Access method, device, computer readable medium and electronic device of storage system

Abstract

Embodiments of the present application provide an access method and device of a cloud storage system, a computer readable medium and an electronic device. The method comprises: obtaining authentication information carried in an authentication request from an access device according to the received authentication request; obtaining second pre-made static token information according to device identification information in the authentication information, and authenticating first signature information in the authentication information according to the second pre-made static token information; if the authentication is passed, sending a temporary credential acquisition request to the cloud system, and obtaining a temporary access credential fed back by the cloud system according to the temporary credential acquisition request; and returning the temporary access credential to the access device, so that the access device accesses the cloud storage system in the cloud system by carrying the temporary access credential. The embodiments of the present application can be applied to the field of transportation. The scheme of the present application can prevent illegal devices from accessing the cloud storage system, improve the data security and the reliability of the cloud storage service, and reduce resource waste.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, in particular to an access method and device of a cloud storage system, a computer readable medium and an electronic device. BACKGROUND

[0002] Cloud storage is an important part of cloud computing technology, and data can be conveniently read and written in the cloud through cloud storage technology. Currently, device access is usually through data upload services to access the cloud storage system. However, on the one hand, when the access request of the device is too much, the data upload service and the cloud storage system traffic are too large, which may not be able to provide reliable cloud storage services due to bandwidth limitations; on the other hand, there is also a situation that illegal devices can access the cloud storage system, which causes data security and resource waste problems. SUMMARY

[0003] Embodiments of the present application provide an access method and device of a cloud storage system, a computer readable medium and an electronic device, thereby at least to some extent, the security and reliability of accessing the cloud storage system can be improved.

[0004] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the present application.

[0005] According to an aspect of an embodiment of the present application, an access method of a cloud storage system is provided, the method comprising: obtaining authentication information carried in an authentication request from an access device according to receiving the authentication request, wherein the authentication information comprises device identification information and first signature information, the first signature information is generated by the access device according to the device identification information and first pre-prepared static token information, and the first pre-prepared static token information is generated by a cloud system according to the device identification information; obtaining second pre-prepared static token information according to the device identification information, and authenticating the first signature information according to the second pre-prepared static token information; if the authentication is passed, sending a temporary credential acquisition request to the cloud system, and obtaining a temporary access credential fed back by the cloud system according to the temporary credential acquisition request; returning the temporary access credential to the access device, so that the access device accesses a cloud storage system in the cloud system by carrying the temporary access credential.

[0006] According to one aspect of the embodiments of this application, an access device for a cloud storage system is provided. The device includes: an authentication information acquisition unit, configured to acquire authentication information carried in an authentication request received from an access device, wherein the authentication information includes device identification information and first signature information, the first signature information being generated by the access device based on the device identification information and first pre-made static token information, the first pre-made static token information being generated by a cloud system based on the device identification information; an authentication unit, configured to obtain second pre-made static token information based on the device identification information, and authenticate the first signature information based on the second pre-made static token information; a temporary access credential acquisition unit, configured to send a temporary credential acquisition request to the cloud system if authentication is successful, and acquire a temporary access credential returned by the cloud system based on the temporary credential acquisition request; and a return unit, configured to return the temporary access credential to the access device, so that the access device can access the cloud storage system in the cloud system by carrying the temporary access credential.

[0007] In some embodiments of this application, based on the foregoing scheme, before sending a temporary credential acquisition request to the cloud system, the temporary access credential acquisition unit is further configured to: acquire permission configuration file information; the temporary access credential acquisition unit is configured to: send the permission configuration file information to the cloud system by sending a temporary credential acquisition request to the cloud system, so as to configure the access permissions of the temporary access credential in the cloud storage system.

[0008] In some embodiments of this application, based on the foregoing scheme, the return unit is configured to: return the temporary access credential to the access device, so that the access device sends an access request carrying the temporary access credential to the cloud storage system in the cloud system, and the cloud storage system verifies the legality of the temporary access credential and determines whether to reject the access request of the access device based on the verification result.

[0009] In some embodiments of this application, based on the foregoing scheme, the permission configuration file information includes at least one of the following: credential validity information, folders with access permissions, and types of access permissions.

[0010] In some embodiments of this application, based on the foregoing scheme, the temporary access credential acquisition unit is configured to: send a first temporary credential acquisition request to the cloud system based on a first cloud storage system access request received from the access device, so as to obtain a first temporary access credential fed back by the cloud system; the temporary access credential acquisition unit is further configured to: when the access request sent by the access device to the cloud storage system exceeds the access permission corresponding to the first temporary access credential in the access request, send a second temporary credential acquisition request to the cloud system based on a second cloud storage system access request received from the access device, so as to obtain a second temporary access credential fed back by the cloud system.

[0011] In some embodiments of this application, based on the foregoing scheme, the authentication unit is configured to: perform a query operation in the cloud system based on the device identification information to obtain second pre-made static token information corresponding to the device identification information; generate second signature information based on the device identification information and the second pre-made static token information; and authenticate the first signature information by comparing the first signature information with the second signature information.

[0012] In some embodiments of this application, based on the foregoing scheme, the authentication information further includes a timestamp generated when the authentication request is sent, and the first signature information is also generated based on the timestamp.

[0013] In some embodiments of this application, based on the foregoing scheme, the device identification information includes a device identification number and tenant identification information.

