File verification method and related device

Abstract

The application provides a file verification method and related equipment, and relates to the field of data processing.In the application, the second node can send a first request to the first node, and the first request is used to request to access a first file in the first node.The first node can obtain a copy of the first file from a third node that has accessed the first file, and when the access control policy corresponding to the second node in the first access control list included in the first file and the second access control list included in the copy of the first file is the same, and it is determined that the second node has the access right to the first file, the first node returns a first request result of the first request to the second node in response to the first request, the first request result indicates the access right of the second node to the first file or return information that the access to the first file is successful, so that the second node can access the first file in the first node.The application can improve the access control strength of the first file and enhance the security of the first file.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a document verification method and related equipment. Background Technology

[0002] A distributed file system (DFS) is a file system that allows files to be shared across multiple hosts over a network, supporting the sharing of files and storage space between multiple hosts.

[0003] In a distributed file system, each host can be considered a node (or storage node) of the distributed file system. When a node wants to request a file, if the local node owns the file, it can read the file directly from the local node; if the local node does not own the file, it can read the file from other nodes in the distributed file system that own the file through the network. Summary of the Invention

[0004] This application provides a file verification method and related equipment, which can improve the strength of access control over files and enhance file security.

[0005] In a first aspect, this application provides a file verification method applied to a first node. The method includes: receiving a first request from a second node, the first request requesting access to a first file in the first node, the first file including a first access control list; obtaining a copy of the first file from a third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list; the first access control list and the second access control list respectively including access control policies corresponding to the second node; and responding to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, returning a first request result of the first request to the second node, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0006] In this file verification method, the access control policies of the second nodes in the first access control list included in the first file and the second access control list included in the copy of the first file are the same. When it is determined that the second node has access rights to the first file, the first node returns the access result corresponding to the access rights of the second node (i.e., the first request result mentioned above) to the second node. This can improve the access control strength of files (such as the first file) stored in the distributed file system and enhance the security of files stored in the distributed file system.

[0007] Optionally, the method further includes: in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, returning a second request result of the first request to the second node, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0008] Optionally, the method further includes: in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, returning a third request result of the first request to the second node, wherein the third request result indicates that the second node cannot access the first file in the first node.

[0009] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0010] By designating the node with the highest device level or the highest computing power among the multiple nodes that have accessed the first file as the third node, the verification efficiency of the file verification method can be effectively improved by utilizing the more powerful computing resources of the third node.

[0011] When the node whose historical access time to the first file is shortest from the time the first node received the first request is selected as the third node, the control lists in both the first and third nodes are less likely to be tampered with, which can make the file verification method more reliable.

[0012] In one possible implementation, the first file conforms to the first type.

[0013] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0014] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0015] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0016] Optionally, the method further includes: receiving a second request from a second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; and the second file does not conform to a first type. In response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, a fourth request result of the second request is returned to the second node, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, a fifth request result of the second request is returned to the second node, the fifth request result indicating that the second node cannot access the second file in the first node.

[0017] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0018] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0019] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0020] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0021] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0022] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0023] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0024] In this implementation, when the first access control list and the second access control list are the same, the first node can further determine whether the second node has access rights to the first file according to the access control policy corresponding to the second node in the first access control list, and when it is determined that the second node has access rights to the first file, return the access result corresponding to the access rights of the second node to the second node, such as the first request result mentioned above.

[0025] Optionally, after returning the first request result of the first request to the second node, the method further includes: recording the access record of the second node to the first file, wherein the access record of the second node to the first file includes: the identification information of the second node, and the path where the second node stores a copy of the first file.

[0026] Once the first node returns the result of its first request to the second node, it indicates that the second node has successfully accessed the first file in the first node's database. For this access, the first node can maintain an access record in its access log for the first file regarding the second node's access. When other nodes subsequently access the first file, the second node can also act as a third node, providing a copy of the first file to the first node.

[0027] Secondly, this application provides a document verification device that can be applied to an electronic device of a first node (such as a terminal device of the first node) to enable the electronic device to implement the document verification method as described in the first aspect and any possible implementation thereof. The function of this device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps in the document verification method described in the first aspect and any possible implementation thereof.

[0028] For example, the apparatus includes: a transceiver unit and a processing unit; the transceiver unit is configured to receive a first request from a second node, the first request requesting access to a first file in a first node, the first file including a first access control list. The transceiver unit is further configured to obtain a copy of the first file from a third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. The processing unit is configured to, in response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, return a first request result of the first request to the second node through the transceiver unit, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0029] Optionally, the processing unit is further configured to respond to the first request and, when the access control policies corresponding to the second node in the first access control list and the second access control list are different, return a second request result of the first request to the second node through the transceiver unit, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0030] Optionally, the processing unit is further configured to respond to the first request by returning a third request result of the first request to the second node through the transceiver unit when the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file. The third request result indicates that the second node cannot access the first file in the first node.

[0031] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0032] In one possible implementation, the first file conforms to the first type.

[0033] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0034] Optionally, the transceiver unit is further configured to receive a second request from a second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; and the second file does not conform to the first type. The processing unit is further configured to, in response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, return a fourth request result of the second request to the second node through the transceiver unit, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, return a fifth request result of the second request to the second node through the transceiver unit, the fifth request result indicating that the second node cannot access the second file in the first node.

[0035] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0036] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0037] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0038] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0039] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0040] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0041] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0042] Optionally, the processing unit is also configured to record the access records of the second node to the first file. The access records of the second node to the first file include: the identification information of the second node and the path where the second node stores a copy of the first file.

[0043] Thirdly, this application provides an electronic device, such as the terminal device described in the first node above. The electronic device includes: a processor; a memory for storing processor-executable instructions; and when the processor is configured to execute the instructions, causing the electronic device to implement the file verification method as described in the first aspect and any possible implementation thereof.

[0044] Fourthly, this application provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the file verification method as described in the first aspect and any possible implementation thereof.

[0045] Fifthly, this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in an electronic device, the processor in the electronic device implements the file verification method as described in the first aspect and any possible implementation thereof.

[0046] The beneficial effects of the second to fifth aspects mentioned above can be referred to in the first aspect, and will not be repeated here.

[0047] Sixthly, this application provides a file verification method applied to a first node. The method includes: receiving a first request from a second node, the first request requesting access to a first file in the first node, the first file including a first access control list; sending the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node; receiving first information returned by the third node, the first information indicating whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same or different; in response to the first request, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, returning a first request result of the first request to the second node, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0048] Optionally, the method further includes: in response to the first request, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, returning a second request result of the first request to the second node, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0049] Optionally, the method further includes: in response to the first request, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, returning a third request result of the first request to the second node, wherein the third request result indicates that the second node cannot access the first file in the first node.

[0050] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0051] In one possible implementation, the first file conforms to the first type.

[0052] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0053] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0054] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0055] Optionally, the method further includes: receiving a second request from a second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; and the second file does not conform to a first type. In response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, a fourth request result of the second request is returned to the second node, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, a fifth request result of the second request is returned to the second node, the fifth request result indicating that the second node cannot access the second file in the first node.

[0056] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0057] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0058] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0059] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0060] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0061] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0062] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0063] Optionally, after returning the first request result of the first request to the second node, the method further includes: recording the access record of the second node to the first file, wherein the access record of the second node to the first file includes: the identification information of the second node, and the path where the second node stores a copy of the first file.

[0064] The beneficial effects of the sixth aspect can be referred to in the first aspect, and will not be repeated here.

[0065] In a seventh aspect, this application provides a document verification apparatus that can be applied to an electronic device of a first node (such as a terminal device of the first node) to enable the electronic device to implement the document verification method as described in the sixth aspect and any possible implementation thereof. The function of this apparatus can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps in the document verification method described in the sixth aspect and any possible implementation thereof.

[0066] For example, the apparatus includes: a transceiver unit and a processing unit; the transceiver unit is configured to receive a first request from a second node, the first request requesting access to a first file in a first node, the first file including a first access control list. The transceiver unit is further configured to send the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. The transceiver unit is further configured to receive first information returned by the third node, the first information indicating whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same or different. The processing unit is configured to, in response to the first request, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, return a first request result of the first request to the second node through the transceiver unit, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0067] Optionally, the processing unit is further configured to respond to the first request and, when the first information indicates that the access control policies corresponding to the second node in the first access control list and the second access control list are different, return a second request result of the first request to the second node through the transceiver unit, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0068] Optionally, the processing unit is further configured to respond to the first request by, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, returning a third request result of the first request to the second node through the transceiver unit, wherein the third request result indicates that the second node cannot access the first file in the first node.

[0069] Eighthly, this application provides an electronic device, such as the terminal device described in the first node above. The electronic device includes: a processor; a memory for storing processor-executable instructions; and, when the processor is configured to execute the instructions, cause the electronic device to implement the file verification method as described in the sixth aspect and any possible implementation thereof.

[0070] Ninthly, this application provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the file verification method as described in the sixth aspect and any possible implementation thereof.

[0071] In a tenth aspect, this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in an electronic device, the processor in the electronic device implements the file verification method as described in the sixth aspect and any possible implementation thereof.

[0072] The beneficial effects described in aspects seven through ten above can be found in aspect six, and will not be repeated here.

[0073] Eleventhly, this application provides a file verification method, the method being applied to a third node, the third node having accessed a first file in a first node; the first node includes a first file, the first file including a first access control list; the third node includes a copy of the first file, the copy of the first file including a second access control list; the first access control list and the second access control list respectively include access control policies corresponding to the second node; the method includes:

[0074] The system receives a first access control list from a first node; this first access control list is sent by the first node after receiving a first request from a second node; the first request requests access to a first file. It compares the access control policies corresponding to the second nodes in the first and second access control lists to determine if they are identical, obtaining a comparison result. Based on the comparison result, it returns first information to the first node, enabling the first node to return the request result of the first request to the second node based on the first information.

[0075] The first piece of information is used to indicate whether the access control policies corresponding to the second node in the first access control list and the second access control list are the same or different.

[0076] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0077] In one possible implementation, the first file conforms to the first type.

[0078] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0079] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0080] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0081] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0082] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0083] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0084] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0085] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0086] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0087] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0088] The beneficial effects of the eleventh aspect can be referred to in the first aspect, and will not be repeated here.

[0089] In a twelfth aspect, this application provides a document verification apparatus that can be applied to an electronic device of a third node (such as a terminal device of the third node) to enable the electronic device to implement the document verification method as described in the eleventh aspect and any possible implementation thereof. The function of the apparatus can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps in the document verification method described in the eleventh aspect and any possible implementation thereof.

[0090] For example, the apparatus includes: a transceiver unit and a processing unit; the transceiver unit is configured to receive a first access control list from a first node; the first access control list is sent by the first node after receiving a first request from a second node; the first request is used to request access to a first file. The processing unit is configured to compare whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and obtain a comparison result. The processing unit is further configured to return first information to the first node through the transceiver unit based on the comparison result, so that the first node returns the request result of the first request to the second node based on the first information.

