An access permission verification method, apparatus and medium thereof

Abstract

This application discloses an access permission verification method, apparatus, and medium, relating to the field of distributed storage technology. It is used for data access verification and addresses the complexity and error-prone nature of current access permission verification in multi-protocol interoperability scenarios. This method provides an access permission verification approach that, through a pre-established mapping relationship between first and second user information, enables the mutual conversion between object and file user information. Therefore, when an access request contains either type of user information, the mapping relationship can determine the other type of user information, allowing for single-type verification of the requested data. This simplifies the access management process, improves efficiency, and helps reduce the possibility of errors during verification. Furthermore, the method retains the original object and file verification methods to the greatest extent possible, significantly reducing development and deployment difficulty and facilitating practical implementation.

Description

Technical Field

[0001] This application relates to the field of distributed storage technology, and in particular to an access permission verification method, apparatus and medium thereof. Background Technology

[0002] Today, with the development of the times, users have increasingly higher requirements for business systems. There are application scenarios where a single piece of data may need to undergo processing through multiple stages in a particular business context, such as autonomous driving and gene sequencing. In these scenarios, it is necessary to copy the same data multiple times to meet data processing requirements. However, if different stages have different format requirements for the data, then in addition to copying the data, format conversion is also required (e.g., converting data between object and file formats). This operation is cumbersome and prone to performance and semantic loss. Therefore, multi-protocol interoperability is currently commonly used to solve these problems, supporting data storage and access between file storage and object storage without format conversion.

[0003] In multi-protocol interoperability application scenarios, there are no strict restrictions on permission verification. Since the object interface and file interface inherit their respective permission setting and verification methods, when a request is received, it is often necessary to pass the verification of both the file and the object. However, the storage structures used by object storage and file storage are different, and their permission management methods are quite different. Currently, this mixed verification method is complex, inefficient, and prone to errors, which is not conducive to ensuring the security of file access.

[0004] Therefore, those skilled in the art urgently need an access permission verification method to solve the problem that access permission verification is complex and error-prone in multi-protocol interoperability scenarios. Summary of the Invention

[0005] The purpose of this application is to provide an access permission verification method, device and medium thereof, to solve the problem that access permission verification is complex and error-prone in multi-protocol interoperability scenarios.

[0006] To address the aforementioned technical problems, this application provides an access permission verification method, comprising:

[0007] Receive an access request; the access request includes request verification information and includes at least one of a first user information or a second user information; the first user information is one of object storage user information or file storage object information, and the other is the second user information, and the first user information and the second user information have a pre-set mapping relationship;

[0008] Determine whether the access request contains the first user information;

[0009] If it is included, then determine whether the requested verification information is the first verification information. If it is, then perform permission verification on the first user information and the requested verification information using the first verification method. If not, then determine the second user information based on the first user information, and perform permission verification on the second user information and the requested verification information using the second verification method. Here, the first verification method is one of either a verification method for implementing object storage access verification or a verification method for implementing file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information.

[0010] If not included, then the second verification method is used to verify the permissions of the second user information and the request verification information.

[0011] Preferably, after determining that the access request contains the first user information, the method further includes:

[0012] When the requested verification information includes both the first verification information and the second verification information, the second user information is determined based on the first user information.

[0013] The first user information and the first verification information are used to verify permissions through the first verification method, and the second user information and the second verification information are used to verify permissions through the second verification method.

[0014] Preferably, when object storage is a higher-level structure than file storage, the first user information is object storage user information, and the second user information is file storage user information.

[0015] Preferably, the mapping relationship between the first user information and the second user information is many-to-one.

[0016] Preferably, the permission verification of the first user information and the request verification information through the first verification method includes:

[0017] Determine whether the bucket permission information and object permission information in the request verification information correspond to the first user information. If they all correspond, the verification passes.

[0018] Preferably, the permission verification of the second user information and request verification information through the second verification method includes:

[0019] Determine whether the namespace permission information, directory permission information, and file permission information in the request verification information correspond to the second user information. If they all correspond, the verification passes.

[0020] Preferably, directory permission information is inherited from namespace permission information when it is saved.