[0014] In some embodiments of this application, based on the foregoing scheme, the first pre-made static token information is generated when the access device is registered in the cloud system.

[0015] In some embodiments of this application, based on the foregoing scheme, the access device is a mobile device, and the device identifier and the tenant identifier information are burned into the access device.

[0016] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the access method of the cloud storage system as described in the above embodiments.

[0017] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the cloud storage system access method as described in the above embodiments.

[0018] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium, a processor of a computer device reading the computer instructions from the computer-readable storage medium, and the processor executing the computer instructions to cause the computer device to perform the cloud storage system access method as described in the above embodiments.

[0019] In some embodiments of this application, the technical solutions provided firstly involve the cloud system generating a first pre-made static token based on device identification information and providing it to the accessing device. Then, the accessing device generates a first signature based on the device identification information and the first pre-made static token. The authentication device sends an authentication request based on the first signature. After receiving the authentication request from the authentication device, the authentication information carried in the authentication request, including the device identification information and the first signature, can be extracted. Then, a second pre-made static token is obtained based on the device identification information, and the first signature is authenticated using the second pre-made static token. Therefore, a complete and reliable authentication process for the accessing device is provided. Based on this, only when authentication is successful will a temporary credential acquisition request be sent to the cloud system, thereby obtaining the temporary access credential from the cloud system and providing it to the accessing device. This prevents unauthorized devices from obtaining the temporary access credential and thus from accessing the cloud storage system, improving data security and reducing resource waste. Furthermore, legitimate accessing devices do not need to rely on forwarding services and can directly access the cloud storage system using temporary access credentials, avoiding dependence on a single transmission link and improving the reliability of cloud storage services.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0022] Figure 1 This diagram illustrates the principle of accessing a cloud storage system in related technologies.

[0023] Figure 2 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown;

[0024] Figure 3 A flowchart illustrating an access method for a cloud storage system according to an embodiment of this application is shown;

[0025] Figure 4 A schematic diagram illustrating the principle of accessing a cloud storage system according to an embodiment of this application is shown;

[0026] Figure 5 A schematic diagram of the process for obtaining a pre-made static token according to an embodiment of this application is shown;

[0027] Figure 6 A flowchart illustrating the authentication of first signature information according to an embodiment of this application is shown;

[0028] Figure 7 A schematic diagram illustrating the process of authenticating a device through a device access authentication service according to an embodiment of this application is shown;

[0029] Figure 8 This illustration shows a schematic diagram of configuring access permissions for temporary access credentials according to an embodiment of this application;

[0030] Figure 9 A schematic diagram of the return structure of a cloud storage temporary authorization access control service according to an embodiment of this application is shown;

[0031] Figure 10 A block diagram of an access device for a cloud storage system according to an embodiment of this application is shown;

[0032] Figure 11 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown. Detailed Implementation

[0033] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0034] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0035] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0036] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0037] In the field of intelligent driving, a vehicle typically generates gigabytes of data per day of real-world driving. This data is crucial for driving data analysis and visualization, model training, and monitoring of the driving process. Therefore, it is usually necessary to transmit the data back to the cloud for storage. Data transmission to the cloud is a common scenario and requirement, and the AWS S3 protocol has become the de facto standard for object cloud storage. Among related technologies, there are two main solutions for implementing cloud storage based on the AWS S3 protocol:

[0038] 1. Mobile devices (such as vehicle-mounted devices) can directly call the API interfaces provided by the S3 SDK to send vehicle-mounted data back to the cloud.

[0039] While this scheme implements access control and user authentication for storage access—for example, requiring mobile devices to provide a valid accesskey / secretkey pair for cloud access—this method is a permanently valid user authentication method. However, because the mobile device provides the accesskey / secretkey pair for authentication every time, this method permanently exposes the accesskey / secretkey pair to mobile devices such as vehicle-mounted devices. Once a device possesses the accesskey / secretkey pair, it can access the cloud storage system without restriction. Therefore, this significantly reduces the security and reliability of cloud storage.

[0040] 2. Access the cloud storage system via cloud data upload service.

[0041] In related technologies, to avoid directly exposing accesskey / secretkey pairs to mobile devices, existing solutions typically provide a cloud data upload service.

[0042] Figure 1 A schematic diagram illustrating the principle of accessing a cloud storage system in related technologies is shown. Please refer to [link / reference]. Figure 1 As shown, the cloud data upload service is... Figure 1 The AppServer in the system encapsulates data upload interfaces such as AWS S3 SDK PutObject. The ClientApp can reside on the accessing device. After logging in, the AppUser using the ClientApp calls the data upload interface provided by the AppServer. The AppServer then requests the cloud API, thereby sending the data back to OSS (Object Storage Service) in the cloud. The AppServer has an AK (access key) that only cloud users hold. Therefore, the ClientApp does not need to provide the access key / secret key pair when accessing the device, thus achieving isolation of access key / secret key information for mobile devices.

[0043] However, this solution still has the following drawbacks:

[0044] 1) The need to provide a separate data upload service increases the service's operation and maintenance costs, makes the entire data backhaul link more complex, increases instability, and results in greater transmission latency.

[0045] 2) Mobile devices all need to request cloud data upload services. Cloud data upload services need to communicate with cloud storage systems through the public network. Once the number of requests reaches a certain level, it can easily cause service bottlenecks due to bandwidth limitations.

