WO2022227420A1 - 一种容器应用认证方法、系统、计算设备及可读存储介质 - Google Patents

一种容器应用认证方法、系统、计算设备及可读存储介质 Download PDF

Info

Publication number
WO2022227420A1
WO2022227420A1 PCT/CN2021/124290 CN2021124290W WO2022227420A1 WO 2022227420 A1 WO2022227420 A1 WO 2022227420A1 CN 2021124290 W CN2021124290 W CN 2021124290W WO 2022227420 A1 WO2022227420 A1 WO 2022227420A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
client
container application
server
message
Prior art date
Application number
PCT/CN2021/124290
Other languages
English (en)
French (fr)
Inventor
张磊
Original Assignee
统信软件技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 统信软件技术有限公司 filed Critical 统信软件技术有限公司
Publication of WO2022227420A1 publication Critical patent/WO2022227420A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/51—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45575—Starting, stopping, suspending or resuming virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present invention relates to the field of security authentication, and in particular, to an authentication method, system, computing device and readable storage medium for container applications.
  • Container technology has the advantages of being lightweight, standard, easy to deploy, and easy to maintain.
  • the application software running in the container requires a strict authentication and authorization to ensure the correct operation of the software.
  • Existing application software usually uses reading and reading software operating environment parameters to obtain a software-related authentication string, which is sent to the server through the network for unified authentication. This method is effective for physical machines, but For docker, because docker is software, copying a docker actually copies a piece of software, and the running environment parameters of the docker running on the same host are exactly the same. In other words, identifying the container environment and distinguishing the physical host cannot To achieve the purpose of docker internal software protection.
  • the present invention provides a container application authentication method, system, computing device and readable storage medium, so as to try to solve or at least alleviate the above problems.
  • a container application authentication method is provided, which is suitable for execution in a container application authentication system.
  • the container application authentication system includes an authentication server and a container application system.
  • the container application system includes a plurality of container application clients and a container application.
  • the method includes: starting the container application client, and generating a first authentication message on the container application client; authenticating the first authentication message through the container application server; if the first authentication message is authenticated , it is determined that the container application client is successfully started; the authentication client obtains the activation serial code input by the user, and authenticates the activation serial code through the authentication server; if the activation serial code authentication passes, the authentication server sends authorization information to the authentication client; authentication The client activates the container application client according to the authorization information.
  • the method further includes: when the container application client is installed, the container application server assigns a corresponding IP address and process number to the container application client.
  • generating the first authentication message at the container application client includes: performing a hash operation on the IP address and progress number of the current container application client; The address and process number generate the first authentication message.
  • the container application server stores an authentication information table and stores a plurality of authentication information records, and each authentication information record includes an IP address, a process number and a process number according to the IP address and process.
  • Authenticating the first authentication message through the container application server includes: the container application server inquires whether the first authentication message exists in the authentication information table; if it exists, the first authentication message is authenticated If successful, otherwise, the authentication of the first authentication message fails.
  • authenticating the activation serial code through the authentication server includes: the authentication client obtains the activation serial code input by the user; The activation serial code is sent to the authentication server for authentication.
  • authenticating the activation serial code through the authentication server includes: the authentication client generates a two-dimensional code, and prompts the user to pass the authentication.
  • the mobile terminal scans the two-dimensional code; the user scans the two-dimensional code with the mobile terminal, and sends the activation serial code to the authentication server for authentication.
  • authenticating the activation serial code through the authentication server includes: the authentication client prompts the user to send an authentication short message; The mobile terminal sends an authentication short message and sends the activation serial code to the authentication server for authentication.
  • the container application authentication method further includes: the authentication client receives the authorization information and saves it; when the authentication client and the authentication server are successfully connected in communication, the authentication client keeps the authentication with the authentication server through the heartbeat mechanism. Communication connection; when the communication connection between the authentication client and the authentication server fails, the authentication client completes the next authentication of the activation serial code every predetermined period of time.
  • the authentication server issuing authorization information to the authentication client further includes: when the communication connection between the authentication client and the authentication server fails, the authentication server sends the authorization to the authentication client through the mobile terminal. information.
  • a container application authentication system which includes an authentication server and a container application system.
  • the container application system includes a plurality of container application clients, a container application server and an authentication client, wherein the container application
  • the client is adapted to generate the first authentication message at startup;
  • the container application server is adapted to authenticate the first authentication message;
  • the authentication client is adapted to obtain the activation sequence code input by the user, and verify the activation sequence through the authentication server It is also suitable for activating the container application client according to the authorization information returned by the authentication server;
  • the authentication server is suitable for authenticating the activation serial code, and if the activation serial code is authenticated, the authorization information is sent to the authentication client.
  • a computing device comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be adapted to be executed by the at least one processor, the program instructions including for Execute any of the above instructions for the container application authentication method.
  • a readable storage medium storing program instructions.
  • the computing device can execute any one of the above container application authentication methods.
  • the container application authentication method of the present invention through the authentication of the first authentication message between the container application client and the container application server, the legality authentication of the container application client by the container application server is realized, and other illegally copied containers are avoided.
  • the application client starts normally on the host.
  • the authentication client obtains authorization information through the authentication of the activation serial code by the authentication server, and the authentication client manages the authorization information in a unified manner, and activates the corresponding container application client according to the authorization information to ensure that Only the authorized container application client can be activated and enabled, which realizes the authorization and authentication of the container application, and avoids the drawback of arbitrary copying of the container application caused by the authorization and authentication of the container operating environment only.
  • FIG. 1 shows a schematic diagram of a container application authentication system 100 according to an embodiment of the present invention
  • FIG. 2 shows a block diagram of a computing device 200 according to one embodiment of the present invention
  • FIG. 3 shows a flowchart of a container application authentication method 300 according to an embodiment of the present invention
  • FIG. 4 shows a flowchart of an activation authentication process 400 according to an embodiment of the present invention
  • FIG. 5 shows a flow diagram of an activation authentication process 500 according to one embodiment of the present invention.
  • the present invention provides an authorization authentication for container applications controlled by a service authentication mechanism.
  • FIG. 1 shows a schematic diagram of a container application authentication system 100 according to an embodiment of the present invention.
  • the container application authentication system 100 includes a container application system 110 , an authentication server 120 and a mobile terminal 130 .
  • the container application system 110 includes a container application server 1101 , a container application client 1102 (including 1102-1, 1102-2 . . . 1102-N) and an authentication client 1103.
  • the container application authentication system 100 shown in FIG. 1 is only exemplary, and in specific practice, it can be designed according to actual needs.
  • the container application usually runs on the host computer.
  • the container application server 1101 is the host computer, which is a physical device with communication, computing, and storage functions, and can be implemented as a server. Such as application server, web server, etc.
  • the docker host is the container application server, and the container application server 1101 is suitable for assigning the corresponding IP address and process number (PID) to the legitimate container application client 1102 running on it.
  • PID IP address and process number
