WO2021115270A1 - 一种边缘应用的管理方法及装置 - Google Patents

一种边缘应用的管理方法及装置 Download PDF

Info

Publication number
WO2021115270A1
WO2021115270A1 PCT/CN2020/134588 CN2020134588W WO2021115270A1 WO 2021115270 A1 WO2021115270 A1 WO 2021115270A1 CN 2020134588 W CN2020134588 W CN 2020134588W WO 2021115270 A1 WO2021115270 A1 WO 2021115270A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
node
management device
request
license
Prior art date
Application number
PCT/CN2020/134588
Other languages
English (en)
French (fr)
Inventor
欧争光
曹俊
刘志翊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021115270A1 publication Critical patent/WO2021115270A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for managing edge applications.
  • edge applications (or applications) can be pushed to the edge nodes from the cloud center side, and the edge nodes provide users with requirements for real-time services, application intelligence, security, and privacy protection.
  • edge applications can be deployed in devices provided by users or operators, where the application images and algorithm models of the edge applications are protected by a license to prevent duplication and destruction, so that the edge applications can be protected by the license. Provide corresponding services to users in a supported way.
  • the edge node needs to request the license management device on the cloud center side to perform application authentication on the application, and only applications whose authentication result is allowed to run can run in the edge node.
  • the cloud center side needs to maintain its connections with numerous edge nodes. The numerous connections that exist at the same time will increase the burden of the license management equipment on the cloud center side, making the network overhead between the cloud center side and the edge side relatively large.
  • the present application provides a management method and device for edge applications, which are used to reduce the burden of managing equipment on the cloud center side in the management scenario of edge applications, and at the same time reduce the network overhead between the cloud center side and the edge side.
  • the present application provides a method for managing edge applications, which can be executed by the first node or the chip in the first node.
  • the first node is a node elected by edge nodes in the local area network for edge application management.
  • the first node can receive the first request from the second node, and the first request is used to request to verify whether the first application is allowed to run.
  • the first application is deployed on the second node, the first node, and the The second node is an edge node.
  • the first node may determine a first verification result according to the authentication information of the first application.
  • the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the first application, the authentication information of the first application comes from the management device on the cloud center side.
  • the first node may also send the first verification result to the second node.
  • the first node can perform the authentication of the application in the second node. Therefore, it is no longer necessary to request authentication from the management device on the cloud center side by each node where the application is deployed, so as to reduce the burden of the management device.
  • the application can be implemented only by maintaining a connection between the first node and the cloud center side. Authentication, so it can reduce the burden on the network.
  • the authentication of the application deployed by the second node can still be realized, which improves the stability and reliability of the application authentication process Sex.
  • the first node may obtain the authentication information of at least one application from the management device, where the authentication information of the at least one application may include the authentication information of the first application.
  • the first node may also receive a license of at least one application from the management device, and the license of the at least one application may include a license of the first application.
  • the license of the first application may carry the authentication information of the first application.
  • the first node may also send a second request to the management device, where the second request is used to request to obtain a license for the first application. Thereafter, the first node may receive the license of the first application from the management device.
  • the first node may also send the license of the first application to the second node. So that the second node installs the first application according to the license of the first application.
  • the first node may receive a third request from the second node, and the second request may be used to request a license for the first application.
  • the first node can also verify whether the application deployed by the first node itself is allowed to run. Specifically, the first node may determine the second verification result according to the authentication information of the second application, and the second verification result may be used to indicate that the second application is allowed to run, or the second verification result may be used to indicate that the second application is not allowed. Run the second application, and the second application is deployed on the first node.
  • the first node may receive authentication information of at least one application from the management device, and the authentication information of the at least one application includes the authentication information of the second application.
  • the first node may also receive a license of at least one application from the management device, and the license of the at least one application includes a license of the second application.
  • the present application provides a method for managing edge applications, which can be executed by the second node or the chip in the second node.
  • the second node is an edge node other than the first node in the edge computing scenario.
  • the second node can send a first request to the first node, and the first request is used to request to verify whether the first application is allowed to run.
  • the first application is deployed on the second node, the first node, and the second node. Both nodes are edge nodes.
  • the second node receives a first verification result from the second node, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the second node may receive the license of the first application from the first node, so that the second node can install the first application.
  • the second node may also send a third request to the first node, where the third request is used to request a license for the first application.
  • this application provides a method for managing edge applications, which can be executed by a management device.
  • the management device is deployed on the cloud center side, which is farther away from users than the edge nodes.
  • the management device can determine the authentication information of at least one application, the management device is deployed on the cloud center side, and the at least one application includes the first application deployed on the second node.
  • the management device may also send authentication information of at least one application to the first node.
  • the first node and the second node are both edge nodes, and the authentication information of the at least one application is used to verify whether the at least one application is allowed to run.
  • the at least one application may further include a second application deployed on the first node, so that the first node can obtain the authentication information of the second application for the authentication of the second application.
  • the management device may send a license of at least one application to the first node, where the license of the at least one application includes the license of the first application.
  • the license of the at least one application may further include a license of a second application, and the second application is used for deployment on the first node.
  • the management device may also receive a second request from the first node, where the second request is used to request a license for the first application. Therefore, the management device can send the license of the first application to the first node in response to the second request. Similarly, the management device may also send the license of the second application to the first node according to the request from the first node.
  • this application provides a management device for edge applications.
  • the management device may be implemented by the first node or a chip in the first node.
  • the management device may be used to perform the functions or steps or operations provided in the first aspect or any possible design of the first aspect.
  • the management device can implement each function or step or operation in each of the foregoing methods through a hardware structure, a software module, or a hardware structure plus a software module.
  • the management device may be provided with functional modules corresponding to the functions or steps or operations in the above-mentioned methods to support the management device to execute the above-mentioned methods.
  • the management device may include a communication module and a processing module that are coupled to each other, wherein the communication module can be used to support the management device to communicate, and the processing module can be used for the management device to perform processing operations, Such as generating information/messages that need to be sent through the communication module, or processing signals received by the communication module to obtain information/messages.
  • the communication module may be configured to receive a first request from the second node, and the first request is used to request verification whether the first application is allowed to run, and the first application is deployed on the second node.
  • the processing module may determine a first verification result according to the authentication information of the first application, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run An application.
  • the authentication information of the first application comes from the management device on the cloud center side.
  • the communication module may also send the first verification result to the second node.
  • the communication module may obtain the authentication information of at least one application from the management device, where the authentication information of the at least one application may include the authentication information of the first application.
  • the communication module may also receive a license of at least one application from the management device, and the license of the at least one application may include the license of the first application.
  • the license of the first application may carry the authentication information of the first application.
  • the communication module may also send a second request to the management device, where the second request is used to request to obtain a license for the first application. Thereafter, the communication module may receive the license of the first application from the management device.
  • the communication module may also send the license of the first application to the second node. So that the second node installs the first application according to the license of the first application.
  • the communication module may receive a third request from the second node, and the second request may be used to request a license for the first application.
  • the processing module can also verify whether the application deployed by the first node itself is allowed to run. Specifically, the processing module may determine the second verification result according to the authentication information of the second application, the second verification result may be used to indicate that the second application is allowed to run, or the second verification result is used to indicate that the second application is not allowed to run The second application, the second application is deployed on the first node.
  • the communication module may receive authentication information of at least one application from the management device, and the authentication information of the at least one application includes the authentication information of the second application.
  • the communication module may also receive a license of at least one application from the management device, and the license of the at least one application includes the license of the second application.
  • the management device may include a processor for executing the functions or steps or operations provided in the foregoing first aspect and/or any possible design of the first aspect.
  • the management device may also include a memory.
  • the memory may be used to store instructions, and the processor may be used to call and run the instructions from the memory to execute the functions or steps or operations provided in the first aspect and/or any possible design of the first aspect.
  • the management device may further include a communication interface for the management device to communicate in a wired and/or wireless manner.
  • the processor may be used to call instructions stored in the memory to execute the steps executed by the processing module in the fourth aspect.
  • the transceiver can be used to perform the steps performed by the communication module in the fourth aspect described above.
  • this application provides a management device for edge applications.
  • the management device can be implemented by the second node or a chip in the second node.
  • the management device may be used to perform the functions or steps or operations provided in the foregoing second aspect or any possible design of the second aspect.
  • the management device can implement each function or step or operation in each of the foregoing methods through a hardware structure, a software module, or a hardware structure plus a software module.
  • the management device may be provided with functional modules corresponding to the functions or steps or operations in the above-mentioned methods to support the management device to execute the above-mentioned methods.
  • the management device may include a communication module and a processing module that are coupled with each other, wherein the communication module can be used to support the management device to communicate, and the processing module can be used to perform processing operations by the management device, Such as generating information/messages that need to be sent through the communication module, or processing signals received by the communication module to obtain information/messages.
  • the communication module may be used to send a first request to the first node, where the first request is used to request to verify whether the first application is allowed to run, and the first application is deployed on the second node.
  • the communication module may receive a first verification result from the second node, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the communication module may receive the license of the first application from the first node, so that the second node can install the first application.
  • the communication module may also send a third request to the first node, where the third request is used to request a license for the first application.
  • the management apparatus may include a processor for executing the functions or steps or operations provided in the foregoing second aspect and/or any possible design of the second aspect.
  • the management device may also include a memory. Wherein, the memory may be used to store instructions, and the processor may be used to call and execute the instructions from the memory to execute the functions or steps or operations provided in the second aspect and/or any possible design of the second aspect.
  • the management device may further include a communication interface for the management device to communicate in a wired and/or wireless manner.
  • the processor may be used to call instructions stored in the memory to execute the steps executed by the processing module in the fifth aspect described above.
  • the transceiver can be used to perform the steps performed by the communication module in the fifth aspect described above.
  • this application provides a management device for edge applications.
  • the management device can be implemented by a management device on the cloud center side or a chip in the management device.
  • the management device may be used to perform the functions or steps or operations provided in the third aspect or any possible design of the third aspect.
  • the management device can implement each function or step or operation in each of the foregoing methods through a hardware structure, a software module, or a hardware structure plus a software module.
  • the management device may be provided with functional modules corresponding to the functions or steps or operations in the above-mentioned methods to support the management device to execute the above-mentioned methods.
  • the management device may include a communication module and a processing module that are coupled to each other, wherein the communication module can be used to support the management device to communicate, and the processing module can be used to perform processing operations on the management device, Such as generating information/messages that need to be sent through the communication module, or processing signals received by the communication module to obtain information/messages.
  • the processing module may be used to determine authentication information of at least one application, and the at least one application includes the first application deployed on the second node.
  • the communication module may also send authentication information of at least one application to the first node.
  • the first node and the second node are both edge nodes, and the authentication information of the at least one application is used to verify whether the at least one application is allowed to run.
  • the at least one application may further include a second application deployed on the first node, so that the first node can obtain the authentication information of the second application for the authentication of the second application.
  • the communication module may send a license of at least one application to the first node, and the license of the at least one application includes the license of the first application.
  • the license of the at least one application may further include a license of a second application, and the second application is used for deployment on the first node.
  • the communication module may also receive a second request from the first node, where the second request is used to request a license for the first application.
  • the management device may include a processor for executing the functions or steps or operations provided in the foregoing third aspect and/or any possible design of the third aspect.
  • the management device may also include a memory.
  • the memory may be used to store instructions, and the processor may be used to call and run the instructions from the memory to execute the functions or steps or operations provided in the third aspect and/or any possible design of the third aspect.
  • the management device may further include a communication interface for the management device to communicate in a wired and/or wireless manner.
  • the processor may be used to call instructions stored in the memory to execute the steps executed by the processing module in the sixth aspect described above.
  • the transceiver can be used to perform the steps performed by the communication module in the sixth aspect described above.
  • the present application provides an edge application management system.
  • the edge application management system may include the management device shown in the fourth aspect and the management device shown in the fifth aspect.
  • the edge application management system may further include the management device shown in the sixth aspect.
  • the management device shown in the fourth aspect may be composed of software modules and/or hardware components
  • the management device shown in the fifth aspect may be composed of software modules and/or hardware components
  • the management device shown in the sixth aspect may be composed of software modules and/or hardware components. / Or hardware component composition.
  • the edge application management system provided in this embodiment of the present application can be used to execute:
  • the second node may send a first request to the first node, where the first request is used to request verification whether the first application is allowed to run.
  • the first node may determine the first verification result according to the authentication information of the first application, and the first verification result may be used to indicate whether the first application is allowed to run.
  • the first node may send the first verification result to the second node, so that the second node may determine whether to allow the first application.
  • the edge application management system may also include the management device shown in the sixth aspect.
  • the management device shown in the sixth aspect as the management device on the cloud center side as an example, the first node obtains the authentication information of the first application from the management device, and the authentication information of the first application is used to verify whether the first application is allowed to run .
  • this application provides a computer-readable storage medium in which instructions (or programs) are stored, which when invoked for execution on a computer, cause the computer to execute the above-mentioned first aspect or Any one of the possible designs of the first aspect, or any one of the possible designs of the foregoing second aspect or the second aspect, or the method described in the foregoing third aspect or any one of the possible designs of the third aspect.
  • this application provides a computer program product, which may contain instructions that when the computer program product runs on a computer, the computer executes the first aspect or any one of the possible designs of the first aspect. , Or any one of the possible designs of the aforementioned second aspect or the second aspect, or the method described in the aforementioned third aspect or any one of the possible designs of the third aspect.
  • the present application provides a chip and/or a chip system including the chip, and the chip may include a processor.
  • the chip may also include a memory (or storage module) and/or a communication interface (or communication module).
  • the chip can be used to implement any possible design of the first aspect or the first aspect, or any possible design of the second or second aspect mentioned above, or any one of the third aspect or the third aspect mentioned above.
