File processing method and device, electronic equipment and storage medium

Abstract

The invention provides a file processing method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving a data request sent by a user based on a client, the data request carrying a corresponding token, and the token being pre-allocated to a corresponding user account; if it is determined that the identity verification of the user is passed, performing permission verification based on a token in the data request; and if the verification is passed, determining that an access operation corresponding to the data request can be executed so as to access a file under a corresponding service module in the storage service. According to the method, the token is adopted as an authentication mechanism to realize an identity authentication mechanism of the user and ensure that the user is not tampered in the transmission process, then, when the identity authentication of the user is passed, authority authentication is performed based on the token in the data request, so that the initiator of the current data request and the corresponding authority thereof are quickly identified, and the user experience is improved. And the database or the session storage does not need to be inquired again, so that the conditions of unauthorized access and data leakage are avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud computing and data storage, and in particular to a file processing method, device, electronic device and storage medium. Background Art

[0002] With the explosive progress of information technology, the wave of digital transformation has swept the world, and the demand for storage and convenient access to files by enterprises and individuals has seen unprecedented growth.

[0003] In order to ensure the security of file access in storage services, user information is often directly authenticated. After the user information is authenticated, the user is allowed to access the corresponding storage service. Since the user information is easily tampered with during the process of identity authentication directly through user information, data leakage of the storage service may occur, and data in the storage service may be accessed without authorization. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a file processing method, device, electronic device and storage medium to solve the problems of data leakage in storage services and unauthorized access to data in storage services in the prior art.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention shows a file processing method, the method comprising:

[0007] Receiving a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-assigned to a corresponding user account;

[0008] If it is determined that the user's identity authentication is passed, performing permission verification based on the token in the data request;

[0009] If the verification is successful, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

[0010] Optionally, the process of pre-allocating tokens to corresponding user accounts includes:

[0011] All users are grouped according to their functional information and the business information they are responsible for, to obtain multiple permission groups;

[0012] Building a fine-grained permission control model based on the permission group;

[0013] The corresponding token is obtained by encapsulating the permissions and role information corresponding to each user in the fine-grained permission control model;

[0014] The token is assigned to a user account corresponding to each user.

[0015] Optionally, all users are grouped according to their functional information and the business information they are responsible for, to obtain multiple permission groups, including:

[0016] For each user, determine the role corresponding to the user according to the user's functional information and the business information for which the user is responsible;

[0017] The users are grouped according to their corresponding roles to obtain a plurality of permission groups.

[0018] Optionally, determining whether the identity authentication of the user is passed includes:

[0019] Integrity verification and authenticity verification of the token carried in the data request;

[0020] If it is determined that the integrity verification and the authenticity verification have passed, it is determined that the user identity verification has passed.

[0021] Optionally, performing permission verification based on the token in the data request includes:

[0022] Determining whether the user has performed an access operation corresponding to the data request based on the permissions possessed by the token;

[0023] If so, determining whether there are other users accessing the service module to be accessed by the data request;

[0024] If so, and it is determined that the number of other users accessing the website is greater than a preset number, determining whether the level of the permission group of the user is greater than the level of the permission groups of other users;

[0025] If it is greater, execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0026] Optionally, also include:

[0027] Obtain permission requirements and access information for storage services;

[0028] A model of an access control list (ACL) is constructed based on the permission requirements and access information of the storage service.

[0029] Optionally, also include:

[0030] Record detailed information about each access operation to the storage service;

[0031] The detailed information of each access operation of the storage service is used to construct a corresponding audit log.

[0032] A second aspect of an embodiment of the present invention shows a file processing device, the device comprising:

[0033] A receiving unit, configured to receive a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-assigned to a corresponding user account;

[0034] A verification unit, configured to perform permission verification based on a token in the data request if it is determined that the identity authentication of the user is passed;

[0035] The access unit is used to determine that the access operation corresponding to the data request can be executed if the verification is passed, so as to access the file under the corresponding service module in the storage service.

[0036] A third aspect of an embodiment of the present invention shows an electronic device, which is used to run a program, wherein the program executes the file processing method shown in the first aspect of the embodiment of the present invention when running.

