CN114995838A - Software authorization installation method, device, equipment and medium for enterprise client - Google Patents

Abstract

The invention discloses a software authorization installation method, device, equipment and medium for an enterprise client. The software authorization installation method includes the following steps: obtaining encrypted software data; decrypting the software data, and downloading software according to the decrypted software data installation package; when the software installation package is verified, release the pre-configured authorization program; set and encrypt account data corresponding to the software installation package; send account data so that the authorization program runs the software installation package according to the administrator account. The invention improves the software installation function of the enterprise client, expands the scope of software installation and improves the user experience on the premise of not reducing security.

Description

Software authorization installation method, apparatus, device and media for enterprise client

technical field

The present invention relates to the field of software, and in particular, to a method, apparatus, device and medium for software authorized installation of an enterprise client.

Background technique

To meet the needs of enterprise management, security and business, it is often necessary to deploy various work software on enterprise clients. For example, communication software (WeChat), airline software, ticket processing software, development software, UI design software and database software, etc. According to the security and management requirements of the enterprise, users are often restricted without administrator rights, but most work software can be installed and used normally only after using administrator rights.

Commonly used software authorized installation methods include authorized installation of local system service rights and authorized installation of designated local administrator rights. The authorized installation method of the local system service is limited by the characteristics of the system service, and can only support the silent installation method without user interaction interface. However, many working software installation packages do not support silent installation, which greatly limits the types of software that system services can support. Although the authorized installation of the designated local administrator rights can solve the problem that the local system service cannot support the interactive installation method with an interactive interface, the security management of the administrator account requires a lot of energy.

It can be seen that the existing software authorization installation method, due to the security requirements of the enterprise client, results in limited software types and a small installation range, resulting in poor user experience.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is to overcome the defects of limited software types, small installation range and poor user experience due to the security requirements of enterprise clients in the prior art, and to provide a software authorized installation of enterprise clients method, apparatus, apparatus and medium.

The present invention solves the above-mentioned technical problems through the following technical solutions:

In a first aspect, the present invention provides a software authorization installation method for an enterprise client, the software authorization installation method comprising:

Obtain encrypted software data;

Decrypt the software data, and download a software installation package according to the decrypted software data;

When the software installation package is verified and passed, the pre-configured authorization program is released; the authorization program is used to represent that the software installation package is obtained and authorized to install with the administrator authority under the operating conditions of the user authority;

Setting and encrypting account data corresponding to the software installation package; the account data includes an administrator account;

The account data is sent, so that the authorization program runs the software installation package according to the administrator account.

Preferably, after the step of releasing the preconfigured authorization program, the software authorization installation method further includes:

Send notification information to the application platform; the notification information is used to make the application platform run the authorization program.

Preferably, the account data includes an administrator account password, and the software authorization installation method further includes:

When receiving the first prompt information sent by the authorization program, reset the administrator account password; the prompt information is used to represent that the authorization program has started to install the software installation package.

Preferably, the software authorization installation method further includes:

When receiving the second prompt message sent by the authorization program, delete the administrator account and the authorization program.

Preferably, the software authorization installation method further includes:

When the verification of the software installation package fails, the alarm information is pushed to the application platform.

In a second aspect, the present invention provides a software authorization installation device for an enterprise client, and the software authorization installation system includes:

an acquisition module for acquiring encrypted software data;

a data decryption module for decrypting the software data, and downloading a software installation package according to the decrypted software data;

The first verification module is used to release the pre-configured authorization program when the software installation package is verified and passed; the authorization program is used to represent that the software is installed after obtaining the authorization of the administrator authority under the operating conditions of the user authority. Installation package;

a setting module for setting and encrypting account data corresponding to the software installation package; the account data includes an administrator account;

A first sending module, configured to send the account data, so that the authorization program runs the software installation package according to the administrator account.

Preferably, the software authorization installation system further includes:

The second sending module is configured to send notification information to the application platform; the notification information is used to make the application platform run the authorization program.

Preferably, the account data includes an administrator account password, and the software authorization installation system further includes:

The first receiving module, when receiving the first prompt information sent by the authorization program, reset the administrator account password; the first prompt information is used to represent that the authorization program has started to install the software installation package .

Preferably, the software authorization installation system further includes:

The second receiving module is configured to delete the administrator account and the authorization program when receiving the second prompt information sent by the authorization program; the second prompt information is used to represent that the authorization program has been installed Software installation package.