  • the container application client 1102 is a container containing application software. Multiple container application clients can jointly run on a host, and obtain valid IP addresses and PIDs from the container application server 1101 respectively, so that when starting Complete the authentication with the container application server.
  • the authentication client 1103 is used to complete the activation authorization authentication with the external authentication server 120, and uniformly manage the activation authorization of all the container application clients 1102.
  • the authentication client 1103 can be implemented by a container application client parallel to the container application client, and the authentication process with the authentication server 120 can be completed by the client installing the authentication service program.
  • the authentication server 120 is used to complete the authorization activation authentication for the container application client in the container application system.
  • the server installed with the authentication service program returns authorization information to the authentication client after passing the authentication request sent by the authentication client.
  • the authentication mechanism for authenticating the client and the authentication server is KMS authentication.
  • the mobile terminal 130 is a terminal device with a communication function, such as a mobile phone, a tablet computer, etc.
  • the authentication client 1103 When the authentication client 1103 is offline and cannot communicate with the authentication server 120, the authentication process with the authentication server 120 can be indirectly completed through the mobile terminal. For example, the authentication client 1103 can generate a two-dimensional code for the user's mobile terminal to scan, so as to complete the authentication interaction with the authentication server.
  • the host ie, the container application server
  • the docker container application ie the container application client
  • the host is installed with the monitoring program client.
  • the docker container application starts, the first authentication message is generated through the IP address and process number, and the authentication with the host is completed through the first authentication message. After the authentication is successful, the docker The container application starts successfully and waits for activation. If the authentication fails, the docker container fails to start.
  • the authentication client 1103 After the docker container is successfully started, the authentication client 1103 generates an activation authentication message according to the activation serial code input by the user, and performs authentication through the authentication server 120. After the authentication is passed, the authentication server 120 issues authorization information, and the authentication client 1103 activates according to the authorization information.
  • the corresponding container application client After the docker container is successfully started, the authentication client 1103 generates an activation authentication message according to the activation serial code input by the user, and performs authentication through the authentication server 120. After the authentication is passed, the authentication server 120 issues authorization information, and the authentication client 1103 activates according to the authorization information.
  • the corresponding container application client After the docker container is successfully started, the authentication client 1103 generates an activation authentication message according to the activation serial code input by the user, and performs authentication through the authentication server 120. After the authentication is passed, the authentication server 120 issues authorization information, and the authentication client 1103 activates according to the authorization information. The corresponding container application client.
  • FIG. 2 shows a block diagram of a computing device 200 according to an embodiment of the present invention.
  • the computing device 200 shown in FIG. 2 is only an example.
  • the computing device used to implement the container application authentication method of the present invention may be any type of device, and its hardware configuration may be the same as that shown in FIG. 2 .
  • the computing device 200 shown is the same, and may also be different from the computing device 200 shown in FIG. 2 .
  • the computing device used to implement the container application authentication method of the present invention may add or delete hardware components of the computing device 200 shown in FIG. 2 , and the present invention does not limit the specific hardware configuration of the computing device.
  • computing device 200 typically includes system memory 206 and one or more processors 204 .
  • Memory bus 208 may be used for communication between processor 204 and system memory 206 .
  • the processor 204 may be any type of process including, but not limited to, a microprocessor ( ⁇ P), a microcontroller ( ⁇ C), a digital information processor (DSP), or any combination thereof.
  • Processor 204 may include one or more levels of cache, such as L1 cache 210 and L2 cache 212 , processor core 214 , and registers 216 .
  • Exemplary processor cores 214 may include arithmetic logic units (ALUs), floating point units (FPUs), digital signal processing cores (DSP cores), or any combination thereof.
  • the example memory controller 218 may be used with the processor 204 , or in some implementations, the memory controller 218 may be an internal part of the processor 204 .
  • system memory 206 may be any type of memory including, but not limited to, volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof.
  • volatile memory such as RAM
  • non-volatile memory such as ROM, flash memory, etc.
  • the physical memory in the computing device generally refers to the volatile memory RAM, and the data in the disk needs to be loaded into the physical memory before it can be read by the processor 204 .
  • System memory 206 may include operating system 220 , one or more applications 222 , and program data 224 .
  • applications 222 may be arranged to execute instructions using program data 224 by one or more processors 204 on an operating system.
  • Operating system 220 which may be, for example, Linux, Windows, etc., includes program instructions for handling basic system services and performing hardware-dependent tasks.
  • the application 222 includes program instructions for implementing various user-desired functions, and the application 222 may be, for example, but not limited to, a browser, instant messaging software, software development tools (eg, integrated development environment IDE, compiler, etc.). Driver modules may be added to operating system 220 when application 222 is installed into computing device 200 .
  • the processor 204 reads the program instructions of the operating system 220 from the memory 206 and executes them.
  • the application 222 runs on the operating system 220, and uses the interface provided by the operating system 220 and the underlying hardware to realize various functions desired by the user.
  • the application 222 is loaded into the memory 206, and the processor 204 reads and executes the program instructions of the application 222 from the memory 206.
  • Computing device 200 also includes storage device 232 including removable storage 236 and non-removable storage 238 , both connected to storage interface bus 234 .
  • Computing device 200 may also include an interface bus 240 that facilitates communication from various interface devices (eg, output device 242 , peripheral interface 244 , and communication device 246 ) to base configuration 202 via bus/interface controller 230 .
  • Example output devices 242 include graphics processing unit 248 and audio processing unit 250 . They may be configured to facilitate communication via one or more A/V ports 252 with various external devices such as displays or speakers.
  • Example peripheral interfaces 244 may include serial interface controller 254 and parallel interface controller 256, which may be configured to facilitate communication via one or more I/O ports 258 and input devices such as keyboard, mouse, pen, etc.
  • the example communication device 246 may include a network controller 260 that may be arranged to facilitate communication via one or more communication ports 264 with one or more other computing devices 262 over a network communication link.
  • a network communication link may be one example of a communication medium.
  • Communication media may typically embody computer readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.
  • a "modulated data signal" can be a signal of which one or more of its data sets or whose alterations can be made in such a way as to encode information in the signal.
  • communication media may include wired media, such as wired or leased line networks, and various wireless media, such as acoustic, radio frequency (RF), microwave, infrared (IR), or other wireless media.
  • RF radio frequency
  • IR infrared
  • the term computer readable medium as used herein may include both storage media and communication media.
  • the application 222 includes instructions for executing the container application authentication method 300 of the present invention, which instructions may instruct the processor 204 to execute the container application authentication method 300 of the present invention.
  • FIG. 3 shows a flowchart of a container application authentication method 300 according to an embodiment of the present invention, which is suitable for execution in the container application authentication system shown in FIG. 1 .
  • the method 300 starts at step S310, In this step, the installation of the container application is completed.
  • the docker container adopts a C/S architecture, the host running on it can be regarded as the container application server, the docker container is the container application client, the server running the listener on the host, and the docker container The client that runs the listener.
  • the host assigns a specific IP address and process number to the docker container application through the listener.
  • the container application server guides the container application client to start.
  • the host machine guides the docker container application to start through the listener, and generates a first authentication message in the docker container according to its IP address and process number.
  • the first authentication message includes the current docker container IP address, process number and According to the hash value of the hash operation performed on the IP address and the process number, the docker container sends the first authentication message to the host for authentication.
  • step S330 is entered, and the container application server authenticates the first authentication message.