[0046] 3) The cloud data upload service lacks a proper access authentication mechanism. Once the data upload interface provided by the cloud data upload service is exposed to the outside world, any mobile device can call the interface, which not only wastes resources but also causes huge cloud storage costs.

[0047] Therefore, this application first provides a method for accessing a cloud storage system. The cloud storage system access method provided by the embodiments of this application can overcome the above-mentioned defects, not only reducing transmission latency and improving the stability and reliability of data return, but also significantly improving the security of the entire access process and avoiding waste of resources and costs.

[0048] The cloud storage system access method provided in this application can be applied to intelligent transportation systems. Intelligent Transportation Systems (ITS), also known as Intelligent Transportation Systems, effectively integrate advanced technologies (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) into transportation, service control, and vehicle manufacturing. This strengthens the connection between vehicles, roads, and users, thereby forming a comprehensive transportation system that ensures safety, improves efficiency, enhances the environment, and conserves energy.

[0049] Figure 2 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown.

[0050] like Figure 2 As shown, the system architecture 200 may include terminal devices such as vehicle sensors 201 and intelligent network cameras (IP cameras) 202, a server 203, and a cloud system 204. Both the terminal devices and the server 203, as well as the server 203 and the cloud system 204, are connected via communication links. Furthermore, each terminal device can also directly establish a communication link with the cloud system 204. The cloud system 204 deploys a cloud storage system, and the server 203 is the implementation terminal for the cloud storage system access method provided in this application. When the cloud storage system access method provided in this application is applied... Figure 2In the system architecture shown, a process can be as follows: First, the terminal device sends an authentication request carrying authentication information to the server 203; then, the server 203 receives the authentication request, extracts the authentication information from the authentication request, and performs authentication on the authentication information; next, after the server 203 confirms that the authentication information has passed authentication, it sends a temporary credential retrieval request to the cloud system 204, and the cloud system 204 returns the generated temporary access credential to the server 203 based on the temporary credential retrieval request; finally, the server 203 returns the temporary access credential to the terminal device that sent the authentication request. When the terminal device needs to access the cloud storage system in the cloud system 204, it can directly access the cloud storage system by carrying the temporary access credential. For example, the vehicle sensor 201 can access the cloud storage system by sending an access request carrying a temporary access credential, thereby uploading the detected data to the cloud storage system.

[0051] In one embodiment of this application, when sending a temporary credential acquisition request to the cloud system 204, permission configuration file information can also be sent to the cloud system 204 to configure the access permissions of the temporary access credential in the cloud storage system.

[0052] In one embodiment of this application, when sending a temporary credential retrieval request to the cloud system 204, configured credential validity information can also be sent to the cloud system 204 to configure the access validity of the temporary access credential in the cloud storage system.

[0053] It should be understood that Figure 1 The number of terminal devices, servers, and cloud systems shown is merely illustrative. Depending on implementation needs, any number of terminal devices, servers, and cloud systems can be included. For example, server 203 could be a server cluster composed of multiple servers.

[0054] It should be noted that, Figure 1The illustration shown is merely one embodiment of this application. Although the terminal in this embodiment is a server, in other embodiments, the terminal can be a workstation or other types of terminal devices. Although the terminal device that needs to transmit data back in this embodiment is a vehicle-mounted sensor, smart network camera, or other mobile device located in the vehicle, in other embodiments, the terminal device that needs to transmit data back to the cloud system can be a smartphone, IoT device, or other devices outside the vehicle networking field, or various fixed devices. Although the terminal device that performs authentication operations on the authentication information and sends a temporary credential acquisition request to the cloud system is the same device—the server—in this embodiment, in other embodiments, one device can perform authentication operations on the authentication information, and another device can send a temporary credential acquisition request to the cloud system. This application does not limit the scope of protection in any way.

[0055] Furthermore, it is readily understood that the cloud storage system access method provided in the embodiments of this application is generally executed by a server, and correspondingly, the cloud storage system access device is generally located in the server. However, in other embodiments of this application, the terminal device may also have similar functions to the server, thereby executing the cloud storage system access scheme provided in the embodiments of this application.

[0056] The server can authenticate each terminal device and return temporary access credentials to the terminal device after successful authentication. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Terminals can be smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, etc., but are not limited to these. Terminals and servers can be connected directly or indirectly via wired or wireless communication; this application does not impose any restrictions on this connection.

[0057] This application's embodiments can be applied to cloud computing technology. Specifically, a cloud server can be used to perform operations such as authenticating terminal devices, issuing temporary access credentials, receiving access requests from terminal devices, and storing data returned by terminal devices. Cloud computing is a computing model that distributes computing tasks across a resource pool composed of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" are infinitely scalable, readily available, on-demand, expandable, and pay-as-you-go.

[0058] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform, generally called IaaS (Infrastructure as a Service)) platform is established. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines containing operating systems), storage devices, and network devices.

[0059] Based on logical function, a PaaS (Platform as a Service) layer can be deployed on top of the IaaS (Infrastructure as a Service) layer, and a SaaS (Software as a Service) layer can be deployed on top of the PaaS layer. Alternatively, SaaS can be deployed directly on top of IaaS. PaaS is a platform for running software, such as databases and web containers. SaaS refers to various types of business software, such as web portals and bulk SMS senders. Generally speaking, SaaS and PaaS are upper layers compared to IaaS.