[0091] The first piece of information is used to indicate whether the access control policies corresponding to the second node in the first access control list and the second access control list are the same or different.

[0092] In a thirteenth aspect, this application provides an electronic device, such that the electronic device can be the terminal device of the third node described above. The electronic device includes: a processor; a memory for storing processor-executable instructions; the processor is configured to, when executing the instructions, cause the electronic device to implement the file verification method as described in the eleventh aspect and any possible implementation thereof.

[0093] In a fourteenth aspect, this application provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the file verification method as described in the eleventh aspect and any possible implementation thereof.

[0094] In a fifteenth aspect, this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in an electronic device, a processor in the electronic device implements the file verification method as described in the eleventh aspect and any possible implementation thereof.

[0095] The beneficial effects described in aspects 12 through 15 above can be found in aspect 11, and will not be repeated here.

[0096] In a sixteenth aspect, this application provides a file verification method applied to a first node. The method includes: receiving a first request from a second node, the first request requesting access to a first file in the first node, the first file including a first access control list; sending the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. Receiving second information returned by the third node, the second information indicating that the access control policies corresponding to the second nodes in the first and second access control lists are the same and the second node has access to the first file, or indicating that the access control policies corresponding to the second nodes in the first and second access control lists are different, or indicating that the access control policies corresponding to the second nodes in the first and second access control lists are the same and the second node does not have access to the first file; and returning a request result of the first request to the second node based on the second information.

[0097] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0098] In one possible implementation, the first file conforms to the first type.

[0099] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0100] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0101] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0102] Optionally, the method further includes: receiving a second request from a second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; and the second file does not conform to a first type. In response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, a fourth request result of the second request is returned to the second node, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, a fifth request result of the second request is returned to the second node, the fifth request result indicating that the second node cannot access the second file in the first node.

[0103] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0104] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0105] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0106] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0107] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0108] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0109] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0110] Optionally, after returning the first request result of the first request to the second node, the method further includes: recording the access record of the second node to the first file, wherein the access record of the second node to the first file includes: the identification information of the second node, and the path where the second node stores a copy of the first file.

[0111] The beneficial effects of the sixteenth aspect can be referred to in the first aspect, and will not be repeated here.

[0112] In a seventeenth aspect, this application provides a document verification apparatus that can be applied to an electronic device of a first node (such as a terminal device of the first node) to enable the electronic device to implement the document verification method as described in the sixteenth aspect and any possible implementation thereof. The functionality of the apparatus can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps in the document verification method described in the sixteenth aspect and any possible implementation thereof.

[0113] For example, the apparatus includes: a transceiver unit and a processing unit; the transceiver unit is configured to receive a first request from a second node, the first request requesting access to a first file in a first node, the first file including a first access control list. The transceiver unit is further configured to send the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. The transceiver unit is further configured to receive second information returned by the third node, the second information indicating that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same and the second node has access to the first file, or indicating that the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, or indicating that the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same and the second node does not have access to the first file. The processing unit is configured to return the request result of the first request to the second node through the transceiver unit according to the second information.

[0114] In an eighteenth aspect, this application provides an electronic device, such as the terminal device of the first node described above. The electronic device includes: a processor; a memory for storing processor-executable instructions; and when the processor is configured to execute the instructions, causing the electronic device to implement the file verification method as described in the sixteenth aspect and any possible implementation thereof.

[0115] In a nineteenth aspect, this application provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the document verification method as described in the sixteenth aspect and any possible implementation thereof.

[0116] In a twentieth aspect, this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in an electronic device, a processor in the electronic device implements the file verification method as described in the sixteenth aspect and any possible implementation thereof.

[0117] The beneficial effects described in aspects seventeen through twentieth above can be found in aspect sixteen, and will not be repeated here.

[0118] In a twentieth aspect, this application provides a file verification method, the method being applied to a third node, the third node having accessed a first file in a first node; the first node includes the first file, the first file including a first access control list; the third node includes a copy of the first file, the copy of the first file including a second access control list; the first access control list and the second access control list respectively include access control policies corresponding to the second node; the method includes:

[0119] The system receives a first access control list from a first node; this first access control list is sent by the first node after receiving a first request from a second node; the first request requests access to a first file. It compares the access control policies corresponding to the second nodes in the first and second access control lists to determine if they are the same, and then determines whether the second node has access rights to the first file, obtaining second information. The system returns the second information to the first node, enabling the first node to return the result of the first request to the second node based on the second information.

[0120] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0121] In one possible implementation, the first file conforms to the first type.

[0122] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0123] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0124] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0125] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0126] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0127] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0128] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0129] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0130] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0131] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0132] The beneficial effects of aspect 21 can be referred to in aspect 1, and will not be repeated here.

[0133] In a twentieth aspect, this application provides a document verification apparatus that can be applied to an electronic device of a third node (such as a terminal device of a third node) to enable the electronic device to implement the document verification method as described in aspect twenty-one and any possible implementation thereof. The functionality of this apparatus can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps in the document verification method described in aspect twenty-one and any possible implementation thereof.

[0134] For example, the apparatus includes: a transceiver unit and a processing unit; the transceiver unit is configured to receive a first access control list from a first node; the first access control list is sent by the first node after receiving a first request from a second node; the first request is used to request access to a first file. The processing unit is configured to compare whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and determine whether the second node has access rights to the first file, thereby obtaining second information. The transceiver unit is further configured to return the second information to the first node, so that the first node returns the request result of the first request to the second node based on the second information.

[0135] In a twentieth aspect, this application provides an electronic device, such as the terminal device described in the first node above. The electronic device includes: a processor; a memory for storing processor-executable instructions; and, when the processor is configured to execute the instructions, cause the electronic device to implement the file verification method as described in the twentieth aspect and any possible implementation thereof.

[0136] In a twentieth aspect, this application provides a computer-readable storage medium having computer program instructions stored thereon; when the computer program instructions are executed by an electronic device, the electronic device causes the electronic device to implement the document verification method as described in the twentieth aspect and any possible implementation thereof.

[0137] In a twentieth aspect, this application provides a computer program product including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in an electronic device, the processor in the electronic device implements the file verification method as described in the twentieth aspect and any possible implementation thereof.

[0138] The beneficial effects of aspects 22 to 25 mentioned above can be referred to in aspect 21, and will not be repeated here.

[0139] In a twentieth aspect, this application provides a distributed file system, comprising: a first node, a second node, and a third node. The first node includes a first file. The second node sends a first request to the first node, the first request requesting access to the first file, the first file including a first access control list. The first node obtains a copy of the first file from the third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. In response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and both determine that the second node has access rights to the first file, the first node returns a first request result to the second node, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0140] Optionally, in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, the first node returns the second request result of the first request to the second node, and the second request result indicates that the second node cannot access the first file in the first node.

[0141] Optionally, in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, the first node returns a third request result of the first request to the second node, the third request result indicating that the second node cannot access the first file in the first node.

[0142] The beneficial effects of the twenty-sixth aspect can be referred to in the first aspect, and will not be repeated here.

[0143] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0144] Figure 1 A schematic diagram illustrating the composition of the distributed file system provided in this application embodiment;

[0145] Figure 2 This is a schematic diagram of the node structure provided in an embodiment of this application;

[0146] Figure 3 A flowchart illustrating the document verification method provided in this application embodiment;

[0147] Figure 4 A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0148] Figure 5 Another flowchart illustrating the document verification method provided in this application embodiment;

[0149] Figure 6 Another flowchart illustrating the document verification method provided in this application embodiment;

[0150] Figure 7 Another flowchart illustrating the document verification method provided in this application embodiment;

[0151] Figure 8 Another flowchart illustrating the document verification method provided in this application embodiment;

[0152] Figure 9 This is a schematic diagram of the structure of the document verification device provided in the embodiments of this application;

[0153] Figure 10 Another structural schematic diagram of the document verification device provided in the embodiments of this application;

[0154] Figure 11 Another schematic diagram of the document verification device provided in the embodiments of this application;

[0155] Figure 12 Another schematic diagram of the document verification device provided in the embodiments of this application;

[0156] Figure 13 This is another schematic diagram of the document verification device provided in the embodiments of this application. Detailed Implementation

[0157] The terminology used in the following embodiments is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to also include expressions such as “one or more,” unless the context clearly indicates otherwise. It should also be understood that in the following embodiments of this application, “at least one” and “one or more” refer to one or more (including two). The character “ / ” generally indicates that the preceding and following objects are in an “or” relationship.

[0158] References to "one embodiment" or "some embodiments" as used in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized. The term "connection" includes both direct and indirect connections, unless otherwise stated.

[0159] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0160] In the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0161] A distributed file system (DFS) is a file system that allows files to be shared across multiple hosts over a network, supporting the sharing of files and storage space between multiple hosts.

[0162] In some embodiments, the host in the distributed file system may include one or more devices such as terminal devices, servers, or virtual machines (VMs). Terminal devices may include mobile phones, tablets, smart TVs, routers, in-vehicle systems, watches, desktop computers, laptops, handheld computers, laptops, ultra-mobile personal computers (UMPCs), netbooks, as well as cellular phones, personal digital assistants (PDAs), augmented reality (AR) / virtual reality (VR) devices, etc. The embodiments of this application do not impose special limitations on the specific form of the terminal devices.

[0163] For example, in one possible implementation scenario, devices such as mobile phones, tablets, smart TVs, routers, in-vehicle systems, and watches can form a distributed file system. Each device can act as a host in the distributed file system, and different devices can share files and storage space. For instance, a mobile phone can access files on a tablet, and a smart TV can access files on a mobile phone.

[0164] In a distributed file system, each host can be considered a node (or storage node) of the distributed file system. When a node requests access to a file, if the node owns the file locally, it can access the file directly from its local machine; if the node does not own the file locally, it can access the file from other nodes in the distributed file system that own the file via the network.

[0165] This application provides a file verification method that can be applied to the aforementioned distributed file system. In this method, each file stored on each node of the distributed file system may include an access control list (ACL) corresponding to that file. Each ACL may include one or more access control policies (or access control rules). The access control policies in the ACL are used to determine access permissions to the file.

[0166] Taking the first node in a distributed file system, which includes the first file, as an example, the first file may include a first access control list. When a second node in the distributed file system requests access to the first file in the first node, the first node can obtain a copy of the first file from a third node that has accessed the first file. The copy of the first file may include a second access control list. The first access control list and the second access control list may each include the access control policy corresponding to the second node. The first node can compare whether the access control policies corresponding to the second node in the first access control list and the second access control list are the same (or consistent).