  • An authentication information table is stored on the container application server, which stores the authentication information records of all container application clients. Each authentication information record includes the IP address, process number and corresponding hash value of the container application client.
  • the authentication of an authentication message is a process of searching according to the IP address, process number and its corresponding hash value in the first authentication message. If it can be found, the authentication succeeds; otherwise, the authentication fails.
  • step S340 if the authentication of the first authentication message fails, the process proceeds to step S340, and the container application client fails to start, so that the illegally copied container application client cannot log in to the host because it does not have a legal IP address and process number. start up.
  • step S350 is entered, and the container application client is successfully started.
  • step S360 is entered to perform activation authorization authentication on the container application client.
  • Each container application corresponds to an activation sequence code.
  • the authentication of the activation serial code is completed through KMS authentication.
  • a docker container in the docker container cluster is designated as the authentication client to complete the authentication process, and the authentication client is uniformly managed by the authentication client. All docker containers of the docker container cluster. According to whether the authentication client and the authentication server are in communication connection, this step can be implemented as offline authentication and online authentication.
  • FIG. 4 shows a flowchart of an activation authentication process 400 according to an embodiment of the present invention, which is an online authentication process of an authentication client (a communication connection between an authentication client and an authentication server).
  • the authentication mechanism is KMS authentication mechanism.
  • the process starts at step S410.
  • the authentication client obtains the activation serial code input by the user, and directly sends it to the authentication server.
  • the authentication server authenticates the received activation serial code. If the authentication fails , then enter step S420, and return an authentication failure message to the authentication client, at this time, the container application client cannot be activated for use.
  • step S430 If the activation serial code authentication is successful, then go to step S430, and the authentication server returns authorization information.
  • the authentication server finds out according to the activation code sequence that it corresponds to 5 container application clients, and returns 5 authorization codes and the number of authorization codes 5.
  • step S440 the authentication client stores the authorization information after receiving the authorization information, and sends the authorization code to the corresponding container application client for activation, so that the container application client enters an activated and used state.
  • step S450 is entered.
  • the authentication client maintains the communication connection with the authentication server by sending a heartbeat packet to confirm the continuous validity of the authorization.
  • FIG. 5 shows a flowchart of a container application authentication process 500 according to an embodiment of the present invention, which is an offline authentication process of the authentication client (that is, the communication connection between the authentication client and the authentication server fails).
  • KMS authentication mechanism As shown in Fig. 5, the process starts from step S510, in this step, when the authentication client is offline, the offline authentication process is started, for example, prompting the user to send a specified short message through the mobile terminal, or generating a specified two-dimensional code, so that the user can pass Scan the mobile terminal.
  • step S520 the user sends a short message of specified content to a specified number through the mobile terminal according to the prompt of the authentication client, or scans the QR code according to the prompt to complete the process of sending the activation serial code to the authentication server.
  • step S530 If the authentication is successful, go to step S530, and the authentication server sends the authorization code information to the mobile terminal, including the authorization code sequence and the number of authorization codes.
  • step S540 the user inputs the authentication client to store according to the authorization information received by the mobile terminal, and the authentication client activates the corresponding container application client according to the authorization information.
  • step S520 if the authentication server fails to authenticate the activation serial code in step S520, then go to step S550 and return an authentication failure message to the corresponding mobile terminal. At this time, the container application client cannot be activated.
  • the activation authentication expiration time is recorded, and when the activation authentication fails, the activation authentication is completed again according to the process 500.
  • the continuous validity of the activation authentication is maintained through the heartbeat mechanism, and if the authentication client fails to send the heartbeat packet, the authentication expiration time is recorded,
  • the offline activation authentication process is started, that is, the authentication is completed according to the process shown in FIG. 5 .
  • the docker container adopts the C/S architecture
  • the host running on it can be regarded as the container application server
  • the docker container is the container application client
  • the host and all the docker containers form an intranet environment
  • the host runs the intranet KMS host service program
  • the docker container runs the intranet KMS connection service program
  • the authentication client runs the intranet KMS server program.
  • the host assigns a specific IP address and process number to the docker container application through the program.
  • the intranet KMS host service program running on the container application server communicates with the container application client through heartbeat packets
  • the container application server communicates with the authentication client through heartbeat packets.
  • the host assigns a specific IP address and process number to the container application client.
  • a second authentication message is generated through the IP address and process number, and the authentication with the host is completed through the second authentication message.
  • the docker container application starts successfully and waits for activation. If the authentication fails, the docker container fails to start.
  • the authentication client obtains the authorization information of the authentication server, the authorization information includes the authorization code sequence and the number of authorization codes, and the authorization code sequence includes the authorization code.
  • the authorization quantity refers to the authorized quantity of the docker container. If the number of authorizations of the container application client is less than the number of authorization codes, the client sends an authorization code to the container application client, and the authentication client activates the container application client according to the authorization code.
  • the container application authentication method of the present invention through the authentication of the first authentication message between the container application client and the container application server, the legality authentication of the container application client by the container application server is realized, and other illegally copied containers are avoided.
  • the application client starts normally on the host.
  • the authentication client obtains authorization information through the authentication of the activation serial code by the authentication server, and the authentication client manages the authorization information in a unified manner, and activates the corresponding container application client according to the authorization information to ensure that Only the authorized container application client can be activated and enabled, which realizes the authorization and authentication of the container application, and avoids the drawback of arbitrary copying of the container application caused by the authorization and authentication of the container operating environment only.
  • the various techniques described herein can be implemented in conjunction with hardware or software, or a combination thereof.
  • the method and apparatus of the present invention may take the form of an embedded tangible medium, such as a removable hard disk, a USB stick, a floppy disk, a CD-ROM, or any other machine-readable storage medium.
  • program code ie, instructions
  • the machine becomes an apparatus for practicing the invention.
  • the computing device typically includes a processor, a storage medium readable by the processor (including volatile and nonvolatile memory and/or storage elements), at least one input device, and at least one output device.
  • the memory is configured to store program codes; the processor is configured to execute the container application authentication method of the present invention according to the instructions in the program codes stored in the memory.
  • readable media include readable storage media and communication media.
  • Readable storage media store information such as computer readable instructions, data structures, program modules or other data.
  • Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Combinations of any of the above are also included within the scope of readable media.
  • modules or units or components of the apparatus in the examples disclosed herein may be arranged in the apparatus as described in this embodiment, or alternatively may be positioned differently from the apparatus in this example in one or more devices.
  • the modules in the preceding examples may be combined into one module or further divided into sub-modules.
  • modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment.
  • the modules or units or components in the embodiments may be combined into one module or unit or component, and further they may be divided into multiple sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method so disclosed may be employed in any combination, unless at least some of such features and/or procedures or elements are mutually exclusive. All processes or units of equipment are combined.
  • Each feature disclosed in this specification may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Storage Device Security (AREA)

