Instant messaging object storage system, object storage request method and device

Abstract

This application relates to an object storage system, object storage request method, and apparatus for instant messaging. The method includes: upon receiving an object storage request from a client, extracting the storage path and authorization token carried in the object storage request. The storage path is used by the server to store a target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server provides instant messaging services to various clients. The authorization token is granted to the client by the server in advance based on the client's instant messaging service group. The storage path is verified according to the path information corresponding to the authorization token. If the storage path verification is successful, the object storage request is executed, and the result of the object storage request execution is saved. This application solves the complex and numerous technical problems of access control in instant messaging.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to an instant messaging object storage system, object storage request method and apparatus. Background Technology

[0002] Instant Messaging (IM) is a real-time communication system that allows two or more people to exchange text messages, files, voice, and video messages over a network in real time. IM messages are relayed by a server; that is, when multiple clients receiving IM services send IM messages, they are first sent to the server for storage, and then other clients retrieve the IM message from the server. However, with the server simultaneously providing IM services to a large number of different applications and clients, how to store IM messages generated by IM services while ensuring the independence of each IM service, and how to simplify access control for IM services, are pressing problems that need to be solved in IM research.

[0003] Currently, in related technologies, instant messaging message storage uses storage paths divided by file type, or by creation time and update time. However, while these technologies can make instant messaging message storage appear clear and organized, information security cannot be guaranteed for users participating in different instant messaging service groups. Users in other instant messaging service groups can see messages from their own group. Therefore, these technologies require the design of dedicated access control systems to clearly define the control permissions of different service groups and different users within the same service group, resulting in complex and numerous access control mechanisms in instant messaging.

[0004] There is currently no effective solution to the complex and numerous issues of access control in instant messaging. Summary of the Invention

[0005] This application provides an object storage system, object storage request method, and apparatus for instant messaging, in order to solve the complex and numerous technical problems of access control in instant messaging.

[0006] According to one aspect of an embodiment of this application, this application provides an object storage system for instant messaging, comprising:

[0007] The client is used to send object storage requests to the server. The object storage request carries the storage path of the target object and an authorization token. The authorization token is granted to the client by the server in advance based on the instant messaging service group to which the client belongs.

[0008] On the server side, upon receiving an object storage request from the client, the server retrieves the path information corresponding to the authorization token to verify the storage path; if the verification is successful, the server executes the object storage request and saves the result of the object storage request execution.

[0009] According to another aspect of the embodiments of this application, this application provides an instant messaging object storage request method, applied to a server, comprising: upon receiving an object storage request sent by a client, extracting the storage path and authorization token carried in the object storage request, wherein the storage path is used by the server to store a target object according to the storage path, the target object is a file uploaded by the client or other clients based on the instant messaging service, the server is used to provide instant messaging services to each client, and the authorization token is granted by the server in advance to the client according to the instant messaging service group to which the client belongs; verifying the storage path according to the path information corresponding to the authorization token; and if the storage path verification is successful, executing the object storage request and saving the result after the object storage request is executed.

[0010] Optionally, verifying the storage path based on the path information corresponding to the authorization token includes: finding a permission group that matches the authorization token; if a permission group is found, determining the permission path corresponding to the authorization token from the permission group; and if the permission path includes a storage path, determining that the storage path verification is successful.

[0011] Optionally, if the permission path includes a storage path, determining that the storage path verification is successful includes: if the permission path includes a storage path, determining the corresponding operation permission of the permission path corresponding to the storage path; if the corresponding operation permission includes the target operation of the object storage request, determining that the storage path verification is successful.

[0012] Optionally, if the storage path verification passes, the object storage request is executed and the result of the object storage request execution is saved. Specifically, this includes: if the target operation is a modification operation, setting the target client to a modifiable state so that the target client has the permission to modify the target object; if the target operation is a read operation, setting the target client to a readable state so that the target client has the permission to read the target object; and if the target operation is a delete operation, setting the target client to a deleteable state so that the target client has the permission to delete the target object.

[0013] Optionally, before receiving the object storage request sent by the client, the method further includes granting an authorization token to the client in the following manner: upon receiving a token acquisition request corresponding to the client, determining the target session associated with the token acquisition request; retrieving the instant messaging service group of the target session from the database; if the client is a member of the instant messaging service group, generating an authorization token, and generating a permission path and corresponding operation permissions for the client based on the session identifier of the target session and the client identifier of the client; forming a permission group from the permission path and the corresponding operation permissions, and mapping and storing the permission group with the authorization token; and sending the authorization token to the client.