[0060] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0061] Figure 3 A flowchart illustrating an access method for a cloud storage system according to an embodiment of this application is shown. This access method can be performed by various devices having computing, storage, and communication capabilities, such as… Figure 2 Server 203 is shown in the image. (See reference...) Figure 3 As shown, the access method for this cloud storage system includes at least the following steps:

[0062] In step 310, based on the authentication request received from the access device, the authentication information carried in the authentication request is obtained. The authentication information includes device identification information and first signature information. The first signature information is generated by the access device based on the device identification information and the first pre-made static token information. The first pre-made static token information is generated by the cloud system based on the device identification information.

[0063] Specifically, the device identification information may include a device identification number and tenant identification information corresponding to the device identification number. In this case, the first signature information is generated by the accessing device based on the device identification number, the tenant identification information and the first pre-made static token information, while the first pre-made static token information is generated by the cloud system based on the device identification number and the tenant identification information.

[0064] The Device ID is used to uniquely identify a device. Each Device ID has a unique corresponding tenant identifier, allowing for the differentiation of different types of Device IDs. For example, the tenant identifier can distinguish devices from different manufacturers. The first pre-built static token is generated by the cloud system based on the Device ID and the tenant identifier. Therefore, the identity of a specific device from a particular manufacturer can be uniquely determined based on the Device ID and its corresponding tenant identifier.

[0065] Specifically, authentication requests can be sent by calling a RESTful API, which employs the stateless design principles of HTTP. The first pre-built static token can be a JWT-based token. JWT (JSON Web Token) is an open standard (RFC 7519) based on JSON for transmitting claims between web application environments. This token is designed to be compact and secure, and is particularly suitable for single sign-on (SSO) scenarios in distributed sites.

[0066] Therefore, the generation of the first pre-built static token information can be varied. For example, it can be generated by signing the device identifier and tenant identifier information. Alternatively, it can be a digest of the combination of the device identifier and tenant identifier information generated using a hash algorithm. Different first pre-built static token information can be generated based on different device identifiers and tenant identifiers. After obtaining the first pre-built static token information provided by the cloud system, it can be burned into the access device. The first signature information can be generated by hashing the combination of the device identifier, tenant identifier information, and the first pre-built static token information.

[0067] Access devices can be of various types, including mobile and fixed devices. They can be used in various fields or application scenarios, such as onboard sensors and smart network cameras located in vehicles in the field of intelligent driving.

[0068] Of course, in other embodiments of this application, the device identification information may be equivalent to the device identification number or may include other information.

[0069] In one embodiment of this application, the access device is a mobile device, and the device identifier and tenant identifier information are burned into the access device.

[0070] Specifically, device identification number and tenant identification information can be programmed into the access device during production, so that the access device carries the programmed device identification number and tenant identification information when it leaves the factory. The access device can only use the programmed device identification number and tenant identification information for authentication, thereby improving the security of subsequent authentication.

[0071] Figure 4 A schematic diagram illustrating the principle of accessing a cloud storage system according to an embodiment of this application is shown. Below, in conjunction with… Figure 4 This application further describes the solutions of its embodiments. Figure 4 In this process, the device sends authentication information to the cloud storage temporary authorization access control service to request a temporary token. The cloud storage temporary authorization access control service then forwards the authentication information from the device to the device access authentication service, requesting device authentication. Device authentication is the process of verifying the device's legitimacy. The cloud system includes STS (Security Token Service) and OSS (Object Storage Service). STS is a web service that provides temporary access tokens to cloud computing users, enabling temporary authorized access to OSS. OSS is used to store object-type data such as video files and image files, and can also store other types of data; therefore, OSS is the cloud storage system within the cloud system. Besides STS and OSS, the cloud system can also include other types of systems or services. Figure 4In this embodiment, although the cloud storage temporary authorization access control service and the device access authentication service are separated and neither is located in the cloud system, in other embodiments, one or more of the cloud storage temporary authorization access control service and the device access authentication service may be located in the cloud system. Alternatively, the cloud storage temporary authorization access control service and the device access authentication service can be integrated into a single service. The advantage of not integrating them in this embodiment is that it allows for functional isolation of the two modules, improving the robustness of the entire system.

[0072] In one embodiment of this application, the first pre-built static token information is generated when the access device is registered in the cloud system.

[0073] Figure 5 A schematic diagram illustrating the process of obtaining a pre-made static token according to an embodiment of this application is shown. Please refer to... Figure 5 As shown, the process of obtaining a pre-made static token through device registration is as follows: First, open the console entry provided by the cloud system; then, log in to the console with the administrator account; next, enter the device ID and tenant ID in the console; finally, obtain the device pre-made static token, for example, the device pre-made static token provided by the cloud system can be displayed on the console page. Figure 5 The process shown can be implemented by the equipment manufacturer registering in the cloud system.

[0074] In one embodiment of this application, the authentication information also includes a timestamp generated when the authentication request is sent, and the first signature information is also generated based on the timestamp.

[0075] In this embodiment of the application, the security of the authentication process is further improved by adding a timestamp to the authentication information.

[0076] The authentication information sent by the accessing device to the cloud storage temporary authorization access control service may include the following:

[0077] {

[0078] "deviceID": "2019040403",

[0079] "signature":"280602452f341a19e346c7f6a47ba0ab",

[0080] "timestamp":1554885066

[0081] "TenantID":"123456"

[0082] }

[0083] Among them, deviceID is the device SN (Serial Number), which can be used to distinguish multiple devices of a tenant; signature is the first signature information; timestamp is the timestamp; and TenantID is the tenant ID. The signature can be generated by the MD5 (TenantID + pre-made static token + deviceID + timestamp) operation, which means combining TenantID, pre-made static token, deviceID, and timestamp into a string in this order, and then inputting the string into the MD5 message digest algorithm for operation.