Abstract

一种容器应用认证方法、系统、计算设备及可读存储介质。该方法适于在容器应用认证系统中执行，容器应用认证系统包括认证服务器（120）、容器应用系统（110），容器应用系统（110）包括多个容器应用客户端（1102）、一个容器应用服务端（1101）和一个认证客户端（1103），方法包括：启动容器应用客户端（1102），并在容器应用客户端（1102）生成第一认证消息；通过容器应用服务端（1101）对第一认证消息进行认证；若第一认证消息认证通过，则确定容器应用客户端（1102）启动成功；认证客户端（1103）获取用户输入的激活序列码，并通过认证服务器（120）对激活序列码进行认证；若激活序列码认证通过，认证服务器（120）向认证客户端（1103）发送授权信息；认证客户端（1103）根据授权信息激活容器应用客户端（1102）。

Description

一种容器应用认证方法、系统、计算设备及可读存储介质 技术领域
本发明涉及安全认证领域，尤其涉及一种容器应用的认证方法、系统、计算设备及可读存储介质。
背景技术
容器技术具有轻量、标准、易部署、易维护等优点，容器中运行的应用软件，需要一种严格的认证授权，才能保证软件正确运行。现有的应用程序软件，通常采用读取读取软件运行环境参数，获得一个和软件相关的认证串，通过网络发送到服务端进行统一认证，这种方式对于实体机来说是有效的，但对于docker来说，因为docker是软件，复制一个docker就实际上复制了一份软件，运行在同一个宿主机上的docker，其运行环境参数是完全相同的，换言之，识别容器环境区别物理主机不能实现docker内部软件保护的目的。
发明内容
为此，本发明提供了一种容器应用认证方法、系统、计算设备及可读存储介质，以力图解决或者至少缓解上面存在的问题。
根据本发明的一个方面，提供一种容器应用认证方法，适于在容器应用认证系统中执行，容器应用认证系统包括认证服务器、容器应用系统，容器应用系统包括多个容器应用客户端、一个容器应用服务端和一个认证客户端，方法包括：启动容器应用客户端，并在容器应用客户端生成第一认证消息；通过容器应用服务端对第一认证消息进行认证；若第一认证消息认证通过，则确定容器应用客户端启动成功；认证客户端获取用户输入的激活序列码，并通过认证服务器对激活序列码进行认证；若激活序列码认证通过，认证服务器向认证客户端发送授权信息；认证客户端根据授权信息激活容器应用客户端。
可选的，在根据本发明的容器应用认证方法中，还包括：容器应用客户端安装时，容器应用服务端为容器应用客户端分配相应的IP地址和进程号。
可选的，在根据本发明的容器应用认证方法中，在容器应用客户端生成第一认证消息包括：对当前容器应用客户端的IP地址和进行号进行哈希运算；根据哈希运算结果、IP地址和进程号生成第一认证消息。
可选的，在根据本发明的容器应用认证方法中，容器应用服务端存储有认证信息表，存储有多条认证信息记录，每一条认证信息记录包括IP地址、进程号和根据IP地址和进程号进行哈希运算的哈希值，通过容器应用服务端对第一认证消息进行认证包括：容器应用服务端查询第一认证消息是否存在于认证信息表中；若存在，则第一认证消息认证成功，否则，第一认证消息认证失败。
可选的，在根据本发明的容器应用认证方法中，当认证客户端与认证服务器通信连接成功时，通过认证服务器对激活序列码进行认证包括：认证客户端获取用户输入的激活序列码；将激活序列码发送至认证服务器进行认证。
可选的，在根据本发明的容器应用认证方法中，当认证客户端与认证服务器通信连接失败时，通过认证服务器对激活序列码进行认证包括：认证客户端生成二维码，并提示用户通过移动终端扫描二维码；通过用户用移动终端扫描二维码，将激活序列码发送至认证服务器进行认证。
可选的，在根据本发明的容器应用认证方法中，当认证客户端与认证服务器通信连接失败时，通过认证服务器对激活序列码进行认证包括：认证客户端提示用户发送认证短信；通过用户用移动终端发送认证短信，将激活序列码发送至认证服务器进行认证。
可选的，在根据本发明的容器应用认证方法中，还包括：认证客户端接收授权信息并保存；当认证客户端与认证服务器通信连接成功时，认证客户端通过心跳机制保持与认证服务器的通信连接；当认证客户端与认证服务器通信连接失败时，认证客户端每间隔预定时长，完成对激活序列码的下一次认证。
可选的，在根据本发明的容器应用认证方法中，认证服务器向认证客户端发放授权信息还包括：当认证客户端与认证服务器通信连接失败时，认证 服务器通过移动终端向认证客户端发送授权信息。
根据本发明的另一个方面，提供一种容器应用认证系统，包括认证服务器、容器应用系统，容器应用系统包括多个容器应用客户端、一个容器应用服务端和一个认证客户端，其中，容器应用客户端，适于在启动时生成第一认证消息；容器应用服务端，适于对第一认证消息进行认证；认证客户端，适于获取用户输入的激活序列码，并通过认证服务器对激活序列码进行认证，还适于根据认证服务器返回的授权信息激活容器应用客户端；认证服务器，适于对激活序列码进行认证，若激活序列码认证通过，向认证客户端发送授权信息。
根据本发明的又一个方面，提供一种计算设备，包括：至少一个处理器；以及存储器，存储有程序指令，其中，程序指令被配置为适于由至少一个处理器执行，程序指令包括用于执行如上的任一项容器应用认证方法的指令。
根据本发明的又一方面，提供一种存储有程序指令的可读存储介质，当程序指令被计算设备读取并执行时，使得计算设备执行如上的任一项容器应用认证方法。
根据本发明的容器应用认证方法，通过容器应用客户端和容器应用服务端之间第一认证消息的认证，实现容器应用服务端对容器应用客户端的合法性的认证，避免了其他非法复制的容器应用客户端在宿主机上正常启动，同时，认证客户端通过认证服务器对激活序列码的认证获得授权信息，并由认证客户端统一管理授权信息，根据授权信息激活相应的容器应用客户端，保证只有授权通过的容器应用客户端能够激活启用，实现了对容器应用的授权认证，避免了仅对容器运行环境进行授权认证导致的容器应用任意复制的弊端。
附图说明
为了实现上述以及相关目的，本文结合下面的描述和附图来描述某些说明性方面，这些方面指示了可以实践本文所公开的原理的各种方式，并且所有方面及其等效方面旨在落入所要求保护的主题的范围内。通过结合附图阅读下面的详细描述，本公开的上述以及其它目的、特征和优势将变得更加明 显。遍及本公开，相同的附图标记通常指代相同的部件或元素。
图1示出了根据本发明一个实施例的容器应用认证系统100的示意图；
图2示出了根据本发明一个实施例的计算设备200的框图；
图3示出了根据本发明一个实施例的容器应用认证方法300的流程图；
图4示出了根据本发明一个实施例的激活认证过程400的流程图；
图5示出了根据本发明一个实施例的激活认证过程500的流程图。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
根据容器应用可以被复制并在同一宿主机上运行的特性，为了防止其他复制的非法容器应用在该宿主机上运行，本发明提供了一种通过服务认证机制控制实现对容器应用的授权认证。
图1示出了根据本发明一个实施例的容器应用认证系统100的示意图。如图1所示，容器应用认证系统100包括容器应用系统110、认证服务器120以及移动终端130。其中，容器应用系统110包括容器应用服务端1101、容器应用客户端1102(包括1102-1、1102-2……1102-N)和认证客户端1103。应当指出，图1所示的容器应用认证系统100仅是示例性的，在具体的实践中，可以根据实际需要进行设计。
根据本发明的一个实施例，容器应用通常运行在宿主机上，本实施例中，容器应用服务端1101即为宿主机，是具备通信、计算、存储功能的物理设备，其可以实现为服务器，例如应用服务器、Web服务器等。在docker容器架构中，docker宿主机即为容器应用服务端，容器应用服务端1101适于给运行在其上面的合法容器应用客户端1102分配相应的IP地址和进程号(PID)，在容器应用客户端启动时，根据相应的分配的IP地址和进程号进行认证，该认证过程可以通过监听服务程序完成。