[0014] According to another aspect of the embodiments of this application, this application provides an instant messaging object storage request method applied to a client, comprising: obtaining the storage path of a target object, wherein the storage path is used by the server to store the target object according to the storage path, the target object being a file uploaded by the client or other clients based on an instant messaging service, and the server providing instant messaging services to each client; sending an object storage request carrying a storage path and an authorization token to the server, so that the server obtains the path information corresponding to the authorization token to verify the storage path, and if the verification is successful, executing the object storage request and saving the result after the object storage request is executed, wherein the authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs, and the authorization token is used by the server to verify the storage path.

[0015] Optionally, the storage path of the target object is determined in the following way: the target application corresponding to the target object and the target session within the target application are determined, wherein all clients in the same session are in the same instant messaging service group; starting with a preset storage field, the application identification identifier of the target application, the session identification identifier of the target session, the object type identifier of the target object, the client identification identifier of the client, the upload timestamp of the target object, and the file name of the target object are combined according to a preset format to obtain the storage path.

[0016] According to another aspect of the embodiments of this application, this application provides an object storage request apparatus for instant messaging, applied to a server, comprising: an extraction module, configured to extract a storage path and an authorization token carried in an object storage request sent by a client, wherein the storage path is used by the server to store a target object according to the storage path, the target object is a file uploaded by the client or other clients based on the instant messaging service, the server is used to provide instant messaging services to each client, and the authorization token is granted by the server in advance to the client according to the instant messaging service group to which the client belongs; a verification module, configured to verify the storage path according to the path information corresponding to the authorization token; and an execution module, configured to execute the object storage request and save the result after the object storage request is executed if the storage path verification is successful.

[0017] According to another aspect of the embodiments of this application, this application provides an object storage request apparatus for instant messaging, applied to a client, comprising: a path acquisition module, used to acquire the storage path of a target object, wherein the storage path is used by the server to store the target object according to the storage path, the target object being a file uploaded by the client or other clients based on the instant messaging service, and the server being used to provide instant messaging services to each client; and a request sending module, used to send an object storage request carrying the storage path and an authorization token to the server, so that the server can acquire the path information corresponding to the authorization token to verify the storage path, and if the verification is successful, execute the object storage request and save the result after the object storage request is executed, wherein the authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs, and the authorization token is used by the server to verify the storage path.

[0018] According to another aspect of the embodiments of this application, this application provides an electronic device, including a memory, a processor, a communication interface and a communication bus. The memory stores a computer program that can run on the processor. The memory and the processor communicate with each other through the communication bus and the communication interface. When the processor executes the computer program, it implements the steps of the above method.

[0019] According to another aspect of the embodiments of this application, this application also provides a computer-readable medium having processor-executable non-volatile program code that causes the processor to perform the above-described method.

[0020] Compared with related technologies, the technical solutions provided in this application have the following advantages:

[0021] This application provides an instant messaging object storage system comprising: a client for sending an object storage request to a server, wherein the object storage request carries the storage path of the target object and an authorization token, the authorization token being pre-granted by the server to the client based on the instant messaging service group to which the client belongs; and a server for obtaining the path information corresponding to the authorization token to verify the storage path upon receiving the object storage request from the client; and, if the verification is successful, executing the object storage request and saving the result of the object storage request execution. This application designs the storage path for instant messaging data based on instant messaging service groups, i.e., chat groups. When a client sends an object storage request, it needs to carry the pre-granted authorization token from the server and the storage path of the instant messaging data to be viewed. The server verifies the storage path based on the path information corresponding to the authorization token, and only executes the object storage request if the verification is successful. This group-based design of data storage paths for different groups is simple to implement and ensures that the data between different groups is independent. Furthermore, it associates the storage path with the user's operation permissions, thus satisfying data storage requirements while solving the complex and numerous technical problems of permission control in instant messaging. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of an optional instant messaging object storage system provided according to an embodiment of this application;

[0025] Figure 2 This is a schematic flowchart of an object storage request method for optional instant messaging on a server, according to an embodiment of this application.

[0026] Figure 3 This is a schematic flowchart of an object storage request method for optional instant messaging on a client side, according to an embodiment of this application.

[0027] Figure 4 This is a schematic diagram of an optional storage path provided according to an embodiment of this application;

[0028] Figure 5This is a block diagram of an object storage request device for optional instant messaging on a server side, according to an embodiment of this application.

[0029] Figure 6 This is a block diagram of an object storage request device for client-optional instant messaging, according to an embodiment of this application.

[0030] Figure 7 This is a schematic diagram of an optional electronic device structure provided in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] In the following description, the use of suffixes such as "module," "part," or "unit" to denote elements is solely for the purpose of illustration and has no specific meaning in itself. Therefore, "module" and "part" may be used interchangeably.