[0167] When the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, the first node can determine whether the second node has permission to access the first file (i.e., whether it has access rights to the first file) based on the access control policy corresponding to the second node in the first access control list, and return the corresponding access result to the second node.

[0168] When the access control policies corresponding to the second nodes in the first and second access control lists are different, the first node can directly return an access denied result to the second node. The copy of the first file is obtained by the third node from the first node when it accesses the first file.

[0169] This method can improve the access control strength of files stored in a distributed file system and enhance the security of files stored in the distributed file system.

[0170] The document verification method provided in this application will be illustrated below with specific examples.

[0171] For example, Figure 1 This is a schematic diagram illustrating the composition of the distributed file system provided in an embodiment of this application. Figure 1 As shown, a distributed file system can include N nodes: node 1, node 2, ..., node N, where N is an integer greater than or equal to 3. Any two nodes among these N nodes can establish a connection via a wired or wireless network.

[0172] Figure 1 In the distributed file system shown, each file stored on each node can include an access control list corresponding to that file. Each access control list can include one or more access control policies. The access control policies in the access control list are used to determine access permissions for that file.

[0173] The document verification method provided in this application embodiment can be applied to... Figure 1The distributed file system shown. The first node mentioned in this method can be... Figure 1 The second node can be any one of the N nodes shown. The third node is any node other than the first node. The third node is any node among the other nodes besides the first and second nodes that has accessed the first file on the first node.

[0174] Optionally, when establishing a wireless connection between two nodes, the wireless communication protocol used can be Wi-Fi, Bluetooth, ZigBee, Near Field Communication (NFC), various cellular network protocols, etc., without specific restrictions.

[0175] For example, taking a mobile phone as an example of a node in a distributed file system, Figure 2 This is a schematic diagram of the node structure provided in an embodiment of this application. For example... Figure 2 As shown, the node may include: processor 210, external memory interface 220, internal memory 221, universal serial bus (USB) interface 230, charging management module 240, power management module 241, battery 242, antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, audio module 270, speaker 270A, receiver 270B, microphone 270C, headphone jack 270D, sensor module 280, button 290, motor 291, indicator 292, camera 293, display screen 294, and subscriber identification module (SIM) card interface 295, etc.

[0176] Processor 210 may include one or more processing units, such as application processor (AP), modem processor, graphics processing unit (GPU), image signal processor (ISP), controller, memory, video codec, digital signal processor (DSP), baseband processor, and / or neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0177] The controller can serve as the nerve center and command center of an electronic device. Based on the instruction opcode and timing signals, the controller generates operation control signals to control the fetching and execution of instructions.

[0178] The processor 210 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 210 is a cache memory. This memory can store instructions or data that the processor 210 has just used or that are being used repeatedly.

[0179] In some embodiments, the processor 210 may include one or more interfaces. Interfaces may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0180] It is understood that the interface connection relationships between the modules illustrated in this embodiment are merely illustrative and do not constitute a structural limitation on the nodes. In other embodiments, nodes may also adopt different interface connection methods or combinations of multiple interface connection methods as described in the above embodiments.

[0181] The charging management module 240 receives charging input from the charger. While charging the battery 242, the charging management module 240 can also supply power to the electronic device through the power management module 241.

[0182] The power management module 241 connects the battery 242, the charging management module 240, and the processor 210. The power management module 241 receives input from the battery 242 and / or the charging management module 240, providing power to the processor 210, internal memory 221, external memory, display screen 294, camera 293, and wireless communication module 260. The power management module 241 can also monitor parameters such as battery capacity, battery cycle count, and battery health status (leakage current, impedance). In some other embodiments, the power management module 241 may also be located within the processor 210. In other embodiments, the power management module 241 and the charging management module 240 may be housed in the same device.

[0183] The wireless communication function of electronic devices can be realized through antenna 1, antenna 2, mobile communication module 250, wireless communication module 260, modem processor and baseband processor, etc.

[0184] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. The mobile communication module 250 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G at nodes. The mobile communication module 250 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 250 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation. The mobile communication module 250 can also amplify the signal modulated by the modem processor and convert it into electromagnetic waves for radiation via antenna 1. In some embodiments, at least some functional modules of the mobile communication module 250 may be housed in the processor 210. In some embodiments, at least some functional modules of the mobile communication module 250 and at least some modules of the processor 210 may be housed in the same device.

[0185] The modem processor may include a modulator and a demodulator. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 210 and may be housed in the same device as the mobile communication module 250 or other functional modules.

[0186] The wireless communication module 260 can provide solutions for wireless communication applications on nodes, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies. The wireless communication module 260 can be one or more devices integrating at least one communication processing module. The wireless communication module 260 receives electromagnetic waves via antenna 2, performs frequency modulation and filtering of the electromagnetic wave signals, and sends the processed signal to processor 210. The wireless communication module 260 can also receive signals to be transmitted from processor 210, perform frequency modulation and amplification, and convert them into electromagnetic waves for radiation via antenna 2.

[0187] In some embodiments, antenna 1 of the node is coupled to mobile communication module 250, and antenna 2 is coupled to wireless communication module 260, enabling the node to communicate with the network and other nodes via wireless communication technology. The wireless communication technology may include Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Time-Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technologies. The GNSS may include Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), BeiDou Navigation Satellite System (BDS), Quasi-Zenith Satellite System (QZSS), and / or Satellite Based Augmentation Systems (SBAS). For example, in this embodiment, the first node can use the wireless communication module 260 to establish a wireless connection with the second node, the third node, etc., through wireless communication technology. Based on the established wireless connection, the first node can send information or messages to the second node, the third node, etc., and can also receive information or messages from the second node, the third node, etc.

[0188] The node enables display functionality through a GPU, display screen 294, and application processor. The GPU is a microprocessor for image processing, connecting the display screen 294 and the application processor. The processor 210 may include one or more GPUs, which execute program instructions to generate or modify display information.

[0189] Display screen 294 is used to display images, videos, etc. Display screen 294 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), a Miniled LED, a MicroLED, a Micro-OLED, a quantum dot light-emitting diode (QLED), etc. In some embodiments, a node may include one or N displays 294, where N is a positive integer greater than 1.

[0190] The node can implement shooting functions through an ISP, camera 293, video codec, GPU, display 294, and application processor. The ISP is used to process data fed back from the camera 293. In some embodiments, the ISP can be located within the camera 293. The camera 293 is used to capture still images or video. In some embodiments, the node can include one or N cameras 293, where N is a positive integer greater than 1. The video codec is used to compress or decompress digital video. The electronic device can support one or more video codecs.

[0191] The external storage interface 220 can be used to connect an external storage card, such as a Micro SD card, to expand the storage capacity of the node. The external storage card communicates with the processor 210 through the external storage interface 220 to perform data storage functions. For example, music, video, and other files can be saved on the external storage card.

[0192] Internal memory 221 can be used to store computer executable program code, which includes instructions. Processor 210 executes various functional applications and data processing of the node by running the instructions stored in internal memory 221. For example, in this embodiment, processor 210 can establish a connection with other nodes and interact with other nodes by executing the instructions stored in internal memory 221 through wireless communication module 260. Internal memory 221 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device (such as audio data, phone book, etc.). In addition, internal memory 221 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0193] The node can implement audio functions such as making calls, playing music, and recording through an audio module 270, a speaker 270A, a receiver 270B, a microphone 270C, a headphone jack 270D, and an application processor.

[0194] The sensor module 280 may include a pressure sensor 280A, a gyroscope sensor 280B, a barometric pressure sensor 280C, a magnetic sensor 280D, an accelerometer sensor 280E, a distance sensor 280F, a proximity light sensor 280G, a fingerprint sensor 280H, a temperature sensor 280J, a touch sensor 280K, an ambient light sensor 280L, a bone conduction sensor 280M, etc.

[0195] Understandable Figure 2 The structure of the nodes shown does not constitute a specific limitation on the nodes. In other embodiments, when the nodes in the distributed file system are servers or virtual machines, tablets, smart TVs, routers, in-vehicle systems, watches, desktop computers, laptops, handheld computers, notebook computers, supermobile personal computers, netbooks, and other devices such as cellular phones, personal digital assistants, augmented reality / virtual reality devices, the nodes may include more than Figure 2 This may involve more or fewer components, or combining certain components, or splitting certain components, or different component arrangements. Figure 2 The components shown can be implemented in hardware, software, or a combination of both. This application does not limit the specific structure of nodes in a distributed file system.

[0196] Alternatively, the operating system of the nodes in the distributed file system can be HarmonyOS.TM (harmony) system, Android TM (Android) system, iOS TM System, Windows TM System, Mac TM System, Linux TM System, EMUI TM AndroidWear TM System, Lite OS TM Tizen TM System, watchOS TM Systems, etc. Alternatively, some nodes may not have an operating system; neither is restricted here.

[0197] For example, consider a distributed file system where the first node contains a first file, and the second node requests access to the first file in the first node. Figure 3 This is a flowchart illustrating the document verification method provided in an embodiment of this application. Figure 3 As shown, the method may include:

[0198] S301. The second node sends a first request to the first node. The first request is used to request access to the first file, which includes a first access control list.

[0199] Optionally, the first request may include identification information of the first file, such as the file name and file path of the first file.

[0200] The first access control list may include one or more access control policies. For example, the access control policy may be the access control policy corresponding to the second node.

[0201] Accordingly, the first node receives the first request from the second node.

[0202] For example, the first file can be an image, document, video file, music file, etc., or it can be a folder or access page, etc. This application does not limit the specific type of the first file.

[0203] S302, The first node obtains a copy of the first file from the third node, and the copy of the first file includes the second access control list.

[0204] In this context, the third node is the node that previously accessed the first file, and the copy of the first file is obtained by the third node from the first node when accessing the first file. It should be understood that "previously" here can refer to before the first node received the aforementioned first request, that is, before the first node received the request from the second node to access the first file.

[0205] For example, when a third node accesses the first file in the first node, it can obtain a copy of the first file from the first node and save it. For instance, the first node can copy the first file to create a copy of the first file and send the copy of the first file to the third node.

[0206] In this embodiment of the application, each file stored on each node in the distributed file system may include an access control list (ACL) corresponding to that file (such as the first file). When other nodes copy the file, the resulting copy of that file may also include the ACL corresponding to that file. For example, a copy of the first file generated by a third node may also include the ACL from the first file. To distinguish it, the ACL in the copy of the first file can be called the second ACL. The second ACL may also include one or more access control policies, such as the access control policy corresponding to the second node.

[0207] In some embodiments, the access control list corresponding to each file stored on each node of the distributed file system may be stored in the extended attributes of the file's inode. The file's inode stores file-related metadata, such as the file's byte count, the file owner's identifier, and the file's timestamp.

