A data access method, device, storage medium and electronic equipment

Abstract

Some embodiments of the present application provide a method, device, storage medium and electronic device for data access, the method comprising: receiving a service request sent by a client, wherein the service request carries a session token, a user virtual identification number and a service data request, wherein the user virtual identification number is randomly generated based on a user real identification number; obtaining original service data corresponding to the service data request in a case where a verification result of a user identity of the client is passed through the session token and the user virtual identification number; processing the original service data to obtain target service data, and sending the target service data to the client. Some embodiments of the present application can prevent unauthorized access of data, and have high security.

Description

Technical Field

[0001] This application relates to the field of data access technology, and more specifically, to a data access method, apparatus, storage medium, and electronic device. Background Technology

[0002] Broken Access Control (BAC) is a common vulnerability in web applications. Due to its wide range and serious harm, it is listed as one of the top ten security risks in web applications.

[0003] Currently, to prevent unauthorized data access, the Web layer needs to verify the legitimacy of user operation requests before executing the corresponding operations. One method to defend against horizontal unauthorized access is to retrieve user information from a token and verify the user's permissions before performing any data operations. Another method is to defend against vertical unauthorized access by loading menus based on roles and permissions from a database, requiring user permission verification before each page loads. However, as business systems become increasingly complex, the number of operation requests to the Web application increases, and the data volume grows larger. Verifying each operation request individually becomes inefficient and cumbersome.

[0004] Therefore, how to provide a technical solution for efficient and secure data access has become an urgent technical problem to be solved. Summary of the Invention

[0005] The purpose of some embodiments of this application is to provide a method, apparatus, storage medium and electronic device for data access. The technical solutions of the embodiments of this application can improve the security and efficiency of data access, and effectively prevent the occurrence of data unauthorized access vulnerabilities.

[0006] In a first aspect, some embodiments of this application provide a data access method, comprising: receiving a service request sent by a client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on a user's real identifier; if the verification result of the client's user identity is successful through the session token and the user virtual identifier, obtaining original service data corresponding to the service data request; processing the original service data to obtain target service data, and sending the target service data to the client.

[0007] Some embodiments of this application send service requests to the client using session tokens and user virtual identifiers, and obtain the original service data after verifying the client's user identity. The original service data is then processed to obtain the target service data, which is sent to the client. This embodiment allows access to service data without exposing the client's real user identifier and user information. Furthermore, by replacing the original service data, secure data transmission is ensured, preventing the exposure of important data information. This improves the security and efficiency of data access while effectively preventing data access violations.

[0008] In some embodiments, the verification result of confirming the user identity of the client through the session token and the user virtual identifier is passed includes: decrypting the session token using a decryption key, obtaining the first user information in the session token after successful decryption; finding the second user information corresponding to the user virtual identifier; if the first user information and the second user information are confirmed to be consistent, then the user identity verification result is passed.

[0009] Some embodiments of this application obtain first user information by decrypting the session token and find second user information by searching through the user's virtual identifier. If the two match, the user's identity verification result can be confirmed as passed, which can realize accurate verification of user identity and improve the security of data access.

[0010] In some embodiments, the method further includes: if it is confirmed that the first user information and the second user information are inconsistent, then the verification result of the user identity is unsuccessful; and sending the verification result to the client.

[0011] Some embodiments of this application can ensure the security of data access by determining that the user's identity is incorrect and notifying the client when the first user information and the second user information are inconsistent.

[0012] In some embodiments, processing the original business data to obtain target business data includes: obtaining a business identifier in the original business data; randomly generating and storing a virtual business identifier corresponding to the business identifier; and replacing the business identifier with the virtual business identifier to obtain the target business data.

[0013] Some embodiments of this application obtain the target business data by replacing the real business identifier in the original business data with a randomly generated virtual business identifier. This can achieve hidden transmission of the replacement of real data, which has high security and effectively prevents unauthorized access to data.

[0014] In some embodiments, before receiving the service request sent by the client, the method further includes: receiving a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, the user identity information including a login name and a password; when confirming that the verification result of the user identity information is successful, encrypting the user identity information using an encryption key to obtain the session token; randomly generating and storing a user virtual identifier corresponding to the user's real identifier; and sending the session token and the user virtual identifier to the client.