  • the chip system may be composed of the above-mentioned chips, or may include the above-mentioned chips and other discrete devices, such as a memory (or storage module), a communication interface, and/or a communication interface (or communication module).
  • FIG. 1 is a schematic diagram of the architecture of an edge application management system provided by an embodiment of this application;
  • FIG. 2 is a schematic diagram of another edge application management system architecture provided by an embodiment of the application.
  • FIG. 3 is a schematic flowchart of a method for managing edge applications according to an embodiment of this application
  • FIG. 4 is a schematic flowchart of another edge application management method provided by an embodiment of this application.
  • FIG. 5 is a schematic flowchart of another edge application management method provided by an embodiment of this application.
  • FIG. 6 is a schematic structural diagram of a management device provided by an embodiment of the application.
  • FIG. 7 is a schematic structural diagram of another management device provided by an embodiment of the application.
  • FIG. 8 is a schematic structural diagram of another management device provided by an embodiment of the application.
  • FIG. 9 is a schematic structural diagram of another management device provided by an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of another management device provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of another management device provided by an embodiment of the application.
  • FIG. 1 shows an edge application management system.
  • the edge application management system may include a cloud center side management device and an edge side business plane device. It should be understood that the edge application management system described in FIG. 1 may be used to manage edge applications in an edge computing scenario.
  • the cloud center-side management device can be used to issue application licenses and for application authentication, and the cloud center-side management device can realize unified license management.
  • the management device may include a license management node (or called a license management terminal cloud center side node), or the management device may include a license management cluster composed of multiple license management nodes.
  • the management device can be used to generate and store content such as application licenses, application copyright information, and authentication information.
  • content such as application licenses, application copyright information, and authentication information.
  • the copyright information and authentication information of the application can be provided to the management device by the supplier of the application, and the management device generates the application license according to the copyright information and the authentication information of the application.
  • the authentication information of the application can be carried in the license to describe the conditions under which the application is allowed to run.
  • the authentication information can include the authorization validity period conditions of the application (which can be used to determine the time conditions for allowing the application to run), the scope conditions for allowing the application to run (which can be used to determine the conditions for allowing the application to run, geographic location, or usage conditions), and allowed applications
  • the type of Internet of Things (IoT) device condition that is called can be used to determine the type of IoT device that is allowed to be called by the application
  • the scope condition that allows the application to call the IoT device can be used to determine the scenario of the IoT device that is allowed to be called by the application) , Geographic location or usage, etc.
  • the number of IoT devices that are allowed to be called by the application and/or the condition of the access method of the allowed IoT device to access the second node (which can be used to determine the access method of the IoT device that allows the application to call Such as wired access, wireless access and other conditions) and other information.
  • IoT devices such as surveillance devices such as cameras in scenarios such as smart industries and home smart networks, vehicles and electrical appliances with communication functions for robots, these IoT devices can perform corresponding actions based on application control.
  • the IoT device may be connected to one or more edge nodes in a wired or wireless manner, so that the edge node can call the IoT device through an application to achieve control of the IoT device.
  • the service plane equipment may include one or more edge nodes (or clients) in the local area network.
  • the edge nodes can run applications, and the licenses for these applications can be issued by the cloud center side management device, and the cloud center side management device performs application authentication to determine whether the edge node is allowed to run these applications.
  • Edge nodes can be used to run applications in edge computing scenarios to implement computing processes such as application mirroring and algorithm models, so as to provide computing services to users.
  • each edge node needs to request application authentication from the cloud center side management device before running the application or periodically according to a certain period to determine whether to allow the application to run. Only after verification, the application whose authentication result is allowed to run can be run in the edge node.
  • such an authentication method needs to maintain the connection between each edge node where the application is deployed and the cloud center side management device, which is too heavy for the management device and will increase the network overhead between the cloud center side and the edge node. .
  • the embodiment of the present application provides a license management method, which can be applied to the license management system shown in FIG. 1 to reduce the burden on the cloud center side management device in the license management process, and at the same time reduce the cloud center side and edge Network burden between nodes.
  • the edge application management method provided by the embodiment of the present application can be implemented by the first node and the second node.
  • both the first node and the second node are edge nodes in the local area network.
  • the edge application management system shown in FIG. 2 only needs to maintain the connection between the first node and the management node, and the connection between the second node and the first node.
  • the second node may request the first node to authenticate the application.
  • the application management method provided in the embodiment of the present application may include the following steps shown in FIG. 3:
  • the first node receives a first request from the second node, where the first request is used to request verification whether the first application is allowed to run, where the first application is deployed on the second node.
  • the first request may be sent by the second node after determining that the first application needs to be run. For example, after the user triggers the running of the first application through the second node, the first application sends a running request to the second node, and the second node sends the first request according to the running request of the first application.
  • the running of the first application may include the first application executing calculation functions such as its mirroring or algorithm model, and may also include the first application calling the IoT device to implement corresponding functions through the IoT device, for example, implementing a shooting function through a camera.
  • the first node determines the first verification result according to the authentication information of the first application.
  • the first verification result is used to indicate that the first application is allowed to run, or is used to indicate that the first application is not allowed to run.
  • the authentication information of the first application may be stored in the first node.
  • the first node performs the authentication of the application in the second node. Therefore, it is no longer necessary for each node where the application is deployed to request authentication from the management device on the cloud center side, so as to reduce the burden of the management device.
  • the application can be implemented only by maintaining a connection between the first node and the cloud center side. Authentication, so it can reduce the burden on the network.
  • the authentication of the application deployed by the second node can still be realized, which improves the stability and reliability of the application authentication process Sex.
  • the first node may be an edge node elected by some or all of the edge nodes in the local area network, or multiple edge nodes that share data with each other.
  • the edge nodes participating in the election may include the first node and/or the second node. It should be understood that the first node can maintain a connection with the cloud center side management device, and has certain storage and computing capabilities.
  • the information of the first node may be stored in the cloud center-side management device and the edge node (which may include the second node) in the local area network.
  • the edge node may request the first node to verify the validity of the license of the application, for example, perform the steps shown in S101.
  • the first node may send the certificate of the first node to other edge nodes, and the other edge nodes store the certificate of the first node for other edge nodes to verify the first node.
  • the process of verifying the first node by the second node is taken as an example: when the first application is installed in the second node, the second node can obtain the license of the first application and the certificate of the first node from the first node, and The certificate of the first node stored by the second node is compared with a certificate from a node to verify whether the first node is an elected node for application management, thereby improving the reliability of the license management process.
  • the edge node in the local area network can re-elect a node from the edge nodes other than the first node, and use To manage applications deployed on edge nodes.
  • the re-elected node may have the function of the first node.
  • the first node may obtain at least one application license from the cloud center side management device through its connection with the cloud center side management device.
  • the management device may send the license of one or more applications requested by the first node to the first node according to a request from the first node (in this application, the request may be referred to as a second request).
  • the synchronization period may be a preset duration, or a duration negotiated by the first node and the management device.
  • the application license may carry the authentication information of the application, so that the first node may obtain the authentication information of the application after obtaining the application license from the management device.
  • the authentication information of the application for example, the authorization validity period conditions of the application, the range conditions that allow the application to run, the types of IoT devices that are allowed to be called by the application, the range conditions that allow the application to call IoT devices, the number of IoT devices that the application is allowed to call, and / Or information such as the access method conditions of allowed IoT devices.
  • the first node can determine whether to allow the application to run according to the authentication information of the application.
  • the first node may determine whether to allow the operation of the application itself, and/or the first node may determine whether to allow the application to call the IoT device according to the difference in the actual scenario of the application running. It should be understood that the management device may also send the authentication information of the application to the first node independent of the license of the application. For example, the management device sends the license and authentication information of the same application to the first node through different messages.
  • the first node can also obtain a certificate provided by the developer of the application from the cloud center side management device, which is used to verify the security of the edge node when receiving a request for an application license from the edge node to improve license management The reliability of the process.
  • the license management method provided in this embodiment of the application can pass the two-way authentication between the first node and the edge node, thereby improving the reliability of the license management process.
  • the certificate can be carried in the application's license or independent of the application's license.
  • the first request may be sent by the second node based on the running request of the first application (or the request of the first application to call the IoT device).
  • the first application can be used to perform computing functions such as mirroring or algorithm models, and/or to implement corresponding functions of the IoT device by controlling the IoT device.
  • the first request may carry information such as the identification of the first application.
  • the first node may determine whether to allow the first application to run according to the authentication information of the first application.
  • the authentication information of the first application may be stored in the first node. For example, after the first node obtains the license of the first application from the management device, the first node may obtain and store the authentication information of the first node from the license. In addition, the first application may query the authentication information of the first application from the stored authentication information of the application according to information such as the identification of the first application.
  • the first node may determine whether the authorization validity period condition of the first application is satisfied according to the time information.
  • the first node may also determine whether the range condition for allowing the first application to run is satisfied according to the scene information of the second node, the geographic location information of the second node, etc.
  • the first node may also determine whether the range condition of the IoT device allowed to be called by the first application is satisfied according to information such as scene information, geographic location information, or usage of the IoT device requested to be called by the first application.
  • the first node may also determine, according to the type information of the IoT device requested to be called by the first application, whether the IoT device type condition allowed to be called by the first application is satisfied.
  • the first node may also determine whether the number of IoT devices allowed to be called by the first application is satisfied according to the number of IoT devices requested to be called by the first application. The first node may also determine whether the access mode condition of the IoT device allowed by the first application is satisfied according to the access type of the IoT device called by the first application request.
  • the above-mentioned scene information of the second node, the geographic location information of the second node, the scene information of the IoT device requested by the first application, geographic location information, usage, quantity, and/or access mode, etc. can be used by the second node Carried in the first request, or sent by the second node to the first node through a separate message.
  • the first node may send the first verification result to the second node for the second node to determine whether to allow the running of the first application.
  • the first application is taken as an example to illustrate the method for obtaining the license of the application in the present application by the edge node.
  • S201 The user of the first application orders the license of the first application from the cloud center side management device.
  • the license of the first application may carry the authentication information of the first application.
  • the application developer of the first application may provide a first certificate of the first application to the management device, and the first certificate is used to verify the reliability of the edge node to which the first application is deployed.
  • S202 The cloud center side management device sends the license of the first application and the first certificate of the first application to the first node.
  • the cloud center-side management device may send the license and the first certificate of the first application to the first node through a periodic synchronization process; or, the management device may send the first application's license to the first node according to the request of the first node.
  • the license and the first certificate are sent to the first node.
  • the first node receives the license and the first certificate of the first application, and obtains the authentication information of the first application.
  • S203 When the first application is installed in the second node, the second node obtains the first certificate of the first application and sends a third request to the first node.
  • the third request is used to obtain the license of the first application.
  • the third request carries the first certificate of the first application.
  • the first certificate can be built into the installation program of the first application.
  • the first node compares the first certificate from the second node with the first certificate stored by itself. If the comparison results are consistent, perform S205; otherwise, if the comparison results are inconsistent, the first node sends a verification failure response message to the second node, thereby refusing to send the license of the first application to the insecure second node.
  • S205 In response to the request of the second node, the first node sends the license of the first application and the second certificate of the first node to the second node, where the second certificate is used to verify the reliability of the first node.
  • the second node receives the license of the first application and the second certificate of the first node.
  • the second node compares the second certificate from the first node with the second certificate of the first node stored by itself. If the comparison results are consistent, perform S207; otherwise, if the comparison results are inconsistent, the second node refuses to associate the license sent by the first node with the first application, so as to avoid installing insecure certificates.
  • the second node may obtain the second certificate of the first node from the first node in the process of electing the first node.
  • S207 The second node installs the license of the first application.
  • the second node stores the license of the first application in the first application, and completes the installation of the first application.
  • the first node can determine the license of the second application according to the licenses of one or more applications obtained from the management node on the cloud center side, and install it. There is no need to perform the verification process of the second certificate.
  • each second node does not need to request the cloud center side management device to obtain a license for the application, nor does it need to maintain the connection between each second node and the cloud center side management device.
  • the second node When the user runs an IoT device through the first application in the second node, the second node will request authentication from the first node to determine whether to allow the first application to run the IoT device.
  • the application authentication process provided by the embodiment of the present application may include the following steps shown in FIG. 5:
  • S301 The user of the first application triggers a call to the IoT device through the first application.
  • the second node sends a first request to the first node, where the first request is used to verify whether the license of the first application is valid.
  • the first request carries a first certificate of the first application, and the first certificate is used to verify the reliability of the second node deployed by the first application.
  • the first request may also carry scene information, geographic location information, scene information of the IoT device called by the first application request, geographic location information, usage, quantity, and/or access mode, etc., for the first node to determine Whether to allow the first application to run.
  • S303 The first node compares the first certificate from the second node with the first certificate stored by itself. If the comparison results are consistent, perform S304; otherwise, if the comparison results are inconsistent, the first node sends a verification failure response message to the second node, so that the second node refuses to run the first application.
  • the first certificate stored by the first node may come from the cloud center side management device.
  • the first node determines the first verification result according to the authentication information of the first application.
  • the first verification result is used to indicate that the first application is allowed to run, or is used to indicate that the first application is not allowed to run.
  • the first request can include the access method information of the IoT device, the type information of the IoT device, etc.
  • the first node can be based on the authorization validity period of the application, the scope of rights, the types of IoT devices that the application is allowed to access, and the allowed IoT devices.
  • Information such as the access mode of the device, as well as the access mode information of the IoT device carried in the first request, the type information of the IoT device, and other information, determine whether the application is allowed to call the IoT device.
  • the first verification result can be used to indicate that the first application is allowed to run; conversely, if the judgment result indicates that the application is not allowed to run the IoT device, the first verification result can be used to indicate that the operation is not allowed The first application.
  • S305 The first node sends the first verification result and the second certificate of the first node to the second node, where the second certificate is used to verify the reliability of the first node.