[0208] For example, taking the first file mentioned above, the first access control list can be stored in the extended attributes of the first file's inode. Taking the first node's operating system as Linux as an example, the extended attribute of the first file's inode could be "system.posix_acl_access". The first node can configure the access control policy of the first file by calling the "setacl()" method, and convert the access control policy into an extended attribute stored in the "system.posix_acl_access" extended attribute of the first file's inode by calling the "setxattr()" method. When the first node receives the first request from the second node, the first node can obtain the access control policy of the first file by calling the "getacl()" method, and convert the extended attribute stored in the first file's inode into a specific access control policy by calling the "getxattr()" method.

[0209] In one possible implementation, the copy of the first file can be generated by copying the complete first file when the third node accesses it. That is, the copy of the first file includes all the information in the first file, such as: the attributes of the first file, the extended attributes of the first file, and the content of the first file.

[0210] Alternatively, in another possible implementation, the copy of the first file can be generated by copying the portion of the first file containing the first control list when the third node accesses the first file. That is, the copy of the first file can only include the portion containing the first control list. For example, the aforementioned portion containing the first control list can be an extended attribute of the inode of the first file.

[0211] Alternatively, in another possible implementation, the copy of the first file can be generated by copying the first control list in the first file when the third node accesses the first file. That is, the copy of the first file can only include the first control list (referred to as the second control list in the copy of the first file).

[0212] Optionally, in this embodiment of the application, each node in the distributed file system can maintain an access record for each stored file. The access record for each file records the identification information (such as device name, device number, etc.) of other nodes that have accessed the file, as well as the paths where other nodes store copies of the file. For example, when a third node accesses the first file in the first node, the first node can add a new record in the access record for the first file regarding the third node's access to the first file. This access record records the identification information of the third node and the path where the third node stores a copy of the first file.

[0213] For example, in one possible implementation, the data structure for the access records maintained by each node in the distributed file system for each stored file can be as follows:

[0214]

[0215] Here, "struct access_list" represents the access records; "unsigned int a_count" represents the number of access records; "struct access_list_entry*a_entries" is used to mark specific access records; "intdevice_id" represents the device identification information of the node, used to identify the device that has accessed the file; and "char*path_name" represents the path on the node (device) identified by "int device_id" to store a copy of the file.

[0216] In S302 above, when the first node obtains a copy of the first file from the third node, it can obtain the copy of the first file from the third node by querying the access record of the first file, based on the identification information of the third node and the path where the third node stores the copy of the first file.

[0217] S303. The first node determines the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list.

[0218] In S303, after the first node obtains a copy of the first file from the third node, it can compare whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same. For example, the access control policy corresponding to the second node in the first access control list can be called the first access control policy, and the access control policy corresponding to the second node in the second access control list can be called the second access control policy. The first node can compare whether the first access control policy and the second access control policy are the same.

[0219] When the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, the first node can further determine whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the first access control list.

[0220] In one possible implementation, an access control policy can be defined as "<tag,perm,id> The "perm" option indicates that "tag" represents the type of the object corresponding to "id", and "perm" represents the access permissions granted to the object corresponding to "id". The object corresponding to "id" can be a specified user or a specified user group, and "id" is the identification information of the specified user (such as uid) or the identification information of the specified user group (such as gid). For example, the specified user can be an application running on the second node, or the specified user group can be a type of application running on the second node. "perm" can include the following three types of access permissions: "read (abbreviated as r)", "write (abbreviated as w)", and "execute (abbreviated as x)". In the first access control list above, the access permissions ("perm") of the object corresponding to "id" in each access control policy can be represented as a combination of the aforementioned three types: "r", "w", and "x".

[0221] Optionally, the access control policy corresponding to the second node may include an access control policy in which "id" is the identification information of the second node or the identification information of the application running on the second node.

[0222] For example, the "perm" in a possible access control policy could be: "rwxr--r--", where "-" indicates no corresponding access permission, "rwx" indicates that the owner of the first file has access permissions to the first file including "read", "write", and "execute", the first "r--" indicates that users in the same group as the owner of the first file have access permissions to the first file including "read", and the second "r--" indicates that other users or groups have access permissions to the first file including "read".

[0223] As described above, the first node can determine whether the second node has access to the first file based on the access control policy corresponding to the second node in the first access control list. For example, when the second node's access to the first file includes at least one of "read", "write", and "execute", the first node can determine that the second node has access to the first file.

[0224] In one possible implementation scenario, the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and the second nodes have access permissions to the first file. In this scenario, when the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and the second nodes have access permissions to the first file, the first node can determine that the request result of the first request is the access result corresponding to the access permissions possessed by the second node. This access result can be referred to as the first request result. The first request result can indicate the second node's access permissions to the first file or return information indicating successful access to the first file, enabling the second node to access the first file in the first node. For example, the return information indicating successful access to the first file by the second node can include one or more of the following: context information of the first file, handle information of the first file, etc., without limitation.

[0225] For example, if the second node's access permissions to the first file only include "read", then the result of the first request can include the first file that only allows read operations; if the second node's access permissions to the first file include both "read" and "write", then the result of the first request can include the first file that allows both read and write operations, and so on.

[0226] In another possible implementation scenario, the access control policies corresponding to the second nodes included in the first and second access control lists are different. In this scenario, when the access control policies corresponding to the second nodes included in the first and second access control lists are different, the first node can directly determine that the request result of the first request is to deny the second node access to the first file. This request result can be called the second request result. The second request result can indicate that the second node cannot access the first file in the first node. For example, the second request result can be an access denied or access failed message. The second request result is also the aforementioned access denied result.

[0227] For example, the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different. This can include: the content of the access control policy corresponding to the second node in the first access control list is not completely the same as the content of the access control policy corresponding to the second node in the second access control list. For example, the access control policy corresponding to the second node in the first access control list gives the second node's access permission to the first file as "read", but the access control policy corresponding to the second node in the second access control list gives the second node's access permission to the first file as both "read" and "write". This indicates that the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different. When the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different, regardless of whether the second node has access permission to the first file, the first node can determine that the request result of the first request is the aforementioned second request result.

[0228] Optionally, when the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different, the first node may no longer need to determine whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the first access control list.

[0229] In another possible implementation scenario, the access control policies corresponding to the second nodes included in the first and second access control lists are the same, and the second nodes do not have access permissions to the first file. In this scenario, when the access control policies corresponding to the second nodes included in the first and second access control lists are the same, and the second nodes do not have access permissions to the first file, the first node can determine that the request result of the first request is also to deny the second node access to the first file. This request result can be called the third request result. The third request result can indicate that the second node cannot access the first file in the first node. For example, the third request result can also be a message of denied access or access failure. Optionally, the third request result can be the same as or different from the second request result.

[0230] For example, the second node not having access permissions to the first file may include: the second node not having "read" and "write" permissions to the first file, nor having "execute" permissions to the first file.

[0231] As described above, in S303, the first node can determine the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list. The request result of the first request can include any one of the following three: the first request result, the second request result, and the third request result. After determining the request result of the first request, the first node can respond to the first request by sending the request result of the first request to the second node. For example, S304 can be executed.

[0232] S304. In response to the first request, the first node returns the request result of the first request to the second node.

[0233] Understandably, in S304, the request result of the first request returned by the first node to the second node can be any one of the first request result, the second request result, and the third request result.

[0234] When the first node returns the result of the first request to the second node, the second node can access the first file according to its access permissions, such as reading or writing the file. When the first node returns the result of the second request to the second node, the second node cannot access the first file regardless of whether it has access permissions.

[0235] In the file verification method provided in this application embodiment, the access control policies corresponding to the second nodes in the first access control list included in the first file and the second access control list included in the copy of the first file are the same. When it is determined that the second node has access rights to the first file, the access result (i.e. the first request result mentioned above) corresponding to the access rights of the second node is returned to the second node. This can improve the access control strength of files (such as the first file) stored in the distributed file system and enhance the security of files stored in the distributed file system.

[0236] For example, in some possible scenarios, the first file or the first access control list included in the first file may be tampered with by an attacker. This method, by introducing a third node as a third-party cross-verification node, can ensure the confidentiality of the first file and prevent unauthorized nodes from intentionally or unintentionally revealing its contents. Distributed file systems can effectively improve file security by applying the file verification method provided in this application.

[0237] For example, Figure 4 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 4 As shown, in one possible application scenario, the distributed file system may include: a Network Attached Storage (NAS) server 410, a mobile phone 420, a computer 430, and a television 440. Any two devices among the NAS server 410, mobile phone 420, computer 430, and television 440 can be connected via a wired or wireless network.

[0238] The network attached storage server 410, mobile phone 420, computer 430, and television 440 can form a distributed file system. Each device can act as a host (i.e., a node) in the distributed file system, and different devices can share files and storage space. For example, mobile phone 420 can access files stored on network attached storage server 410, computer 430, and television 440, and computer 430 can access files stored on network attached storage server 410, mobile phone 420, and television 440, etc.

[0239] In one possible implementation, the network attached storage server 410 can be the first node described in the foregoing embodiments, and the first file stored in the network attached storage server 410 can be a photo. The mobile phone 420 can be the second node described in the foregoing embodiments, and the computer 430 or television 440 can be the third node described in the foregoing embodiments.

[0240] For example, a mobile phone 420 can run an application that allows the user to open a first file within the application's interface. In response to this action, the mobile phone 420 can retrieve and open the first file.

[0241] When the first file is stored locally on the phone 420, the phone 420 can directly open the first file.

[0242] When the first file is not locally located on mobile phone 420, mobile phone 420 can send a first request to network attached storage server 410 to request access to the first file. After receiving the first file, network attached storage server 410 can obtain a copy of the first file from computer 430 or television 440. Network attached storage server 410 can compare the access control policy corresponding to mobile phone 420 in the first access control list included in the first file with the access control policy corresponding to mobile phone 420 in the second access control list included in the copy of the first file. When the access control policy corresponding to mobile phone 420 in the first access control list is the same as the access control policy corresponding to mobile phone 420 in the second access control list, network attached storage server 410 can determine whether mobile phone 420 has access rights to the first file based on the access control policy corresponding to mobile phone 420 in the first access control list. If mobile phone 420 has access rights to the first file, the first request result can be returned to mobile phone 420. The first request result can indicate the access rights of mobile phone 420 to the first file or return information indicating successful access to the first file, so that mobile phone 420 can access the first file in network attached storage server 410. When mobile phone 420 does not have access to the first file, or when the access control policy corresponding to mobile phone 420 in the first access control list is different from the access control policy corresponding to mobile phone 420 in the second access control list, network attached storage server 410 can return a second request result or a third request result to mobile phone 420. Both the second request result and the third request result can indicate that mobile phone 420 cannot access the first file in network attached storage server 410.