[0033] In related technologies, instant messaging message storage uses storage paths divided by file type, or by creation time and update time. However, while these technologies can make instant messaging data storage appear clear and organized, information security cannot be guaranteed for users participating in different instant messaging service groups. Users in other instant messaging service groups can see the data of their own group. Therefore, these technologies require the design of dedicated access control systems to clearly define the control permissions of different service groups and different users within the same service group, resulting in complex and numerous access control mechanisms in instant messaging.

[0034] To address the problems mentioned in the background art, according to one aspect of the embodiments of this application, an embodiment of an object storage system for instant messaging is provided, the system comprising:

[0035] Client 101 is used to send an object storage request to the server. The object storage request carries the storage path of the target object and an authorization token. The authorization token is granted to the client by the server in advance based on the instant messaging service group to which the client belongs.

[0036] Server 103 is used to obtain the path information corresponding to the authorization token to verify the storage path when receiving an object storage request from the client; if the verification is successful, it executes the object storage request and saves the result of the object storage request execution.

[0037] Optionally, a database 105 can also be set up for server 103 to provide data access services for server 103.

[0038] In this embodiment, the server provides instant messaging services to the clients. The target object is instant messaging data generated between multiple clients, which can be text messages, voice messages, video messages, files, and push links, etc. When multiple clients receive the same instant messaging service, these clients are in the same instant messaging service group. On the client side, this is reflected as the same group of the same application; on the server side, it is reflected as an instant messaging service group created by the server for that group. The server can pre-grant authorization tokens to each client in the instant messaging service group. A client holding this authorization token can send an object storage request to the server to view the instant messaging data in the corresponding group. However, it cannot use the same authorization token to view instant messaging data in other groups; that is, to view instant messaging data in different groups, a different authorization token is required. The object storage request carries the storage path of the target object and the authorization token. The server verifies the storage path using the path information corresponding to the authorization token. The authorization token is pre-granted to the client by the server based on the client's instant messaging service group, and the path information corresponding to the authorization token is stored on the server. Successful verification indicates that the client has the permission to execute the object storage request for the target object, and the server can execute the object storage request. If the verification fails, it means that the client does not have the corresponding permissions, and the server will not execute the object storage request.

[0039] In this embodiment of the application, instant messaging data is relayed by the server. That is, when multiple clients receiving instant messaging services look up instant messaging data, they first send the storage path of the instant messaging data to be viewed and the authorization token to the server for verification. Only after the verification is successful can the instant messaging data be viewed.

[0040] In this embodiment of the application, the corresponding operation permissions of the authorization tokens issued under the same group are not the same. For example, the most basic permission of the authorization token is to read the data of the group and add group data (such as files), while the permission to delete files is bound to the specific client in the authorization token. That is, only the file uploader can delete the file. The authorization tokens issued under the same group can allow the client to modify the files in the group by default, or they can only modify the files in the group with the authorization of the file uploader.

[0041] This application designs a storage path for instant messaging data based on instant messaging service groups, i.e., chat groups. When a client sends an object storage request, it needs to carry an authorization token pre-granted by the server and the storage path of the instant messaging data to be retrieved. The server then verifies the storage path based on the path information corresponding to the authorization token. Only after successful verification can the server execute the object storage request. This group-based design for different group data storage paths is simple to implement and ensures that the data between different groups is independent. Furthermore, it associates the storage path with the user's operation permissions, thus satisfying data storage requirements while solving the complex and numerous technical problems of permission control in instant messaging.

[0042] According to another aspect of the embodiments of this application, this application provides an object storage request method for instant messaging, which can be executed by server 103, such as... Figure 2 As shown, the method may include the following steps:

[0043] Step S202: Upon receiving an object storage request sent by the client, extract the storage path and authorization token carried in the object storage request. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server is used to provide instant messaging services to each client. The authorization token is granted by the server in advance to the client according to the instant messaging service group to which the client belongs.

[0044] Step S204: Verify the storage path based on the path information corresponding to the authorization token;

[0045] Step S206: If the storage path verification is successful, execute the object storage request and save the result of the object storage request execution.

[0046] In this application, the target object is instant messaging data generated between multiple clients, which can be text messages, voice messages, video messages, files, and push links, etc. The server establishes a relationship between the storage paths of messages and files and access control. Based on the instant messaging service group to which the client belongs, an authorization token is issued to the client. Holding this authorization token grants the client permission to perform operations on instant messaging messages and group files within the corresponding group, including sending, viewing, and uploading instant messaging messages. The instant messaging messages sent and the files uploaded by the client are first stored on the server. Other clients, holding authorization tokens issued based on the same group and the storage path of the instant messaging data they wish to view, send an object storage request to the server to request access to that instant messaging data. Similarly, a client wishing to view instant messaging data sent by other clients also needs to hold authorization tokens issued based on the same group and the storage path of the instant messaging data it wishes to view, and send an object storage request to the server to request access to that instant messaging data.

