope, and then passes the first The preset public key encrypts the P12 digital envelope to generate a PCK file and then sends it to the system. After receiving the PCK file, the system passes the first preset private key corresponding to the first preset public key pre-configured in the system. Decrypt the PCK file, based on the form of asymmetric encryption, to ensure that even if the digital certificate is hijacked when the digital certificate is issued from the security center to the system, there is no need to worry about the digital certificate leakage, thus ensuring the security of the digital certificate issuance process.

In some embodiments, by introducing a third-party organization as a security center, it provides CA (electronic certification service, which refers to activities that provide authenticity and reliability verification for all parties related to electronic signatures) certification services, thereby obtaining CA private information. Key, and use the CA private key to issue various digital certificates, and then store various digital certificates locally in the system. When issuing digital certificates in the future, there is no need to request CA certification services from third-party organizations. Instead, all kinds of digital certificates and The digital signature is packaged as an authorization file and sent to each terminal, thus realizing one-time deployment and multiple uses, reducing costs and greatly improving the flexibility of authorization.

It can be understood that, in some embodiments, a preset decryption module may be preconfigured at the system, and at least one of a first preset public key and a first preset private key is stored in the preset decryption module, and the first preset The private key is used to decrypt the PCK file, and the PCK file is restored to a P12 digital envelope, and the first preset public key is used to verify the digital signature. By pre-configuring the preset decryption module storing the first preset private key and the first preset public key at the system, during the certificate issuance process, the security center will package the issued digital certificate into a P12 digital envelope, and then digitally The envelope is encrypted with a public key to obtain a PCK file. After receiving the PCK file, the system will use the first preset private key to decrypt it and restore it to a P12 digital envelope. The network attacker does not have the first preset private key, and cannot decrypt the PCK file and restore it to the P12 envelope. Based on this, the use of public key encryption and private key decryption during the certificate issuance process ensures the security of the certificate issuance; during the authorization verification process Among them, since the operation request reported by the terminal will carry the corresponding digital signature, based on the form of asymmetric encryption, when the terminal uploads the operation request, it will be signed by the first preset private key, and the first preset public key will be used on the system side. Since the network attacker does not have the first preset private key, when he forges an operation request, he cannot use the first preset private key to sign the request message. Based on this, it can effectively prevent the network attacker from forging Operation requests to ensure the security when the terminal reports the request.

In some embodiments, referring to FIG. 2, the digital certificate also includes an audit digital certificate, which corresponds to the operation authority to view system log information. Based on this, an external management terminal is set to audit the system through the audit digital certificate. , so as to build a more complete chain of trust.

In some embodiments, the digital certificate includes at least a subject item or an extension item, and the type of the digital certificate is determined through the subject item in the digital certificate, or the type of the digital certificate is determined through the extension item in the digital certificate.

Referring to Fig. 6, the following is an embodiment of the authorization method based on the embodiment of the present application. Taking the public large-screen display management system as an example, the business requirement is to restrict the public large-screen to only play approved legal materials. Based on this requirement, four types of business terminal roles can be set, namely upload terminal, audit terminal, management terminal and audit terminal.

Firstly configure the decrypted USB dong l e (a hardware cryptographic module with a USB interface with a public-private key pair inside which can encrypt and decrypt data and verify signatures) with public and private key pairs stored in the system and the security center respectively, and Configure the issuing USB dong l e that stores the CA private key. It can be understood that this step only needs to be configured when authorization is performed for the first time, and it can be reused multiple times after the first authorization is completed to issue the USB Dongle e and decrypt the configuration of the USB Dongle e.

The system sends certificate issuance requests for four types of digital certificates: audit, audit, management, and upload to the security center. Among them, the auditing and uploading digital certificates are all ordinary digital certificates. After receiving the request, the security center issues various digital certificates through the CA private key, and encapsulates them into P12 digital envelopes, and then decrypts the first data stored in the USB Dongle. The preset public key encrypts the P12 digital envelope to generate a PCK file, and sends the PCK file to the system. After the system receives the PCK file, it decrypts the PCK file through the first preset private key stored in the USB dongle, restores it to a P12 digital envelope, and saves it locally. The holder of the management digital certificate is the management terminal Distribute various digital certificates to corresponding business terminals, thus completing the process of digital certificate distribution. It can be understood that the above embodiment is an example where the system is used for authorization for the first time and a certificate issuance request needs to be sent to the security center.

After receiving the above-mentioned digital certificate issued by the security center, the system issues authorization documents to the audit terminal and the upload terminal through the management digital certificate. authorization file. After the upload terminal uploads the business material, the audit terminal will review the business material. After the audit is passed, the audit terminal will use the private key corresponding to the audit terminal digital certificate to digitally sign the material data, and the audited business material, the first corresponding to the audit terminal Ordinary digital certificates are packaged into operation request messages and submitted to the system. After the system receives the material, it first verifies the validity of the management terminal digital certificate through the CA root certificate, and then verifies and audits the legitimacy of the terminal digital certificate according to the authorization file. , and finally verify the business material according to the digital signature corresponding to the audit terminal digital certificate. If the above verifications pass, it means that the management terminal is certified by the CA certificate, the audit terminal is certified by the management terminal, and the material is Those that have passed the review of the review terminal can be played, based on which a complete chain of trust is built, and when the identity of the review terminal changes, it is only necessary to re-issue the authorization file composed of other types of common digital certificates to the review terminal through the management digital certificate. Yes, on the premise of ensuring the safety and reliability of the trust chain, the flexibility of re-authorization when the authority changes is improved.

The embodiment of the present application also discloses an electronic device 700 .

