Data access method, apparatus, device, and storage medium

Abstract

The application provides a data access method, device and equipment and a computer readable storage medium. The method comprises the following steps: obtaining login information of a client; determining a connection valid duration and sending first token information according to the login information; obtaining a data processing request determined by the client according to the first token information, wherein the data access request comprises second token information; determining identity information and data processing authority of the client according to the second token information; determining to-be-processed data according to the data processing request of the client within the connection valid duration; and processing target data in the to-be-processed data and / or sending the target data to the client according to the identity information and the data processing authority. The method can reduce the risk of information leakage caused by a long connection time, can synchronize the identity information and the data processing authority in the server and the client, and improves the security of data storage.

Description

Technical Field

[0001] This application relates to the technical field of information security, and in particular to a data access method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] In traditional IoT data access processes, firewalls are typically used to form physical perimeter defenses, storing the servers requiring protection and the data they store, such as transaction records, insurance bills, loan information, and electronic signatures, within an "internal network" inside the firewall. However, with the rise of technologies such as cloud computing and big data, the boundaries of IoT network architecture are constantly expanding. Consequently, traditional security boundaries represented by firewalls are increasingly being undermined, failing to meet the security needs of the IoT. IoT security based on firewalls suffers from insufficient security, and the information stored within the IoT, such as transaction records, insurance bills, loan information, and electronic signatures, is easily leaked. Summary of the Invention

[0003] This application provides a data access method, apparatus, device, and computer-readable storage medium, aiming to improve the security of the Internet of Things (IoT) and prevent customers' electronic billing information or electronic signatures from being maliciously read, leading to information leakage.

[0004] In a first aspect, this application provides a data access method, which includes the following steps:

[0005] Obtain the client's login information;

[0006] The connection validity period is determined based on the login information, and the first token information is sent to the client.

[0007] Obtain the data processing request determined by the client based on the first token information, wherein the data access request includes the second token information;

[0008] The client's identity information and data processing permissions are determined based on the second token information;

[0009] Within the effective connection duration, determine the data to be processed based on the client's data processing request; and process the target data in the data to be processed and / or send the target data to the client based on the identity information and the data processing permissions.

[0010] Secondly, this application also provides a data access device, the data access device comprising:

[0011] The login information acquisition module is used to acquire the client's login information;

[0012] The login information verification module is used to determine the effective duration of the connection based on the login information and to send the first token information to the client.

[0013] A data processing request acquisition module is used to acquire a data processing request determined by the client based on the first token information, wherein the data access request includes second token information.

[0014] An identity information determination module is used to determine the client's identity information and data processing permissions based on the second token information;

[0015] The data processing module is used to determine the data to be processed based on the data processing request of the client within the effective connection duration; and to process the target data in the data to be processed based on the identity information and the data processing permissions and / or send the target data to the client.

[0016] Thirdly, this application also provides a computer device, the computer device including a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the steps of the data access method as described above.

[0017] Fourthly, this application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the data access method described above.

[0018] This application provides a data access method, apparatus, device, and computer-readable storage medium. The application obtains a client's login information; determines the effective connection duration based on the login information and sends a first token to the client; obtains a data processing request determined by the client based on the first token, the data access request including second token information; determines the client's identity information and data processing permissions based on the second token information; within the effective connection duration, determines the data to be processed based on the client's data processing request; and processes target data in the data to be processed and / or sends the target data to the client based on the identity information and the data processing permissions. By verifying login information, determining the effective connection duration, and sending the first token to the client, the application enables communication between the client and server within the effective connection duration, reducing the risk of information leakage due to excessively long connection times. Simultaneously, it allows the client to determine a data processing request including the second token information based on the first token information, synchronizing the client's identity information and data processing permissions between the server and the client, and processing the target data based on the synchronized identity information and data processing permissions, thus improving data storage security. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating a data access method provided in an embodiment of this application;

[0021] Figure 2 A schematic diagram illustrating a scenario of a data access method provided in an embodiment of this application;

[0022] Figure 3 A schematic block diagram of a data access device provided in an embodiment of this application;

[0023] Figure 4 This is a schematic block diagram of the structure of a computer device according to an embodiment of this application. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0026] This application provides a data access method, apparatus, computer device, and computer-readable storage medium. The data access method is applied to a server. Optionally, the server includes a terminal device, which may be an electronic device such as a tablet computer, laptop computer, or desktop computer. Alternatively, the server may be a standalone server or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0027] like Figure 2As shown in Figure 2, which is a schematic diagram of a data access method provided in this application, the client can send login information to the server. After the server verifies the login information, it returns the first token information to the client. The client can determine the data processing request based on the first token information and send the data processing request to the server so that the server can send the corresponding target data to the client, thereby realizing the information interaction between the client and the server.

[0028] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0029] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a data access method provided in an embodiment of this application.

[0030] like Figure 1 As shown, the data access method includes steps S101 to S105.

[0031] Step S101: Obtain the client's login information.

[0032] For example, during the process of accessing data on the client side, it is necessary to log in to the server side, so the server side can obtain the client's login information.

[0033] Optionally, the login information includes the login name, login password, and login address. The login information is verified by checking whether the client's login name, login password, and login address are correct and whether the correspondence is correct.

[0034] For example, the server-side login information database contains multiple login names, corresponding login passwords, and corresponding login addresses. After obtaining the client's login information, the login information sent by the client is compared with the login names, login passwords, and corresponding login addresses stored in the login information database. If the comparison is successful, for example, if the login information database can find a login name, login password, and login address that are the same as those contained in the client's login information, and the correspondence between the login name, login password, and login address is also the same, then the login information is confirmed to have passed verification.

[0035] For example, when sending login information, the client can encrypt the login information using the SM2 national cryptographic algorithm to prevent information leakage.

[0036] Understandably, during the user creation process, the server stores the user's login name, password, and address to determine whether the client is a user that has already been created after obtaining the client's login information.

[0037] Step S102: Determine the effective duration of the connection based on the login information and send the first token information to the client.

[0038] For example, after the login information is verified, the connection validity period is determined and a first token is sent to the client so that the client can determine the client's identity information and data processing permissions on the server based on the first token.

[0039] For example, the connection validity period can be determined based on the client's login information, such as the login name and the correspondence between login names and connection validity periods. