File processing method, device, storage medium and system

Abstract

The embodiments of the present disclosure disclose a file processing method, device, storage medium and system. The method is applied to a file processing system, the file processing system comprises an access service and a permission management service, a first client is in a login state of a first business system and the access service, the access service receives a first file uploaded by the first client and stores the first file to a preset storage system, sends a first file storage identifier and a first system identifier returned by the preset storage system to the permission management service to obtain a corresponding first file identifier, the first file identifier is used for enabling a client logged into a target business system with access permission to access the first file, and the access service returns the first file identifier to the first client. By adopting the above technical solution, the safety of the uploaded file is ensured, the information intercommunication between the business systems is facilitated, and the flexibility of business interaction is improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to file processing methods, apparatus, storage media and systems. Background Technology

[0002] Currently, with the rapid development of computer and internet technologies, many business scenarios involve file uploads and access. During a file upload, after a client uploads a file to a server, the server stores the file and sends a link to the client. This link may then be distributed to other users as needed. Since this link directly points to the file's storage location, if some users obtain this link through unconventional means, they can also access the file, leading to its unauthorized dissemination and significant security risks. Summary of the Invention

[0003] This disclosure provides a file processing method, apparatus, storage medium, and system that can optimize existing processing solutions for uploaded files.

[0004] In a first aspect, embodiments of this disclosure provide a file processing method applied to a file processing system, the file processing system including an access service and a permission management service, the method comprising:

[0005] The access service receives a first file uploaded by a first client and stores the first file in a preset storage system, wherein the first client is logged into the first business system and the access service;

[0006] The access service receives the first file storage identifier corresponding to the first file returned by the preset storage system, and sends the first file storage identifier and the first system identifier of the first business system to the permission management service;

[0007] The permission management service records the first correspondence between the first file storage identifier and the first system identifier, and returns the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have the permission to access the first file.

[0008] The access service returns the first file identifier to the first client.

[0009] Secondly, embodiments of this disclosure provide a file processing apparatus configured in a file processing system. The file processing system includes an access service and a permission management service. The access service includes a file storage module, a file storage identifier receiving module, and a file identifier returning module. The permission management service includes a relationship recording module.

[0010] The file storage module is used to receive a first file uploaded by a first client and store the first file in a preset storage system, wherein the first client is logged into the first business system and the access service;

[0011] The file storage identifier receiving module is used to receive the first file storage identifier corresponding to the first file returned by the preset storage system, and send the first file storage identifier and the first system identifier of the first business system to the permission management service;

[0012] The relationship recording module is used to record the first correspondence between the first file storage identifier and the first system identifier, and return the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have permission to access the first file.

[0013] The file identifier return module is used to return the first file identifier to the first client.

[0014] Thirdly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the file processing method provided in embodiments of this disclosure.

[0015] Fourthly, this disclosure provides a file processing system comprising at least two computer devices. A first computer device is equipped with an access service, and a second computer device is equipped with a permission management service. Each of the at least two computer devices includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processors in the first and second computer devices execute the computer program, they cooperate to implement the file processing method provided in this disclosure.

[0016] The file processing scheme provided in this embodiment is applied to a file processing system, which includes an access service and a permission management service. A first client is logged into a first business system and the access service. The access service receives a first file uploaded by the first client and stores it in a preset storage system. It receives a first file storage identifier corresponding to the first file returned by the preset storage system and sends the first file storage identifier and the first system identifier of the first business system to the permission management service for recording a first correspondence. The permission management service returns the first file identifier corresponding to the first correspondence to the access service. This first file identifier is used by clients logged into the target business system to access the first file. The target business system is configured in the permission management service to have permission to access the first file. The access service returns the first file identifier to the first client. By adopting the above technical solution, the permission management service enables access control at the business system level for uploaded files. File upload and permission management are handled by the access service and permission management service respectively. Users do not need to log into the permission management service, ensuring the security of permission management. While ensuring the security of uploaded files, other authorized business systems can access uploaded files using the file identifier returned by the permission management service, facilitating information exchange between business systems and improving the flexibility of business interaction. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a file processing method provided in an embodiment of this disclosure;

[0018] Figure 2 A flowchart illustrating yet another document processing method provided in this disclosure embodiment;

[0019] Figure 3 A flowchart illustrating another file processing method provided in this embodiment of the disclosure;

[0020] Figure 4 A schematic diagram of system interaction provided for an embodiment of this disclosure;

[0021] Figure 5 A schematic diagram of a file processing process provided in an embodiment of this disclosure;

[0022] Figure 6 This is a schematic diagram of another file processing procedure provided in an embodiment of the present disclosure;

[0023] Figure 7 A structural block diagram of a document processing apparatus provided in this disclosure embodiment;

[0024] Figure 8 A structural block diagram of a file processing system provided in this disclosure embodiment;

[0025] Figure 9 This is a structural block diagram of a computer device provided in an embodiment of the present disclosure. Detailed Implementation

[0026] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0027] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0028] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0032] In the following embodiments, each embodiment provides optional features and examples. The features described in the embodiments can be combined to form multiple optional solutions. Each numbered embodiment should not be regarded as only one technical solution.

[0033] Figure 1This is a flowchart illustrating a file processing method provided in an embodiment of the present disclosure. The method can be executed by a file processing device, which can be implemented in software and / or hardware and is generally integrated into a file processing system. The file processing system includes an access service and a permission management service. The access service and permission management service can be deployed on the same physical device or on different physical devices. These physical devices can be servers or server clusters, etc., and are not specifically limited. When deployed on different physical devices, the communication method between the access service and the permission management service is not limited. For some application scenarios, for example, Remote Procedure Call (RPC) can be used for communication. Currently, with increasingly rich business functions, many businesses contain two or more business systems. Taking short video businesses as an example, they typically include recommendation business systems and review business systems, etc. In existing file upload processing solutions, each business system usually stores files directly on public networks such as Content Delivery Networks (CDNs). Any user with a link to the file's storage address can directly access the file, posing a significant security risk. If a business system stores files in a private storage system with authentication capabilities, only the business system that uploaded the file can access it, while other business systems cannot, affecting information exchange between business systems. In real-world applications, business systems often have mutual file access needs. Taking the aforementioned short video business as an example, when a user uploads a real-name authentication file through the recommendation business system, the review business system may also need to access that file for review. If the recommendation business system stores the real-name authentication file in its private storage system, the review business system cannot access it, potentially requiring the user to upload it again, impacting processing efficiency and resulting in a poor user experience. In this embodiment, a file management system is added between the business system and the storage system. The access service and permission management service within the file management system handle the processing of uploaded files. Specifically, as shown... Figure 1 As shown, the method includes:

[0034] Step 101: The access service receives the first file uploaded by the first client and stores the first file in a preset storage system, wherein the first client is logged into the first business system and the access service.