[0037] A fourth aspect of an embodiment of the present invention shows a storage medium, wherein the storage medium includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the file processing method shown in the first aspect of the embodiment of the present invention.

[0038] Based on the above-mentioned embodiment of the present invention, a file processing method, device, electronic device and storage medium are provided, the method includes: receiving a data request sent by a user based on a client, the data request carries a corresponding token, and the token is pre-assigned to the corresponding user account; if it is determined that the user's identity authentication is passed, the authority verification is performed based on the token in the data request; if the verification is passed, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service. In the embodiment of the present invention, a fine-grained authority control model is constructed based on the RBAC role authority system to assign a corresponding token to each user; receiving a data request carrying a token sent by a client, using the token as an authentication mechanism to implement the user's identity authentication mechanism, ensuring that it is not tampered with during the transmission process, and providing a reliable user identity proof basis for each subsequent interaction; then, when the user's identity authentication is passed, the authority verification is performed based on the token in the data request, so as to quickly identify the initiator of the current data request and its corresponding authority, without having to query the database or session storage again, thereby improving the efficiency and security of data access; if the verification is passed, it is determined that the access operation corresponding to the data request can be executed, and the operation corresponding to the data request is executed to access the corresponding service module in the storage service. To avoid unauthorized access and data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a flow chart of a file processing method according to an embodiment of the present invention;

[0041] Figure 2 A schematic flow chart of another file processing method according to an embodiment of the present invention;

[0042] Figure 3 A flowchart of another file processing method according to an embodiment of the present invention is shown;

[0043] Figure 4 A schematic diagram of a file processing flow chart of an embodiment of the present invention;

[0044] Figure 5 A schematic diagram of the file processing architecture shown in an embodiment of the present invention;

[0045] Figure 6 The present invention is a schematic diagram of the structure of a file processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0048] It should be noted that the descriptions of "first", "second", etc. in the present invention are only used for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0049] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0050] The embodiment of the present invention designs a file access method based on cloud computing and data storage technology, and tailors a cloud data storage platform, namely, a storage service, that integrates a sophisticated permission management mechanism for enterprises and individual users of different sizes; it can not only ensure the security and integrity of data, but also improve the efficiency and flexibility of data access to meet the high standards for massive data management.

[0051] Specifically, the fine-grained permission management system implemented by the present invention further refines the permission division on the basis of traditional access control to grant access according to permissions; it supports multi-dimensional and multi-level access control strategies, including but not limited to user identity authentication, role assignment, access key management, and permission settings (such as read, write, delete, share, etc.) at the level of each file or folder. Such a design enables administrators to flexibly configure the most appropriate access rights for different users or teams according to actual needs, effectively preventing data leakage and ensuring the security of information assets.

[0052] In addition, the present invention also optimizes the efficiency of data transmission and storage, and adopts intelligent caching strategies, data compression technology and parallel processing mechanisms to significantly reduce data read and write delays, ensuring service stability and response speed even in a high-concurrency access environment. At the same time, with MinIO's support for multi-cloud environments, users can easily achieve data migration and backup across cloud platforms.

[0053] See also Figure 1 , is a flowchart of a file processing method shown in an embodiment of the present invention, the method comprising:

[0054] Step S101: receiving a data request sent by a client.

[0055] The data request carries a corresponding token, which is pre-assigned to a corresponding user account.

[0056] Optionally, the steps shown in the present invention are implemented by a server, which is connected to the client and is used to determine whether a user can access files under the storage service.

[0057] It should be noted that the process of pre-allocating tokens to corresponding user accounts includes:

[0058] Step S11: grouping all users according to their functional information and the business information they are responsible for, to obtain multiple permission groups;

[0059] It should be noted that the specific process of implementing step S11 includes the following steps:

[0060] Step S21: For each user, determine the role corresponding to the user according to the user's function information and the business information for which the user is responsible.

[0061] In the process of implementing step S21, first, for each company, through the functional information uploaded by each user under the company, such as the scope of work responsible, information of colleagues responsible for handover, information of corresponding superiors or subordinates, etc., the business information such as the handlers and persons in charge corresponding to the submitted business stored in the company database is obtained and summarized to determine the corresponding role of each user.