[0021] To address the aforementioned technical problems, this application also provides an access permission verification device, comprising:

[0022] The receiving module is used to receive access requests; the access request includes request verification information and includes at least one of first user information or second user information; the first user information is one of object storage user information or file storage object information, and the other is the second user information, and the first user information and the second user information have a pre-set mapping relationship;

[0023] The judgment module is used to determine whether the access request contains the first user information. If it does, the first verification module is triggered; if it does not, the second verification module is triggered.

[0024] The first verification module is used to determine whether the requested verification information is the first verification information. If it is, the first user information and the requested verification information are verified for permissions using the first verification method. If not, the second user information is determined based on the first user information, and the second user information and the requested verification information are verified for permissions using the second verification method. The first verification method is one of either a verification method for implementing object storage access verification or a verification method for implementing file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information.

[0025] The second verification module is used to perform permission verification on the second user information and the request verification information through a second verification method.

[0026] Preferred options also include:

[0027] The third verification module is used to determine the second user information based on the first user information when the requested verification information includes both the first verification information and the second verification information; to perform permission verification on the first user information and the first verification information using the first verification method; and to perform permission verification on the second user information and the second verification information using the second verification method.

[0028] To address the aforementioned technical problems, this application also provides an access permission verification device, comprising:

[0029] Memory, used to store computer programs;

[0030] A processor is used to implement the access permission verification method described above when executing a computer program.

[0031] To address the aforementioned technical problems, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the access permission verification method described above.

[0032] This application provides an access permission verification method that, through a pre-established mapping relationship between first and second user information, enables the mutual conversion between two types of user information used for object storage and file storage, respectively. Therefore, when an access request contains either type of user information, the mapping relationship can determine the other type of user information, allowing for single-type verification of the request data. The request sender does not need to provide corresponding user and verification information based on whether the access is to a file or an object, and there is no need to worry about mismatches between user and verification information during verification. This simplifies access permission management in multi-protocol interoperability and improves verification efficiency. Furthermore, by integrating two completely different verification methods into a unified verification process, it also helps reduce the possibility of errors during verification. In addition, the above method retains the original object and file verification methods to the greatest extent, significantly reducing development and deployment difficulty and facilitating practical implementation.

[0033] The access permission verification device and computer-readable storage medium provided in this application correspond to the above method and have the same effect. Attached Figure Description

[0034] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A diagram illustrating methods for object and file permission management;

[0036] Figure 2 A flowchart of an access permission verification method provided by the present invention;

[0037] Figure 3 Comparison chart of metadata related to permission verification for object scenarios and file scenarios;

[0038] Figure 4 A flowchart of another access permission verification method provided by the present invention;

[0039] Figure 5 A structural diagram of an access permission verification device provided by the present invention;

[0040] Figure 6 A structural diagram of another access permission verification device provided by the present invention. Detailed Implementation

[0041] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0042] The core of this application is to provide an access permission verification method, device, and medium.

[0043] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0044] In the field of distributed storage, the two most commonly used types are distributed file storage and distributed object storage, which are applied in different scenarios based on their respective characteristics.

[0045] Distributed file storage uses the command set of Network File System (NFS) or Common Internet File System (CIFS) to access data, with files as the transfer protocol, and uses Transmission Control Protocol / Internet Protocol (TCP / IP).

[0046] Networked storage, implemented using TCP / IP (TCP / IP), offers good scalability, low cost, and ease of user management, and is currently widely used in cluster computing. However, Network Attached Storage (NAS) suffers from high protocol overhead, low bandwidth, and high latency, making it unsuitable for use in high-performance clusters.

[0047] Distributed object storage combines the high-speed direct disk access of block storage with the distributed sharing of file storage. It is mainly designed for storing large amounts of unstructured data, such as images and videos, and has broad application prospects and value.

[0048] In certain application environments, a single set of data may need to be used multiple times within a single business scenario, requiring multiple copies of the data. Examples include autonomous driving and gene sequencing. For these scenarios, multi-protocol interoperability is currently used to address the issue of multiple data copies. Multi-protocol interoperability means that data stored in object storage can be accessed via file storage, or vice versa, without format conversion. Since no format conversion is required between storing and retrieving data, performance and semantic loss are effectively avoided.