[0035] For example, a business system provides services to users, meaning users can log in and access the business system using a client. The login process for both the business system and the access service can be completed in one step. For instance, the access service could be a Hypertext Transfer Protocol (HTTP) service, and the access path for the access service would be a sub-path under the business system's domain name. After the user's client logs into the business system using their username and password, when they then access the access service, the access service can automatically retrieve the user's login status, placing the client in the access service's logged-in state.

[0036] For example, the first client can be any client, the first business system can be any business system, the first file can be any file, and the number of first files can be one or more, without specific limitation. The files in this embodiment can include text, images, or other file formats, without specific limitation. Assuming that user A logs into the first business system through the first client, and the first business system requires user A to upload a first file according to the current business logic, the first business system can guide the first client to access the access service and send the first file to be uploaded to the access service, that is, the access service receives the first file uploaded by the first client.

[0037] For example, the preset storage system can be a private storage system with authentication capabilities, such as a private cloud storage system, and the access service has access permissions to this private storage system. Once the access service successfully receives the first file, it stores the first file in the preset storage system.

[0038] In some embodiments, the access service receives a first file uploaded by a first client and stores the first file in a preset storage system, including: the access service receives the first file uploaded by the first client, encrypts the first file, and stores the encrypted first file in the preset storage system. The advantage of this configuration is that by encrypting the first file before storing it in the preset storage system, even if someone obtains the first file from the preset storage system, they cannot know its content, further improving file storage security. The specific method of encrypting the first file is not limited; when there are multiple first files, they can be encrypted one by one or packaged together for encryption. Furthermore, before encrypting the first file, other operations such as compression can be performed to save storage space.

[0039] Step 102: The access service receives the first file storage identifier corresponding to the first file returned by the preset storage system, and sends the first file storage identifier and the first system identifier of the first business system to the permission management service.

[0040] For example, after the access service stores the first file in the preset storage system, the preset storage system can return the file storage identifier corresponding to the first file to the access service, so that the access service can subsequently retrieve the first file by following up on the file storage identifier. The file storage identifier can be used to uniquely identify the corresponding file in the preset storage system. Its specific form and naming rules are not limited and can be set according to actual needs. For example, it can be a file storage identity identifier (ID). When the preset storage system stores in key-value pairs, the file storage identifier can also be a file storage key.

[0041] For example, after receiving the first file storage identifier returned by the preset storage system, the access service sends the first file storage identifier and the first system identifier of the first business system to the permission management service for registration. The method by which the access service obtains the first system identifier is not limited. For instance, when the access service obtains the login status of the first client for the first business system, it can automatically determine that the business system corresponding to the login status is the first business system, and thus obtain the first system identifier.

[0042] Step 103: The permission management service records the first correspondence between the first file storage identifier and the first system identifier, and returns the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have the permission to access the first file.

[0043] For example, the access permission authorization between various business systems can be configured in the permission management service. That is, the permission management service needs to know which business system uploaded a file stored in a preset storage system, and which business systems(s) have permission to access that file. The registration described above can be understood as the permission management service recording the correspondence between file storage identifiers and system identifiers. This correspondence can be considered the registration result, and the registration result corresponds to a file identifier. The file identifier can be used to uniquely identify the corresponding file in the permission management service. Its specific form and naming rules are not limited and can be set according to actual needs; for example, it can be a file identity identifier (file ID). For example, the correspondence between the first file storage identifier and the first system identifier is recorded as the first correspondence, and the file identifier corresponding to the first correspondence is recorded as the first file identifier. The file identifier is used to allow clients logging into a business system with access permissions to access the corresponding file. The authorization granularity in the permission management service can be further refined based on the business system granularity, such as file storage type, file upload user identity, or file upload time period, etc., without specific limitations. For the target business system, it can be the first business system itself, or other business systems besides the first business system. When the target business system is the first business system itself, it generally has permission to access all first files. Optionally, any file uploaded by the first client while logged into the first business system can be accessed by the first client again. When other business systems want to access the first files, if the other business system is configured to have permission to access all files uploaded by the first business system, it will have permission to access all first files. If the other business system is configured to have permission to access only some files uploaded by the first business system (such as files of a specified storage type, files uploaded by one or more users, or files uploaded within a certain time period), then, based on determining that the other business system is configured with the corresponding access permissions for the first business system, it is further determined whether the first file belongs to the aforementioned subset of files. If it does, then it can be identified as the target business system.

[0044] For example, after registration is complete, the permission management service can return the first file identifier to the access service so that the access service can forward it to the first client.

[0045] Step 104: The access service returns the first file identifier to the first client.

[0046] For example, the access service returns the first file identifier to the first client to complete the file upload process. After receiving the first file identifier, the first client can upload the first file identifier to the first business system, access the first file it uploaded using the first file identifier, and forward the first file identifier to other users or business systems that need it.

[0047] The file processing method provided in this embodiment is applied to a file processing system, which includes an access service and a permission management service. A first client is logged into a first business system and the access service. The access service receives a first file uploaded by the first client and stores the first file in a preset storage system. It receives a first file storage identifier corresponding to the first file returned by the preset storage system and sends the first file storage identifier and the first system identifier of the first business system to the permission management service for registration. The permission management service returns the first file identifier corresponding to the first correspondence to the access service. This first file identifier is used for clients logged into the target business system to access the first file. The target business system is configured in the permission management service to have permission to access the first file. The access service returns the first file identifier to the first client. By adopting the above technical solution, the permission management service is used to implement access control at the business system level for uploaded files. File upload and permission management are handled by the access service and permission management service respectively. Users do not need to log in to the permission management service, which ensures the security of permission management. While ensuring the security of uploaded files, other authorized business systems can access uploaded files using the file identifier returned by the permission management service, facilitating information exchange between business systems and improving the flexibility of business interaction.

