Processing method, apparatus, device, and storage medium

Abstract

The application discloses a processing method, device, equipment and storage medium, comprising: receiving a first access request; generating a first access record corresponding to the first access request; uploading the first access record, so that the first access record is stored in a data storage system, and a second server can obtain the first access record from the data storage system.

Description

Technical Field

[0001] This application relates to the field of processing technology, including but not limited to processing methods, apparatus, devices, and storage media. Background Technology

[0002] With the continuous development of internet technology, all sorts of services have emerged. These include shopping-related services, healthcare-related services, and education-related services, among others.

[0003] In related technologies, different services are managed independently, and data between each server is also stored independently. As the number of services continues to increase, the utilization rate of resources is low. Summary of the Invention

[0004] The processing method, apparatus, equipment, and storage medium provided in this application can obtain the first access record generated by the first server through the second server, thereby enabling multiple servers to share access records.

[0005] The technical solution of this application is implemented as follows:

[0006] This application provides a first processing method, which is applied to a first server and includes:

[0007] Receive the first access request;

[0008] Generate the first access record corresponding to the first access request;

[0009] The first access record is uploaded so that it is stored in the data storage system and the second server can obtain the first access record from the data storage system.

[0010] This application provides a second processing method applied to a first client, the method comprising:

[0011] Send a first access request to a first server; so that the first server generates a first access record corresponding to the first access request, and uploads the first access record so that the first access record is stored in a data storage system, and enables the second server to obtain the first access record from the data storage system.

[0012] This application provides a first processing apparatus, which is deployed on a first server, and the apparatus includes:

[0013] The receiving unit is used to receive the first access request;

[0014] The generation unit is used to generate the first access record corresponding to the first access request;

[0015] An upload unit is used to upload the first access record so that the first access record is stored in a data storage system, and so that the second server can obtain the first access record from the data storage system.

[0016] This application provides a second processing apparatus, which is deployed on a first client, and the apparatus includes:

[0017] The sending unit is configured to send a first access request to a first server, so that the first server generates a first access record corresponding to the first access request, and uploads the first access record so that the first access record is stored in a data storage system, and enables a second server to obtain the first access record from the data storage system.

[0018] This application also provides an electronic device, including: a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement the above-described processing method.

[0019] This application also provides a storage medium on which a computer program is stored, which, when executed by a processor, implements the above-described processing method.

[0020] The processing method, apparatus, device, and storage medium provided in this application include at least: receiving a first access request; generating a first access record corresponding to the first access request; uploading the first access record to store the first access record in a data storage system; and enabling a second server to obtain the first access record from the data storage system. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of an optional structure of the processing system provided in an embodiment of this application;

[0022] Figure 2 A schematic flowchart of an optional processing method provided in the embodiments of this application;

[0023] Figure 3 Another optional flowchart illustrating the first processing method provided in the embodiments of this application;

[0024] Figure 4 A schematic flowchart illustrating another optional processing method provided in the embodiments of this application;

[0025] Figure 5 A schematic flowchart of an optional processing method provided in an embodiment of this application;

[0026] Figure 6A schematic diagram of an optional data processing flow provided in the embodiments of this application;

[0027] Figure 7 A schematic diagram illustrating an optional data storage principle for the processing procedure provided in an embodiment of this application;

[0028] Figure 8 A schematic diagram of an optional structure of the first processing apparatus provided in the embodiments of this application;

[0029] Figure 9 This is a schematic diagram of an optional structure of a second processing apparatus provided in an embodiment of this application;

[0030] Figure 10 This is a schematic diagram of an optional structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the specific technical solutions of the application will be further described in detail below with reference to the accompanying drawings of the embodiments of this application. The following embodiments are used to illustrate this application, but are not intended to limit the scope of this application.

[0032] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0033] In the following description, the terms "first," "second," and "third" are used only to distinguish different objects and do not represent a specific order of objects, nor are they constituting a chronological order. It is understood that "first," "second," and "third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0035] This application provides processing methods, apparatus, devices, and storage media. In practical applications, the processing method can be implemented by a processing device, and the functional entities in the processing device can be collaboratively implemented by the hardware resources of the electronic device, such as computing resources like processors and communication resources (such as those used to support various communication methods like optical fiber and cellular).

[0036] This application does not limit the specific type of electronic device used to perform the processing method, and it can be determined according to the actual situation. For example, the electronic device can be a server, desktop computer, laptop, tablet computer, mobile phone, etc.

[0037] The processing method provided in this application embodiment is applied to a processing system, which includes a server and a client; wherein the server includes at least a first server and a second server, and the client includes at least a first client.

[0038] The first client is configured to: send a first access request to a first server; cause the first server to generate a first access record corresponding to the first access request; upload the first access record to store it in a data storage system; and enable the second server to obtain the first access record from the data storage system.

[0039] The first server is configured to: receive a first access request; generate a first access record corresponding to the first access request; upload the first access record so that the first access record is stored in a data storage system; and enable the second server to obtain the first access record from the data storage system.