[0047] In this embodiment, the server verifies the storage path using the path information corresponding to the authorization token. The authorization token is granted to the client in advance by the server based on the client's instant messaging service group, and the path information corresponding to the authorization token is stored on the server. Successful verification indicates that the client has the permission to execute the object storage request for the target object, and the server can execute the object storage request. Failure to verify indicates that the client does not have the corresponding permission, and the server does not execute the object storage request. After executing the object storage request, the server also saves the result of the object storage request execution.

[0048] Through steps S202 to S206 above, this application designs a storage path for instant messaging data based on instant messaging service groups, i.e., chat groups. When a client sends an object storage request, it needs to carry an authorization token pre-granted by the server and the storage path of the instant messaging data to be viewed. The server then verifies the storage path based on the path information corresponding to the authorization token. Only after successful verification will the server execute the object storage request. This group-based design for different group data storage paths is simple to implement and ensures that the data between different groups is independent. Furthermore, it associates the storage path with the user's operation permissions, thus satisfying data storage requirements while solving the complex and numerous technical problems of permission control in instant messaging.

[0049] Optionally, before receiving an object storage request sent by the client, the method further includes granting an authorization token to the client in the following manner:

[0050] Step 1: Upon receiving a token acquisition request from a client, determine the target session associated with the token acquisition request;

[0051] Step 2: Retrieve the instant messaging service group of the target session from the database;

[0052] Step 3: If the client is a member of the instant messaging service group, generate an authorization token and generate an authorization path and corresponding operation permissions for the client based on the session identifier of the target session and the client identifier of the client.

[0053] Step 4: Combine the permission paths and corresponding operation permissions into permission groups, and map and store the permission groups with the authorization tokens;

[0054] Step 5: Send the authorization token to the client.

[0055] In this embodiment, the instant messaging service group is created by the server for the target session to provide instant messaging services to clients within the same instant messaging service group (i.e., the target session), thus distinguishing it from other instant messaging service groups (other sessions). This associates the authorization token with the session. The client holding the authorization token can view the instant messaging data in the corresponding group, but cannot use the same authorization token to view instant messaging data in other groups. In other words, viewing instant messaging data in different groups requires obtaining different authorization tokens.

[0056] In this embodiment, after the client sends a token acquisition request, the server determines whether the client is in the requested target session. If so, authorization is granted; otherwise, authorization is denied. When a client joins an instant messaging service group, the server can automatically grant it an authorization token for that group. When the client leaves the group, the server automatically revokes the authorization token. If an administrator in the instant messaging service group changes the client's access permissions or management privileges, the server automatically updates the corresponding authorization token for the client.

[0057] In this embodiment, the session identification identifier is a unique identifier for the target session and the instant messaging service group corresponding to the target session, and the client identification identifier is a unique identifier for the client. It should be noted that the client identification identifier may include the identification identifier of the hardware device specifically used by the user, and may also include the user identification identifier.

[0058] In this embodiment, the permission group can be a tuple of strings. One string represents the set of permission paths that the client can access under the target session, such as {image} / {sessionMd5} / {uid}, {text} / {sessionMd5} / {uid}, {video} / {sessionMd5} / {uid}, {file} / {sessionMd5} / {uid}, and {audio} / {sessionMd5} / {uid}, where sessionMd5 represents the session identifier and uid represents the client identifier. The other string represents the set of corresponding operation permissions that the client can perform (e.g., add, modify, delete, read, etc.).

[0059] In this embodiment, the use of permission paths and corresponding operation permissions to form permission groups and bind them to authorization tokens simplifies server-side authorization behavior. Furthermore, authorization tokens within the same session can be reused, eliminating the need for multiple applications from the client. For example, based on file type storage, if session A sends an image tmp.jpg at the storage path " / image / jpg / tmp.jpg" and a text file test.txt at the storage path " / text / txt / test.txt", applying for an authorization token would require requesting a token for each of the two file paths, " / image / jpg / tmp.jpg" and " / text / txt / test.txt". However, with the path design in this solution, only one authorization token based on the session path, integrating the permission path and corresponding operation permissions, needs to be applied for.

[0060] The server maps and stores the permission group with the authorization token, essentially establishing an association between paths and permissions. Before sending an object storage request, the client needs to request an authorization token for the session containing the object from the server. With the authorization token, the client has permission to access messages and files under those paths. Clients in the same group all possess authorization tokens based on the same session; the same session identifier ensures that clients can read messages and files within the same session, and only clients within the same session can read files. Furthermore, due to the existence of the UID, only the creator of the message or file can delete it.

[0061] By mapping and storing permission groups containing permission paths and corresponding operation permissions with authorization tokens, the association between paths and permissions can be established. Then, the storage path of the target object that the client wants to access can be verified based on the authorization token held by the client.