[0048] In some embodiments, the permission management service stores file access permission authorization information between various business systems. The method further includes: the permission management service receiving an access permission request for the first file sent by a second client through a second business system, wherein the access permission request includes the first file identifier, a second system identifier of the second business system, and a second user identifier corresponding to the second client; the permission management service queries the file access permission authorization information based on the second system identifier, and if it determines that the second business system has access permission to the first file, it uses a first preset encryption algorithm to generate corresponding first encryption information based on the first file identifier and the second user identifier, generates a corresponding first access address based on the first encryption information, and returns the first access address to the second client through the second business system. The advantage of this setup is that when it is necessary to access a corresponding file using a file identifier, a corresponding access address can be requested from the permission management service. The permission management service will only return the access address after authentication, and the access address is encrypted using an encryption algorithm, which can effectively ensure the security of file access.

[0049] For example, the second business system can be any business system, including the first business system itself or other systems besides the first business system. Assuming user B logs into the second business system, and the current business logic of the second business system allows or requires user B to access the first file, the second business system can send an access permission request to the permission management service. For example, if user B wants to download the first file, or if the page currently accessed by user B needs to display the first file, the second business system can send an access permission request for the first file to the permission management service. The access permission request includes a first file identifier, used to inform the permission management service which file needs to be accessed; the access permission request also includes a second system identifier of the second business system, used by the permission management service to determine whether the second business system has the necessary access permissions for the first file; the access permission request also includes a second user identifier corresponding to the second client, used to inform the permission management service which user needs to access the first file, so that it can be added to the access address for subsequent verification of whether the access address requester and the user are consistent. It should be noted that user-level authentication can be performed by the corresponding business system. For example, the second business system can control whether the second client has permission to access the first file, and then send an access permission request to the permission management service when it is determined that the client has permission.

[0050] For example, the access control service stores file access permission authorization information between various business systems. This information can include authorization details between business systems based on a preset authorization granularity. This granularity could be, for example, the business system granularity, file storage type granularity, file upload user identity granularity, or file upload time period granularity, as described above. For instance, suppose business system A has multiple photo resources, labeled as channel 1, channel 2, and channel 3, etc. Business system A can be configured to authorize certain photo resources it manages to other business systems, such as authorizing channel 2 to business system B, and channel 1 and channel 3 to business system C, etc., giving business system A access to all photo resources. The access permission authorization information can record the authorization relationship between business system A and business system B, as well as the authorization relationship between business system A and business system C, and specifically record which photo resources are authorized. The access control service queries the file access permission authorization information based on the second system identifier to determine whether the second business system has access to the first file. If not, it can return a request failure. If available, a first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier and the second user identifier, and then a corresponding first access address is generated based on the first encrypted information. The first preset encryption algorithm can be selected according to actual needs and is not specifically limited. The access address in this disclosure can specifically be a Uniform Resource Locator (URL), which can be generated based on the domain name of the second business system and the first encrypted information.

[0051] In some embodiments, determining that the second business system has access rights to the first file includes: determining the first file type corresponding to the first file; and determining that the second business system has access rights to the first file if the second business system has permission to access the first file type in the first business system. The advantage of this approach is that it further refines the authorization granularity based on file type, making access permission management more flexible and better balancing the security of file access and resource sharing between business systems. The specific method of classifying file types is not limited; it can be based on file storage type, file uploader identity, file upload time, etc., or it can be classified according to specific business needs.

[0052] Figure 2This is a flowchart illustrating another file processing method provided in this disclosure. Based on the above optional embodiments, it is optimized and may further include the following steps: The access service receives an access request based on the first access address from a third client, and sends the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service, wherein the third client is logged into the second business system and the access service; The permission management service obtains the first file identifier and the second user identifier in the first encrypted information based on a first preset decryption algorithm, and if the decrypted second user identifier matches the third user identifier, queries the first correspondence relationship corresponding to the first file identifier to obtain the first file storage identifier corresponding to the first file identifier, wherein the first preset decryption algorithm corresponds to the first preset encryption algorithm; The permission management service returns the queried first file storage identifier to the access service; The access service retrieves the corresponding first file from the preset storage system according to the received first file storage identifier and returns the first file to the third client. The advantage of this setup is that when accessing the first file using the first access address, the first access address is strictly verified to ensure that the current visitor is a user with genuine access rights to the first file, further improving the security of file access.

[0053] Specifically, refer to Figure 2 The method may include:

[0054] Step 201: The access service receives the first file uploaded by the first client and stores the first file in the preset storage system.

[0055] The first client is logged into the first business system and the access service.

[0056] Optionally, after receiving the first file uploaded by the first client, the access service encrypts the first file and stores the encrypted first file in a preset storage system.

[0057] Step 202: The access service receives the first file storage identifier corresponding to the first file returned by the preset storage system, and sends the first file storage identifier and the first system identifier of the first business system to the permission management service.

[0058] Step 203: The permission management service records the first correspondence between the first file storage identifier and the first system identifier, and returns the first file identifier corresponding to the first correspondence to the access service.

[0059] The first file identifier is used to allow clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have permission to access the first file.

[0060] Step 204: The access service returns the first file identifier to the first client.

[0061] Step 205: The permission management service receives the access permission request for the first file sent by the second client through the second business system.

[0062] The access permission request includes a first file identifier, a second system identifier of the second business system, and a second user identifier corresponding to the second client.

[0063] Step 206: The permission management service queries the file access permission authorization information based on the second system identifier. If it is determined that the second business system has the access permission to the first file, the first preset encryption algorithm is used to generate the corresponding first encryption information based on the first file identifier and the second user identifier. The first access address is generated based on the first encryption information, and the first access address is returned to the second client through the second business system.