容器应用客户端1102，即为包含应用程序软件的容器，多个容器应用客户端可以共同运行在一个宿主机上，并分别从容器应用服务端1101获得有效的IP地址和PID，以便在启动时完成与容器应用服务端的认证。
认证客户端1103，用于完成与外部认证服务器120的激活授权认证，并统一管理所有容器应用客户端1102的激活授权。在docker容器应用系统中，认证客户端1103可以通过一个和容器应用客户端并列的容器应用客户端实现，并通过安装认证服务程序的客户端完成与认证服务器120的认证过程。
认证服务器120用于完成对容器应用系统中容器应用客户端的授权激活认证，安装有认证服务程序的服务端，对认证客户端发送的认证请求通过后，向认证客户端返回授权信息。根据本发明的一个实施例，认证客户端与认证服务器的认证机制为KMS认证。
移动终端130，是具有通信功能的终端设备，例如：手机、平板电脑等，当认证客户端1103离线，不能通信连接认证服务器120时，可以通过移动终端间接完成与认证服务器120间的认证过程。例如：认证客户端1103可以生成二维码供用户移动终端扫描，以完成与认证服务器的认证交互。
根据本发明的一个实施例，在docker容器应用中，宿主机(即容器应用服务端)安装有监听应用程序服务端，docker容器应用(即容器应用客户端)安装有监听程序客户端，宿主机给docker容器分配特定的IP地址和进程号，在docker容器应用启动时，通过IP地址和进程号生成第一认证消息，通过第一认证消息完成与宿主机之间的认证，认证成功后，docker容器应用启动成功，并等待激活，若认证失败，则docker容器启动失败。docker容器启动成功后，认证客户端1103根据用户输入的激活序列码生成激活认证消息，并通过认证服务器120进行认证，认证通过后，由认证服务器120发放授权信息，认证客户端1103根据授权信息激活相应的容器应用客户端。
图1中的容器应用服务端和认证服务器都可以通过计算设备实现，图2示出了根据本发明一个实施例的计算设备200的框图。需要说明的是，图2所示的计算设备200仅为一个示例，在实践中，用于实施本发明的容器应用认证方法的计算设备可以是任意型号的设备，其硬件配置情况可以与图2所示的计算设备200相同，也可以与图2所示的计算设备200不同。实践中用 于实施本发明的容器应用认证方法的计算设备可以对图2所示的计算设备200的硬件组件进行增加或删减，本发明对计算设备的具体硬件配置情况不做限制。
如图2所示，在基本配置202中，计算设备200典型地包括系统存储器206和一个或者多个处理器204。存储器总线208可以用于在处理器204和系统存储器206之间的通信。
取决于期望的配置，处理器204可以是任何类型的处理，包括但不限于：微处理器(μP)、微控制器(μC)、数字信息处理器(DSP)或者它们的任何组合。处理器204可以包括诸如一级高速缓存210和二级高速缓存212之类的一个或者多个级别的高速缓存、处理器核心214和寄存器216。示例的处理器核心214可以包括运算逻辑单元(ALU)、浮点数单元(FPU)、数字信号处理核心(DSP核心)或者它们的任何组合。示例的存储器控制器218可以与处理器204一起使用，或者在一些实现中，存储器控制器218可以是处理器204的一个内部部分。
取决于期望的配置，系统存储器206可以是任意类型的存储器，包括但不限于：易失性存储器(诸如RAM)、非易失性存储器(诸如ROM、闪存等)或者它们的任何组合。计算设备中的物理内存通常指的是易失性存储器RAM，磁盘中的数据需要加载至物理内存中才能够被处理器204读取。系统存储器206可以包括操作系统220、一个或者多个应用222以及程序数据224。在一些实施方式中，应用222可以布置为在操作系统上由一个或多个处理器204利用程序数据224执行指令。操作系统220例如可以是Linux、Windows等，其包括用于处理基本系统服务以及执行依赖于硬件的任务的程序指令。应用222包括用于实现各种用户期望的功能的程序指令，应用222例如可以是浏览器、即时通讯软件、软件开发工具(例如集成开发环境IDE、编译器等)等，但不限于此。当应用222被安装到计算设备200中时，可以向操作系统220添加驱动模块。
在计算设备200启动运行时，处理器204会从存储器206中读取操作系统220的程序指令并执行。应用222运行在操作系统220之上，利用操作系统220以及底层硬件提供的接口来实现各种用户期望的功能。当用户启动应用222时，应用222会加载至存储器206中，处理器204从存储器206中读 取并执行应用222的程序指令。
计算设备200还包括储存设备232，储存设备232包括可移除储存器236和不可移除储存器238，可移除储存器236和不可移除储存器238均与储存接口总线234连接。
计算设备200还可以包括有助于从各种接口设备(例如，输出设备242、外设接口244和通信设备246)到基本配置202经由总线/接口控制器230的通信的接口总线240。示例的输出设备242包括图形处理单元248和音频处理单元250。它们可以被配置为有助于经由一个或者多个A/V端口252与诸如显示器或者扬声器之类的各种外部设备进行通信。示例外设接口244可以包括串行接口控制器254和并行接口控制器256，它们可以被配置为有助于经由一个或者多个I/O端口258和诸如输入设备(例如，键盘、鼠标、笔、语音输入设备、触摸输入设备)或者其他外设(例如打印机、扫描仪等)之类的外部设备进行通信。示例的通信设备246可以包括网络控制器260，其可以被布置为便于经由一个或者多个通信端口264与一个或者多个其他计算设备262通过网络通信链路的通信。
网络通信链路可以是通信介质的一个示例。通信介质通常可以体现为在诸如载波或者其他传输机制之类的调制数据信号中的计算机可读指令、数据结构、程序模块，并且可以包括任何信息递送介质。“调制数据信号”可以这样的信号，它的数据集中的一个或者多个或者它的改变可以在信号中编码信息的方式进行。作为非限制性的示例，通信介质可以包括诸如有线网络或者专线网络之类的有线介质，以及诸如声音、射频(RF)、微波、红外(IR)或者其它无线介质在内的各种无线介质。这里使用的术语计算机可读介质可以包括存储介质和通信介质二者。
在根据本发明的计算设备200中，应用222包括用于执行本发明的容器应用认证方法300的指令，该指令可以指示处理器204执行本发明的系容器应用认证方法300。
图3示出了根据本发明一个实施例的容器应用认证方法300的流程图，适于在如图1所示的容器应用认证系统中执行，如图1所示，方法300始于步骤S310，在该步骤中，完成容器应用的安装。根据本发明的一个实施例， docker容器采用C/S架构，其运行的宿主机可以视为容器应用服务端，docker容器为容器应用客户端，宿主机上运行监听程序的服务端，docker容器上运行监听程序的客户端，本步骤中，宿主机通过监听程序为docker容器应用分配特定的IP地址和进程号。
随后进入步骤S320，容器应用服务器引导容器应用客户端启动。在docker容器架构中，宿主机通过监听程序引导docker容器应用启动，并在docker容器中根据其IP地址和进程号生成第一认证消息，第一认证消息包括当前docker容器的IP地址、进程号以及根据IP地址和进程号进行哈希运算的哈希值，docker容器将第一认证消息发送至宿主机进行认证。
随后进入步骤S330，容器应用服务端对第一认证消息进行认证。在容器应用服务端存储有认证信息表，其中存储有所有容器应用客户端的认证信息记录，每一条认证信息记录包括容器应用客户端的IP地址、进程号和对应的哈希值，本步骤中对第一认证消息的认证，即根据第一认证消息中的IP地址、进程号和其对应的哈希值进行查找的过程，若能够查找到，则认证成功，否则，认证失败。
根据本发明的一个实施例，若第一认证消息认证失败，进入步骤S340，容器应用客户端启动失败，从而使得非法复制的容器应用客户端由于没有合法的IP地址和进程号而无法在宿主机上启动。