[0084] When sending the above authentication information, the accessing device can also encrypt the authentication information first, and then send the encrypted authentication information to the cloud storage temporary authorization access control service.

[0085] In step 320, the second pre-made static token information is obtained based on the device identification information, and the first signature information is authenticated based on the second pre-made static token information.

[0086] This step involves authenticating the authentication information.

[0087] In one embodiment of this application, obtaining second pre-made static token information based on device identification information includes: generating second pre-made static token information based on device identification information.

[0088] When the device identification information includes the device identification number and the tenant identification information, a second pre-made static token information can be generated based on the device identification number and the tenant identification information.

[0089] The second pre-made static token information can be generated by using a cloud system to generate the first pre-made static token information.

[0090] Figure 6 A flowchart illustrating the authentication of first signature information according to one embodiment of this application is shown. Figure 6 As shown, the following steps may be included:

[0091] In step 610, a query operation is performed in the cloud system based on the device identification information to obtain the second pre-made static token information corresponding to the device identification information.

[0092] When the device identification information includes both the device identification number and the tenant identification information, a query operation is performed in the cloud system based on the device identification number and the tenant identification information to obtain the second pre-made static token information that corresponds to both the device identification number and the tenant identification information.

[0093] After generating pre-made static token information based on the device identifier and tenant identifier information, the cloud system can store the device identifier, tenant identifier information, and pre-made static token information in the database.

[0094] The difference between the second pre-made static token information and the first pre-made static token information is that the first pre-made static token information is the pre-made static token information obtained by the access device from the cloud system to generate the first signature information, while the second pre-made static token information is the pre-made static token information generated and saved by the cloud system.

[0095] In step 620, a second signature is generated based on the device identification information and the second pre-made static token information.

[0096] When the authentication information also includes a timestamp, a second signature is generated based on the timestamp, tenant identification information, device identification number, and second pre-made static token information.

[0097] An agreement is established in advance with the access device to generate the second signature information according to the method used by the access device to generate the first signature information.

[0098] In step 630, the first signature information is authenticated by comparing the first signature information with the second signature information.

[0099] The first signature information is compared with the second signature information. If they match, the authentication is successful; otherwise, the authentication fails.

[0100] Figure 7 A schematic diagram illustrating the process of authenticating a device through a device access authentication service according to an embodiment of this application is shown. Please refer to... Figure 7 The specific process for certifying equipment includes the following steps:

[0101] First, the device sends authentication information to the cloud storage temporary authorization access control service. Then, after receiving the authentication information, the cloud storage temporary authorization access control service sends an access authentication request to the device access authentication service, enabling the device access authentication service to obtain the authentication information. Then, the device access authentication service accesses the database to obtain the information required for authentication, and then performs authentication operations on the authentication information.

[0102] The above process verifies the legitimacy of the device, ensuring the security of device access.

[0103] In step 330, if authentication is successful, a temporary credential retrieval request is sent to the cloud system, and a temporary access credential is obtained from the cloud system based on the temporary credential retrieval request.

[0104] Please continue reading Figure 4The cloud storage temporary access control service accesses the STS in the cloud system by calling the "assume role" interface. It can then obtain the STS credentials returned by the cloud system, which serve as the temporary access credentials for the assumed role. A role is an entity identity type, and different resource access permissions can be granted to different roles. Multiple roles can be created under a primary cloud user account.

[0105] In one embodiment of this application, before sending a temporary credential retrieval request to the cloud system, the method further includes: obtaining permission configuration file information; sending a temporary credential retrieval request to the cloud system, including: sending permission configuration file information to the cloud system by sending a temporary credential retrieval request to configure the access permissions of the temporary access credential in the cloud storage system.

[0106] The permission configuration file is used to configure the access permissions of devices carrying corresponding temporary access credentials in the cloud storage system. Specifically, the permission configuration file can be stored locally as a file. When the `assume role` interface is called, the permission configuration file is read from the local file and uploaded to STS. Users can configure access permissions by accessing the temporary authorization access control service in the cloud storage.

[0107] By configuring access permissions for temporary access credentials, devices carrying temporary access credentials can only access the cloud storage system within the scope of the access permissions specified, thereby improving access security.

[0108] In one embodiment of this application, the permission configuration file information includes at least one of the following: credential validity information, folders with access permissions, and types of access permissions.

[0109] You can send a temporary credential retrieval request to the cloud system to send information about the validity period of the temporary access credential, the folder with access permissions, and the type of access permissions.

[0110] Access permissions can include, for example, read permissions and write permissions.

[0111] By configuring folders with access permissions and the types of access permissions in the permission configuration file, the control of permissions becomes more granular and flexible.

[0112] Figure 8 This diagram illustrates the principle of configuring access permissions for temporary access credentials according to one embodiment of this application. Please refer to... Figure 8As shown, the cloud storage temporary authorization access control service first reads the fine-grained permission configuration file, and then uploads the read information to the STS in the cloud system, thereby realizing fine-grained permission configuration.