[0015] Some embodiments of this application, after verifying the client's login authentication operation, encrypt and replace the user's identity information to obtain a session token and a user virtual identifier, and send them to the client, which can achieve hidden transmission of user identity information and has high security.

[0016] Secondly, some embodiments of this application provide a data access apparatus, comprising: a receiving module configured to receive a service request sent by a client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on a user's real identifier; a confirmation module configured to, if the client's user identity verification result is successful via the session token and the user virtual identifier, obtain original service data corresponding to the service data request; and a sending module configured to process the original service data to obtain target service data and send the target service data to the client.

[0017] In some embodiments, the confirmation module is configured to: decrypt the session token using a decryption key, and obtain the first user information in the session token after successful decryption; search for the second user information corresponding to the user's virtual identifier; if the first user information and the second user information are confirmed to be consistent, the user identity verification result is passed.

[0018] In some embodiments, the confirmation module is configured to: if the first user information and the second user information are confirmed to be inconsistent, then the user identity verification result is failed; and send the verification result to the client.

[0019] In some embodiments, the sending module is configured to: obtain a service identifier in the original service data; randomly generate and store a service virtual identifier corresponding to the service identifier; and replace the service identifier with the service virtual identifier to obtain the target service data.

[0020] In some embodiments, the apparatus further includes an authentication module configured to: receive a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, the user identity information including a login name and a password; when the verification result of the user identity information is successful, encrypt the user identity information using an encryption key to obtain the session token; randomly generate and store a user virtual identifier corresponding to the user's real identifier; and send the session token and the user virtual identifier to the client.

[0021] Thirdly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0022] Fourthly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method as described in any embodiment of the first aspect.

[0023] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 One of the system diagrams for data access provided for some embodiments of this application;

[0026] Figure 2 A second system diagram for data access provided for some embodiments of this application;

[0027] Figure 3 Flowcharts of user authentication methods provided for some embodiments of this application;

[0028] Figure 4 One of the flowcharts for a data access method provided for some embodiments of this application;

[0029] Figure 5A second flowchart illustrating a data access method provided for some embodiments of this application;

[0030] Figure 6 A block diagram of a data access apparatus provided for some embodiments of this application;

[0031] Figure 7 A schematic diagram of an electronic device provided for some embodiments of this application. Detailed Implementation

[0032] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0033] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0034] In related technologies, privilege escalation vulnerabilities arise from flaws in client request permission checks, allowing users to access data belonging to other users with the same or higher privilege roles. Maliciously triggering and exploiting privilege escalation vulnerabilities can disrupt system operation and compromise user data security. Horizontal privilege escalation refers to the ability to manipulate data belonging to other accounts with equivalent privileges through unauthorized operations. If users belong to the same role and have the same permission level, and access to data is only verified by checking if they have the role's permissions without specifying the range of accessible data, then user A can view user B's data.

[0035] In existing technologies, after receiving an operation request at the web layer, the validity of the request needs to be verified before executing the corresponding operation. One verification method is to query whether the resource of the application to be operated belongs to the currently logged-in user, or to query whether other users are allowed to operate on the resource of the application to be operated. Another verification method is for the web layer to pass the logged-in user's information to the SQL (Structured Query Language) level for verification. For example, the user "user" can be added to the original SQL to restrict operations on web application resources.

[0036] However, the first verification method requires the web layer to perform verification on every operation request. As the business system becomes more complex and the data volume grows larger, this method becomes inefficient and cumbersome. Furthermore, the high degree of coupling in the business logic and the need for database queries compromise access efficiency. The second verification method, while not adding extra Java code or database queries, requires an additional user table, increasing SQL complexity. Moreover, a single SQL statement may need to be shared by multiple logic modules; for example, if module A requires authentication while module B does not, the same SQL statement must be rewritten or branches added, making the SQL more difficult to understand and maintain. In addition, this method cannot distinguish between two abnormal operation scenarios: no data or no permission; it can only provide an error message, resulting in a poor user experience.

[0037] In view of this, some embodiments of this application provide a data access method. This method receives a service request carrying a user's session token and user virtual identifier, verifies the user's identity, and obtains the original service data corresponding to the service data request upon successful verification. After processing the service data, the target service data is obtained and sent to the client. Some embodiments of this application covertly transmit the client's user identity information or important real information of the original service data during the data access process. This improves data access efficiency while enhancing data access security, effectively preventing data access privilege escalation vulnerabilities, and has high practicality.