根据本发明的一个实施例，若第一认证消息认证成功，则进入步骤S350，容器应用客户端启动成功。
随后进入步骤S360，对容器应用客户端进行激活授权认证。每一个容器应用对应一个激活序列码。根据本发明的一个实施例，对激活序列码的认证通过KMS认证完成，在docker架构中，指定docker容器集群中的一个docker容器作为认证客户端完成该认证过程，并由该认证客户端统一管理docker容器集群的所有docker容器。根据认证客户端与认证服务器之间是否通信连接，本步骤可以实现为离线认证和在线认证。
图4示出了根据本发明一个实施例的激活认证过程400的流程图，该过程为认证客户端在线认证过程(认证客户端与认证服务器通信连接)，本实施例中，认证机制为KMS认证机制。
如图4所示，该过程始于步骤S410，根据用户输入，认证客户端获取用户输入的激活序列码，并直接发送至认证服务器，认证服务器对收到的激活序列码进行认证，如果认证失败，则进入步骤S420，返回认证失败消息给认证客户端，此时，容器应用客户端无法激活使用。
如果激活序列码认证成功，则进入步骤S430，认证服务器返回授权信息。其中包括授权码序列和授权码数量信息。例如，认证服务器根据激活码序列查询到，其对应5个容器应用客户端，则返回5个授权码以及授权码数量5。
随后进入步骤S440，认证客户端在收到授权信息后进行存储，并将授权码发送至相应的容器应用客户端进行激活，使容器应用客户端进入激活使用状态。
随后进入步骤S450，在授权认证完成后，认证客户端通过发送心跳包，保持与认证服务器的通信连接，以确认此次授权的持续有效性。
图5示出了根据本发明一个实施例的容器应用认证过程500的流程图，该过程为认证客户端离线认证过程(即认证客户端与认证服务器的通信连接失败)，本实施例中，采用KMS认证机制。如图5所示，该过程始于步骤S510，在该步骤中，认证客户端离线时，启动离线认证过程，例如：提示用户通过移动终端发送指定短信，或者生成指定二维码，以便用户通过移动终端进行扫描。
随后进入步骤S520，用户根据认证客户端的提示，通过移动终端发送指定内容短信到指定号码，或者根据提示扫描二维码，完成将激活序列码发送到认证服务器的过程。
若认证成功，进入步骤S530，认证服务器将授权码信息发送至移动终端，其中包括授权码序列和授权码数量。
随后进入步骤S540，用户根据移动终端收到的授权信息，输入认证客户端进行存储，并由认证客户端根据授权信息激活相应的容器应用客户端。
根据本发明的一个实施例，若步骤S520中，认证服务器对激活序列码认证失败，则进入步骤S550，返回认证失败消息给相应的移动终端，此时，容器应用客户端将无法被激活。
根据本发明的一个实施例，在根据过程500完成激活认证时，记录激活 认证失效时间，并在激活认证失效时，根据过程500再次完成激活认证。
根据本发明的又一个实施例，根据上述描述可知，在根据认证过程400完成激活认证时，通过心跳机制保持激活认证的持续有效性，如果认证客户端心跳包发送失败，则记录认证失效时间，并在认证失效时启动离线激活认证过程，即根据图5所示的过程完成认证。
根据本发明的还有一个实施例，docker容器采用C/S架构，其运行的宿主机可以视为容器应用服务端，docker容器为容器应用客户端，宿主机和所有的docker容器组成内网环境，宿主机上运行内网KMS主机服务程序，docker容器上运行内网KMS连接服务程序，认证客户端上运行内网KMS服务器程序。宿主机通过程序为docker容器应用分配特定的IP地址和进程号。其中，容器应用服务端上运行的内网KMS主机服务程序通过心跳包与容器应用客户端通信连接，容器应用服务端通过心跳包与认证客户端通信连接。宿主机给容器应用客户端分配特定的IP地址和进程号，在容器应用客户端启动时，通过IP地址和进程号生成第二认证消息，通过第二认证消息完成与宿主机之间的认证，认证成功后，docker容器应用启动成功，并等待激活，若认证失败，则docker容器启动失败。认证客户端获取认证服务器的授权信息，授权信息包括授权码序列和授权码数量，授权码序列包括授权码。通过容器应用服务器获取容器应用客户端的授权数量，授权数量是指docker容器已获得授权的数量。若容器应用客户端的授权数量小于所述授权码数量，则所述客户端向所述容器应用客户端发送授权码，认证客户端根据授权码激活容器应用客户端。根据本发明的容器应用认证方法，通过容器应用客户端和容器应用服务端之间第一认证消息的认证，实现容器应用服务端对容器应用客户端的合法性的认证，避免了其他非法复制的容器应用客户端在宿主机上正常启动，同时，认证客户端通过认证服务器对激活序列码的认证获得授权信息，并由认证客户端统一管理授权信息，根据授权信息激活相应的容器应用客户端，保证只有授权通过的容器应用客户端能够激活启用，实现了对容器应用的授权认证，避免了仅对容器运行环境进行授权认证导致的容器应用任意复制的弊端。
这里描述的各种技术可结合硬件或软件，或者它们的组合一起实现。从而，本发明的方法和设备，或者本发明的方法和设备的某些方面或部分可采 取嵌入有形媒介，例如可移动硬盘、U盘、软盘、CD-ROM或者其它任意机器可读的存储介质中的程序代码(即指令)的形式，其中当程序被载入诸如计算机之类的机器，并被所述机器执行时，所述机器变成实践本发明的设备。
在程序代码在可编程计算机上执行的情况下，计算设备一般包括处理器、处理器可读的存储介质(包括易失性和非易失性存储器和/或存储元件)，至少一个输入装置，和至少一个输出装置。其中，存储器被配置用于存储程序代码；处理器被配置用于根据该存储器中存储的所述程序代码中的指令，执行本发明的容器应用认证方法。
以示例而非限制的方式，可读介质包括可读存储介质和通信介质。可读存储介质存储诸如计算机可读指令、数据结构、程序模块或其它数据等信息。通信介质一般以诸如载波或其它传输机制等已调制数据信号来体现计算机可读指令、数据结构、程序模块或其它数据，并且包括任何信息传递介质。以上的任一种的组合也包括在可读介质的范围之内。
在此处所提供的说明书中，算法和显示不与任何特定计算机、虚拟系统或者其它设备固有相关。各种通用系统也可以与本发明的示例一起使用。根据上面的描述，构造这类系统所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下被实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员应当理解在本文所公开的示例中的设备的模块或单元或组件可以布置在如该实施例中所描述的设备中，或者可替换地可以定位在与该示例中的设备不同的一个或多个设备中。前述示例中的模块可以组合为一个模块或者此外可以分成多个子模块。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
此外，所述实施例中的一些在此被描述成可以由计算机系统的处理器或者由执行所述功能的其它装置实施的方法或方法元素的组合。因此，具有用于实施所述方法或方法元素的必要指令的处理器形成用于实施该方法或方法元素的装置。此外，装置实施例的在此所述的元素是如下装置的例子：该装置用于实施由为了实施该发明的目的的元素所执行的功能。
如在此所使用的那样，除非另行规定，使用序数词“第一”、“第二”、“第三”等等来描述普通对象仅仅表示涉及类似对象的不同实例，并且并不意图暗示这样被描述的对象必须具有时间上、空间上、排序方面或者以任意其它方式的给定顺序。
尽管根据有限数量的实施例描述了本发明，但是受益于上面的描述，本技术领域内的技术人员明白，在由此描述的本发明的范围内，可以设想其它 实施例。此外，应当注意，本说明书中使用的语言主要是为了可读性和教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择的。因此，在不偏离所附权利要求书的范围和精神的情况下，对于本技术领域的普通技术人员来说许多修改和变更都是显而易见的。对于本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本发明的范围由所附权利要求书限定。