[0049] However, object storage uses a flat data structure, while file storage uses a directory structure. Because their storage structures differ, their corresponding permission settings and validation methods also differ. For example, object storage permissions are as follows: Figure 1 As shown, permissions include read, write, and delete permissions for the owner and other users, while file storage permissions include read and write control permissions for the owner, user groups, and other users (write permissions in file storage are equivalent to write and delete permissions in object storage). Therefore, the permission management methods for the two differ significantly. When receiving access requests in a multi-protocol interoperability scenario, verifying the requested permissions becomes a challenge.

[0050] To address the aforementioned problems, this application provides an access permission verification method, such as... Figure 2 As shown, it includes:

[0051] S11: Receive access request.

[0052] The access request includes request verification information and at least one of the first user information or the second user information. Generally, it includes only one type of user information. The first user information is either object storage user information or file storage object information, and the other is the second user information. The first user information and the second user information have a pre-set mapping relationship.

[0053] As mentioned above, in multi-protocol interoperability scenarios, there are mainly two types: object storage and file storage. The corresponding permission settings and verification methods are also two, namely, the first user information and the second user information mentioned above. It is easy to see that the first and second information are used to distinguish two different types of user information used for verification. However, based on the priority judgment in subsequent steps, the first and second user information have a certain priority. Therefore, in a preferred implementation, the priority can be determined according to the efficiency of object storage verification and file storage verification, with the more efficient storage method being designated as the first. That is, if object storage verification is more efficient, then the first user information is the user information used for object storage.

[0054] S12: Determine whether the access request contains the first user information. If it does, proceed to step S13; otherwise, proceed to step S16.

[0055] S13: Determine whether the requested verification information is the first verification information. If yes, proceed to step S14; otherwise, proceed to step S15.

[0056] S14: Perform permission verification on the first user information and request verification information using the first verification method.

[0057] S15: Determine the second user information based on the first user information.

[0058] S16: Perform permission verification on the second user information and request verification information using the second verification method.

[0059] In this embodiment, the first verification method is either a verification method for object storage access verification or a verification method for file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information. It is readily understood that if the requested verification information does not contain complete verification information necessary to complete this verification process, the verification will fail. Therefore, subsequent verification steps assume that the requested verification information contains complete information required to complete one verification process. Furthermore, since the verification methods for distributed object storage systems and distributed file storage systems are well-known to those skilled in the art, the specific verification process will not be described in detail in this embodiment.

[0060] More specifically, to further illustrate the implementation of the access permission verification method provided in this application in practical applications, the following examples illustrate the method:

[0061] In practical applications, distributed object storage systems typically use the Simple Storage Service (S3) protocol. Currently, the S3 protocol is considered a recognized industry standard for object storage. Similarly, distributed file storage systems commonly use the NAS protocol. The following explanations will use these two most widely used protocols as examples.

[0062] For example, in a multi-protocol interoperability scenario, one possible implementation is that the object storage is located in the entire distributed storage system architecture, above the file storage. In this case, the first user information is the user information used to implement object storage verification, that is, the S3 user information, and the first verification information is the S3_ACL permission; similarly, the second user information is the Unix (an operating system) user information, and the second verification information is the UGO permission.

[0063] UGO: In Linux, UGO permissions divide file access into three categories: file owner (User, U), group (Group, G), and others (Other, O). UGO stands for the first letter of the words User (also known as Owner), Group, and Other.

[0064] For example, the comparison of permission verification data for specific object and file scenarios. Figure 3 As shown:

[0065] The object scenario includes validation of buckets and objects, with specific metadata including S3 user information and S3_ACL permissions; the file scenario includes validation of namespaces, directories and files, with specific metadata including Unix user information and UGO permissions.

[0066] Therefore, when an access request is received, it is determined whether it contains S3 user information. If it does, it is further determined whether it also contains S3_ACL permissions. If it does, the access permission verification method based on the S3 protocol is used to determine whether access to the corresponding file (or object) is allowed. If it contains S3 user information but does not contain S3_ACL permissions, the second verification method, namely the verification method based on the NAS protocol, is used to verify whether access to the relevant file is allowed. Specifically, the corresponding Unix user information is determined through the S3 user information, and then the verification is completed based on the Unix user information and UGO permissions (in this example scenario, the request verification information includes at least one of S3_ACL permissions and UGO permissions).

