File download methods, devices, equipment, storage media and products

Abstract

This invention belongs to the field of computer science and discloses a file download method, apparatus, device, storage medium, and computer program product. The method includes: responding to a user-initiated business data query request, generating a download token based on the business data query request, and feeding back the download token; upon receiving a file download request containing the download token, verifying the download token and obtaining a verification result; and if the verification result is successful, sending the file corresponding to the file download request to the user terminal. Because this invention generates a download token based on a business data query request and downloads files based on the download token, compared to the existing method of adding a data isolation dimension to a file table and then establishing an authorization relationship between the user and the isolation dimension in a dedicated table to verify file download permissions, this invention can prevent users from unauthorizedly downloading files and improve file security.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a file download method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] Currently, the file download process involves adding a data isolation dimension to the file table, establishing authorization relationships between users and the isolation dimension in a dedicated table, and then verifying file download permissions through these authorization relationships. However, the authorization verification process relies on external components. If external caching is used, each verification incurs I / O overhead. If external caching is not used, authorized data is stored in the process's memory, requiring consistency across multiple nodes, resulting in high technical complexity. Furthermore, defining isolation dimensions, authorization tables, and developing authorization management functions are costly. Therefore, improving file download efficiency and preventing horizontal privilege escalation have become pressing technical issues. Summary of the Invention

[0003] The main objective of this invention is to provide a file download method, apparatus, device, storage medium, and computer program product, aiming to solve the technical problem of low file download efficiency in the prior art.

[0004] To achieve the above objectives, the present invention provides a file download method, the method comprising the following steps:

[0005] In response to a user's business data query request, a download token is generated based on the business data query request, and the download token is fed back.

[0006] Upon receiving a file download request containing the download token, the download token is verified to obtain a verification result;

[0007] When the verification result is successful, the file corresponding to the file download request is sent to the user terminal.

[0008] Optionally, the step of responding to a user-initiated business data query request, generating a download token based on the business data query request, and feeding back the download token includes:

[0009] In response to a user-initiated business data query request, determine whether the business data corresponding to the business data query request includes file information;

[0010] When the business data corresponding to the business data query request includes file information, a download token is generated according to the business data query request.

[0011] The download token and the service data are sent to the user terminal.

[0012] Optionally, the step of generating a download token based on the business data query request includes:

[0013] The summary generation information is determined based on the business data query request;

[0014] Generate summary information based on the summary generation information;

[0015] The preceding token is determined based on the digest information and the digest generation information;

[0016] The previous token is encoded to obtain the download token.

[0017] Optionally, the step of determining the summary generation information based on the business data query request includes:

[0018] Determine the file identifier and user identifier corresponding to the business data query request;

[0019] A random string is generated based on the business data query request;

[0020] The digest generation information is determined based on the file identifier, the user identifier, the random string, and the current timestamp.

[0021] Optionally, the step of verifying the download token and obtaining a verification result upon receiving a file download request containing the download token includes:

[0022] Upon receiving a file download request containing the download token, the download token is decoded to obtain the target string;

[0023] Determine the summary information based on the target string;

[0024] The summary information is verified to obtain the verification result.

[0025] Optionally, the step of verifying the summary information to obtain a verification result includes:

[0026] Generate target signature data based on the file download request;

[0027] The target signature data and the digest information are compared to obtain the comparison result;

[0028] When the comparison result shows that the target signature data matches the digest information, a successful verification result is generated.

[0029] Furthermore, to achieve the above objectives, the present invention also provides a file downloading device, the device comprising:

[0030] The response module is used to respond to a user's business data query request, generate a download token based on the business data query request, and return the download token.

[0031] The verification module is used to verify the download token when a file download request containing the download token is received, and to obtain a verification result;

[0032] The download module is used to send the file corresponding to the file download request to the user terminal when the verification result is successful.

[0033] Furthermore, to achieve the above objectives, the present invention also proposes a file download device, the device comprising: a memory, a processor, and a file download program stored on the memory and executable on the processor, the file download program being configured to implement the steps of the file download method described above.

[0034] Furthermore, to achieve the above objectives, the present invention also proposes a storage medium storing a file download program, which, when executed by a processor, implements the steps of the file download method described above.

[0035] In addition, to achieve the above objectives, the present invention also provides a computer program product, the computer program product including a file download program, which, when executed by a processor, implements the steps of the file download method as described above.