[0064] For example, when it is determined that the second business system has access to the first file, it indicates that the second business system can become the target business system.

[0065] Step 207: The access service receives the access request sent by the third client based on the first access address, and sends the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service.

[0066] The third client is logged into both the second business system and the access service. It should be noted that the third client may be the same as or different from the second client, requiring verification in subsequent steps. Since the third client is logged into the access service, the access service can obtain the third user's identifier.

[0067] For example, the access service can directly send the first encrypted information to the permission management service, or it can send the entire first access address containing the first encrypted information to the permission management service; no specific limitation is made here.

[0068] Step 208: The permission management service obtains the first file identifier and the second user identifier in the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier, it queries the first correspondence relationship corresponding to the first file identifier to obtain the first file storage identifier corresponding to the first file identifier.

[0069] The first preset decryption algorithm corresponds to the first preset encryption algorithm; that is, information encrypted using the first preset encryption algorithm can be decrypted based on the first preset decryption algorithm. When the decrypted second user identifier matches the third user identifier, it indicates that the third client is the same as the second client, meaning the applicant and the actual user of the first access address are the same. Therefore, subsequent operations can be allowed, enabling the third client to access the first file.

[0070] Step 209: The permission management service returns the first file storage identifier found to the access service.

[0071] Step 210: The access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier and returns the first file to the third client.

[0072] Optionally, if the access service encrypts the first file when storing it in the preset storage system, this step can be specifically as follows: the access service retrieves the corresponding encrypted first file from the preset storage system based on the received first file storage identifier, decrypts the encrypted first file, and returns the decrypted first file to the third client. The access service decrypts the file before returning it, thus ensuring that the third client can successfully access the specific file content within the first file.

[0073] The file processing method provided in this embodiment involves a first client logged into a first business system and an access service. The access service stores the first file uploaded by the first client into a preset storage system. The first file storage identifier and the first system identifier returned by the preset storage system are sent to the permission management service to record a first correspondence. The access service returns the first file identifier corresponding to the first correspondence to the first client. When a second client needs to access the first file, it first requests a first access address from the permission management service through the second business system. The first access address is returned only after the permission management service successfully authenticates the user. The first access address is encrypted using an encryption algorithm, which effectively ensures the security of file access. When a third client accesses the first file using the first access address, the first access address is strictly verified to ensure that the current user is a genuine user with access rights to the first file, further improving the security of file access.

[0074] Based on the above optional embodiments, further restrictions can be imposed on the first access address to form a more stringent security control strategy. Optionally, the permission management service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm, including: when the permission management service determines that the number of times the first encrypted information has been received is less than a preset threshold, it obtains the first file identifier and the second user identifier from the first encrypted information based on the first preset decryption algorithm. The advantage of this setting is that it limits the number of times the first access address is used, reducing security risks caused by the leakage of the first access address. Optionally, the preset threshold can be, for example, 1. Further, if the number of times the first encrypted information has been received is greater than or equal to the preset threshold, the application can be returned as failed.

[0075] Based on the above optional embodiments, the step of generating corresponding first encrypted information using a first preset encryption algorithm based on the first file identifier and the second user identifier includes: generating corresponding first encrypted information using the first preset encryption algorithm based on the first file identifier, the second user identifier, and a first time, wherein the first time is the current time. Correspondingly, the permission management service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm, and queries the first correspondence relationship corresponding to the first file identifier when the decrypted second user identifier matches the third user identifier. This includes: the permission management service obtains the first file identifier, the second user identifier, and the first time from the first encrypted information based on the first preset decryption algorithm, and queries the first correspondence relationship corresponding to the first file identifier when the decrypted second user identifier matches the third user identifier and the time difference between the current time and the first time is less than or equal to a preset duration. The advantage of this setting is that it restricts the usage time of the first access address, reducing security risks caused by the leakage of the first access address. The current time can be the system time or a unified standard time, such as Beijing time. The preset duration can be, for example, 12 hours or 24 hours.

[0076] Based on the above optional embodiments, other restrictions can be imposed on the first access address. For example, the Internet Protocol (IP) address corresponding to the third client needs to be consistent with the IP address corresponding to the second client, etc., which can be set according to actual needs.

[0077] Based on the above optional embodiments, the access permission request also includes watermark content information corresponding to the second client. Generating corresponding first encrypted information using a first preset encryption algorithm based on the first file identifier and the second user identifier includes: generating corresponding first encrypted information using the first preset encryption algorithm based on the first file identifier, the second user identifier, and the watermark content information. Correspondingly, the permission management service returns the queried first file storage identifier to the access service, including: the permission management service returns the queried first file storage identifier and the watermark content information obtained by decrypting the first encrypted information to the access service. Correspondingly, the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier and returns the first file to the third client, including: the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, performs a watermark addition operation on the first file according to the watermark content information to obtain the corresponding target file, and returns the target file to the third client. The advantage of this setup is that it facilitates tracing the source when files are leaked or spread, and it also raises the security awareness of the first file owner, preventing leaks. The watermark content typically includes information that identifies the user, such as name, account name, last four digits of mobile phone number, and department, or any combination thereof, and can be set according to actual needs. Adding a watermark to the first file can be done by adding semi-transparent text or images corresponding to the watermark content.

[0078] Based on the above optional embodiments, the permission management service records relevant operation information for file uploads and accesses by the client. The advantage of this setup is that both file uploads and accesses require some operation through the permission management service; therefore, it can comprehensively record user actions, realizing the auditing function of the file processing system. Specifically, the aforementioned relevant operation information can be recorded in the audit log of the permission management service for easy retrieval when needed.

[0079] Based on the above optional embodiments, the file processing system may also include an administrator subsystem. The administrator can create and manage file resources of various business systems and their parent systems on the administrator subsystem. The administrator can also configure file access permission authorization information and audit logs in the access permission management service through the administrator subsystem.

[0080] Referring to the various optional embodiments described above, by adopting the technical solutions of this disclosure, the security of file storage and file access can be guaranteed, providing excellent protection for some private files that need to be stored in the business system. Optionally, the first file includes sensitive images, which include at least one of ID card images, qualification images, ticket images, and images containing user biometrics.