[0067] In summary, the access permission verification method provided in this application, upon receiving an access request, first determines whether the user information contained therein is first user information or second user information, and whether it corresponds to the requested verification information. If they do not correspond, the method finds the corresponding other user information through a preset mapping relationship, thereby completing the verification. This integrates the original separate object storage verification method and file storage verification method. Regardless of the type of information included in the access request for verification, access permission verification can be achieved through either object storage verification or file storage verification, thus simplifying and standardizing the original verification process and improving the accuracy of file access permission verification. Furthermore, the access permission verification method provided in this application retains the original object and file permission verification methods to the greatest extent possible, reducing the development cost and deployment difficulty in practical applications, making it more suitable for actual use.

[0068] As can be seen from the above embodiments, in actual implementation, such as Figure 3 As shown, the access permission verification process for both object storage and file storage includes multiple verifications. In practical applications, there may be a scenario where the access request contains part of the first verification information and part of the second verification information. Neither the first verification information nor the second verification information alone is sufficient to complete the entire verification process, but they can be combined to achieve the desired result.

[0069] For the above application scenarios, this embodiment provides a preferred implementation scheme. After determining that the access request contains the first user information, the above method further includes:

[0070] S17: When the requested verification information includes both the first verification information and the second verification information, the second user information shall be determined based on the first user information.

[0071] S18: Perform permission verification on the first user information and the first verification information using the first verification method, and perform permission verification on the second user information and the second verification information using the second verification method.

[0072] It is easy to understand that the principle of this embodiment is the same as that of the above embodiments. Both are to find the corresponding user information according to the type of request verification information to complete the verification process. The difference is that the request verification information targeted in this embodiment is divided more finely, down to specific layered verification.

[0073] objects such as Figure 3 The file shows two layers of verification. Figure 3The diagram shows three layers of verification. Bucket verification, equivalent to namespace verification, determines whether a request has permission to access the file's storage location. Object verification, equivalent to file verification, determines whether a request has permission to access the file itself. Directory verification arises because file storage and object storage have different storage structures. Since files are stored in a specific directory within a namespace, directory verification essentially also falls under the category of permission verification for accessing file storage locations. Therefore, the above verification process can be arbitrarily replaced between object verification and file verification.

[0074] As described above, and considering that in practical applications a namespace is equivalent to the top-level directory of a multi-level directory, this embodiment also provides a preferred implementation: when saving directory permission information, the namespace permission information is inherited.

[0075] In other words, when performing file verification, directory verification is equivalent to namespace verification. The original namespace verification + directory verification of file verification is simplified into a multi-level directory verification (the original directory verification is also a multi-level directory, the difference in name here is only for differentiation). While simplifying the verification process, it also makes the correspondence between object verification and file verification closer, both being two-to-two, and both layers of verification are for file storage location access permission verification and file access permission verification, which is more conducive to arbitrary conversion of the above verification process, and further improves the flexibility and efficiency of access permission verification.

[0076] The preferred solution provided in this embodiment also uses the mapping relationship between the first user information and the second user information to enable permission verification for file access requests to be implemented through any form of object verification or file verification. The verification method is more flexible, and it is not necessary to use the same verification method for all data. According to the type of request verification information, the corresponding user information can be flexibly called, thereby increasing the scope of verifiable requests. Furthermore, since the permission verification method used can be flexibly switched, a more efficient permission verification method can be selected, thereby improving the overall efficiency of the verification process.

[0077] As mentioned in the above embodiments, for distributed storage systems based on multi-protocol interoperability, different structures can lead to varying efficiencies in object verification and file verification. Generally, the verification efficiency of the upper-layer structure is higher than that of the lower-layer structure. That is, if in one possible implementation, object storage is an upper-layer structure of file storage, then the efficiency of object verification is higher than that of file verification. Based on this, this embodiment provides a preferred implementation scheme:

[0078] When object storage is a higher-level structure than file storage, the first user information is the object storage user information, and the second user information is the file storage user information.

[0079] In combination with the above, as follows Figure 3 The example shown is where the first user information is S3 user information and the second user information is Unix user information.

[0080] At this time, it is the same as Figure 3 As shown, object verification is completed using the first user information and the first verification information as follows:

[0081] Determine whether the bucket permission information and object permission information in the request verification information correspond to the first user information. If they all correspond, the verification passes.