[0113] You can upload permission configuration file information when calling the API. The content of the permission configuration file information can be as follows:

[0114] appname: tokenserver

[0115] httpport: 1234

[0116] iot:

[0117] authrequesturl: http: / / 10.10.108.22:9088 / api / devices / v1 / authentication / auth_requests

[0118] tmpkey: LTAI8JaU5xMA1wts

[0119] tmpsecret: gLgAWZqaM0npyzWdQOKAOAZ2zCC7ra

[0120] roleacs: acs:ram::1717205879324084:role / ramtest-write

[0121] RoleSessionName: NebulaV1

[0122] #ttl [900s.3600s]

[0123] TTL: 3600

[0124] The permission configuration file can configure which permissions a temporary access credential has for which storage space (bucket). For example, the permission configuration file shown above indicates that the temporary access credential has write permissions for the NebulaV1 folder under the storage space.

[0125] Therefore, through STS, a temporary access credential with custom validity and permissions can be issued to a third-party application or a sub-user (i.e., a user whose identity is specifically managed by a cloud user).

[0126] As mentioned earlier, permission configuration file information can be uploaded to the STS in the cloud system by calling the assume role interface. Ultimately, the OSS verifies the STS credentials. Therefore, in Figure 4In the illustrated embodiment, a synchronization mechanism is also set between STS and OSS. STS can synchronize the permission configuration file information corresponding to the STS credential to OSS, so that OSS can set the corresponding access permissions for the STS credential. When receiving an access request from the device carrying the STS credential, OSS can verify whether the access request exceeds the access permissions corresponding to the STS credential based on the STS credential.

[0127] In step 340, a temporary access credential is returned to the accessing device so that the accessing device can access the cloud storage system in the cloud system by carrying the temporary access credential.

[0128] Please continue reading Figure 4 After obtaining the STS credential returned by the cloud storage temporary authorization access control service, the service sends the STS credential to the device, thereby caching the STS credential on the device. The device can then use the STS credential to upload data to OSS in the cloud system.

[0129] Access devices can directly access cloud storage systems using temporary access credentials, without needing to forward data through cloud data upload services. The cloud storage system can be an object storage service. When accessing the cloud storage system, the access device can read and write to it; it can both upload and retrieve data stored within the cloud storage system.

[0130] In one embodiment of this application, returning a temporary access credential to an access device to enable the access device to access a cloud storage system in a cloud system by carrying the temporary access credential includes: returning a temporary access credential to the access device to enable the access device to send an access request carrying the temporary access credential to the cloud storage system in the cloud system, wherein the cloud storage system verifies the legality of the temporary access credential and determines whether to reject the access request of the access device based on the verification result.

[0131] If the verification fails, the access request to the device is denied; otherwise, access to the device is allowed.

[0132] The content of temporary access credentials can be configured according to actual needs. Temporary access credentials do not include the cloud user's main account's access key / secret key. Temporary access credentials are generated by the cloud system; therefore, the cloud system can verify the validity of temporary access credentials for identity authentication.

[0133] Figure 9 A schematic diagram of the return structure of a cloud storage temporary authorization access control service according to an embodiment of this application is shown. See also Figure 9As shown, credentials are temporary access credentials. The AccessKeyId / AccessKeySecret / SecurityToken under credentials contain the authentication information required by the mobile device when uploading data. This information is temporary.

[0134] In one embodiment of this application, sending a temporary credential retrieval request to a cloud system includes:

[0135] Upon receiving the first cloud storage system access request from the accessing device, a first temporary credential retrieval request is sent to the cloud system to obtain the first temporary access credential from the cloud system.

[0136] The method further includes: when the access request sent by the access device to the cloud storage system exceeds the access permission corresponding to the first temporary access credential in the access request, sending a second temporary credential acquisition request to the cloud system based on the second cloud storage system access request received from the access device, so as to obtain the second temporary access credential fed back by the cloud system.

[0137] After obtaining the first temporary access credential, the access device returns the first temporary access credential to the access device. The access device then sends an access request carrying the first temporary access credential to access the cloud storage system in the cloud system. If the access request sent by the access device to the cloud storage system exceeds the access permissions corresponding to the first temporary access credential in the access request, it means that the access request has been rejected by the cloud storage system due to reasons such as the expiration of the temporary access credential. In this case, the access device needs to obtain a new temporary access credential and reconfigure the access permissions.

[0138] The cloud storage system will determine whether the access request exceeds the access permissions corresponding to the temporary access credentials in the access request, and will reject the access request that exceeds the access permissions.

[0139] As mentioned earlier, the permission configuration file information includes at least one of the following: credential expiration information, folders with access permissions, and the type of access permission. Therefore, the corresponding access permissions will be configured in the cloud storage system.

[0140] When the permission configuration file includes credential expiration information, the obtained temporary access credentials have an expiration date. If an access request sent by an access device to the cloud storage system is rejected because the temporary access credential is not valid, the access device needs to request a temporary access credential again.

[0141] The cloud system can verify whether a temporary access credential has expired based on its validity information, and thus determine whether an access request carrying the temporary access credential exceeds the access permissions.

[0142] The verification of whether a temporary access credential has expired can be performed by the cloud storage system within the cloud system. Specifically, the credential validity period can be set in seconds, and the validity of a temporary access credential can be verified as follows: determine whether the current time > (the time when the temporary access credential was issued + the time length set in the credential validity period) is true; if so, the temporary access credential has not expired; otherwise, the temporary access credential has expired.