[0040] The second server is used to perform the following: receiving a second access request; generating a second access record corresponding to the second access request; uploading the second access record so that the second access record is stored in the data storage system, and enabling the second server to obtain the second access record from the data storage system.

[0041] It should be noted that the number of clients is greater than or equal to 1. This application embodiment does not limit the specific number of clients and can configure it according to actual conditions. The number of servers is greater than or equal to 2. This application embodiment does not limit the specific number of servers and can configure it according to actual conditions.

[0042] As an example, the processing system is as follows Figure 1 As shown, the processing system 10 includes: a first server 101, a second server 102, and a first client 103. The first client 103 can transmit data with both the first server 101 and the second server 102.

[0043] Specifically, the first server 101 is configured to: receive a first access request; generate a first access record corresponding to the first access request; upload the first access record so that the first access record is stored in the data storage system, and enable the second server to obtain the first access record from the data storage system.

[0044] The first server 101 can be an electronic device with relevant processing capabilities. For example, the first server 101 can include, but is not limited to, electronic devices such as tablet computers, servers, and desktop computers; or virtual devices with relevant processing capabilities.

[0045] The second server 102 is configured to: receive a second access request; generate a second access record corresponding to the second access request; upload the second access record so that the second access record is stored in the data storage system, and enable the second server to obtain the second access record from the data storage system.

[0046] The second server 102 can be an electronic device with relevant processing capabilities. For example, the second server 102 can include, but is not limited to, electronic devices such as tablet computers, servers, and desktop computers; or virtual devices with relevant processing capabilities.

[0047] The first client 103 is configured to: send a first access request to a first server; cause the first server to generate a first access record corresponding to the first access request; upload the first access record to store the first access record in a data storage system; and enable the second server to obtain the first access record from the data storage system.

[0048] The first client 103 can be an electronic device with relevant processing capabilities. For example, the first client 103 can include, but is not limited to: terminal devices such as mobile phones and tablets; smart wearable devices such as smartwatches; or virtual devices with relevant processing capabilities.

[0049] Below, in conjunction with Figure 1 The schematic diagram of the processing system shown illustrates various embodiments of the processing methods, apparatus, devices, and storage media provided in this application.

[0050] In a first aspect, embodiments of this application provide a first processing method, which is applied to a first processing device; wherein the first processing device can be deployed in Figure 1 The first server 101 is described below. Taking the first server as the execution subject, the first processing method provided by the embodiments of this application will be described.

[0051] Figure 2 This is a schematic diagram of one possible process for the first processing method, for reference. Figure 2 The processing method shown may include, but is not limited to, the following: Figure 2 S201 to S203 are shown.

[0052] S201, The first server receives the first access request.

[0053] The first server can be any server in the processing system. This application does not specifically limit the first server in its embodiments; it can be determined according to actual circumstances. For example, the first server could be a processing terminal for shopping-related services, or a processing terminal for medical-related services, etc.

[0054] The first access request is used to access data on the first server. This application embodiment does not specifically limit the content accessed by the first access request, and it can be determined according to the actual situation.

[0055] This application does not limit the specific format of the received first access request, which can be determined according to the actual situation. For example, the first access request can be in encrypted or unencrypted format.

[0056] S201 can be implemented as follows: The first server receives the first access request sent by the client through the relevant data receiving interface.

[0057] After receiving the first access request, the first server will perform corresponding processing. This application embodiment does not limit the specific processing procedure and can determine it according to the actual situation. For example, the first server may access and output relevant data based on the first access request; alternatively, it may not access or output relevant data in response to the first access request.

[0058] S202, The first server generates the first access record corresponding to the first access request.

[0059] The first access record is used to record relevant information in the first access request. This application embodiment does not limit the specific content of the first access record, which can be determined according to the actual situation.

[0060] In one possible implementation, the first access record may include: user information of the accessing user, access data, and identification information indicating whether the access was successful.

[0061] Understandably, the first access record may also include: access time, etc.

[0062] For example, S202 can be implemented as follows: the first server first determines the user information to be accessed based on the first access request, then determines the access data requested by the first access request, and then determines whether the access is successful. The user information, access data, and whether the access is successful are processed according to the pre-set access record format to generate the first access record corresponding to the first access request.

[0063] This application does not limit the specific format of the first access record, and it can be configured according to the actual situation. For example, it can be in table format, or in text description format, etc.

[0064] S203. The first server uploads the first access record so that the first access record is stored in the data storage system, and the second server can obtain the first access record from the data storage system.

[0065] The second server is any server that is different from the first server.

[0066] A data storage system is provided to store access records uploaded by multiple servers; and an access record uploaded by one server can be obtained by other servers. This application does not limit the specific method by which the data storage system stores access records, and this method can be determined according to the actual situation.

[0067] This application does not limit the type of data storage system and can be configured according to actual conditions. For example, the data storage system can be a database storage system; or it can be a blockchain storage system.