[0062] Optionally, verifying the storage path based on the path information corresponding to the authorization token includes: finding a permission group that matches the authorization token; if a permission group is found, determining the permission path corresponding to the authorization token from the permission group; and if the permission path includes a storage path, determining that the storage path verification is successful.

[0063] Optionally, if the permission path includes a storage path, determining that the storage path verification is successful includes: if the permission path includes a storage path, determining the corresponding operation permission of the permission path corresponding to the storage path; if the corresponding operation permission includes the target operation of the object storage request, determining that the storage path verification is successful.

[0064] In this embodiment, the server obtains the mapped permission group based on the authorization token, traverses the permission paths and corresponding operation permissions in the permission group, compares the storage path with the permission path, and compares the target operation of the object storage request with the corresponding operation permission. If the storage path is within the permission path set and the target operation of the object storage request is within the operation permission corresponding to the permission path, then the storage path verification is successful, and the server executes the object storage request.

[0065] In this embodiment of the application, the target operation of the object storage request includes modification operation, read operation, deletion operation, etc.

[0066] Optionally, if the storage path verification passes, the object storage request is executed and the result of the object storage request execution is saved. Specifically, this includes: if the target operation is a modification operation, setting the target client to a modifiable state so that the target client has the permission to modify the target object; if the target operation is a read operation, setting the target client to a readable state so that the target client has the permission to read the target object; and if the target operation is a delete operation, setting the target client to a deleteable state so that the target client has the permission to delete the target object.

[0067] Specifically, when the target operation is a modification operation, the permission path contains a path with a target session identifier, and the corresponding operation permission includes the modification operation, the target client is set to a modifiable state so that the target client has the permission to modify the target object. Here, the target session identifier is the session identifier included in the storage path of the target object.

[0068] Specifically, when the target operation is a read operation, the permission path contains a path with a target session identifier, and the corresponding operation permission includes a read operation, the target client is set to a readable state so that the target client has the permission to read the target object. Here, the target session identifier is the session identifier included in the storage path of the target object.

[0069] If the target operation is a delete operation, the permission path contains a path with a target session identifier and a target client identifier, and the corresponding operation permission includes the delete operation, then the target client is set to a deleteable state so that the target client has the permission to delete the target object. Here, the target session identifier and the target client identifier are the session identifier and client identifier included in the storage path of the target object.

[0070] Taking read and delete operations as an example, for a client, its read permission is the path permission of its session, such as the "{bucket} / {appId} / {type} / {subType} / {sessionMd5}" level permission. Its upload and delete permissions are the client path permission of its session, such as the "{bucket} / {appId} / {type} / {subType} / {sessionMd5} / {uid}" level permission. Here, `bucket` is a field of the object storage block, representing the storage space; `appId` represents the application identifier; `type` represents the session type, such as one-on-one chat or group chat (note that one-on-one chat is a group of two clients, while group chat is a group of more than two clients); and `subType` represents the file type, such as image, video, text, and voice, etc.

[0071] For example, in instant messaging application App1, there are three users (a, b, and c) in group chat session A, and two users (a and d) in one-on-one chat session B in instant messaging application App2. On March 1, 2021, user b sends an image (tmp.jpg) in session A, which will be uploaded to the path "bucket / app1 / group chat / image / session A / b / 20210301 / tmp.jpg". On March 2, 2021, user d sends a text file (test.txt) in session A, which will be uploaded to the path "bucket / app2 / one-on-one chat / text / session B / d / 20210302 / test.txt". Since user a is in both session A and session B, user a has read permissions for both the paths "bucket / app1 / group chat / images / session A" and "bucket / app2 / one-on-one chat / text / session B". Therefore, user a can read the files tmp.jpg and test.txt. User b, on the other hand, is only in session A and only has permissions for the path "bucket / app1 / group chat / images / session A". Therefore, user b can only read the file tmp.jpg.

[0072] Furthermore, since user a only has deletion permissions for the paths "bucket / app1 / group chat / images / conversation A / a" and "bucket / app2 / one-on-one chat / text / conversation B / a", but not for the path "bucket / app1 / group chat / images / conversation A / b", user a cannot delete the tmp.jpg file. Only user b can delete tmp.jpg.

[0073] According to another aspect of the embodiments of this application, this application provides an object storage request method for instant messaging, which can be executed by client 101, such as... Figure 3 As shown, the method may include the following steps:

[0074] Step S302: Obtain the storage path of the target object. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server is used to provide instant messaging services to each client.

[0075] Step S304: Send an object storage request carrying the storage path and authorization token to the server so that the server can obtain the path information corresponding to the authorization token to verify the storage path. If the verification is successful, execute the object storage request and save the result of the object storage request execution. The authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs. The authorization token is used by the server to verify the storage path.