Specifically, the electronic device 700 includes: a memory 710 and one or more processors 720 , one processor 720 and the memory 710 are taken as an example in FIG. 7 . The processor 720 and the memory 710 may be connected through a bus 730 or in other ways, and connection through a bus is taken as an example in FIG. 7 .

As a non-transitory computer-readable storage medium, the memory 710 can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the authorization method in the above embodiments of the present application. The processor 720 executes the non-transitory software program and the program stored in the memory 710, so as to implement the above-mentioned authorization method in the embodiment of the present application. For example, execute steps S101 to S106 in FIG. 1 , steps S301 to S302 in FIG. 3 , steps S401 to S403 in FIG. 4 , and steps S501 to S504 in FIG. 5 .

The memory 710 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and at least one application required by a function; the data storage area may store the data required to execute the authorization method in the above-mentioned embodiment of the present application wait. In addition, the memory 710 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory may optionally include memory located remotely from the processor, and these remote memories may be connected to the electronic device via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The non-transitory software programs and programs required to implement the authorization method in the above embodiment of the present application are stored in the memory 710, and when executed by one or more processors, the authorization method in the above embodiment of the present application is executed.

In addition, the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores a computer-executable program, and the computer-executable program is executed by one or more control processors, for example, executing the above-mentioned Figure 1 Step S101 to step S106 in FIG. 3 , step S301 to step S302 in FIG. 3 , step S401 to step S403 in FIG. 4 , and step S501 to step S504 in FIG. 5 .

The block diagrams shown in the drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices entity.

The embodiments described in the embodiments of the present application are to illustrate the technical solutions of the embodiments of the present application more clearly, and do not constitute a limitation to the technical solutions provided by the embodiments of the present application. Those skilled in the art know that with the evolution of technology and new For the emergence of application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

Those skilled in the art can understand that the technical solutions shown in Figures 1 to 7 do not constitute a limitation to the embodiments of the present application, and may include more or less components than those shown in the illustrations, or combine certain components, or different components.

It should be understood that in this application, "at least one (item)" means one or more, and "multiple" means two or more. "And/or" is used to describe the association relationship of associated objects, indicating that there can be three types of relationships, for example, "A and/or B" can mean: only A exists, only B exists, and A and B exist at the same time , where A and B can be singular or plural. The character "/" generally indicates that the contextual objects are an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one item (piece) of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c ", where a, b, c can be single or multiple.

The preferred embodiments of the embodiments of the present application have been described above with reference to the accompanying drawings, which does not limit the scope of rights of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall fall within the scope of rights of the embodiments of the present application.

Claims (10)

1. A method of authorization, the method comprising:

configuring a plurality of types of digital certificates, wherein the digital certificates at least comprise management type digital certificates and at least one type of common type digital certificates, and the management type digital certificates correspond to the authority of issuing authorization files to the terminal;

issuing an authorization file to at least one terminal through the authority of the management type digital certificate, and backing up the authorization file, wherein the authorization file comprises the common type digital certificate and a corresponding digital signature;

acquiring an operation request reported by a terminal, wherein the operation request carries a first common digital certificate and a first digital signature corresponding to the terminal;

verifying the validity of the first common digital certificate through the authorization file;

under the condition that the first common digital certificate is legal, verifying the legality of the operation request through the first digital signature;

and executing the operation corresponding to the operation request under the condition that the operation request is legal.

2. The method of claim 1, further comprising:

and configuring a preset decryption module, wherein at least one of a first preset private key and a first preset public key is stored in the preset decryption module, the first preset private key is used for decrypting the PCK file, and the first preset public key is used for verifying the first digital signature.

3. The method of claim 1, further comprising:

verifying the legality of the management digital certificate through a preset CA certificate;

and under the condition that the management digital certificate is legal, verifying the legality of the first common digital certificate through the authorization file.

4. The method according to claim 2, wherein said verifying the validity of the first generic type digital certificate by the authorization file comprises:

and determining the legality of the first common digital certificate according to the consistency of the common digital certificate stored in the authorization file and the first common digital certificate.

5. The method of claim 2, wherein the authorization file further comprises a preset digest algorithm, the preset digest algorithm is used for generating a digest of the generic digital certificate, and the verifying the validity of the operation request through the digital signature comprises:

generating a first abstract of the first common digital certificate through a preset abstract algorithm;

decrypting the first digital signature through a first preset public key to obtain a second abstract;

and determining the legality of the operation request according to the consistency of the first abstract and the second abstract.

6. The method of claim 2, wherein configuring the plurality of types of digital certificates comprises:

sending a certificate issuance request to a security center;

receiving a PCK file fed back by the security center in response to the certificate issuance request, wherein the PCK file is obtained by encrypting a P12 digital envelope by using the first preset public key;

decrypting the PCK file through a first preset private key to obtain the P12 digital envelope, wherein the P12 digital envelope at least comprises a management digital certificate and at least one type of the common digital certificate;

and extracting and storing various types of digital certificates from the P12 digital envelope.

7. The method according to any one of claims 1 to 6, wherein the digital certificate further comprises an audit-type digital certificate, and the audit-type digital certificate corresponds to an operation authority for viewing the terminal log information.

8. The method of any of claims 1-6, the digital certificate including at least a user item or an extension item, the method further comprising:

determining the type of the digital certificate through a user item in the digital certificate;

or

And determining the type of the digital certificate through the extension item in the digital certificate.

9. An electronic device, comprising: memory, processor and computer program stored on the memory and executable on the processor, characterized in that the processor implements the authorization method according to any of claims 1 to 8 when executing the computer program.

10. A computer-readable storage medium, characterized in that the computer-readable storage medium stores one or more programs which are executable by one or more processors to implement the authorization method according to any one of claims 1 to 8.

Images