  • the second node receives the first verification result and the second certificate of the first node.
  • S306 The second node compares the second certificate from the first node with the second certificate of the first node stored by itself. If the comparison results are consistent, perform S307; otherwise, if the comparison results are inconsistent, the second node refuses to run the first application based on the first verification result. For example, the second node may refuse to run the first application after determining that the comparison results are inconsistent. One application, or re-authentication of the first application.
  • S307 The second node determines whether the first application is allowed to run according to the first verification result.
  • the first node can determine the second verification result according to the authentication information of the second application carried in the license of the second application. 2.
  • the verification process of the certificate may be used to allow the first application to be run, or the second verification result may be used to indicate that the second application is not allowed to be run. Therefore, the first node can determine whether to run the second application according to the second verification result.
  • the authentication of the application deployed in the second node can be realized through the system shown in FIG. 2.
  • this system there is no need for every second node to request the cloud center side management device for application authentication, and there is no need to maintain the connection between each second node and the cloud center side management device.
  • the management method and method flow of the edge application provided by the embodiments of the present application are introduced from the perspective of the functions respectively implemented by the first node, the second node, and the management device.
  • the first node, the second node, and the management device may respectively include a hardware structure and/or a software module, with a hardware structure, a software module, or a hardware structure plus a software module To achieve the above functions. Whether a certain function among the above-mentioned functions is executed by a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraint conditions of the technical solution.
  • a management apparatus 600 may include a communication module 601 and a processing module 602, and the communication module 601 and the processing module 602 are coupled with each other.
  • the management device 600 can be used to execute the steps executed by the first node in the above method embodiments.
  • the communication module 601 can be used to support the management device 600 to communicate.
  • the communication module 601 can have a communication function, for example, can receive and/or send data frames through a wired and/or wireless communication medium such as an Ethernet port.
  • the processing module 602 can be used to support the management device 600 to perform the processing actions of the first node in the foregoing method embodiments, including but not limited to: determining the verification result, generating information and messages sent by the communication module 601, and/or, to the communication module 601 demodulates and decodes the received signal and so on.
  • the communication module 601 may be used to receive a first request from the second node, and the first request is used to request verification whether the first application is allowed to run. Deploy on the second node.
  • the processing module 602 may determine a first verification result according to the authentication information of the first application, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the first application the authentication information of the first application comes from the management device on the cloud center side.
  • the communication module 601 may also send the first verification result to the second node.
  • the communication module 601 may obtain authentication information of at least one application from the management device, where the authentication information of the at least one application may include the authentication information of the first application.
  • the communication module 601 may also receive a license of at least one application from the management device, and the license of the at least one application may include the license of the first application.
  • the license of the first application may carry the authentication information of the first application.
  • the communication module 601 may also send a second request to the management device, where the second request is used to request to obtain a license for the first application. Thereafter, the communication module 601 may receive the license of the first application from the management device.
  • the communication module 601 may also send the license of the first application to the second node. So that the second node installs the first application according to the license of the first application.
  • the communication module 601 may receive a third request from the second node, and the second request may be used to request a license for the first application.
  • the processing module 602 can also verify whether the application deployed by the first node itself is allowed to run. Specifically, the processing module 602 may determine the second verification result according to the authentication information of the second application, and the second verification result may be used to indicate that the second application is allowed to run, or the second verification result may be used to indicate that the second application is not allowed. Run the second application, and the second application is deployed on the first node.
  • the communication module 601 may receive authentication information of at least one application from the management device, and the authentication information of the at least one application includes the authentication information of the second application.
  • the communication module 601 may also receive a license of at least one application from the management device, and the license of the at least one application includes the license of the second application.
  • the management device When implementing the first node shown in the present application, the management device provided in the embodiment of the present application may further include the structure shown in FIG. 7. It can be seen that the management device 700 may include a processor 701, a memory 702, and a communication interface 703.
  • the above processor 701 can be used to determine the verification result, to process the communication protocol and communication data, to control the management device, to execute the software program, to process the data of the software program, and so on.
  • the memory 702 may be used to store instructions (or programs) and data, and the processor 701 may execute the method executed by the first node in the embodiment of the present application based on the instructions.
  • the communication interface 703 can be used in the present application for the management device 700 to perform wired and/or wireless communication, for example, to receive signals transmitted through power lines, and to send signals through power lines.
  • the above processor 701 may be used to execute the above steps executed by the processing module 602.
  • the communication interface 703 can be used to perform the steps performed by the communication module 601 described above.
  • the communication interface 703 may be used to receive a first request from the second node, and the first request is used to request to verify whether the first application is allowed to run, and the first application is deployed on the second node.
  • the processor 701 may determine a first verification result according to the authentication information of the first application, and the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the first application, the authentication information of the first application comes from the management device on the cloud center side.
  • the communication interface 703 may also send the first verification result to the second node.
  • the communication interface 703 may obtain authentication information of at least one application from the management device, where the authentication information of the at least one application may include the authentication information of the first application.
  • the communication interface 703 may also receive a license of at least one application from the management device, and the license of the at least one application may include the license of the first application.
  • the license of the first application may carry the authentication information of the first application.
  • the communication interface 703 may also send a second request to the management device, where the second request is used to request to obtain a license of the first application. Thereafter, the communication interface 703 may receive the license of the first application from the management device.
  • the communication interface 703 may also send the license of the first application to the second node. So that the second node installs the first application according to the license of the first application.
  • the communication interface 703 may receive a third request from the second node, and the second request may be used to request a license for the first application.
  • the processor 701 may also verify whether the application deployed by the first node itself is allowed to run. Specifically, the processor 701 may determine a second verification result according to the authentication information of the second application. The second verification result may be used to indicate that the second application is allowed to run, or the second verification result may be used to indicate that the second application is not allowed. Run the second application, and the second application is deployed on the first node.
  • the communication interface 703 may receive authentication information of at least one application from the management device, and the authentication information of the at least one application includes the authentication information of the second application.
  • the communication interface 703 may also receive a license of at least one application from the management device, and the license of the at least one application includes the license of the second application.
  • the above management device may also be composed of a chip.
  • the chip includes a processor 701.
  • the chip may also be coupled with any one or more components in the memory 702 or the communication interface 703.
  • a management apparatus 800 provided by an embodiment of the present application may include a communication module 801 and a processing module 802, and the communication module 801 and the processing module 802 are coupled with each other.
  • the management device 800 can be used to execute the steps executed by the second node in the above method embodiments.
  • the communication module 801 can be used to support the management device 800 to communicate.
  • the communication module 801 can have a communication function, for example, can receive and/or send data frames through a wired and/or wireless communication medium such as an Ethernet port.
  • the processing module 802 can be used to support the management device 800 to perform the processing actions of the second node in the above method embodiments, including but not limited to: generating information and messages sent by the communication module 801, and/or signals received by the communication module 801 Perform demodulation and decoding and so on.
  • the communication module 801 may be used to send a first request to the first node, the first request is used to request verification whether the first application is allowed to run, and the first application is deployed At the second node.
  • the communication module 801 may receive a first verification result from the second node, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the communication module 801 may receive the license of the first application from the first node, so that the second node can install the first application.
  • the communication module 801 may also send a third request to the first node, where the third request is used to request to obtain a license for the first application.
  • the management device When implementing the second node shown in the present application, the management device provided in the embodiment of the present application may further include the structure shown in FIG. 9. It can be seen that the management device 900 may include a processor 901, a memory 902 and a communication interface 903.
  • the above processor 901 can be used to process the communication protocol and communication data, control the management device, execute the software program, process the data of the software program, and so on.
  • the memory 902 may be used to store instructions (or programs) and data, and the processor 901 may execute the method executed by the second node in the embodiment of the present application based on the instructions.
  • the communication interface 903 can be used in the present application for the management device 900 to perform wired and/or wireless communication, for example, to receive signals transmitted through power lines, and to send signals through power lines.
  • the above processor 901 may be used to execute the above steps executed by the processing module 802.
  • the communication interface 903 can be used to perform the steps performed by the communication module 801 as described above.
  • the communication interface 903 may be used to send a first request to the first node, where the first request is used to request verification whether the first application is allowed to run, and the first application is deployed on the second node.
  • the communication interface 903 may receive a first verification result from the second node, the first verification result is used to indicate that the first application is allowed to run, or the first verification result is used to indicate that the first application is not allowed to run.
  • the communication interface 903 may receive the license of the first application from the first node, so that the second node can install the first application.
  • the communication interface 903 may also send a third request to the first node, where the third request is used to request to obtain a license of the first application.
  • the above management device may also be composed of a chip.
  • the chip includes a processor 901.
  • the chip may also be coupled with any one or more components in the memory 902 or the communication interface 903.
  • a management apparatus 1000 provided by an embodiment of the present application may include a communication module 1001 and a processing module 1002, and the communication module 1001 and the processing module 1002 are coupled with each other.
  • the management apparatus 1000 can be used to execute the steps performed by the management device in the above method embodiments.
  • the communication module 1001 can be used to support the management device 1000 to communicate.
  • the communication module 1001 can have a communication function, for example, can receive and/or send data frames through a wired and/or wireless communication medium such as an Ethernet port.
  • the processing module 1002 can be used to support the management apparatus 1000 to perform the processing actions of the management device in the above method embodiment, including but not limited to: determining the authentication information of the application, generating information and messages sent by the communication module 1001, and/or, The signal received by the communication module 1001 is demodulated, decoded, and so on.
  • the processing module 1002 may be used to determine authentication information of at least one application, the at least one application including the first application deployed on the second node.
  • the communication module 1001 may also send authentication information of at least one application to the first node.
  • the first node and the second node are both edge nodes, and the authentication information of the at least one application is used to verify whether the at least one application is allowed to run.
  • the at least one application may further include a second application deployed on the first node, so that the first node can obtain the authentication information of the second application for the authentication of the second application.
  • the communication module 1001 may send a license of at least one application to the first node, where the license of the at least one application includes the license of the first application.
  • the license of the at least one application may further include a license of a second application, and the second application is used for deployment on the first node.
  • the communication module 1001 may also receive a second request from the first node, where the second request is used to request a license for the first application.
  • the management device provided in the embodiment of the present application may further include a structure as shown in FIG. 11. It can be seen that the management device 1100 may include a processor 1101, a memory 1102 and a communication interface 1103.
  • the above processor 1101 can be used to determine at least one piece of authentication information used, and used to process communication protocols and communication data, and to control the management device, execute software programs, process data of the software programs, and so on.
  • the memory 1102 may be used to store instructions (or programs) and data, and the processor 1101 may execute the method executed by the management device in the embodiment of the present application based on the instructions.
  • the communication interface 1103 can be used in the present application for the management device 1100 to perform wired and/or wireless communication, for example, to receive signals transmitted through power lines, and to send signals through power lines.
  • the above processor 1101 may be used to execute the above steps executed by the processing module 1002.
  • the communication interface 1103 can be used to perform the steps performed by the communication module 1001 described above.
  • the processor 1101 may be configured to determine authentication information of at least one application, and the at least one application includes the first application deployed on the second node.
  • the communication interface 1103 may also send authentication information of at least one application to the first node.
  • the first node and the second node are both edge nodes, and the authentication information of the at least one application is used to verify whether the at least one application is allowed to run.
  • the at least one application may further include a second application deployed on the first node, so that the first node can obtain the authentication information of the second application for the authentication of the second application.
  • the communication interface 1103 may send a license of at least one application to the first node, where the license of the at least one application includes the license of the first application.
  • the license of the at least one application may further include a license of a second application, and the second application is used for deployment on the first node.
  • the communication interface 1103 may also receive a second request from the first node, where the second request is used to request a license for the first application.
  • the above management device may also be composed of a chip.
  • the chip includes a processor 1101.
  • the chip may also be coupled with any one or more components in the memory 1102 or the communication interface 1103.
  • the embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored.
  • the program is executed by a processor
  • the computer executes the above method embodiment and method implementation.
  • the method executed by the first node, the second node, and/or the management device in any one of the possible implementation manners of the example.
  • this application also provides a computer program product, which when invoked and executed by a computer, enables the computer to implement the above method embodiment and any possible implementation of the method embodiment In the method executed by the first node, the second node and/or the management device.
  • the present application also provides a chip or chip system, and the chip may include a processor.
  • the chip may also include a memory (or storage module) and/or a communication interface (or communication module), or the chip may be coupled with a memory (or storage module) and/or a communication interface (or communication module), wherein the communication interface ( (Or communication module) can be used to support the chip for wired and/or wireless communication, the memory (or storage module) can be used to store a program, and the processor can call the program to implement any one of the above method embodiments and method embodiments.
  • the method executed by the first node, the second node, and/or the management device in the implementation manner.
  • the chip system may include the above chips, or may include the above chips and other discrete devices, such as a memory (or storage module) and/or a communication interface (or communication module).
  • the present application also provides an edge application management system.
  • the edge application management system may include the above first node and second node.
  • the edge application management system may also include management equipment.
  • the edge application management system can be used to implement the method embodiments and the methods involved in any one of the possible implementation manners of the method embodiments.
  • the edge application management system may have a structure as shown in FIG. 2.
  • the second node may send a first request to the first node, where the first request is used to request verification whether to allow Run the first application.
  • the first node may determine the first verification result according to the authentication information of the first application, and the first verification result may be used to indicate whether the first application is allowed to run.
  • the first node may send the first verification result to the second node, so that the second node may determine whether to allow the first application.
  • the edge application management system may further include a management device, and the first node may obtain the authentication information of the first application from the management device, and the authentication information of the first application is used to verify whether the first application is allowed to run.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Telephonic Communication Services (AREA)
  • Stored Programmes (AREA)