Claims (15)

  1. 一种容器应用认证方法，适于在容器应用认证系统中执行，所述容器应用认证系统包括认证服务器、容器应用系统，所述容器应用系统包括多个容器应用客户端、一个容器应用服务端和一个认证客户端，所述方法包括：
    启动所述容器应用客户端，并在所述容器应用客户端生成第一认证消息；
    通过所述容器应用服务端对所述第一认证消息进行认证；
    若所述第一认证消息认证通过，则确定所述容器应用客户端启动成功；
    所述认证客户端获取用户输入的激活序列码，并通过所述认证服务器对所述激活序列码进行认证；
    若所述激活序列码认证通过，所述认证服务器向所述认证客户端发送授权信息；
    所述认证客户端根据所述授权信息激活所述容器应用客户端。
  2. 如权利要求1所述的方法，还包括：
    所述容器应用客户端安装时，所述容器应用服务端为所述容器应用客户端分配相应的IP地址和进程号。
  3. 如权利要求2所述的方法，其中，所述在所述容器应用客户端生成第一认证消息包括：
    对当前容器应用客户端的IP地址和进行号进行哈希运算；
    根据哈希运算结果、IP地址和进程号生成第一认证消息。
  4. 如权利要求1-3中任意一项所述的方法，其中，所述容器应用服务端存储有认证信息表，存储有多条认证信息记录，每一条认证信息记录包括IP地址、进程号和根据所述IP地址和进程号进行哈希运算的哈希值，所述通过所述容器应用服务端对所述第一认证消息进行认证包括：
    所述容器应用服务端查询所述第一认证消息是否存在于所述认证信息表中；
    若存在，则第一认证消息认证成功，否则，第一认证消息认证失败。
  5. 如权利要求1-4中任意一项所述的方法，其中，当所述认证客户端与 所述认证服务器通信连接成功时，所述通过所述认证服务器对所述激活序列码进行认证包括：
    所述认证客户端获取用户输入的激活序列码；
    将所述激活序列码发送至所述认证服务器进行认证。
  6. 如权利要求1-5中任意一项所述的方法，其中，当所述认证客户端与所述认证服务器通信连接失败时，所述通过所述认证服务器对所述激活序列码进行认证包括：
    所述认证客户端生成二维码，并提示用户通过移动终端扫描所述二维码；
    通过用户用移动终端扫描所述二维码，将所述激活序列码发送至所述认证服务器进行认证。
  7. 如权利要求1-6中任意一项所述的方法，其中，当所述认证客户端与所述认证服务器通信连接失败时，所述通过所述认证服务器对所述激活序列码进行认证包括：
    所述认证客户端提示用户发送认证短信；
    通过用户用移动终端发送所述认证短信，将所述激活序列码发送至所述认证服务器进行认证。
  8. 如权利要求1-7中任意一项所述的方法，还包括：
    所述认证客户端接收所述授权信息并保存；
    当所述认证客户端与所述认证服务器通信连接成功时，所述认证客户端通过心跳机制保持与认证服务器的通信连接；
    当所述认证客户端与所述认证服务器通信连接失败时，所述认证客户端每间隔预定时长，完成对激活序列码的下一次认证。
  9. 如权利要求1-8中任意一项所述的方法，所述认证服务器向所述认证客户端发放授权信息还包括：
    当所述认证客户端与所述认证服务器通信连接失败时，所述认证服务器通过移动终端向所述认证客户端发送授权信息。
  10. 一种容器应用认证方法，适于在容器应用系统中执行，所述容器应用系统包括多个容器应用客户端、一个容器应用服务端和一个认证客户端， 所述认证客户端与认证服务器连接，所述方法包括：
    启动所述容器应用客户端，并在所述容器应用客户端生成第二认证消息；
    通过所述容器应用服务端对所述第二认证消息进行认证；
    若所述第二认证消息认证通过，则确定所述容器应用客户端启动成功；
    所述认证客户端获取认证服务器的授权信息，所述授权信息包括授权码序列和授权码数量，所述授权码序列包括授权码；
    通过所述容器应用服务器获取容器应用客户端的授权数量；
    若容器应用客户端的授权数量小于所述授权码数量，则所述认证客户端向所述容器应用客户端发送授权码；
    所述认证客户端根据所述授权码激活所述容器应用客户端；
    其中，所述容器应用服务端通过心跳机制保持与所述容器应用客户端通信连接，所述容器应用服务端通过心跳机制保持与所述认证客户端通信连接。
  11. 如权利要求10所述的方法，还包括：
    所述容器应用客户端安装时，所述容器应用服务端为所述容器应用客户端分配相应的IP地址和进程号。
  12. 如权利要求11所述的方法，其中，所述在所述容器应用客户端生成第二认证消息包括：
    对当前容器应用客户端的IP地址和进行号进行哈希运算；
    根据哈希运算结果、IP地址和进程号生成第二认证消息。
  13. 一种容器应用认证系统，包括认证服务器、容器应用系统，所述容器应用系统包括多个容器应用客户端、一个容器应用服务端和一个认证客户端，其中，
    所述容器应用客户端，适于在启动时生成第一认证消息；
    所述容器应用服务端，适于对所述第一认证消息进行认证；
    所述认证客户端，适于获取用户输入的激活序列码，并通过所述认证服务器对所述激活序列码进行认证，还适于根据所述认证服务器返回的授权信息激活所述容器应用客户端；
    所述认证服务器，适于对所述激活序列码进行认证，若所述激活序列码认证通过，向所述认证客户端发送授权信息。
  14. 一种计算设备，包括：
    至少一个处理器；以及
    存储器，存储有程序指令，其中，所述程序指令被配置为适于由所述至少一个处理器执行，所述程序指令包括用于执行如权利要求1-12中任一项所述方法的指令。
  15. 一种存储有程序指令的可读存储介质，当所述程序指令被计算设备读取并执行时，使得所述移动终端执行如权利要求1-12中任一项所述方法。
PCT/CN2021/124290 2021-04-26 2021-10-18 一种容器应用认证方法、系统、计算设备及可读存储介质 WO2022227420A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110451970.3 2021-04-26
CN202110451970.3A CN112988333B (zh) 2021-04-26 2021-04-26 一种容器应用认证方法、系统、计算设备及可读存储介质