[0038] The following is in conjunction with the appendix Figure 1 The present application provides an exemplary description of the structure of a data access system based on some embodiments thereof.

[0039] like Figure 1 As shown, some embodiments of this application provide a data access system, which includes a client 100 and a server 200. The client 100 and server 200 can communicate bidirectionally. The client 100 can send a service request to the server 200, carrying a session token, a user virtual identifier, and a service data request. After receiving the service data request, the server 200 verifies the user identity of the client 100 using the session token and the user virtual identifier. If the verification is successful, the server 200 obtains the original service data corresponding to the service data request. The server 200 replaces the service identifier in the original service data with the service virtual identifier to obtain the target service data, and then sends it to the client 100.

[0040] like Figure 2As shown, in other embodiments of this application, a data access system is also provided, comprising a client 100, a server 200, and a security gateway 300. During data access, the client 100 and server 200 need to transmit data through the security gateway 300. For example, the client 100 can send a service request to the security gateway 300 carrying a session token, a user virtual identifier, and a service data request. Upon receiving the service data request, the security gateway 300 verifies the user identity of the client 100 using the session token and the user virtual identifier. If the verification is successful, the security gateway 300 forwards the service data request to the server 200. The server 200 then sends the original service data corresponding to the service data request to the security gateway 300. The security gateway 300 replaces the service identifier in the original service data with a service virtual identifier to obtain the target service data, and then sends it to the client 100.

[0041] The data access system provided by the above-described embodiments of this application can replace the real business identifier in the original business data with a hidden transmission, thereby improving the security of data access, increasing efficiency, and effectively preventing the occurrence of data unauthorized access vulnerabilities.

[0042] The following is in conjunction with the appendix Figure 1 Data access systems and attachments Figure 4 The present application provides an exemplary embodiment of the data access process performed by the server 200.

[0043] In some embodiments of this application, before performing the data access method, the server 200 may first authenticate the user identity of the client 100, as detailed in the appendix. Figure 3 , Figure 3 A flowchart of a user authentication method is provided for some embodiments of this application. The specific process of user authentication is as follows:

[0044] S301, Receive a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, including a login name and a password.

[0045] For example, in some embodiments of this application, the client 100 initiates a login authentication operation to the server 200, wherein the login authentication operation includes the user's real ID (Identity document, a specific example of a user's real identification number) and authentication password.

[0046] S302, when the verification result of the user identity information is confirmed to be successful, the user identity information is encrypted using an encryption key to obtain the session token;

[0047] For example, in some embodiments of this application, after the server 200 confirms that the user's real ID and authentication password are correct, it uses an encryption key to encrypt the user's real ID and authentication password to obtain a token (as a specific example of a session token).

[0048] S303, Randomly generate and store a virtual user identifier corresponding to the user's real identifier;

[0049] For example, in some embodiments of this application, the server 200 uses a random algorithm to generate a random temporary user UUID (as a specific example of a user virtual identifier) ​​corresponding to the user's real ID, and caches the mapping relationship between the user's real ID and the user UUID locally on the server 200, so as to achieve the purpose of replacing the user's real ID with the user UUID.

[0050] S304, send the session token and the user virtual identifier to the client.

[0051] For example, in some embodiments of this application, the server 200 can return the user's UUID and token to the client 100. In this case, the page displayed on the client 100 only shows the user's UUID, not the user's real ID.

[0052] In another embodiment of this application, client 100 can send a login authentication operation to an API gateway (as a specific example of security gateway 300). The API gateway forwards the login authentication operation to server 200. After server 200 verifies the login authentication operation, it notifies the API gateway. The API gateway can encrypt the user's identity information using an encryption key to obtain a token and randomly generate a user UUID, which is stored locally on the API gateway. The API gateway returns the user UUID and token to client 100. At this time, only the user UUID is displayed on the client 100's page, not the user's real ID, thus ensuring the secure display of the data.

[0053] Please see the appendix below. Figure 4 , Figure 4 This document provides a flowchart of a data access method according to some embodiments of this application. The implementation process of the data access is illustrated below.

[0054] S410, receive a service request sent by the client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on the user's real identifier.