[0082] Similarly, such as Figure 3 As shown, the file verification is completed using the second user information and the second verification information as follows:

[0083] Determine whether the namespace permission information, directory permission information, and file permission information in the request verification information correspond to the second user information. If they all correspond, the verification passes.

[0084] Furthermore, as can be seen from the above embodiments, the access permission verification method provided in this application establishes a mapping relationship between the first user information and the second user information in advance, so that the second user information can be uniquely determined based on the first user information. Therefore, the mapping relationship can be a one-to-one or many-to-one relationship.

[0085] It is easy to understand that the determination of the above mapping relationship is essentially to realize arbitrary conversion between object storage verification and file storage verification. Considering the verification efficiency, the first user information, which is more efficient, is given the highest priority to complete the verification. Therefore, the above steps only determine the unique second user information through the first user information. Thus, it can be one-to-one or many-to-one, but it cannot be one-to-many.

[0086] In fact, if verification efficiency is not considered, the first user information and the second user information have no priority order when being verified. Therefore, it does not matter whether the second user information is determined based on the first user information or the first user information is determined based on the second user information. At this time, this application does not impose any restrictions on the mapping relationship between the first user information and the second user information.

[0087] However, this embodiment also provides a preferred implementation method:

[0088] The mapping relationship between the first user information and the second user information is many-to-one.

[0089] Under this preferred scheme, a second user can be uniquely identified based on the first user information, which satisfies the above requirements. However, a second user is not limited to a single first user. Therefore, when it is necessary to change the mapping relationship of a certain first user, the corresponding second user can be changed directly without changing other mapping relationships of the corresponding second user (before and after the change), which is more conducive to practical implementation.

[0090] This embodiment provides a preferred solution for a distributed storage system architecture commonly used in practical applications, where object storage is on top and file storage is below. It offers an optimized scheme for first and second user information, allowing a more efficient verification method to be used with higher priority, thereby improving the efficiency of the entire verification process. Furthermore, this embodiment preferably uses a many-to-one mapping relationship between the first and second user information to facilitate changes in the mapping relationship, better meeting practical engineering needs. This further improves the verification efficiency of the access permission verification method provided in this application, making it more suitable for actual production and daily life, and better meeting user needs.

[0091] Taking into account the various preferred solutions mentioned in the above embodiments, and to more clearly illustrate the access permission verification method provided in this application, further explanation is given in conjunction with examples:

[0092] A distributed storage system is implemented based on multi-protocol interoperability, with object storage as the upper-layer storage structure and file storage as the lower-layer storage structure, wherein the object storage is based on the S3 protocol and the file storage is based on the NAS protocol.

[0093] Based on this, such as Figure 4 As shown, an access permission verification method includes:

[0094] S201: Received access request.

[0095] S202: Determine whether the access request contains S3 user information. If yes, proceed to step S203; otherwise, proceed to step S204.

[0096] S203: Determine whether the bucket / namespace metadata contains the S3_ACL permission. If yes, proceed to step S204; otherwise, proceed to step S205.

[0097] S204: Verify the S3_ACL permissions of the bucket.

[0098] S205: Determine the corresponding Unix user information based on the S3 user information.

[0099] The S3 user information and Unix user information are pre-configured with a many-to-one mapping relationship.

[0100] S206: Verify UGO permissions for the namespace.

[0101] S207: Determine whether the object / file metadata contains S3_ACL permissions. If yes, proceed to step S208; otherwise, proceed to step S209.

[0102] S208: Verify the S3_ACL permissions of the object.

[0103] S209: Determine the corresponding Unix user information based on the S3 user information.

[0104] S210: Verify the UGO permissions of the file.

[0105] S211: Determine the corresponding Unix user information based on the S3 user information.

[0106] S212: Verify UGO permissions for the namespace.

[0107] S213: Verify the UGO permissions of the directory.

[0108] S214: Verify the UGO permissions of the file.

[0109] S215: Accessing data.

[0110] It is easy to understand that the verification step in the above steps will only proceed to the next step if the verification passes; otherwise, the current verification process will end directly, and the verification will be judged as failing, and access to the data will not be allowed.

[0111] In the above embodiments, an access permission verification method has been described in detail. This application also provides an embodiment corresponding to an access permission verification device. It should be noted that this application describes the device portion of the embodiment from two perspectives: one is based on functional modules, and the other is based on hardware.