[0068] This application embodiment does not limit the process of the first access record on the first server, and can be configured according to actual conditions. For example, the first server can directly upload the first access record to the data storage system, or it can upload the first access record to the data storage system through other devices.

[0069] After the first server uploads the first access record, the first access record is shared in the data storage system, so that the second server can obtain the first access record from the data storage system.

[0070] This application does not limit the sharing method of access records in the data storage system, and it can be determined according to the actual situation. For example, access records can be fully shared in the storage system, that is, the second server can share the first access record under any circumstances; or, access records can be shared for access by the same user, that is, the second server can share the first access record when accessing the same user.

[0071] Whether a user belongs to the same user can be determined based on user information. This application embodiment does not limit the specific implementation of user information and can determine it according to the actual situation. For example, user information can be a user identity document (ID), which can be used to determine whether a user belongs to the same user. Alternatively, user information can be key information, where the same user's access records correspond to the same root key, and the same user's access records on different servers correspond to different sub-keys.

[0072] The first processing scheme provided in this application includes: receiving a first access request; generating a first access record corresponding to the first access request; uploading the first access record so that the first access record is stored in a data storage system; and enabling a second server to obtain the first access record from the data storage system.

[0073] For the first processing scheme of this application, the first access record generated by the first server can be obtained by the second server, thereby enabling multiple servers to share access records. In this way, on the one hand, storage space is reduced and the utilization rate of storage resources is improved; on the other hand, the second service can obtain the access record generated by the first server, so that the second service can perform further processing based on the access record of the first server, thereby improving the flexibility and convenience of the management of the second service.

[0074] The following describes the process by which the first server uploads the first access record in S203. Specifically, this may include, but is not limited to, method 1 or method 2 described below.

[0075] Method 1: When the data storage system is a database, upload the first access record;

[0076] Method 2: When the data storage system is a blockchain, upload the first access record.

[0077] In Method 1, the first server organizes the first access record into a format supported by the database and then uploads it to the database.

[0078] The following describes the upload process of the first access record in Method 2 when the data storage system is a blockchain.

[0079] In Method 2, the data storage system has a first node and a second node. The first node is associated with the first server, and the second node is associated with the second server. After the first access record is uploaded to the first node, the second node obtains the first access record and saves it.

[0080] The first node is associated with the first server so that after the first node uploads the first access record, the first node will then pass the first access record to other nodes in the blockchain for consensus.

[0081] The second node is associated with the second server so that the second node can receive access records uploaded by the second server and pass the access records to other nodes in the blockchain for consensus.

[0082] This application does not impose a specific limit on the number of nodes included in the blockchain, which can be determined according to the actual situation. For example, the blockchain may include a first node and a second node; or, the blockchain may also include other nodes.

[0083] This application does not limit the deployment method between the first node and the first server, and can be configured according to actual needs. For example, the first server and the first node can be integrated on the same electronic device; or, the first server and the first node can be deployed independently on different electronic devices.

[0084] This application does not limit the specific type of blockchain; it can be configured according to actual circumstances. In one possible implementation, the blockchain can be a public blockchain. In another possible implementation, the blockchain can also be a consortium blockchain. For example, the blockchain can be an internet-based consortium blockchain or a security-based consortium blockchain.

[0085] In practice, data storage systems can also include multiple blockchains simultaneously. For example, a data storage system can include an internet-based consortium blockchain and a security-based consortium blockchain. The internet-based consortium blockchain stores access records generated by internet-based servers, while the security-based consortium blockchain stores access records generated by servers with higher security levels, such as banks. This allows access records from servers with different attributes to be stored on different blockchains, further enhancing data storage security.

[0086] Compared to method 2, method 1 is simpler and more convenient to implement. Compared to method 1, method 2 is more reliable and secure to implement.

[0087] The processing method provided in this application embodiment can perform verification before executing S202, where the first server generates the first access record corresponding to the first access request.

[0088] Specifically, such as Figure 3 As shown, the processing method may include, but is not limited to, S301 to S305 below.

[0089] S301, The first server receives the first access request.

[0090] The implementation of S301 can be referred to in the detailed description of the first server receiving the first access request in S201, which will not be repeated here.

[0091] S302, The first server obtains the second access record.

[0092] The second access record is the access record uploaded by the second server to the data storage system. That is, the second access record is the access record generated by the second server.

[0093] The second access record has a first association relationship with the first access request; the first association relationship indicates that the second access record and the first access request involve the same user information. In other words, the user accessing the second access record and the user accessing the first access request are the same user.

[0094] This can also be understood as the first server being able to obtain other access records belonging to the same user as the user involved in the first access request, based on the first access request. These other access records include the access records of the first server and the access records of the second server.

[0095] Specifically, the first server sends a first request to the data storage system. The first request is used to obtain a second access record that has a first association with the first access request. After receiving the first request, the data storage system searches for a second access record that has a first association with the first access request among multiple access records and sends the second access record to the first server. The first server receives the second access record sent by the data storage system.

[0096] S303. The first server verifies the first access request based on the second access record.