[0062] That is to say, a correspondence is preset between the user's function information, the business information he is responsible for, and the role, that is, based on the summarized information, users with the same or similar functions in the function information are set to the same role.

[0063] It should be noted that roles not only define the basic operations that users can perform, such as read, write, or delete permissions, or operations on a certain function, but also accurately limit the scope of resource access, such as multi-level data access control from the entire bucket to a single object.

[0064] One role corresponds to one basic operation (add, delete, modify, check), and one role can also correspond to multiple basic operations.

[0065] A user can have one or more roles.

[0066] In the embodiment of the present invention, based on the role that the user has, the user can indirectly inherit all the permission sets bound to the role, that is, there is no need to configure the personal account permissions one by one in a fine-grained manner, which greatly simplifies the complexity of permission management. In this way, when users move within the organization, they can quickly adapt to the changes in the permission requirements of the new position. They only need to adjust their role allocation according to the user's functional information and the business information they are responsible for, which not only ensures the efficiency of permission adjustment, but also maintains the consistency and maintainability of the permission structure.

[0067] Step S22: grouping the users according to their corresponding roles to obtain multiple permission groups;

[0068] In the specific process of implementing step S22, users with the same role are divided into the same permission group.

[0069] It should be noted that the levels corresponding to the permission groups include SABCDE, and the permissions decrease from left to right. That is to say, the S-level permission group has more permissions than the A-level permission group.

[0070] Users in the same permission group have the same permissions.

[0071] Step S12: constructing a fine-grained permission control model based on the permission group.

[0072] In the embodiment of the present invention, in order to achieve more delicate permission division, the role configuration can be further refined, such as setting a specific role for each permission group to only perform read operations in a specified bucket, or allowing another role to have full control over an object within a specific time range. This application of the principle of on-demand allocation and least authority ensures that users can only access resources necessary for their work, effectively reducing potential security risks and the probability of misoperation.

[0073] It should be noted that the role-based access control (RBAC) role permission system builds a fine-grained permission control model.

[0074] Among them, the fine-grained permission control model provides a flexible and secure permission management framework for complex organizational structures and changing business scenarios.

[0075] In order to ensure the deployment trend of enterprise multi-cloud and hybrid cloud, the present invention makes full use of MinIO, the cross-platform capability of storage services, so that users can migrate and synchronize data between different cloud environments or local data centers while maintaining the consistency and scalability of permission policies.

[0076] Step S13: Encapsulate the permissions and role information corresponding to each user in the fine-grained permission control model to obtain a corresponding token.

[0077] In the specific implementation of step S13, the authority and role information corresponding to each user in the fine-grained authority control model, as well as the user's unique identifier and other information are encapsulated to obtain a corresponding token, and a corresponding relationship between the token and the user account is established.

[0078] Optionally, the user enters an account number for accessing the storage service through the client, the server obtains the account and determines whether there is information corresponding to the account. If so, it determines that the account has been successfully logged in; a token matching the user account is obtained and sent to the client.

[0079] The token encapsulates all necessary permission information such as the user's unique identifier, role information, and other necessary permission details.

[0080] Among them, the token is JSON Web Tokens (JWT) as a modern and secure authentication mechanism. This token is signed by the public key of a preset encryption algorithm to ensure that its content is not tampered with during transmission, providing a reliable user identity proof basis for each subsequent interaction.

[0081] It should be noted that the preset encryption algorithm is set by technical personnel according to actual conditions, for example, it can be a symmetric encryption algorithm or an asymmetric encryption algorithm.

[0082] JWT tokens are used for mutual trust and collaboration between services. Since the token contains all necessary permission information of the user, the storage service can make access control decisions based on the token and implement fine-grained permission verification without the need for additional permission synchronization or shared session context, thereby maintaining the independence and autonomy of microservices.

[0083] By adopting JWT as the core of the authentication mechanism, it not only strengthens the security level of user identity authentication, but also optimizes the resource access process, ensuring that user permissions can be managed accurately, efficiently, and distributedly every time they interact with the MinIO service, perfectly adapting to the needs of modern cloud-native and distributed applications.