[0112] From the perspective of functional modules, this embodiment provides an access permission verification device, such as... Figure 5 As shown, it includes:

[0113] The receiving module 31 is used to receive an access request; the access request includes request verification information and includes at least one of first user information or second user information; the first user information is one of object storage user information or file storage object information, and the other is the second user information, and the first user information and the second user information have a pre-set mapping relationship;

[0114] The judgment module 32 is used to determine whether the access request contains the first user information. If it does, the first verification module is triggered; if it does not, the second verification module is triggered.

[0115] The first verification module 33 is used to determine whether the requested verification information is the first verification information. If so, the first user information and the requested verification information are verified for permissions using the first verification method. If not, the second user information is determined based on the first user information, and the second user information and the requested verification information are verified for permissions using the second verification method. The first verification method is one of either a verification method for implementing object storage access verification or a verification method for implementing file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information.

[0116] The second verification module 34 is used to perform permission verification on the second user information and the request verification information through the second verification method.

[0117] Preferred options also include:

[0118] The third verification module is used to determine the second user information based on the first user information when the requested verification information includes both the first verification information and the second verification information; to perform permission verification on the first user information and the first verification information using the first verification method; and to perform permission verification on the second user information and the second verification information using the second verification method.

[0119] Since the embodiments of the apparatus and the embodiments of the method correspond to each other, please refer to the description of the embodiments of the method for the embodiments of the apparatus, which will not be repeated here.

[0120] This embodiment provides an access permission verification device. When the receiving module receives an access request, the judging module first determines whether the user information contained therein is first user information or second user information, and whether it corresponds to the requested verification information. If they do not correspond, the device finds the corresponding other user information through a preset mapping relationship, thereby completing the verification. This device integrates the original separate object storage verification method and file storage verification method. Regardless of the type of information used for verification in the access request, access permission verification can be achieved through object storage verification or file storage verification, thereby simplifying and standardizing the original verification process and improving the accuracy of file access permission verification. At the same time, this device also retains the original object and file permission verification methods to the greatest extent, reducing the development cost and deployment difficulty of this device in practical applications, making it more conducive to practical use.

[0121] Figure 6A structural diagram of an access permission verification device provided in another embodiment of this application is shown below. Figure 6 As shown, an access permission verification device includes: a memory 40 for storing computer programs;

[0122] The processor 41 is used to implement the steps of an access permission verification method as described in the above embodiment when executing a computer program.

[0123] The access permission verification device provided in this embodiment may include, but is not limited to, smartphones, tablets, laptops, or desktop computers.

[0124] The processor 41 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 41 may be implemented using at least one of the following hardware forms: Digital Signal Processor (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 41 may also include a main processor and a coprocessor. The main processor, also known as the Central Processing Unit (CPU), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 41 may integrate a Graphics Processing Unit (GPU), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 41 may also include an Artificial Intelligence (AI) processor, which is used to handle computational operations related to machine learning.

[0125] The memory 40 may include one or more computer-readable storage media, which may be non-transitory. The memory 40 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 40 is used to store at least the following computer program 401, which, after being loaded and executed by the processor 41, is capable of implementing the relevant steps of an access permission verification method disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 40 may also include an operating system 402 and data 403, and the storage method may be temporary or permanent storage. The operating system 402 may include Windows, Unix, Linux, etc. The data 403 may include, but is not limited to, an access permission verification method.

[0126] In some embodiments, an access permission verification device may further include a display screen 42, an input / output interface 43, a communication interface 44, a power supply 45, and a communication bus 46.

[0127] Those skilled in the art will understand that Figure 6 The structure shown does not constitute a limitation on an access control device and may include more or fewer components than illustrated.

[0128] This application provides an access permission verification device, which includes a memory and a processor. When the processor executes a program stored in the memory, it can implement the following method: an access permission verification method.

[0129] This embodiment provides an access permission verification device that executes a computer program stored in memory via a processor. Upon receiving an access request, it first determines whether the user information contained within is first user information or second user information, and whether it corresponds to the requested verification information. If they do not correspond, it finds the corresponding user information through a preset mapping relationship, thereby completing the verification. This device integrates the previously separate object storage verification method and file storage verification method. Regardless of the type of information included in the access request for verification, access permission verification can be achieved through either object storage verification or file storage verification, thus simplifying and standardizing the original verification process and improving the accuracy of file access permission verification. Simultaneously, this device retains the original object and file permission verification methods to the greatest extent possible, reducing development costs and deployment difficulty in practical applications, making it more suitable for actual use.