[0076] In this application, the target object is instant messaging data generated between multiple clients, which can be text messages, voice messages, video messages, files, and push links, etc. The server establishes a relationship between the storage paths of messages and files and access control. Based on the instant messaging service group to which the client belongs, an authorization token is issued to the client. Holding this authorization token grants the client permission to perform operations on instant messaging messages and group files within the corresponding group, including sending, viewing, and uploading instant messaging messages. The instant messaging messages sent and the files uploaded by the client are first stored on the server. Other clients, holding authorization tokens issued based on the same group and the storage path of the instant messaging data they wish to view, send an object storage request to the server to request access to that instant messaging data. Similarly, a client wishing to view instant messaging data sent by other clients also needs to hold authorization tokens issued based on the same group and the storage path of the instant messaging data it wishes to view, and send an object storage request to the server to request access to that instant messaging data.

[0077] In this embodiment, the server verifies the storage path using the path information corresponding to the authorization token. The authorization token is granted to the client in advance by the server based on the client's instant messaging service group, and the path information corresponding to the authorization token is stored on the server. Successful verification indicates that the client has the permission to execute the object storage request for the target object, and the server can execute the object storage request. Failure to verify indicates that the client does not have the corresponding permission, and the server does not execute the object storage request. After executing the object storage request, the server also saves the result of the object storage request execution.

[0078] Through steps S302 to S304 above, this application designs a storage path for instant messaging data based on instant messaging service groups, i.e., chat groups. When a client sends an object storage request, it needs to carry an authorization token pre-granted by the server and the storage path of the instant messaging data to be viewed. The server then verifies the storage path based on the path information corresponding to the authorization token. Only after successful verification will the server execute the object storage request. This group-based design for different group data storage paths is simple to implement and ensures that the data between different groups is independent. Furthermore, it associates the storage path with the user's operation permissions, thus satisfying data storage requirements while solving the complex and numerous technical problems of permission control in instant messaging.

[0079] Optionally, the storage path of the target object is determined in the following way: the target application corresponding to the target object and the target session within the target application are determined, wherein all clients in the same session are in the same instant messaging service group; starting with a preset storage field, the application identification identifier of the target application, the session identification identifier of the target session, the object type identifier of the target object, the client identification identifier of the client, the upload timestamp of the target object, and the file name of the target object are combined according to a preset format to obtain the storage path.

[0080] This application can be submitted in accordance with Figure 4 The path is set as shown. Here, `bucket` is a field representing the object storage block, indicating the storage space; `appId` is the application identifier; `type` indicates the session type, such as one-on-one chat or group chat. It should be noted that one-on-one chat refers to a group of two clients, while group chat refers to a group of more than two clients. `subType` indicates the file type, such as image, video, text, and voice. `sessionMd5` is the session identifier; `uid` is the client identifier, which can include the hardware identifier used by the user and also the user identifier; `yyyyMMdd` is the upload timestamp; and `file` is the filename.

[0081] According to another aspect of the embodiments of this application, such as Figure 5 As shown, an object storage request device for instant messaging is provided, applied to a server, including:

[0082] The extraction module 501 is used to extract the storage path and authorization token carried in the object storage request when it receives the object storage request sent by the client. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server is used to provide instant messaging services to each client. The authorization token is granted by the server in advance to the client according to the instant messaging service group to which the client belongs.

[0083] Verification module 503 is used to verify the storage path based on the path information corresponding to the authorization token;

[0084] The execution module 505 is used to execute the object storage request and save the result of the object storage request execution if the storage path verification is successful.

[0085] It should be noted that the extraction module 501 in this embodiment can be used to execute step S202 in this application embodiment, the verification module 503 in this embodiment can be used to execute step S204 in this application embodiment, and the execution module 505 in this embodiment can be used to execute step S206 in this application embodiment.

[0086] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The system shown can be implemented through software or hardware.

[0087] Optionally, the verification module is specifically used to: find a permission group that matches the authorization token; if a permission group is found, determine the permission path corresponding to the authorization token from the permission group; if the permission path includes a storage path, determine that the storage path verification is successful.

[0088] Optionally, the verification module is further configured to: determine the corresponding operation permission of the permission path corresponding to the storage path when the permission path includes the storage path; and determine that the storage path verification is successful when the corresponding operation permission includes the target operation of the object storage request.

[0089] Optionally, the execution module is specifically configured to: set the target client to an editable state when the target operation is a modification operation, so that the target client has the permission to modify the target object; set the target client to a readable state when the target operation is a read operation, so that the target client has the permission to read the target object; and set the target client to a deleteable state when the target operation is a delete operation, so that the target client has the permission to delete the target object.