[0097] In one possible implementation, S303 can be implemented as follows: the first server directly uses the access status (whether the access was successful) or trust status in the second access record as the basis for verifying the first access request. For example, if the access is successful in the second access record, then the verification of the first access request is considered to have passed; if the access fails in the second access record, then the verification of the first access request is considered to have failed.

[0098] In another possible implementation, the first server uses the second access record as a reference factor in the verification process of the first access request. For example, the first access request is considered to have passed verification only if the second access record shows successful access and the first access request also meets the access conditions.

[0099] In this way, verifying the first access request through the access records of the second server simplifies the verification process, and combining the access records of the second server makes the verification process more reliable.

[0100] Understandably, the first service can obtain multiple second access records from the second service and verify the first access request based on these multiple second access records.

[0101] Understandably, the first service can also obtain at least one third access record from the third service, and verify the first access request based on at least one second access record and at least one third access record.

[0102] Among them, the third access record and the first access request have a second association relationship, which is used to indicate that the third access record and the first access request involve the same user information.

[0103] S304. The first server generates the first access record corresponding to the first access request.

[0104] The implementation of S304 can be referred to in the detailed description of the first access record corresponding to the first access request generated by the first server in S202, which will not be repeated here.

[0105] S305. The first server uploads the first access record so that the first access record is stored in the data storage system, and the second server can obtain the first access record from the data storage system.

[0106] The implementation of S305 can refer to the first server uploading the first access record in S203 so that the first access record is stored in the data storage system, and the second server can obtain a detailed description of the first access record from the data storage system. These details will not be repeated here.

[0107] The following explains the first association between the second access record involved in S302 and the first access request.

[0108] In one possible implementation, the first access request is information encrypted with a first key, and the second access record includes key information corresponding to a second key. The first key and the second key are different, and the root key corresponding to the first key and the second key is the same.

[0109] The key information corresponding to the second key includes the second key; or it includes the method for generating the second key and related data (e.g., the root key and related information for generating the second key).

[0110] The first key and the second key correspond to the same root key, that is, the first access request and the second access record are associated with the same root key.

[0111] The following describes the process by which the first server verifies the first access request based on the second access record in S303.

[0112] In one possible implementation, the process may include, but is not limited to, S3031 and S3032 described below.

[0113] S3031. The first server obtains the trust evaluation information from the second access record.

[0114] In one possible implementation, trust evaluation information is used to characterize whether the second access request was successful. For example, if the trust evaluation information is a first value, it indicates that the second access request was successful; if the trust evaluation is a second value, it indicates that the second access request was unsuccessful.

[0115] The embodiments of this application do not limit the specific values ​​of the first and second values, which can be determined according to the actual situation. For example, the first value can be 1 and the second value can be 0.

[0116] In one possible implementation, the trust evaluation information can be a trust score. This trust score characterizes the degree to which the user's access is trusted. A higher trust score corresponds to a higher level of trust.

[0117] In practice, the trust score can be correlated with the number of successful and failed access requests for a user. A higher number of successful accesses results in a higher trust score. Specifically, after each verification, the trust score can be updated based on the verification result; if verification passes (data access successful), the user's trust score increases; if verification fails (data access failed), the user's trust score decreases.

[0118] S3031 can be implemented as follows: The first server reads the trust evaluation information from the second access record to obtain the trust score or whether the second access request was successful.

[0119] S3032. The first server verifies the first access request based on the trust evaluation information.

[0120] In one possible implementation, when the trust evaluation information is used to characterize whether the second access request was successful, S3032 can be implemented as follows: if the trust evaluation information characterizes that the second access request was successful, then the first access request is considered to have passed verification; if the trust evaluation information characterizes that the second access request failed, then the first access request is considered to have failed verification.

[0121] Understandably, the first server can also determine whether the first access request verification passes based on a combination of multiple trust evaluation information. For example, if the percentage of successful accesses among multiple trust evaluation information is greater than a first percentage threshold, then the first access request is considered to have passed verification; otherwise, the verification fails.

[0122] The first percentage threshold can be determined based on the actual situation. The higher the first percentage threshold, the higher the security performance.

[0123] In another possible implementation, when the trust evaluation information is a trust score, S3032 can be implemented as follows: the first server reads the trust score in the trust evaluation information, determines the relationship between the trust score and the trust score threshold, and if the trust score is greater than or equal to the trust score threshold, the first access request is considered to have passed verification; otherwise, the verification fails.

[0124] In another possible implementation, when the trust evaluation information is a trust score, S3032 can be implemented as follows: the first server reads the trust score in the trust evaluation information, determines the relationship between the trust score and the trust score threshold, and if the trust score is greater than or equal to the trust score threshold and the first access request meets the access conditions, then the first access request is considered to have passed the verification; otherwise, the verification fails.

[0125] This application does not limit the specific content of the access conditions, which can be determined according to the actual situation. For example, access conditions may include: the access address is a secure address, the access time falls within a common access time range, etc.

[0126] Optionally, the trust score in the trust evaluation information can be further updated based on the verification result of the first access request.