Abstract

本申请提供一种边缘应用的管理方法及装置，用以降低边缘计算场景中，云中心侧管理设备对于边缘应用的管理负担，同时降低网络开销。本申请中，由第一节点根据第一应用的鉴权信息，确定第一验证结果，其中，第一验证结果用于指示是否允许运行第一应用，并由第一节点向第二节点发送第一验证结果，第一应用的鉴权信息来自于云中心侧管理设备。本申请不再需要由每个部署有应用的节点向云中心侧的管理设备请求鉴权，能够降低管理设备的负担，并且不再需要每个部署有应用的边缘节点与管理设备之间的连接，因此能够降低网络负担，提高了应用鉴权过程的稳定性和可靠性。

Description

一种边缘应用的管理方法及装置
相关申请的交叉引用
本申请要求在2019年12月10日提交中国专利局、申请号为201911257478.1、申请名称为“一种边缘应用的管理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种边缘应用的管理方法及装置。
背景技术
边缘计算场景中，边缘应用(或称应用)可由云中心侧推送至边缘节点，由边缘节点向用户提供实时业务、应用智能、安全与隐私保护等方面的要求。例如，边缘应用可部署于用户或运营商提供的设备中，其中，边缘应用的应用镜像、算法模型等通过许可证(license)进行保护，防止复制及被破坏，从而边缘应用可通过许可证中支持的方式向用户提供相应的服务。
目前，每一个部署边缘应用程序在运行时，需要边缘节点请求云中心侧的许可证管理设备对该应用进行应用鉴权，只有鉴权结果为允许运行的应用才能在边缘节点中运行。这就意味着，云中心侧需要分别维持其与众多的边缘节点之间的连接。同时存在的众多连接会加重云中心侧的许可证管理设备负担，使得云中心侧与边缘侧之间网络开销较大。
发明内容
本申请提供一种边缘应用的管理方法及装置，用以降低边缘应用的管理场景中，云中心侧管理设备的负担，同时降低云中心侧与边缘侧之间的网络开销。
第一方面，本申请提供一种边缘应用的管理方法，该方法可由第一节点或第一节点中的芯片执行。其中，第一节点为局域网中的边缘节点选举出的用于进行边缘应用管理的节点。
根据该方法，第一节点可接收来自第二节点的第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点，该第一节点以及该第二节点均为边缘节点。该第一节点可根据该第一应用的鉴权信息，确定第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用，该第一应用的鉴权信息来自于云中心侧的管理设备。该第一节点还可向该第二节点发送该第一验证结果。
采用以上方法，可由第一节点进行第二节点中应用的鉴权，因此不再需要由每个部署有应用的节点向云中心侧的管理设备请求鉴权，以降低管理设备的负担。另外，在边缘节点的数量较多的场景中，由于不再需要每个部署有应用的边缘节点与管理设备之间的连接，只需要第一节点与云中心侧之间保持连接就能够实现应用的鉴权，因此能够降低网络负担。同时，即便第二节点与云中心侧之间的连接中断或不具备与云中心侧连接的能力，仍可实 现第二节点所部属应用的鉴权，提高了应用鉴权过程的稳定性和可靠性。
示例性的，该第一节点可从该管理设备获取至少一个应用的鉴权信息，其中，该至少一个应用的鉴权信息可包括第一应用的鉴权信息。
在一种具体的示例中，该第一节点还可接收来自该管理设备的至少一个应用的许可证，至少一个应用的许可证可包括该第一应用的许可证。其中，该第一应用的许可证中可携带有该第一应用的鉴权信息。
另外，该第一节点还可向该管理设备发送第二请求，该第二请求用于请求获取该第一应用的许可证。此后，第一节点可从该管理设备接收第一应用的许可证。
示例性的，该第一节点还可向该第二节点发送该第一应用的许可证。以便第二节点根据第一应用的许可证进行第一应用的安装。
在一种具体的示例中，该第一节点可接收来自该第二节点的第三请求，该述第二请求可用于请求获取该第一应用的许可证。
此外，第一节点还可验证是否允许第一节点自身部署的应用的运行。具体的，该第一节点可根据第二应用的鉴权信息，确定第二验证结果，该第二验证结果可用于指示允许运行该第二应用，或者，该第二验证结果用于指示不允许运行该第二应用，该第二应用部署于该第一节点。
示例性的，该第一节点可接收来自该管理设备的至少一个应用的鉴权信息，该至少一个应用的鉴权信息包括该第二应用的鉴权信息。
该第一节点还可接收来自该管理设备的至少一个应用的许可证，该至少一个应用的许可证包括所述第二应用的许可证。
第二方面，本申请提供一种边缘应用的管理方法，该方法可由第二节点或第二节点中的芯片执行。其中，第二节点为边缘计算场景中出第一节点以外的边缘节点。
根据该方法，第二节点可向第一节点发送第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点，该第一节点以及该第二节点均为边缘节点。该第二节点接收来自该第二节点的第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用。
示例性的，该第二节点可接收来自该第一节点的该第一应用的许可证，以便第二节点进行第一应用的安装。
该第二节点还可向该第一节点发送第三请求，该第三请求用于请求获取该第一应用的许可证。
第三方面，本申请提供一种边缘应用的管理方法，该方法可由管理设备执行。其中，该管理设备部署于云中心侧，相对于边缘节点更加远离用户。
根据该方法，管理设备可确定至少一个应用的鉴权信息，该管理设备部署于云中心侧，该至少一个应用包括部署于第二节点的第一应用。该管理设备还可向第一节点发送至少一个应用的鉴权信息，第一节点以及第二节点均为边缘节点，该至少一个应用的鉴权信息用于验证是否允许运行该至少一个应用。
其中，该至少一个应用还可包括部署于第一节点的第二应用，从而第一节点可获取第二应用的鉴权信息，用于第二应用的鉴权。
示例性的，该管理设备可向该第一节点发送至少一个应用的许可证，该至少一个应用的许可证包括该第一应用的许可证。
此外，该至少一个应用的许可证还可包括第二应用的许可证，该第二用于部署于该第一节点。
示例性的，该管理设备还可接收来自该第一节点的第二请求，该第二请求用于请求获取该第一应用的许可证。从而管理设备可响应于第二请求，向第一节点发送第一应用的许可证。同理，管理设备还可根据来自第一节点的请求，向第一节点发送第二应用的许可证。
第四方面，本申请提供一种边缘应用的管理装置。该管理装置可由第一节点或第一节点中的芯片实现。示例性的，该管理装置可用于执行上述第一方面或第一方面的任一可能的设计中提供的功能或步骤或操作。该管理装置可通过硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各方法中的各功能或步骤或操作。比如，在管理装置中可以设置与上述各方法中的功能或步骤或操作相对应的功能模块来支持该管理装置执行上述方法。
在通过软件模块实现第四方面所示管理装置时，该管理装置可包括相互耦合的通信模块以及处理模块，其中，通信模块可用于支持管理装置进行通信，处理模块可用于管理装置执行处理操作，如生成需要通过通信模块发送的信息/消息，或对通信模块接收的信号进行处理以得到信息/消息。
示例性的，通信模块可用于接收来自第二节点的第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该处理模块可根据该第一应用的鉴权信息，确定第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用，该第一应用的鉴权信息来自于云中心侧的管理设备。该通信模块还可向该第二节点发送该第一验证结果。
示例性的，该通信模块可从该管理设备获取至少一个应用的鉴权信息，其中，该至少一个应用的鉴权信息可包括第一应用的鉴权信息。
在一种具体的示例中，该通信模块还可接收来自该管理设备的至少一个应用的许可证，至少一个应用的许可证可包括该第一应用的许可证。其中，该第一应用的许可证中可携带有该第一应用的鉴权信息。
另外，该通信模块还可向该管理设备发送第二请求，该第二请求用于请求获取该第一应用的许可证。此后，通信模块可从该管理设备接收第一应用的许可证。
示例性的，该通信模块还可向该第二节点发送该第一应用的许可证。以便第二节点根据第一应用的许可证进行第一应用的安装。
在一种具体的示例中，该通信模块可接收来自该第二节点的第三请求，该述第二请求可用于请求获取该第一应用的许可证。
此外，处理模块还可验证是否允许第一节点自身部署的应用的运行。具体的，该处理模块可根据第二应用的鉴权信息，确定第二验证结果，该第二验证结果可用于指示允许运行该第二应用，或者，该第二验证结果用于指示不允许运行该第二应用，该第二应用部署于该第一节点。
示例性的，该通信模块可接收来自该管理设备的至少一个应用的鉴权信息，该至少一个应用的鉴权信息包括该第二应用的鉴权信息。
该通信模块还可接收来自该管理设备的至少一个应用的许可证，该至少一个应用的许可证包括所述第二应用的许可证。
在通过硬件组件实现第四方面所示管理装置时，该管理装置可包括处理器，用于执行 上述第一方面和/或第一方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可以包括存储器。其中，存储器可用于存储指令，处理器可用于从所述存储器中调用并运行所述指令，以执行上述第一方面和/或第一方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可包括通信接口，用于管理装置通过有线和/或无线方式进行通信。
示例性的，处理器可用于调用存储器中存储的指令以执行上述第四方面中由处理模块执行的步骤。收发器可用于执行上述第四方面中由通信模块执行的步骤。
第五方面，本申请提供一种边缘应用的管理装置。该管理装置可由第二节点或第二节点中的芯片实现。示例性的，该管理装置可用于执行上述第二方面或第二方面的任一可能的设计中提供的功能或步骤或操作。该管理装置可通过硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各方法中的各功能或步骤或操作。比如，在管理装置中可以设置与上述各方法中的功能或步骤或操作相对应的功能模块来支持该管理装置执行上述方法。
在通过软件模块实现第五方面所示管理装置时，该管理装置可包括相互耦合的通信模块以及处理模块，其中，通信模块可用于支持管理装置进行通信，处理模块可用于管理装置执行处理操作，如生成需要通过通信模块发送的信息/消息，或对通信模块接收的信号进行处理以得到信息/消息。
示例性的，通信模块可用于向第一节点发送第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该通信模块可接收来自该第二节点的第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用。
示例性的，该通信模块可接收来自该第一节点的该第一应用的许可证，以便第二节点进行第一应用的安装。
该通信模块还可向该第一节点发送第三请求，该第三请求用于请求获取该第一应用的许可证。
在通过硬件组件实现第五方面所示管理装置时，该管理装置可包括处理器，用于执行上述第二方面和/或第二方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可以包括存储器。其中，存储器可用于存储指令，处理器可用于从所述存储器中调用并运行所述指令，以执行上述第二方面和/或第二方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可包括通信接口，用于管理装置通过有线和/或无线方式进行通信。