Preferably, the software authorization installation system further includes:

The second verification module is configured to push alarm information to the application platform when the software installation package verification fails.

In a third aspect, the present invention also provides an electronic device, comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program being executed by the processor as described in Section 1. The software authorization installation method of an enterprise client according to any one of the aspects.

In a fourth aspect, the present invention further provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the enterprise according to any one of the first aspects is implemented. The steps of the software license installation method for the client.

The positive improvement effect of the present invention is: to provide a software authorization installation method, device, device and medium for an enterprise client, download the software installation package according to the decrypted software data, and release the pre-configured authorization when the software installation package is verified and passed. The program sends the administrator account corresponding to the software installation package, so that the authorized program runs the software installation package according to the administrator account. The invention improves the software installation function of the enterprise client, expands the scope of software installation and improves the user experience on the premise of not reducing the security.

Description of drawings

FIG. 1 is a flowchart of a software authorization installation method of an enterprise client according to Embodiment 1 of the present invention.

FIG. 2 is a schematic diagram of a data flow of interactive software installation authorization according to Embodiment 1 of the present invention.

FIG. 3 is a schematic diagram of modules of a software authorization installation system of an enterprise client according to Embodiment 2 of the present invention.

FIG. 4 is a schematic diagram of a hardware structure of an electronic device according to Embodiment 3 of the present invention.

Detailed ways

The present invention is further described below by way of examples, but the present invention is not limited to the scope of the described examples.

Example 1

1 is a flowchart of a software authorization installation method for an enterprise client in an embodiment of the present invention, which is applied to the client and may specifically include the following steps:

S1. Obtain encrypted software data.

S2. Decrypt the software data, and download the software installation package according to the decrypted software data.

S31. Release the preconfigured authorization program when the verification of the software installation package is passed; the authorization program is used to represent that the software installation package is installed after obtaining the authorization of the administrator authority under the operating condition of the user authority.

S32, when the software installation package fails to pass the verification, push alarm information to the application platform.

S4. Set and encrypt account data corresponding to the software installation package; the account data includes an administrator account.

S5. Send account data, so that the authorized program runs the software installation package according to the administrator account.

For the above step S1, when the user clicks on the application platform (portal website) installed on the client, after selecting the type of software to be installed through the decryption displayed by the application platform, the client can obtain the software from the server through the background interface. The encrypted software data corresponding to the software type. Therefore, users who do not need a client can obtain different types of software installation packages according to their own needs, realize personalized customization, further save system resources, and expand the range of software installation types supported by the client. The software data may include basic information of the software installation package, network download address information of the software installation package, hash check code of the software installation package, and the like.

It should be noted that the server may be a single server or a server cluster, which may be specifically determined according to the data volume and throughput corresponding to the number of clients that need to be served. The number and types of clients can also be varied.

For the above step S2, after the encrypted software data is decrypted, and after downloading the software installation package according to the network download address information of the software installation package, the downloaded software installation package may be maliciously tampered with by other programs on the server. Before installing the package, you need to verify the downloaded software installation package. If the verification is passed, the software installation package can be run. For example, whether the downloaded software installation package is correct can be checked according to the hash check code of the software installation package, or whether the downloaded software installation package can be checked according to the encrypted data of the software installation package, which can further improve the security of client software installation .

For the above step S31, after the software installation package is verified and passed, the client is pre-configured, and the authorization program temporarily stored in the local system service is stored in another set path of the client. The setting path can be determined according to the specific situation, and there is no specific limitation.

For the above step S32, after the software installation package verification fails, the client will send a download error alarm to the application platform, and the application platform will submit a download error record to the background and end the installation process of the software installation package.

For the above steps S4-S5, the local service system of the client can create an account data corresponding to the software installation package and send it to the authorization program. The account data is time-sensitive and may include an administrator account. The client generates a random strong password while generating the account data. The random strong password is a 20-digit hash check code with upper and lower case letters, numbers or special matches. This method can prevent the account data temporarily generated during the software installation from being leaked, and further improve the security of the client software installation.

In a possible solution, after step S31, the software authorization installation method further includes:

S311. Send notification information to the application platform; the notification information is used to make the application platform run the authorization program.

Specifically, the client evokes the authorization program with the current user authority through the preset private protocol, that is, through the preset registry key value, supports the interaction page of the application platform to evoke the local application protocol, so that the authorization program runs .