[0055] For example, in some embodiments of this application, when a user of client 100 needs to access data of server 200, server 200 can receive a business request sent by client 100 carrying a token, user UUID, and business data request.

[0056] S420, if the verification result of the client's user identity is successful through the session token and the user virtual identifier, the original business data corresponding to the business data request is obtained.

[0057] For example, in some embodiments of this application, the server 200 can verify the user identity of the client 100 using a token and the user's UUID, and will only obtain the corresponding original business data when the verification result is successful.

[0058] In some embodiments of this application, S420 may include: decrypting the session token using a decryption key, obtaining the first user information in the session token after successful decryption; searching for the second user information corresponding to the user's virtual identifier; if it is confirmed that the first user information and the second user information are consistent, then the verification result of the user's identity is passed.

[0059] For example, in some embodiments of this application, server 200 decrypts the token using a local decryption key to obtain the first user's real ID. Server 200 then looks up the corresponding second user's real ID stored locally using the user's UUID. If the first user's real ID and the second user's real ID match, it can be confirmed that the user identity of client 100 is the same user as the previously authenticated user, and that the user has data access rights. The encryption and decryption keys used by server 200 can be symmetric keys or asymmetric encryption / decryption keys; this application does not specifically limit their use.

[0060] In some embodiments of this application, the data access method includes: if it is confirmed that the first user information and the second user information are inconsistent, then the verification result of the user identity is unsuccessful; and sending the verification result to the client.

[0061] For example, in some embodiments of this application, if the first user's real ID and the second user's real ID are inconsistent, it can be confirmed that the user identity of the client 100 is not the same user as the previously authenticated user. In this case, there may be a vulnerability of unauthorized access, so it is necessary to inform the client 100 and refuse to access the data.

[0062] S430, the original business data is processed to obtain target business data, and the target business data is sent to the client.

[0063] For example, in some embodiments of this application, the server 200 can replace the original business data to obtain the target business data, thereby achieving secure transmission and display of the target data. For instance, important information in the original business data can be replaced with meaningless identifiers or virtual data to obtain the replaced target business data.

[0064] In some embodiments of this application, S430 may include: obtaining a service identifier in the original service data; randomly generating and storing a virtual service identifier corresponding to the service identifier; and replacing the service identifier with the virtual service identifier to obtain the target service data.

[0065] For example, in some embodiments of this application, server 200 filters out important real business IDs (as a specific example of a business identifier) ​​from the original business data. Then, it uses a random algorithm to randomly generate a corresponding business UUID (as a specific example of a business virtual identifier) ​​for each real business ID, and stores the correspondence between each real business ID and its corresponding business UUID locally on server 200. Finally, it replaces each real business ID with its corresponding business UUID to obtain the target business data, which is then sent to client 100. The business UUID in the target business data received and displayed by client 100 is not the real business ID, thus achieving secure data display and preventing unauthorized access to data.

[0066] The following is in conjunction with the appendix Figure 2 Data access systems and attachments Figure 5 The present application provides an exemplary illustration of the data access interaction process performed by a client 100, a server 200, and a security gateway 300, as described in some embodiments of this application.

[0067] Please see the appendix Figure 5 , Figure 5 A flowchart illustrating a data access method provided for some embodiments of this application.

[0068] The following example, using the scenario of accessing student data, illustrates the data access process provided by some embodiments of this application.

[0069] It should be noted that before executing the following method embodiments, the security gateway 300 and the server 200 have completed the authentication of the user's identity and sent the user's UUID and token to the client 100.

[0070] S510, client 100 sends a service request to security gateway 300, in which the service request carries a session token, user virtual identifier and service data request.

[0071] For example, as a specific example of this application, client 100 sends a list service request (as a specific example of a service request) to the API gateway, wherein the list service request carries a token, a user UUID, and a list data request (as a specific example of a service data request). The API gateway receives the list service request.

[0072] The S520 security gateway 300 verifies the session token and user virtual identifier. After successful verification, it sends the business data request to the server 200.

[0073] For example, as a specific example of this application, the API gateway encrypts the token to obtain the user's real ID, and then looks up the userID using the user's UUID. If the user's real ID and userID are the same, it indicates that authentication of the client (100) is successful. The API gateway forwards the list data request to the server (200). For example, the user's real ID is wang, the user's UUID is a111, and the userID corresponding to a111 is wang.