[0127] The processing method provided in this application embodiment can also query the access record list. For example... Figure 4 As shown, the process may include, but is not limited to, S401 to S404 below.

[0128] S401, The first server receives the query request.

[0129] A query request is used to request a list of access records.

[0130] The query request is encrypted using the first key. Specifically, the query request is encrypted using the private key of the first key. This allows the corresponding user information to be determined based on the first key, thus obtaining a list of access records corresponding to that user information.

[0131] S401 can be implemented as follows: The first server receives a query request sent by the first client, decrypts the query request using the public key of the first key, and if the decryption is successful, it can determine, based on the first key, that the objects in the list queried by the query request are all access records corresponding to the subkeys under the root key of the first key.

[0132] S402, The first server obtains the target access record from the data storage system.

[0133] The target access record is an access record encrypted with the target key, which includes the key information corresponding to the target key.

[0134] The target key is the same as the root key corresponding to the first key. In one possible implementation, the target key includes the second key.

[0135] The number of target access records is not limited in this embodiment and can be determined according to the actual situation.

[0136] S402 can be implemented as follows: The first server traverses each access record in the data storage system, decrypts it with the second key, and if the decryption is successful and the second key has the same root key as the first key, then the access record is determined to be the target access record; otherwise, the access record is determined to be a non-target access record, thereby obtaining all the target access records.

[0137] S403. The first server generates an access record list based on the target access information.

[0138] The access log list is used to record access information for at least one target. This application embodiment does not limit the specific format of the access log list; it can be determined according to the actual situation.

[0139] S403 can be implemented as follows: The first server organizes all target access information and generates an access record list.

[0140] S404. The first server outputs the access record list.

[0141] This application does not limit the output of the access list; it can be determined according to the actual situation.

[0142] In one possible implementation, the first server outputs a list of access records to the client that sent the query request.

[0143] In another possible implementation, the first server can output a list of access records to all clients. Here, "all clients" can refer to all clients that have logged into the user information, and this user corresponds to the user whose root key belongs to the first key.

[0144] In this way, a list of access records can be viewed through a query request, which provides a basis for further processing based on the access records. This approach is simple and clear to implement.

[0145] It should be noted that the actions performed by the aforementioned server (either the first or second server) can be accomplished through a single integrated server device or through multiple independently deployed devices. For example, server-side authentication can be performed by the authentication party, and data storage system actions can be performed by the data owner, and so on.

[0146] Secondly, embodiments of this application provide a second processing method, which is applied to a second processing device; wherein the second processing device can be deployed in Figure 1 The first client 103 is described below. Using the first client as the execution subject, the second processing method provided in this application embodiment will be explained.

[0147] Figure 5 This is a schematic diagram of one possible process for the second processing method, for reference. Figure 5 The processing method shown may include, but is not limited to, the following: Figure 5 S501 is shown.

[0148] S501. The first client sends a first access request to the first server, so that the first server generates a first access record corresponding to the first access request and uploads the first access record, so that the first access record is stored in the data storage system, and so that the second server can obtain the first access record from the data storage system.

[0149] The first client can be any client. The first user logs in on the first client. This first user is the user corresponding to the root key of the first key.

[0150] The first access request can be encrypted or unencrypted.

[0151] In one possible implementation, the first access request is encrypted using the public key of the first key.

[0152] For example, S501 can be implemented as follows: the first client generates a first access request, encrypts the first access request using the public key of the first key, and sends it to the first server; so that after receiving the first access request, the first server can generate a first access record corresponding to the first access request based on the first access request, and upload the first access record so that the first access record is stored in the data storage system, and the second server can obtain the first access record from the data storage system.

[0153] In this way, after the first client sends the first access request, the first access record generated based on the first access request can be uploaded to the data storage system for sharing by multiple servers.

[0154] like Figure 5As shown, the second processing method provided in this application embodiment also includes, but is not limited to, the following S502 and S503.

[0155] S502. The first client generates a first key and sends the public key of the first key to the first server, so that the first server can verify the first access request based on the public key of the first key.

[0156] The first access record includes the key information corresponding to the first key.

[0157] The first client generates a root key for the first user, and then generates a subkey based on the root key as the first key.

[0158] The embodiments of this application do not limit the specific method of generating the first key, and can be configured according to the actual situation.

[0159] S503. The first client generates a second key and sends the public key of the second key to the second server, so that the second server can verify the second access request of the first client based on the public key of the second key.

[0160] The first key and the second key have the same root key. The second access record corresponding to the second access request is generated by the second server. The second access request is uploaded to the data storage system. The second access request includes the key information corresponding to the second key.

[0161] The first client generates another subkey based on the root key as the second key.

[0162] The embodiments of this application do not limit the specific method of generating the second key, and can be configured according to the actual situation.

[0163] It should be noted that here, one root key corresponds to one first user, and one subkey corresponds to one server. For example, the first server corresponds to the first key, and the second server corresponds to the second key. The root key of the first key and the second key is the same.