[0243] In this example, the first file or the first access control list included in the first file may be tampered with by an attacker. This method introduces a computer 430 or a television 440 as a third-party cross-verification node. The access control policy corresponding to the mobile phone 420 in the first access control list included in the first file is the same as the access control policy corresponding to the mobile phone 420 in the second access control list included in the copy of the first file. When the network attached storage server 410 determines that the mobile phone 420 has access to the first file based on the access control policy corresponding to the mobile phone 420 in the first access control list, it returns the first request result to the mobile phone 420. This can improve the access control strength of the first file, enhance the security of the first file, and prevent unauthorized nodes from intentionally or unintentionally revealing the contents of the first file.

[0244] The above Figure 4The examples given are merely one possible implementation scenario for a distributed file system. Other possible scenarios include multi-device collaboration involving at least three terminal devices. For example, multiple (e.g., at least three) terminal devices such as mobile phones, tablets, personal computers (PCs), and smart home devices (e.g., televisions) can collaborate. This scenario is called a multi-device collaboration scenario. In a multi-device collaboration scenario, a user can have multiple collaborative devices, such as terminal device 1, terminal device 2, terminal device 3, etc. Terminal device 1 can include a first file, and terminal device 1 can be the first node described in the preceding embodiments. Terminal device 2 can be the second node described in the preceding embodiments, and terminal device 3 can be the third node described in the preceding embodiments, etc. This application does not limit the specific implementation scenario of the distributed file system.

[0245] Optionally, the first node, the second node, and the third node described in the embodiments of this application may belong to the same distributed file system or the same local area network.

[0246] It should be understood that in this application, any node in the distributed file system can serve as the first node. For example, when node 1 requests access to the first file in node 2, node 2 is the first node described in the foregoing embodiments, and node 1 is the second node described in the foregoing embodiments. Alternatively, when node 2 requests access to the first file in node 1, node 1 is the first node described in the foregoing embodiments, and node 2 is the second node described in the foregoing embodiments.

[0247] In some embodiments, this application can add a security module using the Linux Security Module (LSM) framework in the kernel of the operating system of each node in the distributed file system. When this node is the first node, the functions of the first node described in the foregoing embodiments can be implemented through this security module. LSM is a lightweight, general-purpose access control framework for the Linux kernel, which allows various security access control models to be implemented as loadable Linux kernel modules. Users can choose the appropriate security module to load into the Linux kernel according to their needs, thereby greatly improving the flexibility and ease of use of the Linux security access control mechanism.

[0248] The above embodiment illustrates how the first node first compares the access control policies corresponding to the second nodes in the first and second access control lists to see if they are the same. If the access control policies corresponding to the second nodes in the first and second access control lists are the same, the first node further determines whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the first access control list. In other embodiments, after the first node obtains a copy of the first file from the third node, it may also first determine whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the first access control list, and then compare the access control policies corresponding to the second nodes in the first and second access control lists to see if they are the same.

[0249] For example, the first node can first determine whether the second node has access permission to the first file based on the access control policy corresponding to the second node in the first access control list. When the second node has access permission to the first file, the second node can compare whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same.

[0250] Optionally, when the second node does not have access rights to the first file, the second node may also stop comparing whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same.

[0251] Alternatively, in some embodiments, the step of the first node determining whether the second node has access to the first file based on the access control policy corresponding to the second node in the first access control list can be performed simultaneously with the step of comparing whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, or can be performed before the step of the first node obtaining a copy of the first file from the third node. This application does not restrict the execution order of the steps.

[0252] Optionally, in some embodiments, when the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, the first node can also determine whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the second access control list. This application does not impose any restrictions on this.

[0253] Optionally, after the first node returns the result of the first request to the second node, it indicates that the second node has successfully accessed the first file in the first node's database. For this access, the first node can continue to maintain an access record in the access log of the first file regarding the second node's access to the first file. When other nodes subsequently access the first file, the second node can also act as the aforementioned third node to provide the first node with a copy of the first file.

[0254] For example, after returning the first request result of the first request to the second node, the method further includes: recording the access record of the second node to the first file, wherein the access record of the second node to the first file includes: the identification information of the second node, and the path where the second node stores a copy of the first file.

[0255] In one possible implementation, the step of comparing whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same may include: the first node comparing whether the first access control list and the second access control list are the same; when the first access control list and the second access control list are the same, the access control policies corresponding to the second nodes included in the first access control list and the second access control list are also the same. For example, when the number and content of the access control policies in the first access control list and the access control policies in the second access control list are exactly the same, it can be determined that the first access control list and the second access control list are the same.

[0256] In this implementation, when the first access control list and the second access control list are the same, the first node can further determine whether the second node has access rights to the first file according to the access control policy corresponding to the second node in the first access control list, and when it is determined that the second node has access rights to the first file, return the access result corresponding to the access rights of the second node to the second node, such as the first request result mentioned above.

[0257] Optionally, when the first access control list and the second access control list are different, the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list may be the same or different. The first node can further compare whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and perform subsequent steps in the manner described in the foregoing embodiments.

[0258] In some possible implementation scenarios, when the first node obtains a copy of the first file, the nodes that have accessed the first file may include one or more. When there is only one node that has accessed the first file, that unique node is the aforementioned third node. When there are multiple nodes that have accessed the first file (e.g., at least two), the first node can select one of the multiple nodes that have accessed the first file as the third node.

[0259] In one possible implementation, when there are multiple nodes that have accessed the first file, the first node can arbitrarily (randomly) select one of the multiple nodes that have accessed the first file as the third node.

[0260] In another possible implementation, when multiple nodes have accessed the first file, the first node can select the most recently accessed node as the third node. That is, the first node can select the node whose historical access time to the first file is closest to the current time from the current time. For example, the current time could be the time the first node received the first request, and the historical access time could be the time when a node that accessed the first file sent the first request to the first node while accessing the first file.

[0261] For example, as described in the foregoing embodiments, in this embodiment of the application, each node in the distributed file system can maintain an access record for each stored file. The access record for each file contains the identification information (such as device name, device number, etc.) of other nodes that have accessed the file, as well as the paths where other nodes store copies of the file. The first node can query the access record of the first file to determine which node corresponds to the most recently added access record, and the first node can then designate that node as the third node.

[0262] For example, in one possible scenario, the distributed file system may include node 1, node 2, node 3, and node 4, where node 1 stores a first file, node 2 requests access to the first file in node 1, and nodes 3 and 4 are nodes that have accessed the first file. In this case, node 1 is the first node described in the previous embodiment, and node 2 is the second node described in the previous embodiment. When node 1 receives the request to access the first file from node 2, node 1 can determine which node is the third node from nodes 3 and 4 by querying the access records of the first file.

[0263] Assume the access records of the first file are as shown in Table 1 below.

[0264] Table 1

[0265]

[0266] In Table 1, the first column records the identifier information of the nodes that have accessed the first file, and the second column records the path where the node corresponding to the identifier information in the first column stores a copy of the first file. When a new access record exists, node 1 can add a new row below Table 1 to record the new access record.

[0267] In this example, node 1 can find by querying table 1 that node 4 is the node that most recently accessed the first file, and node 4 can be selected as the third node. Node 1 can obtain a copy of the first file from node 4.

[0268] Optionally, a timestamp of when the file was accessed can be added to the file access record. The time corresponding to the timestamp can be the historical access time mentioned above. The first node can also select the most recently accessed node as the third node based on the timestamp corresponding to the access record. There are no restrictions here.

[0269] In another possible implementation, when multiple nodes have accessed the first file, the first node can also select the node with the highest device level corresponding to the nearest node that has accessed the first file as the third node. The device level can be determined based on factors such as the abundance of device resources, whether the device can independently connect to the network, and / or human-computer interaction. For example, devices can be divided into levels zero to five, corresponding to L0 to L5, based on their capabilities in random access memory (RAM), read-only memory (ROM), and CPU. Higher device levels indicate stronger performance. No restrictions are placed on the method of device level division here.

[0270] For example, taking a distributed file system that includes nodes 1, 2, 3, and 4 as an example, node 1 stores a first file, node 2 requests access to the first file in node 1, and nodes 3 and 4 are nodes that have accessed the first file. Node 1 is the first node mentioned in the previous embodiment, and node 2 is the second node mentioned in the previous embodiment. When the device level of node 3 is higher than that of node 4, node 3 becomes the third node mentioned in the previous embodiment. When the device level of node 4 is higher than that of node 3, node 4 becomes the third node mentioned in the previous embodiment.

[0271] Optionally, in this implementation, the access record maintained by each node in the distributed file system for each stored file may also include the device level of each node that has accessed the file.

[0272] For example, the data structure of access records maintained by each node in a distributed file system for each stored file can be as follows:

[0273]

[0274] Here, "struct access_list" represents the access records; "unsigned int a_count" represents the number of access records; "struct access_list_entry*a_entries" is used to mark specific access records; "intdevice_id" represents the device identifier information of the node, used to identify the device that has accessed the file; "short security_level" represents the device level of the node (device) identified by "int device_id"; and "char*path_name" represents the path on the node (device) identified by "int device_id" where a copy of the file is stored.

[0275] In other possible implementations, when there are multiple nodes that have accessed the first file, the first node can also select the node with higher (or highest) computing power from among the multiple nodes that have accessed the first file as the third node, or select the node with richer CPU resources, memory resources, storage resources, etc. as the third node. This application does not restrict the selection method of the third node.

[0276] By designating the node with the highest device level or the highest computing power among the multiple nodes that have accessed the first file as the third node, the verification efficiency of the file verification method can be effectively improved by utilizing the more powerful computing resources of the third node.

[0277] When the node whose historical access time to the first file is shortest from the time the first node received the first request is selected as the third node, the control lists in both the first and third nodes are less likely to be tampered with, which can make the file verification method more reliable.

[0278] Optionally, when zero nodes have accessed the first file (i.e., no nodes have accessed the first file), the first node may not need to perform the step of obtaining a copy of the first file from the third node. Instead, the first node can directly determine whether the second node has access rights to the first file based on the access control policy corresponding to the second node in the first access control list. If the second node has access rights to the first file, the first node can return a first request result to the second node. If the second node does not have access rights to the first file, the first node can return a third request result to the second node.

[0279] Optionally, in some embodiments of this application, when a node in the distributed file system receives an access request from another node to access a file on that node, the node can first determine whether the file type of the file requested by the other node conforms to a first type. If it conforms to the first type, the node can perform file verification on the file as the first node according to the file verification method provided in the embodiments of this application. If it does not conform to the first type, the node can directly determine whether the other node has access rights to the file based on the access control policy in the access control list included in the file requested by the other node. When the other node has access rights to the file, the node can return the access result corresponding to the access rights possessed by the other node. When the other node does not have access rights to the file, the node can return an access denied result to the other node.