[0081] Figure 3 This is a flowchart illustrating another file processing method provided in this embodiment. This embodiment optimizes the various optional solutions described above, using a sensitive image as an example for illustration. Specifically, the method includes the following steps:

[0082] Step 301: The access service receives the first image uploaded by the first client, encrypts the first image, and stores it in the preset storage system.

[0083] Step 302: The access service receives the first image storage identifier corresponding to the first image returned by the preset storage system, and sends the first image storage identifier and the first system identifier of the first business system to the permission management service.

[0084] Step 303: The permission management service records the first correspondence between the first image storage identifier and the first system identifier, and returns the first image identifier corresponding to the first correspondence to the access service.

[0085] Step 304: The access service returns the first image identifier to the first client.

[0086] Step 305: The permission management service receives the access permission request for the first image sent by the second client through the second business system.

[0087] The access permission request includes a first image identifier, a second system identifier of the second business system, a second user identifier corresponding to the second client, and watermark content information corresponding to the second client.

[0088] Step 306: The permission management service queries the file access permission authorization information based on the second system identifier. If it is determined that the second business system has the access permission to the first image, the first preset encryption algorithm is used to generate the corresponding first encryption information based on the first image identifier, the second user identifier, the watermark content information, and the first time. The first access address is generated based on the first encryption information, and the first access address is returned to the second client through the second business system.

[0089] Here, "first time" refers to the current time, which is also the time when the first encrypted information was generated.

[0090] Step 307: The access service receives the access request sent by the third client based on the first access address, and sends the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service.

[0091] Step 308: When the access control service determines that the number of times the first encrypted information is received is less than a preset threshold, it obtains the first image identifier, the second user identifier, the watermark content information and the first time in the first encrypted information based on the first preset decryption algorithm. When the second user identifier obtained by decryption is consistent with the third user identifier and the time difference between the current time and the first time is less than or equal to the preset duration, it queries the first correspondence relationship corresponding to the first image identifier to obtain the first image storage identifier corresponding to the first image identifier.

[0092] Step 309: The permission management service returns the first image storage identifier found to the access service.

[0093] Step 310: The access service retrieves the corresponding first image from the preset storage system based on the received first image storage identifier, decrypts the first image, and returns the decrypted first image to the third client.

[0094] The file processing method provided in this disclosure embodiment effectively controls access permissions for the uploading and downloading of sensitive images. It requires users to be logged in to perform operations, ensuring the validity of user identities. After successful authentication at the business level, the permission management service provides an image access link. When using the image access link, strict security controls are implemented, including whether the applicant and user identities are consistent, the number of uses, and the usage time limit. In addition, the storage of images is encrypted to effectively ensure the security of image storage. A watermark is added to the accessed images, allowing for traceability when screenshots or the images themselves are leaked.

[0095] Figure 4 This is a schematic diagram of system interaction provided in an embodiment of the present disclosure. Figure 5 This is a schematic diagram of a file processing process provided in an embodiment of the present disclosure. Figure 6 This is a schematic diagram of another file processing process provided by an embodiment of this disclosure, which is described below in conjunction with... Figures 4 to 6 Further explanation is needed.

[0096] like Figure 4As shown in the diagram, the file processing system comprises an access service, a permission management service, and an administrator subsystem. The entire business system includes multiple business systems, a file processing system, and a storage system (i.e., the pre-defined storage system mentioned above). For ease of explanation, we will use business system A and business system B as examples. The storage system can be a private image cloud storage system. The naming of the file processing system can be set according to actual needs. It acts as a bridge between the business systems and the storage system, responsible for hosting image uploads and access; it can also be called an image hosting system. The access service can also be called an access hosting service. Administrators can log in to the administrator subsystem to perform configuration, auditing, and other related management operations.

[0097] like Figure 5 As shown, when user A (or the client used by user A) uploads an image after logging into business system A, the image upload process is completed through steps 1 to 6. The image is uploaded to the access service, which encrypts it and stores it in the storage system. The storage system returns the image's storage identifier to the access service, which then sends the storage identifier to the permission management service for registration. After completing the registration, the permission management service returns the file identifier corresponding to the registration result to the access service, which forwards the file identifier to user A. Subsequently, steps 7 to 10 are the process for user A to obtain the image access address. When user A wants to access or download a previously uploaded image, they submit the file identifier to business system A. Business system A sends an access permission request to the permission management service, containing the file identifier, the system identifier of business system A, and the user identifier of user A. After successfully authenticating the identity of business system A, the permission management service returns the image access address to user A through business system A. This access address can be used once, i.e., it is valid only once and is valid for 12 hours. The access address can include the domain name of business system A and encrypted information generated by the access management service. The content used to generate the encrypted information may include a key (secret), the current time, user A's user identifier (uid), file identifier (file_id), and user A's identity information (such as name and last four digits of mobile phone number) as watermark content. Details regarding using the access address for image access are as follows... Figure 6 Steps 5 through 10 are similar and can be referenced. Figure 6 To understand.

[0098] like Figure 6As shown, when user B (or the client used by user B) requests to load a certain page, if the page contains an image, the business system B requests an access address from the permission management service. Steps 2 to 4 constitute the process of requesting an access address, which is also the authorization process. Business system B sends an access permission request to the permission management service containing information such as the file identifier, the system identifier of business system B, and the user identifier of user B. After successfully authenticating the identity of business system B, the permission management service returns the image access address to user B through business system B. This access address can be used once, that is, it is valid only once and is valid for 12 hours. This access address may include the domain name of business system B and encrypted information generated by the permission management service. The content used to generate the encrypted information may include the secret, the current time, the user identifier of user B, the file identifier, and user B's identity information (such as name and last four digits of mobile phone number) as watermark content. Steps 5 to 10 describe the process of accessing an image using an access address. After obtaining the image's access address, User B uses this address to access the access service and request access to the image. The access service can send the access address, its encrypted information, and User B's user identifier to the permission management service. The permission management service first determines whether the access address is being used for the first time. If not, it is considered invalid and a failure is returned. If it is being used for the first time, the encrypted information is decrypted, and the requester of the access address and the user initiating the access request are verified to be the same. If they are the same, and the time difference between the current time and the time in the decrypted encrypted information is less than or equal to 12 hours, a storage identifier is returned to the access service. The access service then uses the storage identifier to retrieve the image from the storage system, decrypts the image, adds a watermark to the image, and returns it to User B, facilitating tracing if the image is leaked by screenshotting.