[0036] This invention responds to a user-initiated business data query request, generates a download token based on the query request, and sends the download token back. Upon receiving a file download request containing the download token, the download token is verified to obtain a verification result. If the verification result is successful, the file corresponding to the download request is sent to the user's terminal. Because this invention generates a download token based on the business data query request and performs file downloads based on the token, compared to existing methods that add a data isolation dimension to the file table, establish an authorization relationship between the user and the isolation dimension in a dedicated table, and verify file download permissions through this relationship, this invention prevents users from unauthorizedly downloading files, thus improving file security. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the structure of a file download device in the hardware operating environment involved in the embodiments of the present invention;

[0038] Figure 2 This is a flowchart illustrating the first embodiment of the document download method of the present invention;

[0039] Figure 3This is a flowchart illustrating the second embodiment of the document download method of the present invention;

[0040] Figure 4 This is a structural block diagram of the first embodiment of the document downloading device of the present invention.

[0041] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0042] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0043] Reference Figure 1 , Figure 1 This is a schematic diagram of the file download device structure in the hardware operating environment involved in the embodiments of the present invention.

[0044] like Figure 1 As shown, the file download device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0045] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the file download device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0046] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a file download program.

[0047] exist Figure 1In the file download device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the file download device of the present invention can be set in the file download device, and the file download device calls the file download program stored in the memory 1005 through the processor 1001 and executes the file download method provided in the embodiment of the present invention.

[0048] Based on the aforementioned file download device, this embodiment of the invention provides a file download method, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the document download method of the present invention.

[0049] In this embodiment, the file download method includes the following steps:

[0050] Step S10: In response to the user's business data query request, generate a download token based on the business data query request and return the download token.

[0051] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a mobile phone, tablet computer, or personal computer, or an electronic device or server capable of performing the above functions. The following description uses the server as an example to illustrate this embodiment and the subsequent embodiments.

[0052] It should be noted that the business data query request can be a command to query business details data. The step of generating a download token based on the business data query request and feeding back the download token can be based on determining whether the information queried by the user contains file information. If file information is included, it is assumed that the user may have a need to download files in the future. At this time, a download token is generated, and the download token is used by the user to download files.

[0053] Furthermore, in order to prevent horizontal privilege escalation and improve file download efficiency, step S10 may include: responding to a user-initiated business data query request and determining whether the business data corresponding to the business data query request includes file information;

[0054] When the business data corresponding to the business data query request includes file information, a download token is generated according to the business data query request.

[0055] The download token and the service data are sent to the user terminal.

[0056] It should be noted that when the business data corresponding to the business data query request includes file information, it is assumed that the user will have a need to download the file. In this case, a download token needs to be generated according to the business data query request. Specifically, the file identifier in the file information can be encrypted according to a preset encryption algorithm to obtain the download token. When the user downloads the file using the download token, the download token is decrypted to obtain the file identifier, and then the file corresponding to the file identifier is sent to the user.

[0057] Step S20: Upon receiving a file download request containing the download token, verify the download token and obtain the verification result.

[0058] It should be noted that users need to include a download token generated by the server when downloading files. Therefore, the file download request initiated by the user should contain the download token. Verifying the download token can be done by verifying whether the download token is valid enough to download the corresponding file.

[0059] Step S30: When the verification result is successful, the file corresponding to the file download request is sent to the user terminal.

[0060] It should be understood that when the verification result is successful, it is determined that the user has permission to download the file. At this time, the file corresponding to the file download request is sent to the user's terminal.

[0061] In practice, the client initiates a business details data query request. If the query request is associated with file information, the server generates a file download token and returns it to the client along with the corresponding business details data. The file download token contains the user's file download permission information. When the client clicks the file download link, it initiates a file download request. This request transmits the file download token returned in the previous steps to the server. The server receives the file download request, extracts the file information and verification information from the download token, and uses the verification information to check the user's permissions. If the verification is successful, the server returns the file stream to the client. The generation of the file download token depends on whether the user has business details data query permissions. These permissions are controlled by the business system. If the user can query their details, it is determined that the user has permission to download files. If the business details data contains file information, the server generates a file download token and returns it to the client along with the business details data. This ensures that only users with business details data viewing permissions can obtain the corresponding file download token and continue with subsequent file download operations.