[0280] For example, consider a distributed file system where the first node includes a first file and a second file, where the first file is a file conforming to a first type and the second file is a file that does not conform to the first type. Figure 5 Another flowchart illustrating the document verification method provided in this application embodiment. For example... Figure 5 As shown, in the file verification method provided in this application embodiment, for a scenario where a second node requests access to a first file in a first node, the process of the first node performing file verification may include:

[0281] S501, The first node receives a first request from the second node. The first request is used to request access to a first file, which includes a first access control list.

[0282] For details regarding S501, please refer to the relevant explanation of S301 above, which will not be repeated here.

[0283] S502, The first node obtains a copy of the first file from the third node, and the copy of the first file includes the second access control list.

[0284] For details of S502, please refer to the aforementioned S302, which will not be repeated here.

[0285] S503, the first node determines whether the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same.

[0286] If yes, that is, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, execute S505; if no, that is, the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, execute S504.

[0287] S504, The first node returns the second request result to the second node.

[0288] S505. The first node determines whether the second node has access permission to the first file based on the access control policy corresponding to the second node in the first access control list.

[0289] If yes, that is, when the first node determines that the second node has access rights to the first file, execute S506; if no, that is, when the first node determines that the second node does not have access rights to the first file, execute S507.

[0290] S506, The first node returns the result of the first request to the second node.

[0291] S507, The first node returns the result of the third request to the second node.

[0292] For details of S503-S507, please refer to the foregoing embodiments, and will not be repeated here.

[0293] Figure 6 This is another schematic flowchart illustrating the document verification method provided in this application embodiment. For example... Figure 6 As shown, in the file verification method provided in this application embodiment, for a scenario where a second node requests access to a second file in a first node, the process of the first node performing file verification may include:

[0294] S601, The first node receives a second request from the second node, the second request being used to request access to a second file, the second file including a third access control list.

[0295] For example, the access control list in the second file can be called a third access control list, which may include the access control policy corresponding to the second node.

[0296] S601 is similar to S501, so I will not go into details.

[0297] S602. The first node determines whether the second node has access permission to the second file based on the access control policy corresponding to the second node in the third access control list.

[0298] If yes, that is, when the first node determines that the second node has access rights to the second file, execute S603; if no, that is, when the first node determines that the second node does not have access rights to the second file, execute S604.

[0299] S603, The first node returns the result of the fourth request to the second node.

[0300] The fourth request result can indicate the second node's access permissions to the second file or return information indicating successful access to the second file, so that the second node can access the second file in the first node.

[0301] For example, the return information when the second node successfully accesses the second file may include one or more of the following: context information of the second file, handle information of the second file, etc., without limitation.

[0302] S604, The first node returns the result of the fifth request to the second node.

[0303] The result of the fifth request can indicate that the second node cannot access the second file in the first node. For example, the result of the fifth request can be a message indicating that access is denied or access failed.

[0304] That is, in this embodiment of the application, when the second node sends a second request to the first node to request access to a second file that does not conform to the first type, the first node can respond to the second request by returning a fourth request result of the second request to the second node when the access control policy corresponding to the second node in the third access control list included in the second file determines that the second node has access rights to the second file. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, the first node returns a fifth request result of the second request to the second node.

[0305] For example, in some possible embodiments, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0306] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0307] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0308] In some embodiments, the tag indicating whether a file conforms to the first type can be stored in the file's extended attributes. That is, the tag indicating whether a file conforms to the first type can be stored in the file's extended attributes.

[0309] For example, the device where the file is located can use the Linux system command "setfattr" to mark the file's extended attributes, adding a tag to the file's extended attributes to indicate that the file conforms to the first type, such as the first tag.

[0310] Optionally, in this embodiment, when the first node receives a request from the second node to access a file, it can first determine whether the file requested by the second node conforms to the first type. For files conforming to the first type, the verification process for the first file described above can be followed; for files not conforming to the first type, the verification process for the second file described above can be followed. For example, the step of the first node determining whether a file conforms to the first type can include: the first node calling the "sechmdfs_check_sensitivity" function to check whether the file's extended attributes contain a first tag; when the file's extended attributes contain a first tag, the first node determines that the file conforms to the first type.

[0311] Optionally, in this embodiment of the application, when the first node receives a first request from the second node, if the first node does not include the first file, the first node can directly return an access failure result to the second node, such as "the first file cannot be found".

[0312] Similarly, when the first node receives a second request from the second node, if the first node does not contain the second file, the first node can also directly return an access failure result to the second node, such as "Unable to find the second file".

[0313] The above embodiments illustrate the file verification method provided in this application by taking the example of a first node actively obtaining a copy of a first file from a third node and determining the request result to return the first request to a second node based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list.

[0314] Optionally, in some other embodiments, the step of determining the request result of returning the first request to the second node based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list can also be completed by the third node, and the first node may not need to obtain a copy of the first file from the third node.

[0315] For example, taking a distributed file system where the first node contains the first file and the second node requests access to the first file in the first node as an example, Figure 7This is another schematic flowchart illustrating the document verification method provided in this application embodiment. For example... Figure 7 As shown, the method may include:

[0316] S701, The second node sends a first request to the first node. The first request is used to request access to the first file, which includes a first access control list.

[0317] S701 can be referred to in the above-mentioned S301, and will not be repeated here.

[0318] Accordingly, the first node receives the first request from the second node.

[0319] S702, The first node sends the first access control list to the third node.

[0320] Accordingly, the third node receives the first access control list from the first node.

[0321] In one possible implementation, the first node sends the first access control list to the third node, which may include: the first node sending the first access control list only to the third node. For example, the first node can obtain the access control policy of the first file by calling the "getacl()" method, and convert the extended attributes of the inode stored in the first file into a specific access control policy by calling the "getxattr()" method, thereby obtaining the first access control list and sending it to the third node.

[0322] Alternatively, in another possible implementation, the first node sending the first access control list to the third node may include: the first node sending a complete first file to the third node, the first file including the first access control list.

[0323] Alternatively, in another possible implementation, the first node sending the first access control list to the third node may include: the first node sending a portion of the first file containing the first control list to the third node. For example, the aforementioned portion of the file containing the first control list may be an extended attribute of the inode of the first file.

[0324] Optionally, the method for determining the third node described in this embodiment can refer to the method described in the previous embodiments, and will not be repeated here.

[0325] In some embodiments, after the first node sends the first access control list to the third node, the first access control list can trigger or instruct the third node to perform the steps described in S703-S704 below. That is, the third node can be instructed to determine the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list, and return the determined request result of the first request to the first node.

[0326] In other embodiments, the first node may send not only the first access control list to the third node, but also an instruction, such as a first instruction, to the third node. The first instruction may instruct the third node to perform the steps described in S703-S704 below. For example, S702 may include: the first node sending the first access control list to the third node and the first instruction.

[0327] S703, the third node determines the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list.

[0328] The step of the third node determining the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list can be referred to the step of the first node determining the request result of the first request based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list in the foregoing embodiment, and will not be repeated here.

[0329] The request result of the first request determined by the third node based on the access control policy corresponding to the second node in the first access control list and the access control policy corresponding to the second node in the second access control list may include any one of the following three types: the first request result, the second request result, and the third request result.

[0330] S704, The third node sends the request result of the first request to the first node.

[0331] Accordingly, the first node receives the request result of the first request sent by the third node.

[0332] S705. In response to the first request, the first node returns the request result of the first request to the second node.

[0333] Accordingly, the second node receives the request result of the first request sent by the first node.

[0334] Understandably, in S705, the request result of the first request returned by the first node to the second node can be any one of the first request result, the second request result, and the third request result.

[0335] Optionally, in S704, the third node may not directly send the request result of the first request to the first node. Instead, the third node may send second information to the first node. This second information indicates that the access control policies corresponding to the second nodes in the first and second access control lists are the same, and the second node has access to the first file; or it indicates that the access control policies corresponding to the second nodes in the first and second access control lists are different; or it indicates that the access control policies corresponding to the second nodes in the first and second access control lists are the same, and the second node does not have access to the first file. The first node can then return the request result of the first request to the second node based on the second information.

[0336] Optionally, in some embodiments, in the file verification method provided in this application, the third node may only perform the step of comparing whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and return the comparison result to the first node. The comparison result includes: the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, or the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different. After receiving the comparison result, the first node can perform the subsequent step of returning the request result of the first request to the second node in the manner described in the foregoing embodiments, according to the comparison result.

[0337] For example, taking a distributed file system where the first node contains the first file and the second node requests access to the first file in the first node as an example, Figure 8 This is another schematic flowchart illustrating the document verification method provided in this application embodiment. For example... Figure 8 As shown, the method may include:

[0338] S801, The second node sends a first request to the first node. The first request is used to request access to the first file, which includes a first access control list.

[0339] Accordingly, the first node receives the first request from the second node.

[0340] S801 can be referred to in the above-mentioned S301, and will not be repeated here.

[0341] S802, The first node sends the first access control list to the third node.

[0342] Accordingly, the third node receives the first access control list from the first node.

[0343] The implementation method of the first node sending the first access control list to the third node in S802 can refer to the description in S702. The method of determining the third node in this embodiment can refer to the description in the previous embodiments, and will not be repeated here.

[0344] In some embodiments, after the first node sends the first access control list to the third node, the first access control list can trigger or instruct the third node to perform the steps described in S803-S804 below, that is, the third node can be instructed to compare whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and return the comparison result to the first node.

[0345] In other embodiments, the first node may send not only the first access control list to the third node, but also an instruction, such as a second instruction, to the third node. The second instruction may instruct the third node to perform the steps described in S803-S804 below. For example, S802 may include: the first node sending the first access control list and the second instruction to the third node.

[0346] S803. The third node compares whether the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and obtains the comparison result.

[0347] As described above, the comparison results may include: the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, or the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different.

[0348] S804, the third node sends the comparison result to the first node.

[0349] Accordingly, the first node receives the comparison result from the third node.

[0350] S805. The first node determines the request result of the first request based on the comparison result and the access control policy corresponding to the second node in the first access control list.

[0351] S805 may include: when the comparison result shows that the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, the first node determines whether the second node has access rights to the first file according to the access control policy corresponding to the second node in the first access control list.

[0352] When the comparison result shows that the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and the second node has access rights to the first file, the first node determines the request result of the first request as the first request result.

[0353] When the comparison result shows that the access control policies corresponding to the second nodes included in the first access control list and the second access control list are different, the first node determines that the request result of the first request is the result of the second request.

[0354] When the comparison result shows that the access control policies corresponding to the second nodes included in the first access control list and the second access control list are the same, and the second node does not have access rights to the first file, the first node determines that the request result of the first request is the result of the third request.

[0355] The results of the first request, the second request, and the third request can be referred to in the foregoing embodiments, and will not be repeated here.

[0356] S806. In response to the first request, the first node returns the request result of the first request to the second node.

[0357] Understandably, in S806, the request result of the first request returned by the first node to the second node can be any one of the first request result, the second request result, and the third request result.