[0099] Figure 7 This is a structural block diagram of a file processing apparatus provided in an embodiment of the present disclosure. The apparatus can be implemented in software and / or hardware, configured in a file processing system, and can perform file processing by executing file processing methods. Figure 7 As shown, the file processing system includes an access service and a permission management service. The access service is configured with a file storage module 701, a file storage identifier receiving module 702, and a file identifier return module 703. The permission management service is configured with a relationship record module 704, wherein:

[0100] The file storage module 701 is used to receive a first file uploaded by a first client and store the first file in a preset storage system, wherein the first client is in a logged-in state of the first business system and the access service;

[0101] The file storage identifier receiving module 702 is used to receive the first file storage identifier corresponding to the first file returned by the preset storage system, and send the first file storage identifier and the first system identifier of the first business system to the permission management service;

[0102] The relationship recording module 703 is used to record the first correspondence between the first file storage identifier and the first system identifier, and return the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for the client logging into the target business system to access the first file. The target business system is configured in the permission management service to have the permission to access the first file.

[0103] The file identifier return module 704 is used to return the first file identifier to the first client.

[0104] The file processing apparatus provided in this embodiment utilizes a permission management service to implement access control at the business system level for uploaded files. File upload and permission management are handled by the access service and permission management service, respectively. Users do not need to log in to the permission management service, which ensures the security of permission management. While ensuring the security of uploaded files, it enables other authorized business systems to access uploaded files using the file identifier returned by the permission management service, facilitating information exchange between business systems and improving the flexibility of business interaction.

[0105] Optionally, the permission management service stores file access permission authorization information between various business systems, and the device further includes:

[0106] The access permission request module configured in the permission management service is used to receive an access permission request for the first file sent by the second client through the second business system. The access permission request includes the first file identifier, the second system identifier of the second business system, and the second user identifier corresponding to the second client.

[0107] The access address generation module configured in the permission management service is used to query the file access permission authorization information according to the second system identifier. If it is determined that the second business system has the access permission to the first file, a first preset encryption algorithm is used to generate corresponding first encryption information according to the first file identifier and the second user identifier. A corresponding first access address is generated according to the first encryption information, and the first access address is returned to the second client through the second business system.

[0108] Optionally, determining that the second business system has access permissions to the first file includes:

[0109] Determine the first file type corresponding to the first file;

[0110] If the second business system has permission to access the first file type in the first business system, it is determined that the second business system has access permission to the first file.

[0111] Optionally, the device further includes:

[0112] An access request receiving module configured in the access service is used to receive an access request sent by a third client based on the first access address, and send the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service, wherein the third client is in the login state of the second business system and the access service;

[0113] The decryption module configured in the permission management service is used to obtain the first file identifier and the second user identifier in the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier, the module queries the first correspondence relationship corresponding to the first file identifier to obtain the first file storage identifier corresponding to the first file identifier. The first preset decryption algorithm corresponds to the first preset encryption algorithm.

[0114] The storage identifier return module configured in the permission management service is used to return the first file storage identifier found to the access service;

[0115] The access file acquisition module configured in the access service is used to obtain the corresponding first file from the preset storage system according to the received first file storage identifier, and return the first file to the third client.

[0116] Optionally, obtaining the first file identifier and the second user identifier from the first encrypted information based on the first preset decryption algorithm includes:

[0117] If it is determined that the number of times the first encrypted information is received is less than a preset threshold, the first file identifier and the second user identifier in the first encrypted information are obtained based on the first preset decryption algorithm.

[0118] Optionally, the step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes:

[0119] A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the first time, wherein the first time is the current time;

[0120] Accordingly, the step of obtaining the first file identifier and the second user identifier from the first encrypted information based on the first preset decryption algorithm, and querying the first correspondence relationship corresponding to the first file identifier when the decrypted second user identifier matches the third user identifier, includes:

[0121] Based on the first preset decryption algorithm, the first file identifier, the second user identifier, and the first time in the first encrypted information are obtained. If the decrypted second user identifier is consistent with the third user identifier and the time difference between the current time and the first time is less than or equal to a preset duration, the first correspondence relationship corresponding to the first file identifier is queried.

[0122] Optionally, the access permission request may also include watermark content information corresponding to the second client;

[0123] The step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes:

[0124] A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the watermark content information;

[0125] Accordingly, returning the first file storage identifier found in the query to the access service includes:

[0126] The first file storage identifier found in the query and the watermark content information obtained by decrypting the first encrypted information are returned to the access service;

[0127] Accordingly, the step of retrieving the corresponding first file from the preset storage system based on the received first file storage identifier and returning the first file to the third client includes:

[0128] The first file is obtained from the preset storage system according to the received first file storage identifier. The first file is then watermarked according to the watermark content information to obtain the corresponding target file. The target file is then returned to the third client.

[0129] Optionally, receiving the first file uploaded by the first client and storing the first file in a preset storage system includes:

[0130] Receive a first file uploaded by a first client, encrypt the first file, and store the encrypted first file in a preset storage system;

[0131] Accordingly, the step of retrieving the corresponding first file from the preset storage system based on the received first file storage identifier and returning the first file to the third client includes:

[0132] The first step involves retrieving the corresponding encrypted first file from the preset storage system based on the received first file storage identifier, decrypting the encrypted first file, and returning the decrypted first file to the third client.

[0133] Optionally, the device also includes an operation information recording module configured in the permission management service, used to record relevant operation information of file upload and file access by the client.

[0134] Optionally, the first file includes sensitive images, which include at least one of the following: ID card images, qualification images, ticket images, and images containing user biometrics.

[0135] This disclosure provides a file processing system comprising at least two computer devices. The first computer device is equipped with an access service, and the second computer device is equipped with a permission management service. Each computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processors in the first and second computer devices execute the computer program, they cooperate to implement the file processing method provided in this disclosure.