[0084] Step S14: Send the token to the user account corresponding to each user.

[0085] In the specific implementation of step S14, the token is sent to the user account corresponding to each user according to the corresponding relationship between the token and the user account.

[0086] Optionally, the user triggers access to the storage service operation through the client, including uploading files, downloading data, or performing other management operations; the client generates a data request based on the access to the storage service operation, and uses the token as part of the data request header to send the token and the data request to the server together.

[0087] It should be noted that the data request can be an HTTP request, and the storage service is the file system service MinIO.

[0088] In the specific implementation of step S101, the server obtains the data request sent by the client and the token carried by the request.

[0089] Step S102: Determine whether the user's identity authentication is passed. If the authentication is passed, execute step S103. If the authentication is not passed, output that the user is not allowed to access the storage service.

[0090] It should be noted that the specific process of implementing step S102 includes the following steps:

[0091] Step S31: Verify the integrity of the token carried in the data request. If the integrity verification passes, execute step S32. If the integrity verification fails, output that the user is not allowed to access the storage service.

[0092] In the specific implementation of step S31, the signature of the token is decrypted using the private key password to determine whether the signature has been modified. If not, it indicates the integrity of the token, and step S32 is executed. If it has been modified, it indicates that the token has no integrity, and the output does not allow the user to access the storage service.

[0093] Optionally, the method further includes: after executing step S31, obtaining the validity period of the token, comparing it with the current date, and determining whether the token is expired; if not, continuing to execute step S32; if so, outputting that the user is not allowed to access the storage service.

[0094] Step S32: Verify the authenticity of the token. If the verification is successful, execute step S33. If the verification is unsuccessful, output that the user is not allowed to access the storage service.

[0095] In the process of implementing step S32, the user unique identifier in the token is used to check whether it is consistent with the identifier of the token corresponding to the user account stored on the server; if they are consistent, it is verified whether the data contained in the token is permission and role information. If so, it means that the authenticity verification is passed, and step S33 is executed. If they are inconsistent, or the permission and role information does not exist, the output is that the user is not allowed to access the storage service.

[0096] Step S33: Determine whether the user identity verification is successful.

[0097] In the embodiment of the present invention, the scheme can determine whether the sent data request has been tampered with by verifying the token, so that the initiator of the current data request and its corresponding authority information can be identified through the token later, without querying the database or session storage again. This simplifies the frequent database query or session management overhead in the traditional authentication mechanism, and improves the scalability and response speed of the system through the stateless design. This further improves the efficiency and security of data access.

[0098] Step S103: Perform permission verification based on the token in the data request. If the verification is successful, determine that the access operation corresponding to the data request can be executed, and execute step S104. If the verification fails, output information that the user is not allowed to access the storage service.

[0099] It should be noted that the specific implementation of step S103 includes the following steps:

[0100] Step S41: Determine whether the user has the authority in the token to perform an access operation corresponding to the data request. If so, execute step S42. If not, output that the user is not allowed to access the storage service.

[0101] In the specific implementation of step S41, it is determined whether the token contains permissions related to the operation corresponding to the data request. If so, step S42 is executed. If not, a message indicating that the user is not allowed to access the storage service is outputted.

[0102] Step S42: Determine whether there are other users accessing the service module corresponding to the data request. If so, execute step S43; if not, execute step S104.

[0103] Since the operation corresponding to the data request refers to the operation performed on one or more service modules in the storage service, the operation corresponding to the data request can determine the one or more service modules that need to be accessed for the operation; in the specific implementation of step S42, it is determined whether there are other users accessing the service module corresponding to the current data request. If so, execute step S43; if not, execute step S104.

[0104] Optionally, each other user may trigger a corresponding data request through a mobile terminal to access the storage service.

[0105] Step S43: Determine whether the number of other users currently accessing is greater than a preset number. If so, it means that the number of accesses to the service module currently corresponding to the data request has reached the upper limit, and step S44 is executed. If not, it means that the service module currently corresponding to the data request can still be accessed, and step S104 is directly executed.