[0164] like Figure 5 As shown, the second processing method provided in the embodiments of this application may also include, but is not limited to, the following S504 and S505.

[0165] S504, The first client sends a query request.

[0166] A query request is used to request a list of access records.

[0167] The query request is encrypted using the first key.

[0168] S504 can be implemented as follows: The first client sends a query request encrypted with the private key of the first key. This request can be sent to either the first server or the second server.

[0169] S505, The first client receives the access record list.

[0170] The access record list is generated based on the target access record, which is obtained from the data storage system. The target access record is generated by the first server or the second server. The target access record includes key information corresponding to the target key, and the target key is the same as the root key corresponding to the first key.

[0171] The list of access records received here may be sent by the first server or by the second server.

[0172] The following describes the processing method provided in this application embodiment, taking a complete access process with the server deployed on different devices as an example.

[0173] User authentication and authorization are typically handled by service providers or identity providers. However, these centralized systems limit users' control over their identities and, due to their centralized nature, are prone to large-scale data breaches. Using attribute-based access control policies and privacy-preserving algorithms for user authentication and authorization ultimately returns control of user identities to the users themselves.

[0174] Identity providers or service providers, acting as third-party operators, identify and authorize users within identity management systems. Traditional systems are neither secure nor reliable. If commonly used password managers or single sign-on providers are compromised by hackers, the confidence of all customers will be affected.

[0175] This embodiment of the application proposes a complete data identity management service system. Users can select different identity attributes to process corresponding data, and the relevant data keys are encrypted in layers to enhance the privacy and security of the data. The identity provider (also known as the identity verification provider) enables single sign-on, the data owner is responsible for verifying and disseminating the user's identity, and the relevant data requests are stored through the blockchain to provide auditability and transaction traceability. The service provider determines whether to provide the relevant service based on the request trust score.

[0176] like Figure 6 As shown, this process involves the user (also known as the user side or client), the server (service provider, data owner (the data owner can be on the blockchain or off the blockchain), and the authentication party).

[0177] The functions of each part are described below:

[0178] Client: Responsible for making requests, selecting data owners, determining data attributes, and generating encryption keys. Clients can have different privacy protection roles and can freely control their own roles and interactions with the authentication parties.

[0179] Service Provider: This is a dependency of the open-source identity authentication protocol (OpenID Connect, OIDC), providing specific services based on user requests, such as redirection and threshold judgment.

[0180] Identity Provider: Handles user identity verification and authorization, using OIDC to implement single sign-on functionality. Essentially, it acts as the OIDC provider. It is responsible for redirecting encrypted files to the appropriate data owner and generating a trust assessment score based on the received data owner information.

[0181] Data owner: Responsible for decrypting data, uploading data access information to the blockchain, and authorizing requests based on ID and access time.

[0182] Specifically, the process may include, but is not limited to, S601 to S611 below.

[0183] S601, The client initiates a service request.

[0184] S602. The service provider receives the service request and performs redirection to verify the identity.

[0185] S603, the identity verification party logs in.

[0186] If login is successful, execute the following S604; if login fails, no related services will be provided.

[0187] S604: The client selects the data owner and encrypts it.

[0188] S605, the client performs attribute encryption.

[0189] S606, the authentication party redirects the encryption to the specified data party.

[0190] S607, Data owner decrypts data.

[0191] S608, The identity verification party generates a trust score.

[0192] S609. The service provider performs threshold determination.

[0193] If the value is greater than the threshold, execute S610; if the value is less than or equal to the threshold, no related service is provided.

[0194] S610, The service provider provides the service.

[0195] S611, Client request ends.

[0196] This scheme uses blockchain to store data access requests and identity attribute re-authentication events. It does not store the user's actual identity information, but rather obtains user identity information in a secure and verifiable manner, thus ensuring data integrity while improving system transparency and traceability. The data owner is responsible for verifying the data and disseminating user identity information, providing auditability and transaction traceability. The authentication party enables single sign-on using the OIDC protocol when needed. The process is stored through cryptographic algorithms, ensuring user information privacy. These algorithms also ensure transaction auditability when required.

[0197] like Figure 7 As shown, if blockchain is used to store relevant data (e.g., access records), a consortium blockchain can be chosen for blockchain selection. Specifically, different identity consortia can be formed, such as security attribute consortium blockchains, internet attribute consortium blockchains, etc. This allows the user side (client) to control which identity consortium is used, depending on the specific use case. For example, there are social media network identity attributes and security identity attributes, allowing users to control their identity attributes according to specific service requirements. Blockchain allows identity providers to query and verify identity attributes.

[0198] Users can customize multiple attributes, enabling them to isolate their identities across different federations and enhancing user privacy through attribute encryption. Furthermore, because users have different data owners, attackers would need to obtain the keys for all the different identities of multiple users to achieve their attack objectives, which is impossible for an attacker to accomplish.

[0199] The cryptographic scheme employs a layered deterministic wallet to generate keys and identity information, and uses conditional proxy re-encryption to securely store and transmit the user's personal information throughout the system.