示例性的，处理器可用于调用存储器中存储的指令以执行上述第五方面中由处理模块执行的步骤。收发器可用于执行上述第五方面中由通信模块执行的步骤。
第六方面，本申请提供一种边缘应用的管理装置。该管理装置可由云中心侧的管理设备或管理设备中的芯片实现。示例性的，该管理装置可用于执行上述第三方面或第三方面的任一可能的设计中提供的功能或步骤或操作。该管理装置可通过硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各方法中的各功能或步骤或操作。比如，在管理装置中可以设置与上述各方法中的功能或步骤或操作相对应的功能模块来支持该管理装置执行上述方法。
在通过软件模块实现第六方面所示管理装置时，该管理装置可包括相互耦合的通信模块以及处理模块，其中，通信模块可用于支持管理装置进行通信，处理模块可用于管理装置执行处理操作，如生成需要通过通信模块发送的信息/消息，或对通信模块接收的信号进 行处理以得到信息/消息。
示例性的，处理模块可用于确定至少一个应用的鉴权信息，该至少一个应用包括部署于第二节点的第一应用。该通信模块还可向第一节点发送至少一个应用的鉴权信息，第一节点以及第二节点均为边缘节点，该至少一个应用的鉴权信息用于验证是否允许运行该至少一个应用。
其中，该至少一个应用还可包括部署于第一节点的第二应用，从而第一节点可获取第二应用的鉴权信息，用于第二应用的鉴权。
示例性的，该通信模块可向该第一节点发送至少一个应用的许可证，该至少一个应用的许可证包括该第一应用的许可证。
此外，该至少一个应用的许可证还可包括第二应用的许可证，该第二用于部署于该第一节点。
示例性的，该通信模块还可接收来自该第一节点的第二请求，该第二请求用于请求获取该第一应用的许可证。
在通过硬件组件实现第六方面所示管理装置时，该管理装置可包括处理器，用于执行上述第三方面和/或第三方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可以包括存储器。其中，存储器可用于存储指令，处理器可用于从所述存储器中调用并运行所述指令，以执行上述第三方面和/或第三方面的任意可能的设计中提供的功能或步骤或操作。该管理装置还可包括通信接口，用于管理装置通过有线和/或无线方式进行通信。
示例性的，处理器可用于调用存储器中存储的指令以执行上述第六方面中由处理模块执行的步骤。收发器可用于执行上述第六方面中由通信模块执行的步骤。
第七方面，本申请提供一种边缘应用管理系统，该边缘应用管理系统可以包括第四方面所示的管理装置以及第五方面所示的管理装置。示例性的，该边缘应用管理系统还可包括第六方面所示的管理装置。其中，第四方面所示的管理装置可由软件模块和/或硬件组件构成，第五方面所示的管理装置可由软件模块和/或硬件组件构成，第六方面所示的管理装置可由软件模块和/或硬件组件构成。
示例性的，以第四方面所示的管理装置为第一节点、第五方面所示的管理装置为第二节点，本申请实施例提供的边缘应用管理系统可用于执行：当第二节点中需要运行第一应用时，第二节点可向第一节点发送第一请求，其中，第一请求用于请求验证是否允许运行第一应用。第一节点可根据第一应用的鉴权信息确定第一验证结果，第一验证结果可用于指示是否允许运行第一应用。此外，第一节点可向第二节点发送第一验证结果，从而可由第二节点确定是否允许第一应用。
此外，该边缘应用管理系统中还可包括第六方面所示的管理装置。以第六方面所示的管理装置为云中心侧的管理设备为例，第一节点从管理设备获取第一应用的鉴权信息，第一应用的鉴权信息用于验证是否允许运行第一应用。
第八方面，本申请提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令(或称程序)，当其在计算机上被调用执行时，使得计算机执行上述第一方面或第一方面的任意一种可能的设计，或上述第二方面或第二方面的任意一种可能的设计，或上述第三方面或第三方面的任意一种可能的设计中所述的方法。
第九方面，本申请提供一种计算机程序产品，该计算机程序产品可包含指令，当所述计算机程序产品在计算机上运行时使得计算机执行上述第一方面或第一方面的任意一种 可能的设计，或上述第二方面或第二方面的任意一种可能的设计，或上述第三方面或第三方面的任意一种可能的设计中所述的方法。
第十方面，本申请提供一种芯片和/或包含芯片的芯片系统，该芯片可包括处理器。该芯片还可以包括存储器(或存储模块)和/或通信接口(或通信模块)。该芯片可用于执行上述第一方面或第一方面的任意一种可能的设计，或上述第二方面或第二方面的任意一种可能的设计，或上述第三方面或第三方面的任意一种可能的设计中所述的方法。该芯片系统可以由上述芯片构成，也可以包含上述芯片和其他分立器件，如存储器(或存储模块)、通信接口和/或通信接口(或通信模块)。
上述第二方面至第十方面及其可能的设计中的有益效果可以参考对第一方面及第一方面的可能的设计中所述方法的有益效果的描述。
附图说明
图1为本申请实施例提供的一种边缘应用管理系统架构示意图；
图2为本申请实施例提供的另一种边缘应用管理系统架构示意图；
图3为本申请实施例提供的一种边缘应用的管理方法的流程示意图；
图4为本申请实施例提供的另一种边缘应用的管理方法的流程示意图；
图5为本申请实施例提供的另一种边缘应用的管理方法的流程示意图；
图6为本申请实施例提供的一种管理装置的结构示意图；
图7为本申请实施例提供的另一种管理装置的结构示意图；
图8为本申请实施例提供的另一种管理装置的结构示意图；
图9为本申请实施例提供的另一种管理装置的结构示意图；
图10为本申请实施例提供的另一种管理装置的结构示意图；
图11为本申请实施例提供的另一种管理装置的结构示意图。
具体实施方式
如图1所示为一种边缘应用管理系统，该边缘应用管理系统可包括云中心侧管理设备以及边缘侧业务面设备。应理解，图1所述边缘应用管理系统可以用于边缘计算场景中边缘应用的管理。
云中心侧管理设备可用于进行应用许可证的发放和用于进行应用的鉴权，通过云中心侧管理设备能够实现统一的许可证管理。在具体实施中，管理设备可包括许可证管理节点(或称许可证管理端云中心侧节点)，或者，管理设备可包括由多个许可证管理节点构成的许可证管理集群。
示例性的，管理设备可用于生成和存放应用的许可证、应用的版权信息和鉴权信息等内容。其中，应用的版权信息和鉴权信息可由应用的供应商提供给管理设备，并由管理设备根据应用的版权信息和鉴权信息生成应用的许可证。其中，应用的鉴权信息可携带于许可证中，用于描述应用允许运行的条件。鉴权信息可包括应用的授权有效期条件(可以用于确定允许应用运行的时间条件)、允许应用运行的范围条件(可以用于确定允许应用运行的场景、地理位置或者用途等条件)、允许应用调用的物联网(internet of things，IoT)设备种类条件(可以用于确定允许应用调用的IoT设备的种类)、允许应用调用IoT设备的 范围条件(可以用于确定允许应用调用的IoT设备的场景、地理位置或用途等)、允许应用调用的IoT设备的数量条件和/或允许的IoT设备接入第二节点的接入方式条件(可以用于确定允许应用调用的IoT设备的接入方式，如有线接入、无线接入等条件)等信息。
应理解，IoT设备例如智能工业、家庭智能网络等场景中的摄像头等监控设备、机器人具备通信功能的车辆、电器等设备，这些IoT设备可基于应用的控制，执行相应的动作。应理解，IoT设备可通过有线或无线等方式连接至一个或多个边缘节点，从而边缘节点可通过应用调用IoT设备，实现对IoT设备的控制。
业务面设备可包括局域网中的一个或多个边缘节点(或称客户端)。边缘节点中可运行应用，这些应用的许可证可由云中心侧管理设备颁发，并由云中心侧管理设备进行应用的鉴权，以确定是否允许边缘节点运行这些应用。
边缘节点在边缘计算场景中可用于运行应用，以实现应用的镜像、算法模型等计算过程，从而面向用户提供计算服务。按照现有技术，每个边缘节点需要在运行应用前，或者按照一定周期定期向云中心侧管理设备请求应用鉴权，以决定是否允许应用的运行。只有经过验证，鉴权结果为允许运行的应用才能在边缘节点中运行。然而，这样的鉴权方式需要维持每个部署了应用的边缘节点与云中心侧管理设备之间的连接，对于管理设备的负担过重，并且会增加云中心侧与边缘节点之间的网络开销。
本申请实施例提供一种许可证管理方法，可应用于如图1所示的许可证管理系统，以降低云中心侧管理设备在许可证的管理过程中的负担，同时降低云中心侧与边缘节点之间的网络负担。
如图2所示，本申请实施例提供的边缘应用管理方法可由第一节点以及第二节点实施。其中，第一节点以及第二节点均为局域网内的边缘节点。图2所示的边缘应用管理系统中只需要保持第一节点与管理节点之间的连接，以及保持第二节点与第一节点之间的连接。当第二节点中运行应用时，第二节点可请求第一节点对应用进行鉴权。
以图2所示系统为例，本申请实施例提供的应用管理方法可包括图3所示的如下步骤：
S101：第一节点接收来自第二节点的第一请求，第一请求用于请求验证是否允许运行第一应用，其中，第一应用部署于第二节点。
第一请求可以是第二节点在确定需要运行第一应用后发送的。例如，当用户通过第二节点触发第一应用的运行后，第一应用会向第二节点发送运行请求，第二节点根据第一应用的运行请求发送所述第一请求。应理解，第一应用的运行可包括第一应用执行其镜像或算法模型等计算功能，还可包括第一应用调用IoT设备以通过IoT设备实现相应的功能，例如，通过摄像头实现拍摄功能。
S102：第一节点根据第一应用的鉴权信息，确定第一验证结果。第一验证结果用于指示允许运行第一应用，或者，用于指示不允许运行第一应用。
其中，第一应用的鉴权信息可存储于第一节点中。
S103：第一节点向第二节点发送所述第一验证结果。
采用以上方法，由第一节点进行第二节点中应用的鉴权，因此不再需要由每个部署有应用的节点向云中心侧的管理设备请求鉴权，以降低管理设备的负担。另外，在边缘节点的数量较多的场景中，由于不再需要每个部署有应用的边缘节点与管理设备之间的连接，只需要第一节点与云中心侧之间保持连接就能够实现应用的鉴权，因此能够降低网络负担。同时，即便第二节点与云中心侧之间的连接中断或不具备与云中心侧连接的能力，仍可实 现第二节点所部属应用的鉴权，提高了应用鉴权过程的稳定性和可靠性。
在本申请中，第一节点可以是局域网内部分或全部的边缘节点选举出来的一个边缘节点，或多个相互之间数据共享的边缘节点。其中，参与选举的边缘节点可包括第一节点和/或第二节点。应理解，第一节点可保持与云中心侧管理设备的连接，并具备一定的存储和计算能力。
应理解，第一节点的信息可存储于云中心侧管理设备以及局域网中的边缘节点(可包括第二节点)中。当边缘节点中需要运行应用，或其他满足需要进行应用鉴权的条件出现时，边缘节点可向第一节点请求验证应用的许可证的有效性，例如执行S101所示步骤。
示例性的，第一节点可向其他的边缘节点发送第一节点的证书，由其他的边缘节点存储第一节点的证书，用于其他的边缘节点对第一节点进行验证。这里以第二节点验证第一节点的过程为例说明：当第二节点中安装第一应用时，第二节点可从第一节点获取该第一应用的许可证以及第一节点的证书，并将第二节点存储的第一节点的证书与来自于一节点的证书进行比对，以验证第一节点是否为选举出的用于进行应用管理的节点，从而提高许可证管理过程的可靠性。