[0106] In the process of implementing step S43, the number of users who are accessing the service module corresponding to the data request is used to determine whether the user can directly access the service module corresponding to the data request. When it is determined that the number of other users who are accessing is greater than the preset number, it means that the number of accesses to the service module corresponding to the data request has reached the upper limit, and step S44 is executed. When it is determined that the number of other users who are accessing is less than or equal to the preset number, it means that the service module corresponding to the data request can still be accessed, and step S104 is directly executed.

[0107] It should be noted that the preset number is set based on multiple experiments, and the embodiment of the present invention does not limit this.

[0108] Step S44: Determine whether the level of the permission group to which the user belongs is greater than the levels of the permission groups to which other users belong. If so, execute step S104; if less than or equal to, directly enter the waiting queue.

[0109] In the specific implementation of step S44, the level of the permission group of the user is compared with the level of the permission group of each other user. If the level of the permission group of any other user is lower than the level of the permission group of the user, it means that the user can directly access the service module corresponding to the data request after a preset time, and step S104 is executed. If the levels of the permission groups of all other users are higher than the level of the permission group of the user, the user is controlled to directly enter the waiting queue.

[0110] Optionally, the execution of step S44 also includes sorting the permission groups of each other user from large to small, and outputting a prompt message to suspend access to the corresponding client of the other user with the smallest level so that the other user can prepare, and when the preset time arrives, controlling the other user with the smallest level to enter a waiting state.

[0111] Step S104: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0112] In the specific implementation of step S104, it is determined that the user can perform an operation corresponding to the data request to access the storage service, that is, the file under the service module corresponding to the data request in the file system service MinIO.

[0113] In order to ensure the security of stored data, enhance the flexibility of data access, simplify operation and maintenance, and enhance cross-platform compatibility and scalability, the present invention implements a fine-grained permission control strategy to achieve strict protection of files and objects in MinIO.

[0114] In an embodiment of the present invention, a fine-grained permission control model is constructed based on the RBAC role permission system to assign a corresponding token to each user; a data request carrying a token sent by a client is received, and the token is used as an authentication mechanism to implement the user's identity authentication mechanism; then, when the user's identity authentication passes, permission verification is performed based on the token in the data request. If the verification passes, it is determined that the access operation corresponding to the data request can be executed, and the operation corresponding to the data request is executed to access the corresponding service module in the storage service.

[0115] Based on the flowchart of a file processing method shown in the above embodiment of the present invention, the embodiment of the present invention also shows a flowchart of another file processing method, such as Figure 2 As shown, the method includes:

[0116] Step S201: Obtain permission requirements and access information for storage services.

[0117] It should be noted that storage service refers to a platform that provides file access management for users.

[0118] Permission requirements refer to the permissions required for each service in the storage service. Access information includes user account, user role, permissions, user access time, and accessed services.

[0119] Step S202: constructing an access control list (ACL) model based on the permission requirements and access information of the storage service.

[0120] Specifically, the initial model is trained using the permission requirements and access information of the storage service to obtain a trained initial model to analyze and generate a set of ACL rules for each user in the file access system, i.e., the storage service. In other words, each user has an ACL rule corresponding to himself in the storage service.

[0121] The initial model is a deep integration of advanced machine learning algorithms and big data analysis algorithms.

[0122] It should be noted that building a model that can automatically analyze ACL is committed to realizing the intelligent simplification and optimization of ACL rule sets, so that each user's access mode and permission requirements can be quickly identified through the ACL rules in the file access system, and redundant access control rules can be automatically identified and eliminated, thereby refining the permission allocation logic and ensuring that the permission checking process is executed efficiently and accurately.

[0123] The present invention not only reduces the delay of the system when performing access authorization through the above method, but also further enhances data security and the fluency of resource access.

[0124] Optionally, the access control list (ACL) model can be used to update access rights in real time. It can quickly adjust the permission configuration of each role according to organizational changes or security policy adjustments, and all changes can take effect immediately without interrupting services or restarting the system. This improves the flexibility and responsiveness of the system, ensuring that enterprises can quickly make permission adjustments in a rapidly changing environment, reduce redundancy, and optimize permission allocation logic to cope with various security challenges or meet new business needs.