[0200] The Identity Based Conditional Proxy Re-Encryption (IBCPRE) algorithm is packaged as an extension of proxy re-encryption. By using conditional proxy re-encryption, the proxy can re-encrypt ciphertext using IBCPRE, resulting in well-formatted ciphertext that is easy to decrypt and facilitates application sharing via encrypted storage.

[0201] A hierarchical deterministic wallet can obtain child keys from a parent key (including obtaining a child's private key from a parent's private key, or a child's public key from a parent's public key), but the reverse is not true; the master public key can be made public without worrying about fund loss. The advantages of this scheme include convenient backup and transfer to other compatible devices, as well as hierarchical access control. This master key can generate a sequence of child keys. These child keys can then derive grandchild keys, and so on infinitely.

[0202] On the user side, sub-private key data access keys can be generated for each data source. The data owner can access the key they own, as well as any subsequent keys derived from it. The data owner can derive more keys, which can then be used for related transactions on the blockchain. This ensures the anonymity of the blockchain. Because these data owner keys are derived from the data access keys, users will have access to all subsequent keys derived from the data owner.

[0203] The user generates and stores a data access key and a data authorization key locally. The user only provides the data access key to the identity provider when accessing online services; the user provides the data authorization key to the data owner. The data access key and data authorization key encrypt data using the IBCPRE scheme during transmission. The data access key and data authorization key are independent, thus providing a protective barrier between data authentication and data authorization.

[0204] The IBCPRE scheme uses Advanced Encryption Standard (AES) to encrypt information during transit. On the user side, a different key is created for each data owner, ensuring information isolation between data owners. The hierarchical deterministic key generation scheme allows users to commit to a separate transaction key on the blockchain for each new transaction. The blockchain only stores data access requests and re-authentication activities related to identity attributes. Because the transaction keys used for these transactions are derived from a single parent key, data owners can track all transactions belonging to the same user information. This ensures transaction traceability and auditability when needed. The user side has access to the master key and can monitor all transactions.

[0205] Based on the type of data owner and attributes, the identity provider generates a trust score and returns it to the service provider. If multiple data owners verify the identity attributes, the trust score may be higher. The identity provider is unaware of the user's identity information and acts only as a trusted intermediary between the user and the service provider. Attribute-based access control policies rely on the data owner to verify the user's identity.

[0206] Thirdly, to implement the above processing method, an embodiment of this application provides a first processing device, which is deployed on a first server. The following is in conjunction with... Figure 8 The structural diagram of the processing device shown is used for explanation.

[0207] like Figure 8 As shown, the first processing device 80 includes: a receiving unit 801, a generating unit 802, and an uploading unit 803. Wherein:

[0208] The receiving unit 801 is used to receive the first access request;

[0209] Generation unit 802 is used to generate the first access record corresponding to the first access request;

[0210] The upload unit 803 is used to upload the first access record so that the first access record is stored in the data storage system and the second server can obtain the first access record from the data storage system.

[0211] In some embodiments, the data storage system has a first node and a second node, the first node being associated with the first server and the second node being associated with the second server. After the first access record is uploaded to the first node, the second node obtains the first access record and saves it.

[0212] In some embodiments, the first processing device 80 further includes a verification unit, which is configured to perform the following before the generation unit 802 generates the first access record corresponding to the first access request:

[0213] A second access record is obtained, which is an access record uploaded by the second server to the data storage system. The second access record has a first association relationship with the first access request. The first association relationship is used to indicate that the second access record and the first access request involve the same user information.

[0214] The first access request is verified based on the second access record.

[0215] In some embodiments, the first access request is information encrypted with a first key, the second access record includes key information corresponding to a second key, the first key and the second key are different, and the root key corresponding to the first key and the second key is the same.

[0216] In some embodiments, the verification unit is further configured to:

[0217] Obtain the trust evaluation information from the second access record;

[0218] The first access request is verified based on the trust evaluation information.

[0219] In some embodiments, the first processing device 80 further includes a query unit, which is used for:

[0220] Receive a query request, which is encrypted using the first key;

[0221] Obtain a target access record from the data storage system. The target access record includes key information corresponding to the target key. The target key is the same as the root key corresponding to the first key. The target key includes the second key.

[0222] Generate an access record list based on the target access information;

[0223] Output the list of access records.

[0224] Fourthly, to implement the above processing method, an embodiment of this application provides a second processing device, which is deployed on a first client. The following is in conjunction with... Figure 9 The structural diagram of the processing device shown is used for explanation.

[0225] like Figure 9 As shown, the second processing device 90 includes a sending unit 901.

[0226] Wherein: the sending unit 901 is used to: send a first access request to the first server; so that the first server generates a first access record corresponding to the first access request, and upload the first access record so that the first access record is stored in the data storage system, and enable the second server to obtain the first access record from the data storage system.