[0062] This embodiment responds to a user-initiated business data query request, generates a download token based on the request, and sends the download token back. Upon receiving a file download request containing the download token, the download token is verified to obtain a verification result. If the verification result is successful, the file corresponding to the download request is sent to the user's terminal. Because this embodiment generates a download token based on the business data query request and performs file downloads based on the token, compared to the existing method of adding a data isolation dimension to the file table and then establishing an authorization relationship between the user and the isolation dimension in a dedicated table to verify file download permissions, this embodiment prevents users from unauthorizedly downloading files, thus improving file security.

[0063] refer to Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the document download method of the present invention.

[0064] Based on the first embodiment described above, in this embodiment, the step of generating a download token according to the business data query request includes:

[0065] Step S101: Determine the summary generation information based on the business data query request.

[0066] It should be noted that the digest generation information may include: a file unique identifier F, a user unique identifier U, the server's current timestamp T, and randomly generated key information. The key information is a randomly generated string, denoted as S, which is configured in the server as a configuration item.

[0067] Step S102: Generate summary information based on the summary generation information.

[0068] It should be noted that generating digest information based on the digest generation information may involve concatenating the digest generation information to obtain a concatenated result, and then compressing the concatenated result based on a hash algorithm to obtain the digest information. The hash algorithm may be a pre-set digest generation algorithm such as the SHA256 hash algorithm, and this embodiment does not impose any restrictions.

[0069] Step S103: Determine the pre-token based on the digest information and the digest generation information.

[0070] It should be noted that the determination of the pre-token based on the digest information and the digest generation information can be achieved by generating key-value pair description information based on the digest information and the digest generation information to obtain the pre-token.

[0071] Step S104: Encode the previous token to obtain the download token.

[0072] It should be noted that encoding the previous token to obtain the download token can be done by encoding the previous token using base64.

[0073] In practice, the file download token contains the following information: a unique file identifier, a timestamp, and a digest. This information is represented in JSON format and then encrypted using base64. The digest generation process is as follows: Obtain the file's unique identifier, denoted as F; obtain the current user's unique identifier information, such as user ID or session ID, selecting one, denoted as U; generate the server's current timestamp, denoted as T; generate key information, which is a random string, denoted as S, configured in the server; concatenate F, U, T, and S in sequence and use a secure hash algorithm to calculate the digest information.

[0074] Example as follows:

[0075] File unique identifier: 23234133424, User unique identifier: 111231313, Server current timestamp: 170134141205, Key: RZBS0gooJdAjlpN3SYUA4EX5Jdfl30

[0076] The concatenated value is:

[0077] 23234133424111231313170134141205RZBS0gooJdAjlpN3SYUA4EX5Jdfl30

[0078] The digest information calculated using the SHA256 hash algorithm is as follows:

[0079] e4c3596582ece22d02283cc53dd40ce474da46e79ee35c0f62a39ad2e6b52fd8, the token before Base64 encoding is:

[0080] {"fileId":"23234133424","ts":"170134141205","sign":"e4c3596582ece 22d02283cc53dd40ce474da46e79ee35c0f62a39ad2e6b52fd8"},

[0081] The download token after base64 encoding is:

[0082] eyJmaWxlSWQiOiIyMzIzNDEzMzQyNCIsInNpZ24iOiJlNGMzNTk2NTgy ZWNlMjJkMDIyODNjYzUzZGQ0MGNlNDc0ZGE0NmU3OWVlMzVjMGY2MmEzOWFkMmU2YjUyZmQ4In0=.

[0083] Furthermore, in order to improve file download efficiency, step S20 may include: upon receiving a file download request containing the download token, decoding the download token to obtain the target string;

[0084] Determine the summary information based on the target string;

[0085] The summary information is verified to obtain the verification result.

[0086] It should be noted that the process of verifying the download token can refer to the process of generating the download token described above. Specifically, the download token is decoded to obtain the target string. This can be done by base64 decoding the download token, resulting in a JSON string, which is the target string. The digest information is extracted from the target string, specifically the value corresponding to the key "sign" in the target string. The digest information is then verified to obtain the verification result. This can be done by determining the file identifier and timestamp information based on the target string, then obtaining the random string corresponding to the file identifier from the server's configuration items, generating target signature data following the steps for generating the digest information described above, and comparing it with the digest information in the target string. If they match, the verification result is considered successful.