[0358] Optionally, in S804, the third node may not directly send the comparison result to the first node. Instead, the third node can return first information to the first node based on the comparison result. The first information can indicate the comparison result or the request result of the first request. The first node can then return the request result of the first request to the second node based on the first information.

[0359] For example, the first information is used to indicate whether the access control policies corresponding to the second node in the first access control list and the second access control list are the same or different.

[0360] The embodiments described above are all illustrative examples, and this application does not limit the subject that performs the steps of the document verification method.

[0361] It should be noted that although the above embodiments use a distributed file system as an example to illustrate the file verification method provided in this application, the application scenarios of this file verification method are not limited to distributed file systems. The file verification method provided in this application is also applicable in other scenarios where multiple nodes exist, and at least three of these nodes can access each other's nodes. The application scenarios described in the foregoing embodiments are merely illustrative examples of the embodiments of this application, and this application does not limit the application scenarios of the file verification method.

[0362] It should be understood that the above embodiments are merely illustrative examples of the document verification method provided in this application. In other possible implementations, some execution steps may be omitted or added to the above embodiments, or the order of some steps in the above embodiments may be adjusted, and this application does not impose any limitations on these aspects.

[0363] Corresponding to the file verification method described in the foregoing embodiments, this application provides a distributed file system that can implement the file verification method described in the foregoing embodiments.

[0364] For example, a distributed file system includes a first node, a second node, and a third node. The first node includes a first file. The second node sends a first request to the first node, requesting access to the first file, which includes a first access control list. The first node obtains a copy of the first file from the third node, where the third node has accessed the first file, and the copy includes a second access control list. The first and second access control lists each include access control policies corresponding to the second node. In response to the first request, if the access control policies corresponding to the second node in both the first and second access control lists are the same and both determine that the second node has access rights to the first file, the first node returns a first request result to the second node. This first request result indicates the second node's access rights to the first file or a successful access message, allowing the second node to access the first file in the first node.

[0365] Optionally, in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, the first node returns the second request result of the first request to the second node, and the second request result indicates that the second node cannot access the first file in the first node.

[0366] Optionally, in response to the first request, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, the first node returns a third request result of the first request to the second node, the third request result indicating that the second node cannot access the first file in the first node.

[0367] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0368] By designating the node with the highest device level or the highest computing power among the multiple nodes that have accessed the first file as the third node, the verification efficiency of the file verification method can be effectively improved by utilizing the more powerful computing resources of the third node.

[0369] When the node whose historical access time to the first file is shortest from the time the first node received the first request is selected as the third node, the control lists in both the first and third nodes are less likely to be tampered with, which can make the file verification method more reliable.

[0370] In one possible implementation, the first file conforms to the first type.

[0371] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0372] In some possible implementations, whether a file conforms to the first type can be configured by the user. For example, the user can add a tag to the file to indicate that the file conforms to the first type. When the file does not include this tag, it means that the file does not conform to the first type.

[0373] In other possible approaches, whether a file conforms to the first type can be automatically configured by the device (node) where the file resides according to some preset rules. These preset rules can be manually configured. For example, preset rules may include: when the file is a photo, add a tag corresponding to the first type to the file. Then, when the device where the file resides detects that the file is a photo, it can automatically add a tag to the photo, which can be used to indicate that the file conforms to the first type. Similarly, when the file does not include this tag, it means that the file does not conform to the first type.

[0374] Optionally, the first node may also receive a second request from the second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; the second file does not conform to the first type. In response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, the first node returns a fourth request result of the second request to the second node, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, the first node returns a fifth request result of the second request to the second node, the fifth request result indicating that the second node cannot access the second file in the first node.

[0375] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0376] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0377] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0378] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0379] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0380] Optionally, the first node, the second node, and the third node all belong to the same local area network.

[0381] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0382] In this implementation, when the first access control list and the second access control list are the same, the first node can further determine whether the second node has access rights to the first file according to the access control policy corresponding to the second node in the first access control list, and when it is determined that the second node has access rights to the first file, return the access result corresponding to the access rights of the second node to the second node, such as the first request result mentioned above.

[0383] Optionally, after returning the first request result of the first request to the second node, the first node may record the access record of the second node to the first file. The access record of the second node to the first file includes: the identification information of the second node and the path where the second node stores a copy of the first file.

[0384] Once the first node returns the result of its first request to the second node, it indicates that the second node has successfully accessed the first file in the first node's database. For this access, the first node can maintain an access record in its access log for the first file regarding the second node's access. When other nodes subsequently access the first file, the second node can also act as a third node, providing a copy of the first file to the first node.

[0385] Similarly, a distributed file system can implement all the functions corresponding to the file verification method described in the foregoing embodiments, which will not be repeated here.

[0386] This application also provides a file verification device, which can be applied to an electronic device (such as a terminal device of the first node) of a first node to enable the electronic device to perform the steps executed by the first node in the file verification method described in the foregoing embodiments. The function of this device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps executed by the first node in the file verification method described in the foregoing embodiments.

[0387] For example, Figure 9 This is a schematic diagram of the document verification device provided in an embodiment of this application. Figure 9 As shown, the device may include: a transceiver unit 901, a processing unit 902, etc.

[0388] The system comprises a transceiver unit 901 and a processing unit 902. The transceiver unit 901 receives a first request from a second node, requesting access to a first file in the first node. The first file includes a first access control list. The transceiver unit is also configured to obtain a copy of the first file from a third node, wherein the third node has accessed the first file, and the copy includes a second access control list. The first and second access control lists each include an access control policy corresponding to the second node. The processing unit 902, in response to the first request, returns a first request result to the second node through the transceiver unit 901 when the access control policies corresponding to the second node in the first and second access control lists are the same, and it is determined that the second node has access rights to the first file. The first request result indicates the second node's access rights to the first file or a successful access message, enabling the second node to access the first file in the first node.

[0389] Optionally, the processing unit 902 is further configured to respond to the first request and, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, return a second request result of the first request to the second node through the transceiver unit 901, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0390] Optionally, the processing unit 902 is further configured to respond to the first request and, when the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, return a third request result of the first request to the second node through the transceiver unit 901. The third request result indicates that the second node cannot access the first file in the first node.

[0391] In one possible implementation, there are multiple nodes that have accessed the first file; the third node is the node with the highest device level among the multiple nodes that have accessed the first file; or, the third node is the node whose historical access time to the first file is the shortest time since the first node received the first request; or, the third node is the node with the highest computing power among the multiple nodes that have accessed the first file.

[0392] In one possible implementation, the first file conforms to the first type.

[0393] For example, the first type mentioned above may include one or more of the following: high importance, high security requirements, high privacy requirements, etc.

[0394] Optionally, the transceiver unit 901 is further configured to receive a second request from the second node, the second request requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; and the second file does not conform to the first type. The processing unit 902 is further configured to, in response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, return a fourth request result of the second request to the second node through the transceiver unit 901, the fourth request result indicating the second node's access rights to the second file or a successful access message to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, return a fifth request result of the second request to the second node through the transceiver unit 901, the fifth request result indicating that the second node cannot access the second file in the first node.

[0395] In one possible implementation, the copy of the first file is generated by copying the complete first file when the third node accesses it.

[0396] Alternatively, in another possible implementation, the copy of the first file is generated by copying the portion of the first file containing the first control list when the third node accesses the first file.

[0397] For example, the portion of the file containing the first control list could be an extended attribute of the inode of the first file.

[0398] Alternatively, in another possible implementation, the copy of the first file is generated by copying the first control list in the first file when the third node accesses the first file.

[0399] Optionally, the return information when the second node successfully accesses the first file includes one or more of the following: the context information of the first file, and the handle information of the first file.

[0400] Optionally, the first node, the second node, and the third node may all belong to the same local area network; or, the first node, the second node, and the third node may all belong to the same distributed file system.

[0401] In one possible implementation, the access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: the first access control list and the second access control list are the same.

[0402] Optionally, the processing unit 902 is further configured to record the access records of the second node to the first file. The access records of the second node to the first file include: the identification information of the second node and the path where the second node stores a copy of the first file.

[0403] For example, Figure 10 Another structural schematic diagram of the document verification device provided in an embodiment of this application. (See diagram below.) Figure 10 As shown, the device may include: a transceiver unit 1001, a processing unit 1002, etc.

[0404] The transceiver unit 1001 is configured to receive a first request from a second node, the first request requesting access to a first file in the first node, the first file including a first access control list. The transceiver unit 1001 is also configured to send the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list respectively include access control policies corresponding to the second node. The transceiver unit 1001 is also configured to receive first information returned by the third node, the first information indicating whether the access control policies corresponding to the second nodes in the first and second access control lists are the same or different. The processing unit 1002, in response to the first request, when the first information indicates that the access control policies corresponding to the second nodes in the first and second access control lists are the same, and it is determined that the second node has access rights to the first file, returns a first request result of the first request to the second node through the transceiver unit 1001, the first request result indicating the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

[0405] Optionally, the processing unit 1002 is further configured to respond to the first request and, when the first information indicates that the access control policies corresponding to the second nodes in the first access control list and the second access control list are different, return the second request result of the first request to the second node through the transceiver unit 1001, wherein the second request result indicates that the second node cannot access the first file in the first node.

[0406] Optionally, the processing unit 1002 is further configured to respond to the first request, when the first information indicates that the access control policy corresponding to the second node in the first access control list and the second access control list is the same, and it is determined that the second node does not have access rights to the first file, and the third request result of the first request is returned to the second node through the transceiver unit 1001, the third request result indicating that the second node cannot access the first file in the first node.

[0407] For example, Figure 11This is yet another structural schematic diagram of the document verification device provided in an embodiment of this application. (See attached diagram.) Figure 11 As shown, the device may include: a transceiver unit 1101, a processing unit 1102, etc.

[0408] The transceiver unit 1101 is configured to receive a first request from a second node, the first request requesting access to a first file in the first node, the first file including a first access control list. The transceiver unit 1101 is also configured to send the first access control list to a third node; wherein the third node has accessed the first file, the third node includes a copy of the first file, and the copy of the first file includes a second access control list. The first access control list and the second access control list each include an access control policy corresponding to the second node. The transceiver unit 1101 is also configured to receive second information returned by the third node, the second information indicating that the access control policies corresponding to the second nodes in the first and second access control lists are the same and the second node has access to the first file; or, indicating that the access control policies corresponding to the second nodes in the first and second access control lists are different; or, indicating that the access control policies corresponding to the second nodes in the first and second access control lists are the same and the second node does not have access to the first file. The processing unit 1102 is configured to return the request result of the first request to the second node through the transceiver unit 1101 based on the second information.

[0409] This application also provides a document verification device, which can be applied to an electronic device of a third node (such as a terminal device of the third node) to enable the electronic device to perform the steps executed by the third node in the document verification method described in the foregoing embodiments. The function of this device can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps executed by the third node in the document verification method described in the foregoing embodiments.