[0136] Figure 8 This is a structural block diagram of a file processing system provided in an embodiment of the present disclosure, taking an example where the file processing system includes two computer devices, such as... Figure 8 As shown, the system includes a first computer device 801, which has an access service deployed in it, and a second computer device 802, which has an access control service deployed in it.

[0137] The following is for reference. Figure 9 The diagram illustrates a structural schematic of a computer device 900 suitable for implementing embodiments of the present disclosure. The computer device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 9 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0138] like Figure 9 As shown, computer device 900 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 902 or a program loaded from storage device 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of computer device 900. The processing unit 901, ROM 902, and RAM 903 are interconnected via bus 904. An input / output (I / O) interface 905 is also connected to bus 904.

[0139] Typically, the following devices can be connected to I / O interface 905: input devices 906 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 907 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 908 including, for example, magnetic tapes, hard disks, etc.; and communication devices 909. Communication device 909 allows computer device 900 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 9 A computer device 900 with various devices is shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have instead.

[0140] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 909, or installed from a storage device 908, or installed from a ROM 902. When the computer program is executed by a processing device 901, it performs the functions defined in the methods of embodiments of this disclosure.

[0141] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0142] The aforementioned computer-readable medium may be included in the aforementioned computer device; or it may exist independently and not assembled into the computer device.

[0143] The aforementioned computer-readable medium carries one or more programs, which, when executed by the computer device, enable the computer device to implement the corresponding steps in the file processing method provided in the embodiments of this disclosure.

[0144] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0146] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules are not necessarily limiting in certain circumstances; for example, a file storage module can also be described as "a module that receives a first file uploaded by a first client and stores the first file in a preset storage system, wherein the first client is logged into the first business system and the access service."

[0147] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0148] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0149] According to one or more embodiments of this disclosure, a file processing method is provided, applied to a file processing system, the file processing system including an access service and a permission management service, the method comprising:

[0150] The access service receives a first file uploaded by a first client and stores the first file in a preset storage system, wherein the first client is logged into the first business system and the access service;

[0151] The access service receives the first file storage identifier corresponding to the first file returned by the preset storage system, and sends the first file storage identifier and the first system identifier of the first business system to the permission management service;

[0152] The permission management service records the first correspondence between the first file storage identifier and the first system identifier, and returns the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have the permission to access the first file.

[0153] The access service returns the first file identifier to the first client.

[0154] Optionally, the permission management service stores file access permission authorization information between various business systems, and the method further includes:

[0155] The permission management service receives an access permission request for the first file sent by the second client through the second business system. The access permission request includes the first file identifier, the second system identifier of the second business system, and the second user identifier corresponding to the second client.

[0156] The permission management service queries the file access permission authorization information based on the second system identifier. If it is determined that the second business system has the access permission to the first file, it uses a first preset encryption algorithm to generate corresponding first encryption information based on the first file identifier and the second user identifier, generates a corresponding first access address based on the first encryption information, and returns the first access address to the second client through the second business system.

[0157] Optionally, determining that the second business system has access permissions to the first file includes:

[0158] Determine the first file type corresponding to the first file;

[0159] If the second business system has permission to access the first file type in the first business system, it is determined that the second business system has access permission to the first file.

[0160] Optional, also includes:

[0161] The access service receives an access request based on the first access address sent by a third client, and sends the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service, wherein the third client is logged into the second business system and the access service;

[0162] The permission management service obtains the first file identifier and the second user identifier in the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier, it queries the first correspondence relationship corresponding to the first file identifier to obtain the first file storage identifier corresponding to the first file identifier. The first preset decryption algorithm corresponds to the first preset encryption algorithm.

[0163] The permission management service returns the first file storage identifier found in the query to the access service;

[0164] The access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client.

[0165] Optionally, the permission management service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm, including:

[0166] When the permission management service determines that the number of times the first encrypted information has been received is less than a preset threshold, it obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm.

[0167] Optionally, the step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes:

[0168] A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the first time, wherein the first time is the current time;

[0169] Accordingly, the permission management service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm. If the decrypted second user identifier matches the third user identifier, it queries the first correspondence relationship corresponding to the first file identifier, including:

[0170] The permission management service obtains the first file identifier, the second user identifier, and the first time from the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier and the time difference between the current time and the first time is less than or equal to a preset duration, the service queries the first correspondence relationship corresponding to the first file identifier.

[0171] Optionally, the access permission request may also include watermark content information corresponding to the second client;

[0172] The step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes:

[0173] A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the watermark content information;

[0174] Accordingly, the permission management service returns the first file storage identifier found to the access service, including:

[0175] The permission management service returns the first file storage identifier found in the query and the watermark content information obtained by decrypting the first encrypted information to the access service;

[0176] Accordingly, the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client, including:

[0177] The access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, performs a watermark addition operation on the first file according to the watermark content information, obtains the corresponding target file, and returns the target file to the third client.

[0178] Optionally, the access service receives a first file uploaded by a first client and stores the first file in a preset storage system, including:

[0179] The access service receives a first file uploaded by a first client, encrypts the first file, and stores the encrypted first file in a preset storage system;

[0180] Accordingly, the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client, including:

[0181] The access service retrieves the corresponding encrypted first file from the preset storage system based on the received first file storage identifier, decrypts the encrypted first file, and returns the decrypted first file to the third client.

[0182] Optionally, the permission management service records relevant operation information for file uploads and file accesses by the client.

[0183] Optionally, the first file includes sensitive images, which include at least one of the following: ID card images, qualification images, ticket images, and images containing user biometrics.

[0184] According to one or more embodiments of this disclosure, a file processing apparatus is provided, configured in a file processing system, the file processing system including an access service and a permission management service, wherein the access service is configured with a file storage module, a file storage identifier receiving module, and a file identifier returning module, and the permission management service is configured with a relationship recording module, wherein:

[0185] The file storage module is used to receive a first file uploaded by a first client and store the first file in a preset storage system, wherein the first client is logged into the first business system and the access service;

[0186] The file storage identifier receiving module is used to receive the first file storage identifier corresponding to the first file returned by the preset storage system, and send the first file storage identifier and the first system identifier of the first business system to the permission management service;

[0187] The relationship recording module is used to record the first correspondence between the first file storage identifier and the first system identifier, and return the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file. The target business system is configured in the permission management service to have permission to access the first file.