[0087] Furthermore, to improve file download efficiency and prevent unauthorized user access, the download token verification also includes verifying the download token's validity period. Specifically, the timestamp in the download token is determined; if the download token's timestamp + specified validity period > the current server timestamp, it is invalid; otherwise, it is valid. When both the digest information and validity period verification pass, the file stream corresponding to the file download request is sent to the user. The specified validity period can be a pre-set validity period, a general validity period, or a validity period with different durations for different users, or the validity period of the download token can be generated directly when the download token is generated.

[0088] In practice, after a user clicks the download link on the client, the download request sends a download token to the server. The server extracts the information from the download token and verifies it. If the verification is successful, the download request is allowed, and the user is allowed to download the file; otherwise, a verification error message is returned.

[0089] The file download token verification process is as follows:

[0090] 1. Decode the download token using base64 encoding; the decoded value is a JSON string.

[0091] 2. Extract file unique identifier and signature information from JSON string.

[0092] 3. Verify the signature; if verification passes, allow the user's download request.

[0093] The signature verification process may include:

[0094] 1. Signature validity period verification: If the timestamp in the token plus the specified validity period is greater than the current server timestamp, it is invalid; otherwise, it is valid, and the verification ends.

[0095] A signature is generated, following the same process as that described in the file download token generation. The generated signature is compared to the signature extracted from the token; if they match, it's a valid signature; otherwise, it's an invalid signature. This signature information is the digest information.

[0096] In this embodiment, the file's unique identifier is part of the business details data. Based on the user's permission to view the business details data, the user is determined to have file download permission. File download permission is represented by the relationship between the file's unique identifier and the user, and the permission expiration time is represented by a timestamp. This information is carried by a download token. To prevent the leakage of sensitive information, the user information is not stored in plain text within the download token. The download token needs to be transmitted; to ensure that the information is not tampered with, a secure hash algorithm is used to sign this information. The file download permission information is not stored in a database or cache, which simplifies implementation and reduces resource consumption. Furthermore, this embodiment uses a secure hash algorithm for signing to ensure that the download token information is not tampered with. The timestamp information is extracted from the download token to verify the expiration time, thereby verifying whether the user's permission has expired. User information is extracted from the backend rather than included in the download token, preventing the token from being copied and allowing other users to download the file, thus preventing horizontal privilege escalation.

[0097] This embodiment determines summary generation information based on the business data query request; generates summary information based on the summary generation information; determines a pre-token based on the summary information and the summary generation information; and encodes the pre-token to obtain a download token. This embodiment generates a download token based on the business data query request, allowing users to download files subsequently using the download token. Furthermore, the download token has an expiration date, preventing unauthorized access and improving file download efficiency.

[0098] Reference Figure 4 , Figure 4This is a structural block diagram of the first embodiment of the document downloading device of the present invention.

[0099] like Figure 4 As shown, the file download device proposed in this embodiment of the invention includes:

[0100] The response module 10 is used to respond to a user's business data query request, generate a download token based on the business data query request, and return the download token.

[0101] The verification module 20 is used to verify the download token when a file download request containing the download token is received, and obtain a verification result;

[0102] The download module 30 is used to send the file corresponding to the file download request to the user terminal when the verification result is successful.

[0103] This embodiment responds to a user-initiated business data query request, generates a download token based on the request, and sends the download token back. Upon receiving a file download request containing the download token, the download token is verified to obtain a verification result. If the verification result is successful, the file corresponding to the download request is sent to the user's terminal. Because this embodiment generates a download token based on the business data query request and performs file downloads based on the token, compared to the existing method of adding a data isolation dimension to the file table and then establishing an authorization relationship between the user and the isolation dimension in a dedicated table to verify file download permissions, this embodiment prevents users from unauthorizedly downloading files, thus improving file security.

[0104] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0105] In addition, for technical details not described in detail in this embodiment, please refer to the file download method provided in any embodiment of the present invention, which will not be repeated here.

[0106] Based on the first embodiment of the file download device of the present invention described above, a second embodiment of the file download device of the present invention is proposed.

[0107] In this embodiment, the response module 10 is further configured to respond to a business data query request initiated by a user and determine whether the business data corresponding to the business data query request includes file information;

[0108] When the business data corresponding to the business data query request includes file information, a download token is generated according to the business data query request.