The account data includes the administrator account password, and the software authorized installation method also includes:

S51. When receiving the first prompt message sent by the authorization program, reset the administrator account password; the first prompt message is used to indicate that the authorization program has started to install the software installation package.

S52 , when receiving the second prompt information sent by the authorization program, delete the administrator account and the authorization program; the second prompt information is used to indicate that the authorization program has completed installing the software installation package.

For the above steps S51-S52, when receiving the prompt message of "installation start" sent by the authorized program, immediately generate a random strong password again and modify the temporarily generated administrator account password, so as to avoid the temporary interruption of the software installation package during the installation process. The generated administrator account password is leaked, which reduces the risk that the temporarily generated administrator account password is acquired by memory hijacking, and ensures the security of software installation.

When receiving the "installation complete" prompt message sent by the authorized program, the client will clean up the software installation, delete the locally temporarily generated administrator account password, and delete the authorized program. Thus, the administrator account password temporarily generated after the installation of the software installation package is prevented from being leaked, the risk of the temporarily generated administrator account password being acquired by memory hijacking is reduced, and the security of software installation is also ensured.

As shown in Figure 2, the backend interface is part of the server, which can provide management pages to add or change applications, set configuration data (applets configuration), and store configuration data in a database. The client is divided into two parts: the application platform and the local system service from the perspective of the display interface and the internal operation of the client tool. The application platform corresponds to the interface displayed to the user, and the local system service corresponds to the background running part of the client tool. When the user selects and runs an application through the interface provided by the application platform installed on the client, the server provides the client with download instruction data of the corresponding application, that is, encrypted software data. In this way, the user only needs to select once to realize the running of the selected application, and see the execution result of the software data download through the step of displaying the application execution result, which provides the user experience.

The client performs the aforementioned steps of acquiring the encrypted software data, decrypting the software data, and downloading the installation package through the local system service.

This embodiment provides a software authorization installation method for an enterprise client, which obtains encrypted software data; decrypts the software data, and downloads a software installation package according to the decrypted software data; when the software installation package is verified, the pre-configured software is released the authorization program; set and encrypt the account data corresponding to the software installation package; send the account data so that the authorization program can run the software installation package according to the administrator account. The invention improves the software installation function of the enterprise client, expands the scope of software installation and improves the user experience on the premise of not reducing the security.

Example 2

3 is a schematic diagram of modules of a software authorization installation device for an enterprise client in an embodiment of the present invention, which may specifically include the following modules: an acquisition module 210, a data decryption module 220, a first verification module 231, a second verification module 232, A setting module 240 and a first sending module 250 are provided.

The obtaining module 210 is used for obtaining encrypted software data.

The data decryption module 220 is used to decrypt the software data, and download the software installation package according to the decrypted software data,

The first verification module 231 is used to release the preconfigured authorization program when the software installation package is verified and passed; the authorization program is used to represent that the software installation package is obtained and authorized to install with the administrator authorization under the operating condition of the user authorization.

The second verification module 232, when the software installation package verification fails, pushes alarm information to the application platform.

The setting module 240 is used for setting and encrypting account data corresponding to the software installation package; the account data includes an administrator account.

The first sending module 250 is configured to send account data, so that the authorized program runs the software installation package according to the administrator account.

When the user clicks on the application platform (portal website) installed on the client, after selecting the software type to be installed through the decryption displayed by the application platform, the obtaining module 210 can obtain the corresponding software type from the server through the background interface Encrypted software data. Therefore, users who do not need a client can obtain different types of software installation packages according to their own needs, realize personalized customization, further save system resources, and expand the range of software installation types supported by the client. The software data may include basic information of the software installation package, network download address information of the software installation package, hash check code of the software installation package, and the like.

It should be noted that the server may be a single server or a server cluster, which may be specifically determined according to the data volume and throughput corresponding to the number of clients that need to be served. The number and types of clients can also be varied.

After the encrypted software data is decrypted, after the data decryption module 220 downloads the software installation package according to the network download address information of the software installation package, the downloaded software installation package may be maliciously tampered with by other programs on the server. The downloaded software installation package needs to be verified before the package. If the verification is passed, the software installation package can be run. For example, whether the downloaded software installation package is correct can be checked according to the hash check code of the software installation package, or whether the downloaded software installation package can be checked according to the encrypted data of the software installation package, which can further improve the security of client software installation .