[0143] Access requests that exceed other types of access permissions will also be rejected by the cloud storage system.

[0144] Of course, access devices don't necessarily have to wait until their access request to the cloud storage system is denied before they can re-request temporary access credentials. For example, in... Figure 9 In the illustrated embodiment, the temporary access credential provided to the access device contains an expiration information. Therefore, the access device can determine when the temporary access credential expires based on the expiration information, and proactively request a new temporary access credential when the expiration is detected.

[0145] In summary, the cloud storage system access method provided by the embodiments of this application has the following beneficial technical effects: It designs a novel cloud storage access control system, unifying the access authentication process for mobile devices accessing cloud storage services; mobile devices can directly call the relevant interfaces provided by the AWS S3 SDK to upload data without additional cloud data upload services, realizing a direct data return path from the mobile device to the cloud system; it provides more granular and flexible permission control, precisely controlling the read and write permissions of mobile devices to cloud storage folders; mobile devices do not need to have built-in accesskey / secretkey information, only need to burn device identification information, tenant identification information, and the first pre-built static token information, reducing the risk of leakage of the main account's AccessKeyID and AccessKeySecret.

[0146] The following describes an apparatus embodiment of this application, which can be used to execute the cloud storage system access method in the above embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the cloud storage system access method described above.

[0147] Figure 10 A block diagram of an access device for a cloud storage system according to an embodiment of this application is shown.

[0148] Reference Figure 10As shown, an access device 1000 for a cloud storage system according to an embodiment of this application includes: an authentication information acquisition unit 1010, an authentication unit 1020, a temporary access credential acquisition unit 1030, and a return unit 1040. The authentication information acquisition unit 1010 is used to acquire authentication information carried in an authentication request received from an access device. The authentication information includes device identification information and first signature information, the first signature information being generated by the access device based on the device identification information and first pre-made static token information, which is generated by the cloud system based on the device identification information. The authentication unit 1020 is used to obtain second pre-made static token information based on the device identification information and to authenticate the first signature information based on the second pre-made static token information. The temporary access credential acquisition unit 1030 is used to send a temporary credential acquisition request to the cloud system if authentication is successful, and to acquire a temporary access credential returned by the cloud system based on the temporary credential acquisition request. The return unit 1040 is used to return the temporary access credential to the access device, enabling the access device to access the cloud storage system within the cloud system by carrying the temporary access credential.

[0149] In some embodiments of this application, based on the foregoing scheme, before sending a temporary credential acquisition request to the cloud system, the temporary access credential acquisition unit 1030 is further configured to: acquire permission configuration file information; the temporary access credential acquisition unit 1030 is configured to: send the permission configuration file information to the cloud system by sending a temporary credential acquisition request to the cloud system, so as to configure the access permissions of the temporary access credential in the cloud storage system.

[0150] In some embodiments of this application, based on the foregoing scheme, the return unit 1040 is configured to: return the temporary access credential to the access device, so that the access device sends an access request carrying the temporary access credential to the cloud storage system in the cloud system, and the cloud storage system verifies the legality of the temporary access credential and determines whether to reject the access request of the access device based on the verification result.

[0151] In some embodiments of this application, based on the foregoing scheme, the permission configuration file information includes at least one of the following: credential validity information, folders with access permissions, and types of access permissions.

[0152] In some embodiments of this application, based on the foregoing scheme, the temporary access credential acquisition unit 1030 is configured to: send a first temporary credential acquisition request to the cloud system based on a first cloud storage system access request received from the access device, so as to obtain a first temporary access credential fed back by the cloud system; the temporary access credential acquisition unit 1030 is further configured to: when the access request sent by the access device to the cloud storage system exceeds the access permission corresponding to the first temporary access credential in the access request, send a second temporary credential acquisition request to the cloud system based on a second cloud storage system access request received from the access device, so as to obtain a second temporary access credential fed back by the cloud system.

[0153] In some embodiments of this application, based on the foregoing scheme, the authentication unit 1020 is configured to: perform a query operation in the cloud system based on the device identification information to obtain second pre-made static token information corresponding to the device identification information; generate second signature information based on the device identification information and the second pre-made static token information; and authenticate the first signature information by comparing the first signature information with the second signature information.

[0154] In some embodiments of this application, based on the foregoing scheme, the authentication information further includes a timestamp generated when the authentication request is sent, and the first signature information is also generated based on the timestamp.

[0155] In some embodiments of this application, based on the foregoing scheme, the device identification information includes a device identification number and tenant identification information.

[0156] In some embodiments of this application, based on the foregoing scheme, the first pre-made static token information is generated when the access device is registered in the cloud system.

[0157] In some embodiments of this application, based on the foregoing scheme, the access device is a mobile device, and the device identifier and the tenant identifier information are burned into the access device.

[0158] Figure 11 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0159] It should be noted that, Figure 11 The computer system 1100 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0160] like Figure 11As shown, the computer system 1100 includes a Central Processing Unit (CPU) 1101, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 1102 or programs loaded from storage portion 1108 into Random Access Memory (RAM) 1103, such as performing the methods described in the above embodiments. Various programs and data required for system operation are also stored in RAM 1103. The CPU 1101, ROM 1102, and RAM 1103 are interconnected via bus 1104. An Input / Output (I / O) interface 1105 is also connected to bus 1104.