[0125] In addition, the access control list ACL model also has predictive analysis capabilities. It can be trained based on the user's token information, historical access data, and user behavior patterns, thereby providing better permission optimization suggestions for current users, thereby predicting and avoiding potential access control risks.

[0126] This solution also combines a visual management interface, so that even complex ACL structures can be seen at a glance, facilitating efficient management and auditing, ensuring that the system's permission settings are always highly consistent with actual business needs, and effectively supporting the organization's digital transformation and security compliance goals.

[0127] Optionally, the access control list ACL model can also intelligently optimize the access control list, support the setting of static access control rules, and effectively control access control based on dynamic rules and balance principles.

[0128] Step S203: receiving a data request sent by the client.

[0129] It should be noted that the data request carries the user account.

[0130] Step S204: Determine whether the user's identity authentication is passed. If the authentication is passed, execute step S205. If the authentication is not passed, output that the user is not allowed to access the storage service.

[0131] It should be noted that the specific implementation process of step S204 is the same as the specific implementation process of the above-mentioned step S102, and they can refer to each other.

[0132] Step S205: Determine the access control list ACL corresponding to the user account from the access control list ACL model.

[0133] It should be noted that the data request carries the user account.

[0134] In the specific process of implementing step S205, the model of the access control list ACL is traversed to determine the access control list ACL matching the user account.

[0135] Step S206: Determine whether the operation corresponding to the data request can be executed based on the data request and the access control list ACL corresponding to the user account. If so, execute step S207; if not, output information that the user is not allowed to access the storage service.

[0136] In the specific implementation of step S206, it is determined whether the access control list ACL contains the permission to execute the access operation corresponding to the data request. If so, step S207 is executed. If not, a message indicating that the user is not allowed to access the storage service is outputted.

[0137] Step S207: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0138] It should be noted that the specific implementation process of step S207 is the same as the specific implementation process of the above-mentioned specific implementation step S104, and they can refer to each other.

[0139] In an embodiment of the present invention, the permission requirements and access information of the storage service are obtained to construct a corresponding access control list ACL model; the access control list ACL corresponding to the user account is determined from the access control list ACL model, and based on the access control list ACL, it is determined whether the user has the permission to perform the operation corresponding to the data request, thereby ensuring that the university executes the permission check process and reduces access delays.

[0140] Optionally, based on the flowchart of a file processing method shown in the above embodiment of the present invention, combined with Figure 1 , see Figure 3 , the method comprising:

[0141] Step S301: receiving a data request sent by a client.

[0142] Step S302: Determine whether the user's identity authentication is passed. If the authentication is passed, execute step S303. If the authentication is not passed, output that the user is not allowed to access the storage service.

[0143] Step S303: Perform permission verification based on the token in the data request. If the verification succeeds, determine that the access operation corresponding to the data request can be executed, and execute step S304. If the verification fails, output information that the user is not allowed to access the storage service.

[0144] Step S304: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0145] Step S305: Record detailed information of each access operation to the storage service.

[0146] In the process of implementing step S305, detailed information of each file access operation in the storage service is recorded, including operator identity authentication information, operation time, operation type (read / write / delete), target file, etc., to facilitate subsequent review and compliance inspection.

[0147] In order to build a comprehensive and fine-grained audit tracking system, it is necessary to record the message information of each file access operation.

[0148] It should be noted that the operator authentication information, that is, the specific user or system process that performs the operation, can even be associated with the role group or department to which it belongs, in order to trace individual responsibility and evaluate team behavior patterns.

[0149] Operation time, that is, the operation timestamp accurate to the second, helps to reconstruct the sequence of events and quickly locate the time window when the problem occurred.

[0150] Operation types, such as being able to distinguish between operations such as reading, modifying, adding content, or deleting files, are critical to understanding data flows and change history, especially when it is necessary to backtrack errors or investigate potential violations.

[0151] Target file, that is, the full path and attributes of the target file, including metadata such as file name, directory, file size, last modification time, and file sensitivity label or classification, to help assess the potential impact and importance of each access.