After the software installation package has passed the verification, the first verification module 231 is pre-configured, and the authorized program temporarily stored in the local system service is stored in another set path of the client. The setting path can be determined according to the specific situation, and there is no specific limitation.

After the software installation package verification fails, the second verification module 232 will send a download error alarm message to the application platform, and the application platform will submit a download error record to the background and end the installation process of the software installation package.

The setting module 240 may create an account data corresponding to the software installation package and send it to the authorization program. The account data is time-sensitive and may include an administrator account. The client generates a random strong password while generating the account data. The random strong password is a 20-digit hash check code with upper and lower case letters, numbers or special matches. This method can prevent the account data temporarily generated during the software installation from being leaked, and further improve the security of the client software installation.

In a possible solution, the software authorization installation system further includes:

The second sending module is used to send notification information to the application platform; the notification information is used to make the application platform run the authorization program.

Specifically, the second sending module evokes the authorization program with the current user authority through the preset private protocol, that is, through the preset registry key value, supports the interaction page of the application platform to evoke the local application protocol, so that the authorization program up and running.

The account data includes the administrator account password, and the software authorized installation system also includes:

The first receiving module resets the administrator account password when receiving the first prompt message sent by the authorization program; the first prompt message is used to indicate that the authorization program has started to install the software installation package.

The second receiving module is used to delete the administrator account and the authorization program when receiving the second prompt information sent by the authorization program; the second prompt information is used to indicate that the authorization program has completed installing the software installation package.

When the first receiving module receives the "installation start" prompt message sent by the authorized program, it immediately generates a random strong password again and modifies the temporarily generated administrator account password, so as to avoid the temporarily generated management of the software installation package during the installation process. The administrator account password is leaked, which reduces the risk that the temporarily generated administrator account password is acquired by memory hijacking, and ensures the security of software installation.

When the second receiving module receives the prompt message of "installation complete" sent by the authorization program, the client performs software installation cleaning, deletes the locally temporarily generated administrator account password, and deletes the authorization program. Thus, the administrator account password temporarily generated after the installation of the software installation package is prevented from being leaked, the risk of the temporarily generated administrator account password being acquired by memory hijacking is reduced, and the security of software installation is also ensured.

This embodiment provides a software authorization installation device for an enterprise client. The obtaining module obtains encrypted software data; the data decryption module decrypts the software data, and downloads the software installation package according to the decrypted software data; when the software installation package is verified and passed When the first verification module releases the preconfigured authorization program; the setting module sets and encrypts the account data corresponding to the software installation package; the first sending module sends the account data, so that the authorization program runs the software installation package according to the administrator account. The invention improves the software installation function of the enterprise client, expands the scope of software installation and improves the user experience on the premise of not reducing the security.

Example 3

FIG. 4 is a schematic structural diagram of an electronic device provided in this embodiment. The electronic device includes a memory, a processor, and a computer program stored on the memory and running on the processor. When the processor executes the program, the software authorization installation method for the enterprise client of Embodiment 1 is implemented, as shown in FIG. 4 . The electronic device 60 is only an example, and should not impose any limitation on the function and scope of use of the embodiments of the present invention.

The electronic device 60 may take the form of a general-purpose computing device, which may be, for example, a server device. The components of the electronic device 60 may include, but are not limited to: the above-mentioned at least one processor 61 , the above-mentioned at least one memory 62 , and a bus 63 connecting different system components (including the memory 62 and the processor 61 ).

The bus 63 includes a data bus, an address bus, and a control bus.

Memory 62 may include volatile memory, such as random access memory (RAM) 621 and/or cache memory 622 , and may further include read only memory (ROM) 623 .

The memory 62 may also include a program/utility 625 having a set (at least one) of program modules 624 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, which An implementation of a network environment may be included in each or some combination of the examples.

The processor 61 executes various functional applications and data processing by running the computer program stored in the memory 62, such as the software authorization installation method of the enterprise client according to Embodiment 1 of the present invention.

The electronic device 60 may also communicate with one or more external devices 64 (eg, keyboards, pointing devices, etc.). Such communication may take place through input/output (I/O) interface 65 . Also, the model-generating device 60 may also communicate with one or more networks (eg, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through a network adapter 66 . As shown, the network adapter 66 communicates with other modules of the model generation device 60 via the bus 63 . It should be understood that, although not shown, other hardware and/or software modules may be used in conjunction with the model-generated device 60, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID (disk) array) systems, tape drives, and data backup storage systems.