[0161] The following components are connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. Removable media 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1110 as needed so that computer programs read from them can be installed into storage section 1108 as needed.

[0162] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by central processing unit (CPU) 1101, it performs various functions defined in the system of this application.

[0163] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0164] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0165] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0166] In one aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0167] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0168] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0169] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0170] The data collection and processing plan outlined in this application must be implemented in strict accordance with the requirements of relevant national laws and regulations, obtaining the informed consent or separate consent of the data subject (or having a legal basis as stipulated by the relevant national laws and regulations), and conducting subsequent data use and processing within the scope authorized by laws and regulations and the data subject.

[0171] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. An access method of a cloud storage system, characterized by, The method comprises: obtaining permission profile information, the permission profile information being used for configuring access permission of an access device carrying corresponding temporary access credential in a cloud storage system, the permission profile information comprising at least one of the following: credential validity information, a folder with access permission, and a type of access permission; obtaining authentication information carried in an authentication request from the access device according to reception of the authentication request, wherein the authentication information comprises device identification information and first signature information, the first signature information being generated by the access device according to the device identification information and first pre-prepared static token information, the first pre-prepared static token information being generated by the cloud system according to the device identification information; performing a query operation in the cloud system according to the device identification information to obtain second pre-prepared static token information corresponding to the device identification information; generating second signature information according to the device identification information and the second pre-prepared static token information; authenticating the first signature information by comparing the first signature information with the second signature information; if authentication is passed, sending the permission profile information to the cloud system by sending a temporary credential obtaining request to the cloud system to configure access permission of the temporary access credential in the cloud storage system, and obtaining a temporary access credential fed back by the cloud system according to the temporary credential obtaining request; returning the temporary access credential to the access device to enable the access device to access the cloud storage system in the cloud system by carrying the temporary access credential. 2.The access method of the cloud storage system according to claim 1, wherein, The returning of the temporary access credential to the access device to enable the access device to access the cloud storage system in the cloud system comprises: returning the temporary access credential to the access device to enable the access device to send an access request carrying the temporary access credential to the cloud storage system in the cloud system, and enabling the cloud storage system to verify the legality of the temporary access credential and determine whether to reject the access request of the access device according to a verification result.

3. The access method of the cloud storage system according to claim 1, wherein the sending of the temporary credential obtaining request to the cloud system comprises: sending a first temporary credential obtaining request to the cloud system to obtain a first temporary access credential fed back by the cloud system according to reception of a first cloud storage system access request from the access device. The method further comprises: when an access request sent by the access device to the cloud storage system exceeds access permission corresponding to the first temporary access credential in the access request, sending a second temporary credential obtaining request to the cloud system to obtain a second temporary access credential fed back by the cloud system according to reception of a second cloud storage system access request from the access device.

4. The access method of a cloud storage system according to claim 1, wherein, The authentication information further comprises a timestamp generated when the authentication request is sent, and the first signature information is further generated according to the timestamp.

5. The access method of the cloud storage system according to claim 1 or 4, wherein, The device identification information comprises a device identification number and tenant identification information.

6. The access method of a cloud storage system according to claim 1, wherein, The first pre-prepared static token information is generated when the cloud system registers the access device.

7. The access method of a cloud storage system according to claim 5, wherein, The access device is a mobile device, and the device identifier and the tenant identifier information are burned into the access device.

8. An access device of a cloud storage system, characterized in that, The apparatus comprises: An authentication information obtaining unit configured to, according to a received authentication request from an access device, obtain authentication information carried in the authentication request, wherein the authentication information comprises device identifier information and first signature information, the first signature information is generated by the access device according to the device identifier information and first pre-prepared static token information, and the first pre-prepared static token information is generated by a cloud system according to the device identifier information; An authentication unit configured to obtain second pre-prepared static token information according to the device identifier information, and authenticate the first signature information according to the second pre-prepared static token information; the authentication unit is configured to: perform a query operation in the cloud system according to the device identifier information to obtain second pre-prepared static token information corresponding to the device identifier information; generate second signature information according to the device identifier information and the second pre-prepared static token information; and authenticate the first signature information by comparing the first signature information with the second signature information; A temporary access credential obtaining unit configured to, if the authentication is passed, send a temporary credential obtaining request to the cloud system, and obtain a temporary access credential fed back by the cloud system according to the temporary credential obtaining request; Before sending the temporary credential obtaining request to the cloud system, the temporary access credential obtaining unit is further configured to obtain permission configuration file information, the permission configuration file information being used to configure access permission of an access device carrying a corresponding temporary access credential in a cloud storage system, and the permission configuration file information comprising at least one of the following: credential validity information, a folder with access permission, and a type of access permission; the temporary access credential obtaining unit is configured to send the permission configuration file information to the cloud system by sending the temporary credential obtaining request to the cloud system, so as to configure access permission of the temporary access credential in the cloud storage system; A returning unit configured to return the temporary access credential to the access device, so that the access device accesses a cloud storage system in the cloud system by carrying the temporary access credential.

9. A computer readable medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, implements the access method of the cloud storage system according to any one of claims 1 to 7.

10. An electronic device, comprising: Comprise: One or more processors; A storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more programs cause the one or more processors to implement the access method of the cloud storage system according to any one of claims 1 to 7.

11. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium, a processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device executes the access method of the cloud storage system according to any one of claims 1 to 7.

Images