[0130] Finally, this application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps described in the above method embodiments.

[0131] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] This embodiment provides a computer-readable storage medium. When the computer program stored therein is executed, it can determine whether the user information contained in an access request corresponds to the request verification information upon receiving the request. If they do not correspond, it finds the corresponding user information through a preset mapping relationship, thereby completing the verification. This integrates the original separate object storage verification method and file storage verification method. Regardless of whether the information contained in the access request corresponds to file storage verification or object storage verification, it can be transformed into a single verification method to verify access permissions. This simplifies and standardizes the original verification process and improves the accuracy of file access permission verification. At the same time, it retains the original object and file permission verification methods to the greatest extent, reducing the development cost and deployment difficulty of this device in practical applications, making it more suitable for actual use.

[0133] The foregoing has provided a detailed description of an access permission verification method, apparatus, and medium provided in this application. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0134] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. An access permission verification method, characterized in that, include: Receive an access request; the access request includes request verification information and at least one of first user information or second user information; the first user information is one of object storage user information or file storage object information, and the other is the second user information, and the first user information and the second user information have a pre-set mapping relationship; the request verification information includes at least first verification information or second verification information; Determine whether the access request contains the first user information; If it is included, then it is determined whether the request verification information is the first verification information. If it is, then the first user information and the request verification information are used for permission verification through the first verification method. If not, then the second user information is determined based on the first user information, and the second user information and the request verification information are used for permission verification through the second verification method. The first verification method is one of either a verification method for implementing object storage access verification or a verification method for implementing file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information. If not included, then the second verification method is used to perform permission verification on the second user information and the request verification information.

2. The access permission verification method according to claim 1, characterized in that, After determining that the access request contains the first user information, the process further includes: When the request verification information includes both the first verification information and the second verification information, the second user information is determined based on the first user information. The first user information and the first verification information are used to perform permission verification using the first verification method, and the second user information and the second verification information are used to perform permission verification using the second verification method.

3. The access permission verification method according to claim 1, characterized in that, When object storage is a higher-level structure than file storage, the first user information is object storage user information, and the second user information is file storage user information.

4. The access permission verification method according to claim 1, characterized in that, The mapping relationship between the first user information and the second user information is many-to-one.

5. The access permission verification method according to claim 3, characterized in that, The permission verification of the first user information and the request verification information using the first verification method includes: Determine whether the bucket permission information and object permission information in the request verification information correspond to the first user information. If they all correspond, the verification passes.

6. The access permission verification method according to claim 3, characterized in that, The permission verification of the second user information and the request verification information through the second verification method includes: Determine whether the namespace permission information, directory permission information, and file permission information in the request verification information correspond to the second user information. If they all correspond, the verification passes.

7. The access permission verification method according to claim 6, characterized in that, When the directory permission information is saved, it inherits the namespace permission information.

8. An access permission verification device, characterized in that, include: A receiving module is used to receive an access request; the access request includes request verification information and at least one of first user information or second user information; the first user information is one of object storage user information or file storage object information, and the other is the second user information, and the first user information and the second user information have a pre-set mapping relationship; the request verification information includes at least first verification information or second verification information. The judgment module is used to determine whether the access request contains the first user information. If it does, the first verification module is triggered; if it does not, the second verification module is triggered. The first verification module is used to determine whether the request verification information is the first verification information. If so, it performs permission verification on the first user information and the request verification information using a first verification method. If not, it determines the second user information based on the first user information and performs permission verification on the second user information and the request verification information using a second verification method. The first verification method is either a verification method for implementing object storage access verification or a verification method for implementing file storage access verification, and the other is the second verification method. Correspondingly, the verification information used to implement the first verification method is the first verification information, and the verification information used to implement the second verification method is the second verification information. The second verification module is used to perform permission verification on the second user information and the request verification information using the second verification method.

9. An access permission verification device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the access permission verification method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the access permission verification method as described in any one of claims 1 to 7.

Images