[0227] In some embodiments, the first processing device 90 further includes a generation unit, the generation unit being configured to:

[0228] A first key is generated, and the public key of the first key is sent to the first server so that the first server can verify the first access request based on the public key of the first key; the first access record includes the key information corresponding to the first key;

[0229] A second key is generated, and the public key of the second key is sent to the second server so that the second server can verify the second access request of the first client based on the public key of the second key; the root key corresponding to the first key and the second key is the same, the second access record corresponding to the second access request is generated by the second server, the second access request is uploaded to the data storage system, and the second access request includes the key information corresponding to the second key.

[0230] In some embodiments, the first processing device 90 further includes a transmission unit, the transmission unit being configured to:

[0231] Send a query request, which is encrypted using the first key;

[0232] Receive an access record list, which is generated based on a target access record obtained from the data storage system. The target access record is generated by the first server or the second server and includes key information corresponding to the target key. The target key is the same as the root key corresponding to the first key.

[0233] It should be noted that the processing device provided in this application embodiment includes all the units included, which can be implemented by a processor in an electronic device; of course, it can also be implemented by specific logic circuits; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP), or a field-programmable gate array (FPGA), etc.

[0234] The descriptions of the above device embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0235] It should be noted that, in the embodiments of this application, if the above-described data processing method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0236] Fifthly, to implement the above processing method, this application provides an electronic device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements the steps in the data processing method provided in the above embodiments.

[0237] The following is combined with Figure 10 The electronic device 100 shown is illustrated with a structural diagram.

[0238] In one example, electronic device 100 can be the aforementioned electronic device. For example... Figure 10 As shown, the electronic device 100 includes: a processor 1001, at least one communication bus 1002, a user interface 1003, at least one external communication interface 1004, and a memory 1005. The communication bus 1002 is configured to enable communication between these components. The user interface 1003 may include a display screen, and the external communication interface 1004 may include standard wired and wireless interfaces.

[0239] The memory 1005 is configured to store instructions and applications executable by the processor 1001, and can also cache data to be processed or already processed by the processor 1001 and various modules in the electronic device (e.g., image data, audio data, voice communication data and video communication data), which can be implemented by flash memory or random access memory (RAM).

[0240] Sixthly, embodiments of this application provide a storage medium, namely a computer-readable storage medium, on which a computer program is stored, which, when executed by a processor, implements the steps in the processing method provided in the above embodiments.

[0241] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0242] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in some embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0243] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0244] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0245] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0246] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0247] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0248] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0249] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A processing method applied to a first server, the method comprising: Receive the first access request encrypted with the first key; A second access record is obtained, which includes key information corresponding to the second key. The second access record is an access record uploaded to the data storage system by the second server. The second access record has a first association relationship with the first access request. The first association relationship is used to indicate that the second access record and the first access request involve the same user information. The first key and the second key are different, but the root key corresponding to the first key and the second key is the same. The first access request and the second access record are associated with the same root key. The first access request is verified based on the second access record; Based on the verification results, a first access record corresponding to the first access request is generated; The first access record is uploaded so that it is stored in the data storage system and the second server can obtain the first access record from the data storage system.

2. The method according to claim 1, wherein the data storage system has a first node and a second node, the first node is associated with the first server, the second node is associated with the second server, and after the first access record is uploaded to the first node, the second node obtains the first access record and saves it.

3. The method according to claim 1, wherein verifying the first access request based on the second access record includes: Obtain the trust evaluation information from the second access record; The first access request is verified based on the trust evaluation information.

4. The method according to claim 1, further comprising: Receive a query request, which is encrypted using the first key; Obtain a target access record from the data storage system. The target access record includes key information corresponding to the target key. The target key is the same as the root key corresponding to the first key. The target key includes the second key. Generate an access record list based on the target access information; Output the list of access records.

5. A processing method applied to a first client, the method comprising: Send a first access request encrypted with a first key to the first server; The first server verifies the first access request based on the second access record, generates a first access record corresponding to the first access request based on the verification result, and uploads the first access record to store it in a data storage system, enabling the second server to obtain the first access record from the data storage system. The second access record is an access record uploaded to the data storage system by the second server, and includes key information corresponding to the second key. The second access record has a first association relationship with the first access request. The first association relationship is used to indicate that the second access record and the first access request involve the same user information. The first key and the second key are different, but the root key corresponding to the first key and the second key is the same. The first access request and the second access record are associated through the same root key.

6. The method according to claim 5, wherein the method comprises: Generate a first key and send the public key of the first key to the first server so that the first server can verify the first access request based on the public key of the first key; A second key is generated, and the public key of the second key is sent to the second server so that the second server can verify the second access request of the first client based on the public key of the second key; the second access record corresponding to the second access request is generated by the second server, and the second access request is uploaded to the data storage system, and the second access request includes the key information corresponding to the second key.

7. The method according to claim 6, further comprising: Send a query request, which is encrypted using the first key; Receive an access record list, which is generated based on a target access record obtained from the data storage system. The target access record is generated by the first server or the second server and includes key information corresponding to the target key. The target key is the same as the root key corresponding to the first key.

8. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, the processor executing the program to implement the processing method according to any one of claims 1 to 7.

Images