[0410] For example, Figure 12 This is yet another structural schematic diagram of the document verification device provided in an embodiment of this application. (See attached diagram.) Figure 12 As shown, the device may include: a transceiver unit 1201, a processing unit 1202, etc.

[0411] The transceiver unit 1201 is used to receive a first access control list from a first node; the first access control list is sent by the first node after receiving a first request from a second node; the first request is used to request access to a first file. The processing unit 1202 is used to compare whether the access control policies corresponding to the second nodes in the first and second access control lists are the same, and obtain a comparison result. The processing unit 1202 is also used to return first information to the first node through the transceiver unit 1201 based on the comparison result, so that the first node returns the request result of the first request to the second node based on the first information.

[0412] The first piece of information is used to indicate whether the access control policies corresponding to the second node in the first access control list and the second access control list are the same or different.

[0413] For example, Figure 13 This is yet another structural schematic diagram of the document verification device provided in an embodiment of this application. (See attached diagram.) Figure 13 As shown, the device may include: a transceiver unit 1301, a processing unit 1302, etc.

[0414] The transceiver unit 1301 is configured to receive a first access control list from a first node; the first access control list is sent by the first node after receiving a first request from a second node; the first request is for requesting access to a first file. The processing unit 1302 is configured to compare whether the access control policies corresponding to the second nodes in the first and second access control lists are the same, and determine whether the second node has access rights to the first file, thereby obtaining second information. The transceiver unit 1301 is also configured to return the second information to the first node, so that the first node returns the request result of the first request to the second node based on the second information.

[0415] This application also provides a document verification device, which can be applied to an electronic device (such as a terminal device of the second node) of a second node to enable the electronic device to perform the steps executed by the second node in the document verification method described in the foregoing embodiments. The function of this device can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules or units corresponding to the steps executed by the third node in the document verification method described in the foregoing embodiments. For example, the device may include a transceiver unit and a processing unit. The processing unit can be used to send a first request or a second request to a first node through the transceiver unit, and the transceiver unit can be used to receive request results from the first node, such as a first request result, a second request result, a third request result, a fourth request result, a fifth request result, etc. Further details are omitted here.

[0416] It should be understood that the division of units (or modules) in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, all units in the device can be implemented entirely in software through processing element calls; all units can be implemented entirely in hardware; or some units can be implemented in software through processing element calls, while others can be implemented in hardware.

[0417] For example, each unit can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as a program in memory, invoked and executed by a processing element within the device. Furthermore, these units can be integrated in whole or in part, or implemented independently. The processing element described here can also be called a processor, which can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each of the above units can be implemented through integrated logic circuits in the processor element or through software invoked by the processing element.

[0418] In one example, the unit in the above device may be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), or one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), or a combination of at least two of these integrated circuit forms.

[0419] For example, when the units in the device can be implemented through a processing element scheduler, the processing element can be a general-purpose processor, such as a central processing unit (CPU) or other processor capable of calling programs. Alternatively, these units can be integrated together to form a system-on-a-chip (SOC).

[0420] In one implementation, the units that implement the corresponding steps in the above method can be implemented in the form of a processing element scheduler. For example, the file verification device may include a processing element and a storage element. The processing element calls a program stored in the storage element to execute the steps executed by the first node, the second node, or the third node in the file verification method described in the above method embodiments. The storage element can be a storage element located on the same chip as the processing element, i.e., an on-chip storage element.

[0421] In another implementation, the program used to perform the above method can be located on a storage element on a different chip than the processing element, i.e., an off-chip storage element. In this case, the processing element calls or loads the program from the off-chip storage element onto the on-chip storage element to call and execute the steps executed by the first node, the second node, or the third node in the file verification method described in the above method embodiments.

[0422] This application also provides an electronic device. The electronic device can be the terminal device of the first node described above. The electronic device includes: a processor; a memory for storing processor-executable instructions; when the processor is configured to execute the instructions, the electronic device performs the steps executed by the first node in the file verification method described in the above method embodiments. The memory can be located within or outside the electronic device. The processor may include one or more processors.

[0423] This application also provides an electronic device. This electronic device can be the terminal device of the second node described above. The electronic device includes: a processor; a memory for storing processor-executable instructions; when the processor is configured to execute the instructions, the electronic device performs the steps executed by the second node in the file verification method described in the above method embodiments. The memory can be located within or outside the electronic device. The processor may include one or more processors.

[0424] This application also provides an electronic device. This electronic device can be the terminal device of the aforementioned third node. The electronic device includes: a processor; a memory for storing processor-executable instructions; when the processor is configured to execute the instructions, the electronic device performs the steps executed by the third node in the file verification method described in the above method embodiments. The memory can be located within or outside the electronic device. Furthermore, the processor may include one or more processors.

[0425] In another implementation, the units in the above-described electronic device that implement the steps of the above method can be configured as one or more processing elements. These processing elements can be integrated circuits, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or combinations of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.

[0426] For example, this application also provides a chip that can be applied to the aforementioned electronic device. The chip includes one or more interface circuits and one or more processors; the interface circuits and processors are interconnected via lines; the processor receives and executes computer instructions from the memory of the electronic device through the interface circuits to implement the steps performed by the first node, the second node, or the third node in the file verification method described in the above method embodiments.

[0427] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0428] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0429] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.

[0430] Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product, such as a program. This software product is stored in a program product, such as a computer-readable storage medium, and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0431] For example, embodiments of this application also provide a computer-readable storage medium storing computer program instructions thereon; when the computer program instructions are executed by an electronic device, the electronic device performs the steps executed by the first node, or the steps executed by the second node, or the steps executed by the third node in the file verification method described in the above method embodiments.

[0432] For example, embodiments of this application also provide a computer program product, including: computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code is run in an electronic device, the processor in the electronic device implements the steps executed by the first node, or the steps executed by the second node, or the steps executed by the third node in the file verification method described in the above method embodiments.

[0433] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A file verification method characterized by, The method is applied to the first node, and the method includes: Receive a first request from a second node, the first request being for requesting access to a first file in the first node, the first file including a first access control list; Obtain a copy of the first file from a third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list; The first access control list and the second access control list each include access control policies corresponding to the second node; In response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, the first request result of the first request is returned to the second node. The first request result indicates the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

2. The method of claim 1, wherein, The method further includes: In response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are different, a second request result of the first request is returned to the second node, and the second request result indicates that the second node cannot access the first file in the first node.

3. The method according to claim 1 or 2, characterized in that, The method further includes: In response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and it is determined that the second node does not have access rights to the first file, a third request result of the first request is returned to the second node, the third request result indicating that the second node cannot access the first file in the first node.

4. The method according to claim 1 or 2, characterized in that, The nodes that have accessed the first file include multiple nodes; The third node is the node with the highest device level among the multiple nodes that have accessed the first file; Alternatively, the third node is the node among the multiple nodes that have accessed the first file whose historical access time to the first file is the shortest time between the first node receiving the first request; Alternatively, the third node may be the node with the highest computing power among the multiple nodes that have accessed the first file.

5. The method according to claim 1 or 2, characterized in that, The first file conforms to the first type.

6. The method according to claim 5, characterized in that, The method further includes: A second request is received from a second node, the second request being for requesting access to a second file in the first node, wherein the second file includes a third access control list, the third access control list including an access control policy corresponding to the second node; the second file does not conform to the first type; In response to the second request, when the access control policy corresponding to the second node in the third access control list determines that the second node has access rights to the second file, a fourth request result of the second request is returned to the second node. The fourth request result indicates the second node's access rights to the second file or a return message indicating successful access to the second file, so that the second node can access the second file in the first node. Alternatively, when the access control policy corresponding to the second node in the third access control list determines that the second node does not have access rights to the second file, a fifth request result of the second request is returned to the second node, the fifth request result indicating that the second node cannot access the second file in the first node.

7. The method according to claim 1, 2, or 6, characterized in that, The copy of the first file is generated by the third node copying the complete first file when it accesses the first file; Alternatively, the copy of the first file is generated by the third node copying the portion of the first file containing the first access control list when accessing the first file; Alternatively, the copy of the first file may be generated by the third node copying the first access control list in the first file when accessing the first file.

8. The method according to claim 1, 2, or 6, characterized in that, The message returned when the second node successfully accesses the first file includes one or more of the following: The context information of the first file and the handle information of the first file.

9. The method according to claim 1, 2, or 6, characterized in that, The first node, the second node, and the third node all belong to the same local area network; Alternatively, the first node, the second node, and the third node may all belong to the same distributed file system.

10. The method according to claim 1, 2, or 6, characterized in that, The access control policies corresponding to the second nodes in the first access control list and the second access control list are the same, including: The first access control list is the same as the second access control list.

11. The method according to claim 1, 2, or 6, characterized in that, After returning the first request result of the first request to the second node, the method further includes: The access records of the second node to the first file are recorded. The access records of the second node to the first file include: the identification information of the second node and the path where the second node stores a copy of the first file.

12. A document verification device, characterized in that, The device is applied to the first node, and the device includes: a transceiver unit and a processing unit; The transceiver unit is configured to receive a first request from a second node, the first request being a request to access a first file in the first node, the first file including a first access control list; The transceiver unit is further configured to obtain a copy of the first file from a third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list; The first access control list and the second access control list each include access control policies corresponding to the second node; The processing unit is configured to respond to the first request, and when the access control policies corresponding to the second node in the first access control list and the second access control list are the same, and it is determined that the second node has access rights to the first file, return a first request result of the first request to the second node through the transceiver unit. The first request result indicates the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

13. A distributed file system, characterized in that, include: The first node, the second node, and the third node; The first node includes the first file; The second node sends a first request to the first node, the first request being used to request access to the first file, the first file including a first access control list; The first node obtains a copy of the first file from the third node, wherein the third node has accessed the first file, and the copy of the first file includes a second access control list; The first access control list and the second access control list each include access control policies corresponding to the second node; In response to the first request, when the access control policies corresponding to the second node in the first access control list and the second access control list are the same and both determine that the second node has access rights to the first file, the first node returns a first request result of the first request to the second node. The first request result indicates the second node's access rights to the first file or a return message indicating successful access to the first file, so that the second node can access the first file in the first node.

14. An electronic device, characterized in that, include: A processor, and a memory for storing processor-executable instructions; When the processor is configured to execute the instructions, it causes the electronic device to implement the method as described in any one of claims 1-11.

15. A computer-readable storage medium having computer program instructions stored thereon; characterized in that, When the computer program instructions are executed by the electronic device, the electronic device causes the electronic device to perform the method as described in any one of claims 1-11.

16. A computer program product comprising computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, characterized in that, When the computer-readable code is run in an electronic device, the processor in the electronic device implements the method as described in any one of claims 1-11.

Images