It should be noted that although several units/modules or sub-units/modules of the electronic device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. Indeed, the features and functions of two or more units/modules described above may be embodied in one unit/module according to embodiments of the present invention. Conversely, the features and functions of one unit/module described above may be further subdivided to be embodied by multiple units/modules.

Example 4

This embodiment provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the software authorization installation method of the enterprise client in Embodiment 1.

Wherein, the readable storage medium may include, but is not limited to, a portable disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical storage device, a magnetic storage device, or any of the above suitable combination.

In a possible implementation manner, the present invention can also be implemented in the form of a program product, which includes program codes, when the program product runs on a terminal device, the program code is used to cause the terminal device to execute the implementation The software authorization installation method of the enterprise client of Embodiment 1.

Wherein, the program code for executing the present invention can be written in any combination of one or more programming languages, and the program code can be completely executed on the user equipment, partially executed on the user equipment, as an independent The software package executes on the user's device, partly on the user's device, partly on the remote device, or entirely on the remote device.

Although the specific embodiments of the present invention are described above, those skilled in the art should understand that this is only an illustration, and the protection scope of the present invention is defined by the appended claims. Those skilled in the art can make various changes or modifications to these embodiments without departing from the principle and essence of the present invention, but these changes and modifications all fall within the protection scope of the present invention.

Claims (12)

1. A software authorization installation method of an enterprise client is characterized by comprising the following steps:

acquiring encrypted software data;

decrypting the software data and downloading a software installation package according to the decrypted software data;

when the software installation package passes the verification, releasing a pre-configured authorization program; the authorization program is used for representing that the software installation package is installed after the authority of an administrator is obtained under the user authority operation condition;

setting and encrypting account data corresponding to the software installation package; the account data comprises an administrator account;

and sending the account data to enable the authorization program to operate the software installation package according to the administrator account.

2. The method of claim 1, wherein after the step of releasing the pre-configured authorization procedure, the method further comprises:

sending notification information to the application platform; the notification information is used for enabling the application platform to run the authorization program.

3. The method of claim 1, wherein the account data includes an administrator account password, the method further comprising:

when first prompt information sent by the authorization program is received, resetting the administrator account password; the first prompt message is used for representing that the software installation package is installed after the authorization program is started.

4. The method of claim 3, wherein the method further comprises:

when second prompt information sent by the authorization program is received, deleting the administrator account and the authorization program; the second prompt message is used for representing that the authorized program finishes installing the software installation package.

5. The method of claim 1, wherein the method further comprises:

and when the software installation package fails to pass the verification, pushing alarm information to the application platform.

6. A software authorization installation apparatus for an enterprise client, said software authorization installation system comprising:

the acquisition module is used for acquiring the encrypted software data;

the data decryption module is used for decrypting the software data and downloading a software installation package according to the decrypted software data;

the first checking module is used for releasing a pre-configured authorization program when the software installation package passes the checking; the authorization program is used for representing that the software installation package is obtained and authorized to be installed by the authority of an administrator under the condition of user authority operation;

the setting module is used for setting and encrypting account data corresponding to the software installation package; the account data includes an administrator account;

and the first sending module is used for sending the account data so that the authorization program operates the software installation package according to the administrator account.

7. The software authorization installation system of an enterprise client of claim 6, wherein the software authorization installation system further comprises:

the second sending module is used for sending notification information to the application platform; the notification information is used for enabling the application platform to run the authorization program.

8. The software authorization installation system of an enterprise client of claim 7, wherein the account data comprises an administrator account password, the software authorization installation system further comprising:

the first receiving module is used for resetting the administrator account password when receiving first prompt information sent by the authorization program; the first prompt message is used for representing that the software installation package is installed after the authorization program is started.

9. The software authorization installation system of an enterprise client of claim 8, wherein the software authorization installation system further comprises:

the second receiving module is used for deleting the administrator account and the authorization program when receiving second prompt information sent by the authorization program; the second prompt message is used for representing that the authorized program finishes installing the software installation package.

10. The software authorization installation system of an enterprise client of claim 6, wherein the software authorization installation system further comprises:

and the second checking module is used for pushing the alarm information to the application platform when the software installation package fails to check.

11. An electronic device comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, the computer program being executed by the processor to perform the software authorization installation method of an enterprise client as claimed in any one of claims 1-5.

12. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out a method for software authorization installation of an enterprise client according to any one of claims 1-5.

Images