[0090] Optionally, the instant messaging object storage request device further includes an authorization module, configured to: upon receiving a token acquisition request from a client, determine the target session associated with the token acquisition request; retrieve the instant messaging service group of the target session from the database; if the client is a member of the instant messaging service group, generate an authorization token, and generate a permission path and corresponding operation permissions for the client based on the session identifier of the target session and the client identifier of the client; group the permission path and corresponding operation permissions into a permission group, and map and store the permission group with the authorization token; and send the authorization token to the client.

[0091] According to another aspect of the embodiments of this application, such as Figure 6 As shown, an object storage request device for instant messaging is provided, applied to a client, including:

[0092] The path acquisition module 601 is used to acquire the storage path of the target object. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server is used to provide instant messaging services to each client.

[0093] The request sending module 603 is used to send an object storage request carrying a storage path and an authorization token to the server, so that the server can obtain the path information corresponding to the authorization token to verify the storage path. If the verification is successful, the server executes the object storage request and saves the result of the object storage request execution. The authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs. The authorization token is used by the server to verify the storage path.

[0094] It should be noted that the path acquisition module 601 in this embodiment can be used to execute step S302 in this application embodiment, and the request sending module 603 in this embodiment can be used to execute step S304 in this application embodiment.

[0095] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1The system shown can be implemented through software or hardware.

[0096] Optionally, the instant messaging object storage request device further includes a path determination module, used to: determine the target application corresponding to the target object and the target session within the target application, wherein all clients in the same session are in the same instant messaging service group; starting with a preset storage field, combine the application identification identifier of the target application, the session identification identifier of the target session, the object type identifier of the target object, the client identification identifier of the client, the upload timestamp of the target object, and the file name of the target object according to a preset format to obtain the storage path.

[0097] According to another aspect of the embodiments of this application, this application provides an electronic device, such as... Figure 7 As shown, the device includes a memory 701, a processor 703, a communication interface 705, and a communication bus 707. The memory 701 stores a computer program that can run on the processor 703. The memory 701 and the processor 703 communicate through the communication interface 705 and the communication bus 707. When the processor 703 executes the computer program, it implements the steps of the above method.

[0098] The memory and processor in the aforementioned electronic devices communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0099] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0100] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0101] According to another aspect of the embodiments of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the above embodiments.

[0102] Optionally, in embodiments of this application, the computer-readable medium is configured to store program code for the processor to perform the following steps:

[0103] Upon receiving an object storage request from a client, the server extracts the storage path and authorization token carried in the object storage request. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server uses it to provide instant messaging services to each client. The authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs.

[0104] Verify the storage path based on the path information corresponding to the authorization token;

[0105] If the storage path verification is successful, execute the object storage request and save the result of the object storage request execution.

[0106] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0107] In specific implementation, the embodiments of this application can be referred to the above embodiments and have corresponding technical effects.

[0108] Optionally, in embodiments of this application, the computer-readable medium may also be configured to store program code for the processor to perform the following steps:

[0109] Obtain the storage path of the target object. The storage path is used by the server to store the target object according to the storage path. The target object is a file uploaded by the client or other clients based on the instant messaging service. The server is used to provide instant messaging services to each client.

[0110] Send an object storage request carrying the storage path and authorization token to the server so that the server can obtain the path information corresponding to the authorization token to verify the storage path. If the verification is successful, execute the object storage request and save the result of the object storage request execution. The authorization token is granted to the client by the server in advance according to the instant messaging service group to which the client belongs. The authorization token is used by the server to verify the storage path.

[0111] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0112] In specific implementation, the embodiments of this application can be referred to the above embodiments and have corresponding technical effects.

[0113] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0114] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0115] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0116] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0117] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0118] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0119] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0120] If the aforementioned function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks. It should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. In the absence of further restrictions, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0121] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for instant messaging object storage request, applied to a server, and characterized in that, The method comprises the following steps: In the case of receiving an object storage request sent by a client, the storage path and the authorization token carried in the object storage request are extracted, wherein the storage path is used for the server to store a target object according to the storage path, the target object is a file uploaded by the client or other clients based on an instant messaging service, the server is used for providing instant messaging services for each client, and the authorization token is granted to the client by the server in advance according to an instant messaging service group in which the client is located; The storage path is verified according to the path information corresponding to the authorization token; In the case where the storage path is verified, the object storage request is executed and the result after the execution of the object storage request is saved.

2. The method of claim 1, wherein, The step of verifying the storage path according to the path information corresponding to the authorization token comprises the following steps: Finding an authority group matched with the authorization token; In the case where the authority group is found, the authority path corresponding to the authorization token is determined from the authority group; In the case where the authority path includes the storage path, it is determined that the storage path is verified.