Publications (1)

Publication Number Publication Date
WO2022227420A1 true WO2022227420A1 (zh) 2022-11-03

Family

ID=76340180

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/124290 WO2022227420A1 (zh) 2021-04-26 2021-10-18 一种容器应用认证方法、系统、计算设备及可读存储介质

Country Status (2)

Country Link
CN (1) CN112988333B (zh)
WO (1) WO2022227420A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112988333B (zh) * 2021-04-26 2021-09-03 武汉深之度科技有限公司 一种容器应用认证方法、系统、计算设备及可读存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103888255A (zh) * 2012-12-21 2014-06-25 中国移动通信集团公司 一种身份认证方法、装置及系统
CN105306211A (zh) * 2014-08-01 2016-02-03 成都天钥科技有限公司 一种客户端软件的身份认证方法
CN108429730A (zh) * 2018-01-22 2018-08-21 北京智涵芯宇科技有限公司 无反馈安全认证与访问控制方法
US20190333062A1 (en) * 2005-10-07 2019-10-31 Raymond J. Gallagher, III Secure authentication and transaction system and method
CN112153025A (zh) * 2020-09-11 2020-12-29 浪潮电子信息产业股份有限公司 基于PAM实现OAuth2.0认证的方法、装置
CN112988333A (zh) * 2021-04-26 2021-06-18 武汉深之度科技有限公司 一种容器应用认证方法、系统、计算设备及可读存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100470575C (zh) * 2006-04-12 2009-03-18 北京金山软件有限公司 一种软件使用许可的方法和系统
US8412945B2 (en) * 2011-08-09 2013-04-02 CloudPassage, Inc. Systems and methods for implementing security in a cloud computing environment
CN103559436A (zh) * 2013-10-28 2014-02-05 曙光云计算技术有限公司 虚拟化启动的认证方法和装置
CN107133499B (zh) * 2017-05-10 2020-12-18 国信电子票据平台信息服务有限公司 一种软件版权保护方法、客户端、服务端以及系统
CN107395642B (zh) * 2017-08-31 2020-03-06 郑州云海信息技术有限公司 基于Websocket访问启动TLS认证的Docker容器的方法及系统
CN111625497B (zh) * 2020-05-22 2023-04-28 柏科数据技术（深圳）股份有限公司 一种分布式文件系统的部署方法、装置、设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190333062A1 (en) * 2005-10-07 2019-10-31 Raymond J. Gallagher, III Secure authentication and transaction system and method
CN103888255A (zh) * 2012-12-21 2014-06-25 中国移动通信集团公司 一种身份认证方法、装置及系统
CN105306211A (zh) * 2014-08-01 2016-02-03 成都天钥科技有限公司 一种客户端软件的身份认证方法
CN108429730A (zh) * 2018-01-22 2018-08-21 北京智涵芯宇科技有限公司 无反馈安全认证与访问控制方法
CN112153025A (zh) * 2020-09-11 2020-12-29 浪潮电子信息产业股份有限公司 基于PAM实现OAuth2.0认证的方法、装置
CN112988333A (zh) * 2021-04-26 2021-06-18 武汉深之度科技有限公司 一种容器应用认证方法、系统、计算设备及可读存储介质

Also Published As

Publication number Publication date
CN112988333B (zh) 2021-09-03
CN112988333A (zh) 2021-06-18

Similar Documents

Publication Publication Date Title
US11882108B2 (en) Application user single sign-on
US6223284B1 (en) Method and apparatus for remote ROM flashing and security management for a computer system
CN112699342B (zh) 授权控制方法、授权方法、装置及计算设备
RU2365987C2 (ru) Трехсторонняя проверка и аутентификация файлов начальной загрузки, передаваемых от сервера клиенту
US10482257B2 (en) System and method to enforce the secure boot policy of a platform on a virtual machine
US7788475B2 (en) Booting utilizing electronic mail
US9154504B2 (en) Device apparatus, control method, and relating storage medium
TWI654533B (zh) 下載以及安裝客戶端的方法、伺服器以及客戶端
CN102404314A (zh) 远程资源单点登录
CN112182550A (zh) 应用程序的授权方法、授权系统、激活装置及计算设备
JP5613596B2 (ja) 認証システム、端末装置、認証サーバ、およびプログラム
CN108073823B (zh) 数据处理方法、装置及系统
CN110069909B (zh) 一种免密登录第三方系统的方法及装置
US20160127356A1 (en) Information processing system and authentication method
JP2011076377A (ja) 端末装置及び端末装置におけるアクセス制御ポリシー取得方法
JP2006268449A (ja) 計算機システム及び記憶装置とコンピュータ・ソフトウエア並びにストレージ制御における管理者の認証方法
WO2022227420A1 (zh) 一种容器应用认证方法、系统、计算设备及可读存储介质
RU2638779C1 (ru) Способ и сервер для вьполнения авторизации приложения на электронном устройстве
CN113496020A (zh) 车机用户无感登录方法及其系统、车机、车辆
US11868476B2 (en) Boot-specific key access in a virtual device platform
US11356367B2 (en) Secure preloading of serverless function sequences
CN111447178B (zh) 一种访问控制方法、系统及计算设备
TW201328284A (zh) 在不同軟體發展平臺之間訪問驗證身份的系統及方法
CN107276966B (zh) 一种分布式系统的控制方法及登录系统
CN114880648A (zh) 操作系统的批量离线激活方法、在线激活方法及激活系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21938883

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21938883

Country of ref document: EP

Kind code of ref document: A1