[0188] The file identifier return module is used to return the first file identifier to the first client.

[0189] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0190] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0191] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A file processing method, characterized in that, Applied to a file processing system, the file processing system including an access service and a permission management service, the method includes: The access service receives a first file uploaded by a first client and stores the first file in a preset storage system. The first client is logged into the first business system and the access service. The preset storage system is a storage system with authentication function, and the access service has access permissions to the preset storage system. The access service receives the first file storage identifier corresponding to the first file returned by the preset storage system, and sends the first file storage identifier and the first system identifier of the first business system to the permission management service; The permission management service records the first correspondence between the first file storage identifier and the first system identifier, and returns the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file through the permission management service and the access service. The target business system is configured in the permission management service to have the permission to access the first file. The access service returns the first file identifier to the first client.

2. The method according to claim 1, characterized in that, The permission management service stores file access permission authorization information between various business systems, and the method further includes: The permission management service receives an access permission request for the first file sent by the second client through the second business system. The access permission request includes the first file identifier, the second system identifier of the second business system, and the second user identifier corresponding to the second client. The permission management service queries the file access permission authorization information based on the second system identifier. If it is determined that the second business system has the access permission to the first file, it uses a first preset encryption algorithm to generate corresponding first encryption information based on the first file identifier and the second user identifier, generates a corresponding first access address based on the first encryption information, and returns the first access address to the second client through the second business system.

3. The method according to claim 2, characterized in that, The step of determining that the second business system has access rights to the first file includes: Determine the first file type corresponding to the first file; If the second business system has permission to access the first file type in the first business system, it is determined that the second business system has access permission to the first file.

4. The method according to claim 2, characterized in that, Also includes: The access service receives an access request based on the first access address sent by a third client, and sends the first encrypted information in the first access address and the third user identifier corresponding to the third client to the permission management service, wherein the third client is logged into the second business system and the access service; The permission management service obtains the first file identifier and the second user identifier in the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier, it queries the first correspondence relationship corresponding to the first file identifier to obtain the first file storage identifier corresponding to the first file identifier. The first preset decryption algorithm corresponds to the first preset encryption algorithm. The permission management service returns the first file storage identifier found in the query to the access service; The access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client.

5. The method according to claim 4, characterized in that, The access control service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm, including: When the permission management service determines that the number of times the first encrypted information has been received is less than a preset threshold, it obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm.

6. The method according to claim 4, characterized in that, The step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes: A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the first time, wherein the first time is the current time; Accordingly, the permission management service obtains the first file identifier and the second user identifier from the first encrypted information based on a first preset decryption algorithm. If the decrypted second user identifier matches the third user identifier, it queries the first correspondence relationship corresponding to the first file identifier, including: The permission management service obtains the first file identifier, the second user identifier, and the first time from the first encrypted information based on the first preset decryption algorithm. If the decrypted second user identifier is consistent with the third user identifier and the time difference between the current time and the first time is less than or equal to a preset duration, the service queries the first correspondence relationship corresponding to the first file identifier.

7. The method according to claim 4, characterized in that, The access permission request also includes watermark content information corresponding to the second client; The step of generating corresponding first encrypted information based on the first file identifier and the second user identifier using a first preset encryption algorithm includes: A first preset encryption algorithm is used to generate corresponding first encrypted information based on the first file identifier, the second user identifier, and the watermark content information; Accordingly, the permission management service returns the first file storage identifier found to the access service, including: The permission management service returns the first file storage identifier found in the query and the watermark content information obtained by decrypting the first encrypted information to the access service; Accordingly, the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client, including: The access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, performs a watermark addition operation on the first file according to the watermark content information, obtains the corresponding target file, and returns the target file to the third client.

8. The method according to claim 4, characterized in that, The access service receives a first file uploaded by a first client and stores the first file in a preset storage system, including: The access service receives a first file uploaded by a first client, encrypts the first file, and stores the encrypted first file in a preset storage system; Accordingly, the access service retrieves the corresponding first file from the preset storage system based on the received first file storage identifier, and returns the first file to the third client, including: The access service retrieves the corresponding encrypted first file from the preset storage system based on the received first file storage identifier, decrypts the encrypted first file, and returns the decrypted first file to the third client.

9. The method according to claim 4, characterized in that, The permission management service records information related to file uploads and file accesses by the client.

10. The method according to any one of claims 1-9, characterized in that, The first file includes sensitive images, which include at least one of the following: image of identification document, image of qualification certificate, image of invoice, and image containing user biometrics.

11. A document processing device, characterized in that, Configured in a file processing system, the file processing system includes an access service and a permission management service. The access service is configured with a file storage module, a file storage identifier receiving module, and a file identifier returning module. The permission management service is configured with a relationship record module, wherein: The file storage module is used to receive a first file uploaded by a first client and store the first file in a preset storage system. The first client is logged into the first business system and the access service. The preset storage system is a storage system with authentication function. The access service has access permissions to the preset storage system. The file storage identifier receiving module is used to receive the first file storage identifier corresponding to the first file returned by the preset storage system, and send the first file storage identifier and the first system identifier of the first business system to the permission management service; The relationship recording module is used to record the first correspondence between the first file storage identifier and the first system identifier, and return the first file identifier corresponding to the first correspondence to the access service. The first file identifier is used for clients logging into the target business system to access the first file through the permission management service and the access service. The target business system is configured in the permission management service to have permission to access the first file. The file identifier return module is used to return the first file identifier to the first client.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-10.

13. A document processing system, characterized in that, The file processing system includes at least two computer devices. The first computer device has an access service deployed, and the second computer device has an access control service deployed. The at least two computer devices include a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processors in the first computer device and the second computer device execute the computer program, they cooperate to implement the method as described in any one of claims 1-10.

Images