[0074] S530, server 200 retrieves the original business data corresponding to the business data request.

[0075] For example, as a specific example of this application, server 200 retrieves the corresponding student list data from the database (as a specific example of the original business data). For example, the student list data is shown in Table 1:

[0076] Table 1

[0077] Student ID Name age 1001 Zhang San 12 1002 Li Si 14

[0078] S540, server 200 sends raw business data to security gateway 300.

[0079] For example, as a specific example of this application, the API gateway receives student list data sent by server 200.

[0080] S550, Security Gateway 300 obtains the service identifier from the original service data, randomly generates and stores the service virtual identifier.

[0081] For example, as a specific example of this application, the API gateway filters out student IDs (as a specific example of business identifiers) from the student list data, namely 1001 and 1002 in the student list data. The API gateway randomly generates a temporary student ID a01 (as a specific example of a business virtual identifier) ​​corresponding to student ID 1001, and a temporary student ID a02 (as a specific example of a business virtual identifier) ​​corresponding to student ID 1002.

[0082] S560, the security gateway 300 replaces the service identifier with the service virtual identifier to obtain the target service data.

[0083] For example, as a specific example of this application, the target student list (as a specific example of target business data) is obtained by replacing the student IDs in the student list data, as shown in Table 2:

[0084] Table 2

[0085] Student ID Name age a01 Zhang San 12 a02 Li Si 14

[0086] S570, security gateway 300 sends target service data to client 100.

[0087] For example, as a specific example of this application, client 100 can receive and display a list of target students sent by the API gateway.

[0088] In addition, in some other embodiments of this application, if the client 100 also needs to obtain detailed information about a student (e.g., home address information or transcript information), the client 100 can send a business request to the API gateway 300 carrying a token, user UUID, student temporary ID and detailed student data request. The subsequent processing is similar to the principle of S520 to S570, and will not be described in detail here to avoid repetition.

[0089] As can be seen from the embodiments of this application described above, by replacing the real ID in the response data (as a specific example of the original target data) of all authentication or business requests with a random temporary UUID, the ID value obtained by client 100 for each request to the same business data is different, thus achieving the hiding or replacement of the real ID and protecting sensitive data. Business requests are sent using the user's UUID (the business request carries a token), and token authorization verification is implemented by verifying the token. The user information in the token is obtained, and the corresponding userId and ID information are obtained through the temporary user UUID. The consistency between the user information in the token and the userId is verified to confirm whether the current operation belongs to the same user. These three methods effectively avoid the occurrence of horizontal privilege escalation vulnerabilities. If it is not necessary to replace or hide the real ID, a method without replacement or hiding can be chosen for data access, achieving flexible adjustment and a pluggable effect.

[0090] Please refer to Figure 6 , Figure 6The diagram illustrates a block diagram of a data access apparatus provided in some embodiments of this application. It should be understood that this data access apparatus corresponds to the method embodiments described above and is capable of performing the various steps involved in the method embodiments. The specific functions of this data access apparatus can be found in the description above; detailed descriptions are omitted here to avoid repetition.

[0091] Figure 6 The data access device includes at least one software functional module that can be stored in a memory or embedded in the data access device in the form of software or firmware. The data access device includes: a receiving module 610 configured to receive a service request sent by a client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on the user's real identifier; a confirmation module 620 configured to, if the client's user identity verification result is successful using the session token and the user virtual identifier, obtain the original service data corresponding to the service data request; and a sending module 630 configured to process the original service data to obtain target service data and send the target service data to the client.

[0092] In some embodiments of this application, the verification module 620 is configured to: decrypt the session token using a decryption key, and obtain the first user information in the session token after successful decryption; search for the second user information corresponding to the user's virtual identifier; if the first user information and the second user information are confirmed to be consistent, the verification result of the user's identity is passed.

[0093] In some embodiments of this application, the confirmation module 620 is configured to: if the first user information and the second user information are confirmed to be inconsistent, then the verification result of the user identity is failed; and send the verification result to the client.

[0094] In some embodiments of this application, the sending module 630 is configured to: obtain a service identifier in the original service data; randomly generate and store a service virtual identifier corresponding to the service identifier; and replace the service identifier with the service virtual identifier to obtain the target service data.