应理解，当第一节点出现故障，或者第一节点与云中心侧管理设备之间的连接中断时，局域网中的边缘节点可从第一节点以外的边缘节点中，重新选举出一个节点，用于对边缘节点部署的应用进行管理。重新选举出的节点可具备第一节点的功能。
示例性的，第一节点可以通过其与云中心侧管理设备的连接，从云中心侧管理设备获取至少一个应用的许可证。具体来说，可由管理设备根据来自第一节点的请求(在本申请中，该请求可称为第二请求)，向第一节点发送第一节点所请求的一个或多个应用的许可证。或者，可根据同步周期，保持管理设备中存储的应用的许可证与第一节点中存储的应用的许可证的同步。其中，进行同步的周期可以是预设时长，或者是经过第一节点以及管理设备协商一致的时长。
在一种可能的示例中，应用的许可证中可携带有该应用的鉴权信息，从而第一节点可在从管理设备获取应用的许可证后，获取应用的鉴权信息。其中，应用的鉴权信息例如，应用的授权有效期条件、允许应用运行的范围条件、允许应用调用的IoT设备种类条件、允许应用调用IoT设备的范围条件、允许应用调用的IoT设备的数量条件和/或允许的IoT设备的接入方式条件等信息。第一节点可根据应用的鉴权信息，确定是否允许应用的运行。具体的，根据应用运行的实际场景的区别，第一节点可确定是否允许应用本身的运行，和/或，第一节点可确定是否允许应用调用IoT设备。应理解，管理设备也可将应用的鉴权信息独立于应用的许可证发送至第一节点，例如，管理设备分别通过不同的消息，向第一节点发送同一应用的许可证以及鉴权信息。
此外，第一节点还可从云中心侧管理设备获取应用的开发商提供的证书，用于在接收到来自边缘节点的应用许可证的请求时，验证边缘节点的安全性，以提高许可证管理过程的可靠性。结合第一节点的证书，本申请实施例提供的许可证管理方法可通过第一节点与边缘节点的双向认证，提高许可证管理过程的可靠性。该证书可携带于应用的许可证中，或独立于应用的许可证。
具体的，以上S101中，第一请求可以是第二节点基于第一应用的运行请求(或第一应用调用IoT设备的请求)所发送的。这里第一应用可用于执行镜像或算法模型等计算功能，和/或用于通过对IoT设备进行控制以实现IoT设备具备的相应功能。其中，该第一请 求中可携带第一应用的标识等信息。
在S102的执行中，第一节点可根据第一应用的鉴权信息，确定是否允许运行第一应用。第一应用的鉴权信息可存储于第一节点中。例如，在第一节点从管理设备获取第一应用的许可证后，第一节点可从许可证中获取第一节点的鉴权信息并存储。此外，第一应用可根据第一应用的标识等信息，从存储的应用的鉴权信息中查询第一应用的鉴权信息。
具体的，第一节点在接收请求信息后，可根据时间信息确定是否满足第一应用的授权有效期条件。第一节点还可根据第二节点的场景信息、第二节点的地理位置信息等，确定是否满足允许第一应用运行的范围条件。第一节点还可根据第一应用请求调用的IoT设备的场景消息、地理位置信息或用途等信息，确定是否满足第一应用允许调用的IoT设备的范围条件。第一节点还可根据第一应用请求调用的IoT设备的类型信息，确定是否满足第一应用允许调用的IoT设备种类条件。第一节点还可根据第一应用请求调用的IoT设备的数量，确定是否满足第一应用允许调用的IoT设备的数量条件。第一节点还可根据第一应用请求调用的IoT设备的接入类型，确定是否满足第一应用允许的IoT设备的接入方式条件。
其中，上述第二节点的场景信息、第二节点的地理位置信息、第一应用请求调用的IoT设备的场景消息、地理位置信息、用途、数量和/或接入方式等信息，可由第二节点携带在第一请求中，或由第二节点通过单独的消息发送至第一节点。
在确定第一验证结果后，第一节点可将第一验证结果发送至第二节点，用于第二节点确定是否允许第一应用的运行。
下面结合图4，以第一应用为例说明本申请中边缘节点获取应用的许可证的方法。
S201：第一应用的用户向云中心侧管理设备订购第一应用的许可证。
其中，第一应用的许可证中可携带有第一应用的鉴权信息。第一应用的应用开发商可向管理设备提供第一应用的第一证书，第一证书用于验证第一应用所部属的边缘节点的可靠性。
S202：云中心侧管理设备将第一应用的许可证以及第一应用的第一证书，发送至第一节点。
具体的，云中心侧管理设备可通过周期性的同步过程，将第一应用的许可证以及第一证书发送至第一节点；或者，管理设备可根据第一节点的请求，将第一应用的许可证以及第一证书发送至第一节点。
相应地，第一节点接收第一应用的许可证以及第一证书，并获取第一应用的鉴权信息。
S203：当第一应用在第二节点中安装时，第二节点获取第一应用的第一证书，并向第一节点发送第三请求，第三请求用于获取第一应用的许可证，第三请求中携带第一应用的第一证书。
其中，第一证书可内置于第一应用的安装程序中。
S204：第一节点比对来自于第二节点的第一证书以及自身存储的第一证书。若比对结果一致，则执行S205；否则，若比对结果不一致，则第一节点向第二节点发送验证失败的响应消息，从而拒绝向不安全的第二节点发送第一应用的许可证。
S205：第一节点响应于第二节点的请求，向第二节点发送第一应用的许可证以及第一节点的第二证书，第二证书用于验证第一节点的可靠性。
相应地，第二节点接收第一应用的许可证以及第一节点的第二证书。
S206：第二节点比对来自第一节点的第二证书和自身存储的第一节点的第二证书。若比对结果一致，则执行S207；否则，若比对结果不一致，则第二节点拒绝将第一节点发送的许可证与第一应用进行关联，避免安装不安全的证书。
其中，第二节点可在选举第一节点的过程中，从第一节点获取第一节点的第二证书。
S207：第二节点安装第一应用的许可证。
具体的，第二节点将第一应用的许可证存储到第一应用中，完成第一应用的安装。
同理，当第一节点中安装第二应用时，第一节点可根据从云中心侧管理节点获取的一个或多个应用的许可证中，确定第二应用的许可证，并进行安装，此时不需要进行第二证书的验证过程。
采用以上图4所示流程，可通过图2所示系统实现部署于第二节点中应用的许可证的颁发。该系统中，不需要每个第二节点均向云中心侧管理设备请求获取应用的许可证，也不需要保持每个第二节点与云中心侧管理设备之间的连接。
当用户通过第二节点中的第一应用运行某个IoT设备时，第二节点会向第一节点请求鉴权，以确定是否允许第一应用运行该IoT设备。本申请实施例提供的应用鉴权过程可包括图5所示的如下步骤：
S301：第一应用的用户通过第一应用触发对IoT设备的调用。
S302：第二节点向第一节点发送第一请求，其中，第一请求用于验证第一应用的许可证是否有效。第一请求中携带有第一应用的第一证书，第一证书用于验证第一应用所部属的第二节点的可靠性。
此外，第一请求中还可携带场景信息、地理位置信息、第一应用请求调用的IoT设备的场景消息、地理位置信息、用途、数量和/或接入方式等信息，用于第一节点判断是否允许第一应用的运行。
S303：第一节点比对来自于第二节点的第一证书以及自身存储的第一证书。若比对结果一致，则执行S304；否则，若比对结果不一致，则第一节点向第二节点发送验证失败的响应消息，从而令第二节点拒绝运行第一应用。
其中，第一节点存储的第一证书，可来自于云中心侧管理设备。
S304：第一节点根据第一应用的鉴权信息，确定第一验证结果。第一验证结果用于指示允许运行第一应用，或者，用于指示不允许运行第一应用。
其中，第一请求中可包括该IoT设备的接入方式信息、该IoT设备的类型信息等，第一节点可根据应用的授权有效期、权利范围、允许应用接入的IoT设备种类、允许的IoT设备的接入方式等信息，以及第一请求中携带的IoT设备的接入方式信息、该IoT设备的类型信息等信息，判断是否允许应用调用该IoT设备。若判断结果表示允许该IoT设备的运行，则第一验证结果可用于指示允许运行第一应用；反之，若判断结果表示不允许应用运行该IoT设备，则第一验证结果可用于指示不允许运行第一应用。
S305：第一节点向第二节点发送第一验证结果以及第一节点的第二证书，第二证书用于验证第一节点的可靠性。
相应地，第二节点接收第一验证结果以及第一节点的第二证书。
S306：第二节点比对来自第一节点的第二证书和自身存储的第一节点的第二证书。若比对结果一致，则执行S307；否则，若比对结果不一致，则第二节点拒绝根据第一验证结果运行第一应用，例如，第二节点在确定比对结果不一致后，可拒绝运行第一应用，或重 新进行第一应用的鉴权。
S307：第二节点根据第一验证结果，确定是否允许运行第一应用。
同理，当第一节点中的第二应用请求运行时，第一节点可根据第二应用的许可证中携带的第二应用的鉴权信息，确定第二验证结果，此时不需要进行第二证书的验证过程。该第二验证结果可用于允许运行第一应用，或者，第二验证结果用于指示不允许运行第二应用。从而第一节点可根据第二验证结果，确定是否运行第二应用。
采用以上图5所示流程，可通过图2所示系统实现部署于第二节点中应用的鉴权。该系统中，不需要每个第二节点均向云中心侧管理设备请求进行应用的鉴权，也不需要保持每个第二节点与云中心侧管理设备之间的连接。
上述本申请提供的实施例中，从第一节点、第二节点以及管理设备分别所实现的功能的角度对本申请实施例提供的边缘应用的管理方法及方法流程进行了介绍。为了实现上述本申请实施例提供的方法中的各功能，该第一节点、第二节点以及管理设备可以分别包括硬件结构和/或软件模块，以硬件结构、软件模块、或硬件结构加软件模块的形式来实现上述各功能。上述各功能中的某个功能以硬件结构、软件模块、还是硬件结构加软件模块的方式来执行，取决于技术方案的特定应用和设计约束条件。
如图6所示，本申请实施例提供的一种管理装置600可以包括通信模块601以及处理模块602，以上通信模块601以及处理模块602之间相互耦合。该管理装置600可用于执行以上方法实施例中由第一节点执行的步骤。该通信模块601可用于支持管理装置600进行通信，通信模块601可具备通信功能，例如能够通过以太网口等有线和/或无线通信介质进行数据帧的接收和/或发送。处理模块602可用于支持该管理装置600执行上述方法实施例中第一节点的处理动作，包括但不限于：确定验证结果、生成由通信模块601发送的信息、消息，和/或，对通信模块601接收的信号进行解调解码等等。
在执行上述方法实施例中由第一节点执行的步骤时，通信模块601可用于接收来自第二节点的第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该处理模块602可根据该第一应用的鉴权信息，确定第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用，该第一应用的鉴权信息来自于云中心侧的管理设备。该通信模块601还可向该第二节点发送该第一验证结果。
示例性的，该通信模块601可从该管理设备获取至少一个应用的鉴权信息，其中，该至少一个应用的鉴权信息可包括第一应用的鉴权信息。
在一种具体的示例中，该通信模块601还可接收来自该管理设备的至少一个应用的许可证，至少一个应用的许可证可包括该第一应用的许可证。其中，该第一应用的许可证中可携带有该第一应用的鉴权信息。
另外，该通信模块601还可向该管理设备发送第二请求，该第二请求用于请求获取该第一应用的许可证。此后，通信模块601可从该管理设备接收第一应用的许可证。
示例性的，该通信模块601还可向该第二节点发送该第一应用的许可证。以便第二节点根据第一应用的许可证进行第一应用的安装。
在一种具体的示例中，该通信模块601可接收来自该第二节点的第三请求，该述第二请求可用于请求获取该第一应用的许可证。