3. The method of claim 2, wherein, In the case where the authority path includes the storage path, it is determined that the storage path is verified, specifically comprising the following steps: In the case where the authority path includes the storage path, the corresponding operation authority of the authority path corresponding to the storage path is determined; In the case where the corresponding operation authority includes the target operation of the object storage request, it is determined that the storage path is verified.

4. The method of claim 3, wherein, In the case where the storage path is verified, the object storage request is executed and the result after the execution of the object storage request is saved, specifically comprising the following steps: In the case where the target operation is a modification operation, the client is set to a modifiable state, so that the client has the authority to modify the target object; In the case where the target operation is a read operation, the client is set to a readable state, so that the client has the authority to read the target object; In the case where the target operation is a deletion operation, the client is set to a deletable state, so that the client has the authority to delete the target object.

5. The method according to any one of claims 2 to 4, characterized in that, Before receiving the object storage request sent by the client, the method further comprises granting the authorization token to the client in the following manner: In the case where the token acquisition request corresponding to the client is received, the target session associated with the token acquisition request is determined; The instant messaging service group of the target session is called from the database; In the case where the client is a member in the instant messaging service group, the authorization token is generated, and the authority path and the corresponding operation authority are generated for the client based on the session identification of the target session and the client identification of the client; The authority path and the corresponding operation authority are combined to form the authority group, and the authority group and the authorization token are stored in a mapping manner; The authorization token is sent to the client. 6.A method for instant messaging object storage request, applied to a client, and characterized in that, The method comprises the following steps: Obtaining a storage path of a target object, wherein the storage path is used by a server to store the target object according to the storage path, the target object is a file uploaded by the client or other clients based on an instant messaging service, and the server is used to provide the instant messaging service for each client; Sending an object storage request carrying the storage path and an authorization token to the server, so that the server obtains path information corresponding to the authorization token to verify the storage path, and executes the object storage request and saves a result after execution of the object storage request in a case where the verification is passed, wherein the authorization token is granted to the client in advance by the server according to an instant messaging service group in which the client is located, and the authorization token is used by the server to verify the storage path; The storage path of the target object is determined by determining a target application corresponding to the target object and a target session in the target application, wherein all clients in a same session are in a same instant messaging service group; starting from a preset storage field, combining an application identification of the target application, a session identification of the target session, an object type identification of the target object, a client identification of the client, an upload timestamp of the target object, and a file name of the target object according to a preset format to obtain the storage path.

7. An object storage request device for instant messaging, applied to a server to implement the object storage request method for instant messaging as claimed in any one of claims 1 to 5, characterized in that, Comprise: The extraction module is used for extracting the storage path and the authorization token carried in the object storage request in a case where the object storage request sent by the client is received, wherein the storage path is used by the server to store the target object according to the storage path, the target object is a file uploaded by the client or other clients based on an instant messaging service, the server is used to provide the instant messaging service for each client, and the authorization token is granted to the client in advance by the server according to an instant messaging service group in which the client is located; The verification module is used for verifying the storage path according to path information corresponding to the authorization token; The execution module is used for executing the object storage request and saving a result after execution of the object storage request in a case where the storage path is verified.

8. An object storage request device for instant messaging, applied to a client to implement the object storage request method for instant messaging according to claim 6, characterized in that, Comprise: The path obtaining module is used for obtaining a storage path of a target object, wherein the storage path is used by a server to store the target object according to the storage path, the target object is a file uploaded by the client or other clients based on an instant messaging service, and the server is used to provide the instant messaging service for each client; The request sending module is configured to send an object storage request carrying the storage path and the authorization token to the server, so that the server acquires path information corresponding to the authorization token to verify the storage path, and in the case of verification, executes the object storage request and saves the result after the execution of the object storage request, wherein the authorization token is granted to the client by the server in advance according to an instant messaging service group to which the client belongs, and the authorization token is used by the server to verify the storage path.

9. An object storage system for instant messaging, configured to implement the object storage request method for instant messaging according to any one of claims 1 to 5 or 6. Comprise: A client configured to send an object storage request to a server, wherein the object storage request carries a storage path of a target object and an authorization token, and the authorization token is granted to the client by the server in advance according to an instant messaging service group to which the client belongs; A server configured to, in the case of receiving the object storage request sent by the client, acquire path information corresponding to the authorization token to verify the storage path; In the case of verification, execute the object storage request and save the result after the execution of the object storage request.

10. An electronic device comprising a memory, a processor, a communication interface and a communication bus, the memory having stored therein a computer program executable on the processor, the memory, the processor being in communication via the communication bus and the communication interface, characterized in that, The processor executes the computer program to realize the steps of the method of any one of claims 1 to 5 or 6.

11. A computer readable medium having non-transitory program code executable by a processor, the program code comprising instructions for: The program code causes the processor to execute the method of any one of claims 1 to 5 or 6.

Images