[0109] The download token and the service data are sent to the user terminal.

[0110] Furthermore, the response module 10 is also used to determine summary generation information based on the business data query request;

[0111] Generate summary information based on the summary generation information;

[0112] The preceding token is determined based on the digest information and the digest generation information;

[0113] The previous token is encoded to obtain the download token.

[0114] Furthermore, the response module 10 is also used to determine the file identifier and user identifier corresponding to the business data query request;

[0115] A random string is generated based on the business data query request;

[0116] The digest generation information is determined based on the file identifier, the user identifier, the random string, and the current timestamp.

[0117] Furthermore, the verification module 20 is also used to decode the download token to obtain the target string when a file download request containing the download token is received;

[0118] Determine the summary information based on the target string;

[0119] The summary information is verified to obtain the verification result.

[0120] Furthermore, the verification module 20 is also used to generate target signature data based on the file download request;

[0121] The target signature data and the digest information are compared to obtain the comparison result;

[0122] When the comparison result shows that the target signature data matches the digest information, a successful verification result is generated.

[0123] Other embodiments or specific implementations of the document download device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0124] Furthermore, embodiments of the present invention also propose a storage medium storing a file download program, wherein the file download program, when executed by a processor, implements the steps of the file download method described above.

[0125] Furthermore, embodiments of the present invention also propose a computer program product, including a file download program, which, when executed by a processor, implements the steps of the file download method described above.

[0126] The specific implementation of the computer program product of the present invention is basically the same as the embodiments of the above-described file download method, and will not be repeated here.

[0127] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0128] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0129] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0130] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A file download method, characterized in that, The file download method includes the following steps: In response to a user's business data query request, a download token is generated based on the business data query request, and the download token is fed back. Upon receiving a file download request containing the download token, the download token is verified to obtain a verification result; When the verification result is successful, the file corresponding to the file download request is sent to the user terminal; The step of generating a download token based on the business data query request includes: The summary generation information is determined based on the business data query request; Generate summary information based on the summary generation information; The preceding token is determined based on the digest information and the digest generation information; The previous token is encoded to obtain the download token.

2. The file download method as described in claim 1, characterized in that, The step of responding to a user-initiated business data query request, generating a download token based on the business data query request, and feeding back the download token includes: In response to a user-initiated business data query request, determine whether the business data corresponding to the business data query request includes file information; When the business data corresponding to the business data query request includes file information, a download token is generated according to the business data query request. The download token and the service data are sent to the user terminal.

3. The file download method as described in claim 1, characterized in that, The step of determining the summary generation information based on the business data query request includes: Determine the file identifier and user identifier corresponding to the business data query request; A random string is generated based on the business data query request; The digest generation information is determined based on the file identifier, the user identifier, the random string, and the current timestamp.

4. The file download method according to any one of claims 1-3, characterized in that, The step of verifying the download token and obtaining a verification result upon receiving a file download request containing the download token includes: Upon receiving a file download request containing the download token, the download token is decoded to obtain the target string; Determine the summary information based on the target string; The summary information is verified to obtain the verification result.

5. The file download method as described in claim 4, characterized in that, The step of verifying the summary information and obtaining the verification result includes: Generate target signature data based on the file download request; The target signature data and the digest information are compared to obtain the comparison result; When the comparison result shows that the target signature data matches the digest information, a successful verification result is generated.

6. A file download device, characterized in that, The file download device includes: The response module is used to respond to a user's business data query request, generate a download token based on the business data query request, and return the download token. The verification module is used to verify the download token when a file download request containing the download token is received, and to obtain a verification result; The download module is used to send the file corresponding to the file download request to the user terminal when the verification result is successful. The step of generating a download token based on the business data query request includes: The summary generation information is determined based on the business data query request; Generate summary information based on the summary generation information; The preceding token is determined based on the digest information and the digest generation information; The previous token is encoded to obtain the download token.

7. A file download device, characterized in that, The device includes: a memory, a processor, and a file download program stored on the memory and executable on the processor, the file download program being configured to implement the steps of the file download method as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium stores a file download program, which, when executed by a processor, implements the steps of the file download method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes a file downloader, which, when executed by a processor, implements the steps of the file download method as described in any one of claims 1 to 5.

Images