此外，处理模块602还可验证是否允许第一节点自身部署的应用的运行。具体的，该 处理模块602可根据第二应用的鉴权信息，确定第二验证结果，该第二验证结果可用于指示允许运行该第二应用，或者，该第二验证结果用于指示不允许运行该第二应用，该第二应用部署于该第一节点。
示例性的，该通信模块601可接收来自该管理设备的至少一个应用的鉴权信息，该至少一个应用的鉴权信息包括该第二应用的鉴权信息。
该通信模块601还可接收来自该管理设备的至少一个应用的许可证，该至少一个应用的许可证包括所述第二应用的许可证。
在实现本申请所示的第一节点时，本申请实施例提供的管理装置还可包括如图7所示结构，可见，管理装置700可包括处理器701、存储器702以及通信接口703。
以上处理器701可用于确定验证结果，以及用于对通信协议以及通信数据进行处理，以及对管理装置进行控制，执行软件程序，处理软件程序的数据等。存储器702可用于存储指令(或称程序)和数据，处理器701可基于该指令执行本申请实施例中由第一节点执行的方法。通信接口703在本申请中可用于管理装置700进行有线和/或无线通信，例如，接收通过电力线传输的信号，以及通过电力线发送信号。
示例性的，以上处理器701可用于执行上述由处理模块602所执行的步骤。通信接口703可用于执行上述由通信模块601执行的步骤。
具体的，通信接口703可用于接收来自第二节点的第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该处理器701可根据该第一应用的鉴权信息，确定第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用，该第一应用的鉴权信息来自于云中心侧的管理设备。该通信接口703还可向该第二节点发送该第一验证结果。
示例性的，该通信接口703可从该管理设备获取至少一个应用的鉴权信息，其中，该至少一个应用的鉴权信息可包括第一应用的鉴权信息。
在一种具体的示例中，该通信接口703还可接收来自该管理设备的至少一个应用的许可证，至少一个应用的许可证可包括该第一应用的许可证。其中，该第一应用的许可证中可携带有该第一应用的鉴权信息。
另外，该通信接口703还可向该管理设备发送第二请求，该第二请求用于请求获取该第一应用的许可证。此后，通信接口703可从该管理设备接收第一应用的许可证。
示例性的，该通信接口703还可向该第二节点发送该第一应用的许可证。以便第二节点根据第一应用的许可证进行第一应用的安装。
在一种具体的示例中，该通信接口703可接收来自该第二节点的第三请求，该述第二请求可用于请求获取该第一应用的许可证。
此外，处理器701还可验证是否允许第一节点自身部署的应用的运行。具体的，该处理器701可根据第二应用的鉴权信息，确定第二验证结果，该第二验证结果可用于指示允许运行该第二应用，或者，该第二验证结果用于指示不允许运行该第二应用，该第二应用部署于该第一节点。
示例性的，该通信接口703可接收来自该管理设备的至少一个应用的鉴权信息，该至少一个应用的鉴权信息包括该第二应用的鉴权信息。
该通信接口703还可接收来自该管理设备的至少一个应用的许可证，该至少一个应用的许可证包括所述第二应用的许可证。
应理解，以上管理装置也可由芯片构成。例如，该芯片包含处理器701。另外，该芯片还可与存储器702或者通信接口703中的任意一个或多个组件耦合。
如图8所示，本申请实施例提供的一种管理装置800可以包括通信模块801以及处理模块802，以上通信模块801以及处理模块802之间相互耦合。该管理装置800可用于执行以上方法实施例中由第二节点执行的步骤。该通信模块801可用于支持管理装置800进行通信，通信模块801可具备通信功能，例如能够通过以太网口等有线和/或无线通信介质进行数据帧的接收和/或发送。处理模块802可用于支持该管理装置800执行上述方法实施例中第二节点的处理动作，包括但不限于：生成由通信模块801发送的信息、消息，和/或，对通信模块801接收的信号进行解调解码等等。
在执行上述方法实施例中由第二节点执行的步骤时，通信模块801可用于向第一节点发送第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该通信模块801可接收来自该第二节点的第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用。
示例性的，该通信模块801可接收来自该第一节点的该第一应用的许可证，以便第二节点进行第一应用的安装。
该通信模块801还可向该第一节点发送第三请求，该第三请求用于请求获取该第一应用的许可证。
在实现本申请所示的第二节点时，本申请实施例提供的管理装置还可包括如图9所示结构，可见，管理装置900可包括处理器901、存储器902以及通信接口903。
以上处理器901可用于对通信协议以及通信数据进行处理，以及对管理装置进行控制，执行软件程序，处理软件程序的数据等。存储器902可用于存储指令(或称程序)和数据，处理器901可基于该指令执行本申请实施例中由第二节点执行的方法。通信接口903在本申请中可用于管理装置900进行有线和/或无线通信，例如，接收通过电力线传输的信号，以及通过电力线发送信号。
示例性的，以上处理器901可用于执行上述由处理模块802所执行的步骤。通信接口903可用于执行上述由通信模块801执行的步骤。
具体的，通信接口903可用于向第一节点发送第一请求，该第一请求用于请求验证是否允许运行第一应用，该第一应用部署于该第二节点。该通信接口903可接收来自该第二节点的第一验证结果，该第一验证结果用于指示允许运行该第一应用，或者，该第一验证结果用于指示不允许运行该第一应用。
示例性的，该通信接口903可接收来自该第一节点的该第一应用的许可证，以便第二节点进行第一应用的安装。
该通信接口903还可向该第一节点发送第三请求，该第三请求用于请求获取该第一应用的许可证。
应理解，以上管理装置也可由芯片构成。例如，该芯片包含处理器901。另外，该芯片还可与存储器902或者通信接口903中的任意一个或多个组件耦合。
如图10所示，本申请实施例提供的一种管理装置1000可以包括通信模块1001以及处理模块1002，以上通信模块1001以及处理模块1002之间相互耦合。该管理装置1000可用于执行以上方法实施例中由管理设备执行的步骤。该通信模块1001可用于支持管理装置1000进行通信，通信模块1001可具备通信功能，例如能够通过以太网口等有线和/ 或无线通信介质进行数据帧的接收和/或发送。处理模块1002可用于支持该管理装置1000执行上述方法实施例中管理设备的处理动作，包括但不限于：确定应用的鉴权信息、生成由通信模块1001发送的信息、消息，和/或，对通信模块1001接收的信号进行解调解码等等。
在执行上述方法实施例中由管理设备执行的步骤时，处理模块1002可用于确定至少一个应用的鉴权信息，该至少一个应用包括部署于第二节点的第一应用。该通信模块1001还可向第一节点发送至少一个应用的鉴权信息，第一节点以及第二节点均为边缘节点，该至少一个应用的鉴权信息用于验证是否允许运行该至少一个应用。
其中，该至少一个应用还可包括部署于第一节点的第二应用，从而第一节点可获取第二应用的鉴权信息，用于第二应用的鉴权。
示例性的，该通信模块1001可向该第一节点发送至少一个应用的许可证，该至少一个应用的许可证包括该第一应用的许可证。
此外，该至少一个应用的许可证还可包括第二应用的许可证，该第二用于部署于该第一节点。
示例性的，该通信模块1001还可接收来自该第一节点的第二请求，该第二请求用于请求获取该第一应用的许可证。
在实现本申请所示的管理设备时，本申请实施例提供的管理装置还可包括如图11所示结构，可见，管理装置1100可包括处理器1101、存储器1102以及通信接口1103。
以上处理器1101可用于确定至少一个用于的鉴权信息，以及用于对通信协议以及通信数据进行处理，以及对管理装置进行控制，执行软件程序，处理软件程序的数据等。存储器1102可用于存储指令(或称程序)和数据，处理器1101可基于该指令执行本申请实施例中由管理设备执行的方法。通信接口1103在本申请中可用于管理装置1100进行有线和/或无线通信，例如，接收通过电力线传输的信号，以及通过电力线发送信号。
示例性的，以上处理器1101可用于执行上述由处理模块1002所执行的步骤。通信接口1103可用于执行上述由通信模块1001执行的步骤。
具体的，处理器1101可用于确定至少一个应用的鉴权信息，该至少一个应用包括部署于第二节点的第一应用。该通信接口1103还可向第一节点发送至少一个应用的鉴权信息，第一节点以及第二节点均为边缘节点，该至少一个应用的鉴权信息用于验证是否允许运行该至少一个应用。
其中，该至少一个应用还可包括部署于第一节点的第二应用，从而第一节点可获取第二应用的鉴权信息，用于第二应用的鉴权。
示例性的，该通信接口1103可向该第一节点发送至少一个应用的许可证，该至少一个应用的许可证包括该第一应用的许可证。
此外，该至少一个应用的许可证还可包括第二应用的许可证，该第二用于部署于该第一节点。
示例性的，该通信接口1103还可接收来自该第一节点的第二请求，该第二请求用于请求获取该第一应用的许可证。
应理解，以上管理装置也可由芯片构成。例如，该芯片包含处理器1101。另外，该芯片还可与存储器1102或者通信接口1103中的任意一个或多个组件耦合。
基于与上述方法实施例相同构思，本申请实施例中还提供一种计算机可读存储介质， 其上存储有计算机程序，该程序被处理器执行时，使该计算机执行上述方法实施例、方法实施例的任意一种可能的实现方式中由第一节点、第二节点和/或管理设备执行的方法。
基于与上述方法实施例相同构思，本申请还提供一种计算机程序产品，该计算机程序产品在被计算机调用执行时，可以使得计算机实现上述方法实施例、方法实施例的任意一种可能的实现方式中由第一节点、第二节点和/或管理设备执行的方法。
基于与上述方法实施例相同构思，本申请还提供一种芯片或芯片系统，该芯片可包括处理器。该芯片还可包括存储器(或存储模块)和/或通信接口(或通信模块)，或者，该芯片与存储器(或存储模块)和/或通信接口(或通信模块)耦合，其中，通信接口(或通信模块)可用于支持该芯片进行有线和/或无线通信，存储器(或存储模块)可用于存储程序，该处理器调用该程序可用于实现上述方法实施例、方法实施例的任意一种可能的实现方式中由第一节点、第二节点和/或管理设备执行的方法。该芯片系统可包括以上芯片，也可以包含上述芯片和其他分立器件，如存储器(或存储模块)和/或通信接口(或通信模块)。
基于与上述方法实施例相同构思，本申请还提供一种边缘应用管理系统，该边缘应用管理系统可包括以上第一节点以及第二节点。此外，该边缘应用管理系统中还可包括管理设备。该边缘应用管理系统可用于实现上述方法实施例、方法实施例的任意一种可能的实现方式中涉及的方法。示例性的，该边缘应用管理系统可具有如图2所示结构。
示例性的，图2所示边缘应用管理系统中，当第二节点中需要运行第一应用时，第二节点可向第一节点发送第一请求，其中，第一请求用于请求验证是否允许运行第一应用。第一节点可根据第一应用的鉴权信息确定第一验证结果，第一验证结果可用于指示是否允许运行第一应用。此外，第一节点可向第二节点发送第一验证结果，从而可由第二节点确定是否允许第一应用。此外，边缘应用管理系统中还可包括管理设备，第一节点可从管理设备获取第一应用的鉴权信息，第一应用的鉴权信息用于验证是否允许运行第一应用。
本申请实施例是参照实施例所涉及的方法、装置、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。