[0152] Operation results and exception records, including details of routine operations, whether the operation was successful, and any error codes or exception information that occurred, to facilitate troubleshooting and system tuning.

[0153] Records of access rights verification details, specifically recording the permission check process before access, including the verification basis, permission level, and whether verification is passed, to ensure that each step of the operation complies with established security policies and compliance requirements.

[0154] Step S306: Construct a corresponding audit log with the detailed information of each access operation of the storage service.

[0155] Optionally, audit logs are used to protect encrypted storage and access control, ensuring data integrity and privacy. At the same time, with efficient log search, screening and analysis tools, security administrators and compliance auditors can quickly locate key events in large amounts of data, conduct post-reviews, regular audits, trend analysis and compliance verification, effectively enhancing the organization's information security management capabilities and ability to respond to regulatory compliance challenges.

[0156] Optionally, the process based on the above steps S301 to S306 can also be described by an architecture flow chart, such as Figure 4 shown.

[0157] The present invention adopts the log analysis system ELK, that is, the audit log records data including but not limited to operator identity authentication information, operation timestamp accurate to seconds, detailed operation type identification, complete path and attributes of the target file, operation results and exception records, and access permission verification details within a reasonable and legal scope.

[0158] Figure 4 The proxy access data shown in is that the mobile terminal used by the user can access the files under the corresponding service module in the storage service.

[0159] Optionally, the above content can also be Figure 5 The architecture shown is described.

[0160] Among them, the identity authentication mechanism is used to execute the process of step S301 and step S302, the fine-grained permission control model is used to execute the process of step S303; the intelligent optimization of the access control list can execute the process of step S201 to step S207, and the audit log is used to execute the process of step S305 and step S306.

[0161] In the embodiment of the present invention, the detailed information of each file access operation is recorded to construct a corresponding audit log so that a quick review and compliance check can be performed later.

[0162] Based on the file processing method shown in the above embodiment of the present invention, the embodiment of the present invention accordingly shows a structural schematic diagram of a file processing device, such as Figure 6 Said device comprises:

[0163] The receiving unit 601 is used to receive a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-assigned to a corresponding user account;

[0164] A verification unit 602, configured to perform permission verification based on the token in the data request if it is determined that the identity authentication of the user is passed;

[0165] The access unit 603 is used to determine that the access operation corresponding to the data request can be executed if the verification is passed, so as to access the file under the corresponding service module in the storage service.

[0166] The specific principles and execution processes of each unit in the file processing device disclosed in the above embodiment of the present invention are the same as the corresponding contents in the file processing method provided in the above embodiment of the present invention. Please refer to the corresponding parts of the file processing method disclosed in the above embodiment of the present invention, and will not be repeated here.

[0167] In an embodiment of the present invention, a fine-grained permission control model is constructed based on the RBAC role permission system to assign a corresponding token to each user; a data request carrying a token sent by a client is received, and the token is used as an authentication mechanism to implement the user's identity authentication mechanism; then, when the user's identity authentication passes, permission verification is performed based on the token in the data request. If the verification passes, it is determined that the access operation corresponding to the data request can be executed, and the operation corresponding to the data request is executed to access the corresponding service module in the storage service.

[0168] Optionally, based on the file processing device shown in the above embodiment of the present invention, the receiving unit 601 of the process of pre-allocating the token to the corresponding user account is specifically used to:

[0169] All users are grouped according to their functional information and the business information they are responsible for, to obtain multiple permission groups;

[0170] Building a fine-grained permission control model based on the permission group;

[0171] The corresponding token is obtained by encapsulating the permissions and role information corresponding to each user in the fine-grained permission control model;

[0172] The token is assigned to a user account corresponding to each user.

[0173] Among them, all users are grouped according to their functional information and the business information they are responsible for, and multiple permission groups are obtained, including:

[0174] For each user, determine the role corresponding to the user according to the user's functional information and the business information for which the user is responsible;

[0175] The users are grouped according to their corresponding roles to obtain a plurality of permission groups.

[0176] Optionally, based on the file processing device shown in the above embodiment of the present invention, the verification unit 602 for determining whether the identity authentication of the user is passed is specifically configured to:

[0177] Integrity verification and authenticity verification of the token carried in the data request;

[0178] If it is determined that the integrity verification and the authenticity verification have passed, it is determined that the user identity verification has passed.