[0095] In some embodiments of this application, before the receiving module 610, the data access device further includes: an authentication module (not shown in the figure), configured to: receive a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, the user identity information including a login name and a password; when the verification result of the user identity information is confirmed to be successful, encrypt the user identity information using an encryption key to obtain the session token; randomly generate and store a user virtual identifier corresponding to the user's real identifier; and send the session token and the user virtual identifier to the client.

[0096] Some embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can perform the operation of any of the methods corresponding to the methods provided in the above embodiments.

[0097] Some embodiments of this application also provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the above embodiments provided in the above embodiments.

[0098] like Figure 7 As shown, some embodiments of this application provide an electronic device 700, which includes a memory 710, a processor 720, and a computer program stored in the memory 710 and executable on the processor 720. When the processor 720 reads the program from the memory 710 via a bus 730 and executes the program, it can implement the methods of any of the above embodiments.

[0099] Processor 720 can process digital signals and can include various computing architectures. For example, it can be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 720 can be a microprocessor.

[0100] The memory 710 can be used to store instructions executed by the processor 720 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 720 of this disclosure embodiment can be used to execute the instructions in the memory 710 to implement the methods shown above. The memory 710 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0101] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0102] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0103] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for data access, characterized in that, include: Receive a service request sent by a client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on the user's real identifier; If the verification result of the client's user identity is successful using the session token and the user virtual identifier, the original business data corresponding to the business data request is obtained. The original business data is processed to obtain target business data, and the target business data is sent to the client. The step of verifying the user identity of the client by using the session token and the user virtual identifier is as follows: decrypting the session token using a decryption key, and obtaining the first user information in the session token after successful decryption; finding the second user information corresponding to the user virtual identifier; and if the first user information and the second user information are confirmed to be consistent, then the user identity verification result is passed.

2. The method as described in claim 1, characterized in that, The method further includes: If it is confirmed that the first user information and the second user information are inconsistent, then the user identity verification result is unsuccessful. The verification result is sent to the client.

3. The method as described in claim 1, characterized in that, The process of processing the original business data to obtain the target business data includes: Obtain the business identifier from the original business data; Randomly generate and store a virtual business identifier corresponding to the business identifier; The target business data is obtained by replacing the business identifier with the business virtual identifier.

4. The method as described in claim 1, characterized in that, Before receiving the service request sent by the client, the method further includes: The system receives a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, including a username and a password. When the verification result of the user's identity information is confirmed to be successful, the user's identity information is encrypted using an encryption key to obtain the session token; Randomly generate and store a virtual user identifier corresponding to the user's real identifier; Send the session token and the user virtual identifier to the client.

5. A data access device, characterized in that, The apparatus is used to perform the method as described in claim 1, comprising: The receiving module is configured to receive service requests sent by the client, wherein the service request carries a session token, a user virtual identifier, and a service data request, wherein the user virtual identifier is randomly generated based on the user's real identifier; The confirmation module is configured to, if the verification result of the client's user identity is passed by using the session token and the user virtual identifier, obtain the original business data corresponding to the business data request; The sending module is configured to process the original business data to obtain target business data and send the target business data to the client.

6. The apparatus as claimed in claim 5, characterized in that, The confirmation module is configured as follows: If it is confirmed that the first user information and the second user information are inconsistent, then the user identity verification result is unsuccessful. The verification result is sent to the client.

7. The apparatus as claimed in claim 5, characterized in that, The sending module is configured as follows: Obtain the business identifier from the original business data; Randomly generate and store a virtual business identifier corresponding to the business identifier; The target business data is obtained by replacing the business identifier with the business virtual identifier.

8. The apparatus as claimed in claim 5, characterized in that, The device further includes: an authentication module, configured to: The system receives a login authentication operation sent by the client, wherein the login authentication operation carries user identity information, including a username and a password. When the verification result of the user's identity information is confirmed to be successful, the user's identity information is encrypted using an encryption key to obtain the session token; Randomly generate and store a virtual user identifier corresponding to the user's real identifier; Send the session token and the user virtual identifier to the client.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is executed by a processor to perform the method as described in any one of claims 1-4.

10. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the computer program is executed by the processor to perform the method as described in any one of claims 1-4.

Images