Claims (37)

  1. 一种边缘应用的管理方法，其特征在于，包括：
    第一节点接收来自第二节点的第一请求，所述第一请求用于请求验证是否允许运行第一应用，所述第一应用部署于第二节点，所述第一节点以及所述第二节点均为边缘节点；
    所述第一节点根据所述第一应用的鉴权信息，确定第一验证结果，所述第一验证结果用于指示允许运行所述第一应用，或者，所述第一验证结果用于指示不允许运行所述第一应用，所述第一应用的鉴权信息来自于云中心侧的管理设备；
    所述第一节点向所述第二节点发送所述第一验证结果。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一节点接收来自所述管理设备的至少一个应用的鉴权信息，所述至少一个应用的鉴权信息包括所述第一应用的鉴权信息。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一节点接收来自所述管理设备的至少一个应用的许可证，所述至少一个应用的许可证包括所述第一应用的许可证。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    所述第一节点向所述管理设备发送第二请求，所述第二请求用于请求获取所述第一应用的许可证。
  5. 如权利要求3或4所述的方法，其特征在于，所述方法还包括：
    所述第一节点向所述第二节点发送所述第一应用的许可证。
  6. 如权利要求3-5中任一所述的方法，其特征在于，所述方法还包括：
    所述第一节点接收来自所述第二节点的第三请求，所述第二请求用于请求获取所述第一应用的许可证。
  7. 如权利要求1-6中任一所述的方法，其特征在于，所述方法还包括：
    所述第一节点根据第二应用的鉴权信息，确定第二验证结果，所述第二验证结果用于指示允许运行所述第二应用，或者，所述第二验证结果用于指示不允许运行所述第二应用，所述第二应用部署于所述第一节点。
  8. 一种边缘应用的管理方法，其特征在于，包括：
    第二节点向第一节点发送第一请求，所述第一请求用于请求验证是否允许运行第一应用，所述第一应用部署于所述第二节点，所述第一节点以及所述第二节点均为边缘节点；
    所述第二节点接收来自所述第二节点的第一验证结果，所述第一验证结果用于指示允许运行所述第一应用，或者，所述第一验证结果用于指示不允许运行所述第一应用。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    所述第二节点接收来自所述第一节点的所述第一应用的许可证。
  10. 如权利要求8或9所述的方法，其特征在于，所述方法还包括：
    所述第二节点向所述第一节点发送第三请求，所述第三请求用于请求获取所述第一应用的许可证。
  11. 一种边缘应用的管理方法，其特征在于，包括：
    管理设备确定至少一个应用的鉴权信息，所述管理设备部署于云中心侧，所述至少一个应用包括部署于第二节点的第一应用；
    所述管理设备向第一节点发送至少一个应用的鉴权信息，所述第一节点以及所述第二节点均为边缘节点，所述至少一个应用的鉴权信息用于验证是否允许运行所述至少一个应用。
  12. 如权利要求11所述的方法，其特征在于，所述至少一个应用还包括部署于第一节点的第二应用。
  13. 如权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述管理设备向所述第一节点发送至少一个应用的许可证，所述至少一个应用的许可证包括所述第一应用的许可证。
  14. 如权利要求13所述的方法，其特征在于，所述至少一个应用的许可证还包括第二应用的许可证，所述第二用于部署于所述第一节点。
  15. 如权利要求13或14所述的方法，其特征在于，所述方法还包括：
    所述管理设备接收来自所述第一节点的第二请求，所述第二请求用于请求获取所述第一应用的许可证。
  16. 一种边缘应用的管理装置，其特征在于，包括：
    通信模块，用于第一节点接收来自第二节点的第一请求，所述第一请求用于请求验证是否允许运行第一应用，所述第一应用部署于第二节点，所述第一节点以及所述第二节点均为边缘节点；
    处理模块，用于所述第一节点根据所述第一应用的鉴权信息，确定第一验证结果，所述第一验证结果用于指示允许运行所述第一应用，或者，所述第一验证结果用于指示不允许运行所述第一应用，所述第一应用的鉴权信息来自于云中心侧的管理设备；
    所述通信模块，还用于向所述第二节点发送所述第一验证结果。
  17. 如权利要求16所述的管理装置，其特征在于，所述通信模块还用于：
    接收来自所述管理设备的至少一个应用的鉴权信息，所述至少一个应用的鉴权信息包括所述第一应用的鉴权信息。
  18. 如权利要求16或17所述的管理装置，其特征在于，所述通信模块还用于：
    接收来自所述管理设备的至少一个应用的许可证，所述至少一个应用的许可证包括所述第一应用的许可证。
  19. 如权利要求18所述的管理装置，其特征在于，所述通信模块还用于：
    向所述管理设备发送第二请求，所述第二请求用于请求获取所述第一应用的许可证。
  20. 如权利要求18或19所述的管理装置，其特征在于，所述通信模块还用于：
    向所述第二节点发送所述第一应用的许可证。
  21. 如权利要求18-20中任一所述的管理装置，其特征在于，所述通信模块还用于：
    接收来自所述第二节点的第三请求，所述第二请求用于请求获取所述第一应用的许可证。
  22. 如权利要求16-21中任一所述的管理装置，其特征在于，所述处理模块还用于：
    根据第二应用的鉴权信息，确定第二验证结果，所述第二验证结果用于指示允许运行所述第二应用，或者，所述第二验证结果用于指示不允许运行所述第二应用，所述第二应用部署于所述第一节点。
  23. 一种边缘应用的管理装置，其特征在于，包括：
    通信模块，用于向第一节点发送第一请求，所述第一请求用于请求验证是否允许运行 第一应用，所述第一应用部署于所述第二节点，所述第一节点以及所述第二节点均为边缘节点；
    所述通信模块，还用于接收来自所述第二节点的第一验证结果，所述第一验证结果用于指示允许运行所述第一应用，或者，所述第一验证结果用于指示不允许运行所述第一应用。
  24. 如权利要求23所述的管理装置，其特征在于，所述通信模块还用于：
    接收来自所述第一节点的所述第一应用的许可证。
  25. 如权利要求23或24所述的管理装置，其特征在于，所述通信模块还用于：
    向所述第一节点发送第三请求，所述第三请求用于请求获取所述第一应用的许可证。
  26. 一种边缘应用的管理装置，其特征在于，包括：
    处理模块，用于确定至少一个应用的鉴权信息，所述管理设备部署于云中心侧，所述至少一个应用包括部署于第二节点的第一应用；
    通信模块，用于向第一节点发送至少一个应用的鉴权信息，所述第一节点以及所述第二节点均为边缘节点，所述至少一个应用的鉴权信息用于验证是否允许运行所述至少一个应用。
  27. 如权利要求26所述的管理装置，其特征在于，所述至少一个应用还包括部署于第一节点的第二应用。
  28. 如权利要求26或27所述的管理装置，其特征在于，所述通信模块还用于：
    向所述第一节点发送至少一个应用的许可证，所述至少一个应用的许可证包括所述第一应用的许可证。
  29. 如权利要求28所述的管理装置，其特征在于，所述至少一个应用的许可证还包括第二应用的许可证，所述第二用于部署于所述第一节点。
  30. 如权利要求28或29所述的管理装置，其特征在于，所述通信模块还用于：
    接收来自所述第一节点的第二请求，所述第二请求用于请求获取所述第一应用的许可证。
  31. 一种管理装置，其特征在于，包括：
    存储器，用于存储指令；
    处理器，用于从所述存储器中调用并运行所述指令，使得所述通信装置执行如权利要求1-7中任一项所述的方法。
  32. 一种管理装置，其特征在于，包括：
    存储器，用于存储指令；
    处理器，用于从所述存储器中调用并运行所述指令，使得所述通信装置执行如权利要求8-10中任一项所述的方法。
  33. 一种管理装置，其特征在于，包括：
    存储器，用于存储指令；
    处理器，用于从所述存储器中调用并运行所述指令，使得所述通信装置执行如权利要求11-15中任一项所述的方法。
  34. 一种通信系统，其特征在于，包括如权利要求16-22或31中任一所述的管理装置、如权利要求23-25或32中任一所述的管理装置和如权利要求26-30或33中任一所述的管理装置。
  35. 一种计算机可读存储介质，其特征在于，所述计算机存储介质中存储有指令，当所述指令在计算机上被调用执行时，使得所述计算机执行如权利要求1-15中任一项所述的方法。
  36. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求1-15中任一项所述的方法。
  37. 一种电路，其特征在于，所述电路与存储器耦合，所述电路用于读取并执行所述存储器中存储的程序以执行如权利要求1-15中任一项所述的方法。
PCT/CN2020/134588 2019-12-10 2020-12-08 一种边缘应用的管理方法及装置 WO2021115270A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911257478.1A CN112953986B (zh) 2019-12-10 2019-12-10 一种边缘应用的管理方法及装置
CN201911257478.1 2019-12-10

Publications (1)

Publication Number Publication Date
WO2021115270A1 true WO2021115270A1 (zh) 2021-06-17

Family

ID=76225325

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/134588 WO2021115270A1 (zh) 2019-12-10 2020-12-08 一种边缘应用的管理方法及装置

Country Status (2)

Country Link
CN (1) CN112953986B (zh)
WO (1) WO2021115270A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113689606A (zh) * 2021-08-20 2021-11-23 浙江大华技术股份有限公司 对象的鉴权方法、装置、存储介质和电子装置
CN114944928A (zh) * 2022-03-23 2022-08-26 北京奕斯伟计算技术股份有限公司 边缘计算设备中算法模型的鉴权方法、系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106506439A (zh) * 2015-11-30 2017-03-15 杭州华三通信技术有限公司 一种认证终端接入网络的方法和装置
CN109861828A (zh) * 2018-12-11 2019-06-07 全球能源互联网研究院有限公司 一种基于边缘计算的节点接入和节点认证方法
WO2019120091A1 (zh) * 2017-12-18 2019-06-27 阿里巴巴集团控股有限公司 身份认证方法、系统及计算设备
CN110177102A (zh) * 2019-05-28 2019-08-27 深圳市网心科技有限公司 基于边缘节点的防攻击方法、电子设备、系统及介质
CN110191139A (zh) * 2019-07-17 2019-08-30 中国联合网络通信集团有限公司 一种鉴权方法和系统、终端接入网络的方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150350361A1 (en) * 2014-06-02 2015-12-03 International Business Machines Corporation Parallel processing architecture for license metrics software
CN104811438B (zh) * 2015-03-26 2018-01-23 网宿科技股份有限公司 基于调度系统的异步防盗链方法与系统
CN106998345A (zh) * 2016-01-26 2017-08-01 中兴通讯股份有限公司 业务网络的处理方法、装置及系统
CN106961451A (zh) * 2017-05-25 2017-07-18 网宿科技股份有限公司 Cdn中的鉴权方法、鉴权系统、边缘节点及鉴权服务器
US10922385B2 (en) * 2017-08-02 2021-02-16 Dell Products, L.P. Generating license files in an information handling system
CN109413000B (zh) * 2017-08-15 2021-06-18 刘其星 一种防盗链方法及防盗链网关系统
CN110166409B (zh) * 2018-02-13 2021-12-28 华为技术有限公司 设备接入方法、相关平台及计算机存储介质
CN110290094B (zh) * 2018-03-19 2022-03-11 华为技术有限公司 一种数据访问权限的控制方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106506439A (zh) * 2015-11-30 2017-03-15 杭州华三通信技术有限公司 一种认证终端接入网络的方法和装置
WO2019120091A1 (zh) * 2017-12-18 2019-06-27 阿里巴巴集团控股有限公司 身份认证方法、系统及计算设备
CN109861828A (zh) * 2018-12-11 2019-06-07 全球能源互联网研究院有限公司 一种基于边缘计算的节点接入和节点认证方法
CN110177102A (zh) * 2019-05-28 2019-08-27 深圳市网心科技有限公司 基于边缘节点的防攻击方法、电子设备、系统及介质
CN110191139A (zh) * 2019-07-17 2019-08-30 中国联合网络通信集团有限公司 一种鉴权方法和系统、终端接入网络的方法

Also Published As

Publication number Publication date
CN112953986B (zh) 2024-03-12
CN112953986A (zh) 2021-06-11

Similar Documents

Publication Publication Date Title
US20210297410A1 (en) Mec platform deployment method and apparatus
JP7528366B2 (ja) サービス通信方法、システム、装置及び電子機器
CN107784221B (zh) 权限控制方法、服务提供方法、装置、系统及电子设备
US8438621B2 (en) Method and apparatus for secure management of debugging processes within communication devices
KR102472362B1 (ko) 블록 체인 기반 사물 인터넷 장치 제어 시스템 및 방법
US11989284B2 (en) Service API invoking method and related apparatus
WO2021115270A1 (zh) 一种边缘应用的管理方法及装置
WO2020048194A1 (zh) 用于在通用服务实体上进行任务处理的方法、通用服务实体、进行任务处理的装置和介质
US9596244B1 (en) Securing services and intra-service communications
EP3972199B1 (en) Open interface management method, electronic device, and storage medium
CN115865537B (zh) 基于中心化系统管理的隐私计算方法、电子设备和存储介质
CN116049860B (zh) 访问控制方法、装置、计算机设备及存储介质
JP2023120287A (ja) 拡張可能な証明書管理システムアーキテクチャ
WO2020119477A1 (zh) 一种基于区块链的身份认证方法及终端设备
CN108540301B (zh) 一种预置账户的密码初始化方法及相关设备
CN115296866A (zh) 一种边缘节点的访问方法及装置
CN114329574A (zh) 基于域管平台的加密分区访问控制方法、系统及计算设备
CN114567678A (zh) 一种云安全服务的资源调用方法、装置及电子设备
CN109120631B (zh) 功能调用系统、方法、装置及存储介质
WO2022252912A1 (zh) 一种用户数据管理方法以及相关设备
CN118300835B (zh) 可信计算设备集群的高可用管理方法、系统、终端及介质
WO2023284549A1 (zh) 一种用户数据管理方法以及相关设备
CN115865439A (zh) 一种分布式工业控制系统及该系统的访问权限控制方法
CN118118906A (zh) 通信方法及通信装置
CN116961931A (zh) 一种边缘计算组网方法、装置及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20899183

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20899183

Country of ref document: EP

Kind code of ref document: A1