[0179] Optionally, based on the file processing device shown in the above embodiment of the present invention, the verification unit 602 that performs authority verification based on the token in the data request is specifically used to:

[0180] Determining whether the user has performed an access operation corresponding to the data request based on the permissions possessed by the token;

[0181] If so, determining whether there are other users accessing the service module to be accessed by the data request;

[0182] If so, and it is determined that the number of other users accessing the website is greater than a preset number, determining whether the level of the permission group of the user is greater than the level of the permission groups of other users;

[0183] If it is greater, execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0184] Optionally, the file processing device shown in the above embodiment of the present invention further includes: a processing unit;

[0185] The processing unit is used to obtain permission requirements and access information of the storage service;

[0186] A model of an access control list (ACL) is constructed based on the permission requirements and access information of the storage service.

[0187] Optionally, based on the file processing device shown in the above embodiment of the present invention, the processing unit is further used to record detailed information of each access operation of the storage service;

[0188] The detailed information of each access operation of the storage service is used to construct a corresponding audit log.

[0189] An embodiment of the present application provides an electronic device, which includes a processor and a memory, the memory is used for program codes and data for file processing, and the processor is used to call program instructions in the memory to execute the steps shown in the file processing method in the above embodiment.

[0190] An embodiment of the present application provides a storage medium, which includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the file processing method shown in the above embodiment.

[0191] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0192] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0193] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A file processing method, characterized in that: The method comprises: Receiving a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-assigned to a corresponding user account; If it is determined that the user's identity authentication is passed, performing permission verification based on the token in the data request; If the verification is successful, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

2. The method according to claim 1, characterized in that The process of pre-allocating tokens to corresponding user accounts includes: All users are grouped according to their functional information and the business information they are responsible for, to obtain multiple permission groups; Building a fine-grained permission control model based on the permission group; The corresponding token is obtained by encapsulating the permissions and role information corresponding to each user in the fine-grained permission control model; The token is assigned to a user account corresponding to each user.

3. The method according to claim 1, characterized in that All users are grouped according to their functional information and the business information they are responsible for, and multiple permission groups are obtained, including: For each user, determine the role corresponding to the user according to the user's functional information and the business information for which the user is responsible; The users are grouped according to their corresponding roles to obtain a plurality of permission groups.

4. The method according to claim 1, characterized in that: Determining whether the user's identity authentication is passed includes: Integrity verification and authenticity verification of the token carried in the data request; If it is determined that the integrity verification and the authenticity verification have passed, it is determined that the user identity verification has passed.

5. The method according to claim 1, characterized in that Performing permission verification based on the token in the data request includes: Determining whether the user has performed an access operation corresponding to the data request based on the permissions possessed by the token; If so, determining whether there are other users accessing the service module to be accessed by the data request; If so, and it is determined that the number of other users accessing the website is greater than a preset number, determining whether the level of the permission group of the user is greater than the level of the permission groups of other users; If it is greater, execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

6. The method according to claim 1, characterized in that Also includes: Obtain permission requirements and access information for storage services; A model of an access control list (ACL) is constructed based on the permission requirements and access information of the storage service.

7. The method according to claim 1, characterized in that Also includes: Record detailed information about each access operation to the storage service; The detailed information of each access operation of the storage service is used to construct a corresponding audit log.

8. A file processing device, characterized in that: The device comprises: A receiving unit, configured to receive a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-assigned to a corresponding user account; A verification unit, configured to perform permission verification based on a token in the data request if it is determined that the identity authentication of the user is passed; The access unit is used to determine that the access operation corresponding to the data request can be executed if the verification is passed, so as to access the file under the corresponding service module in the storage service.

9. An electronic device, characterized in that: The electronic device is used to run a program, wherein the program executes the file processing method as described in any one of claims 1 to 7 when running.

10. A storage medium, characterized in that: The storage medium includes a storage program, wherein when the program is running, the device where the storage medium is located is controlled to execute the file processing method according to any one of claims 1 to 7.

Images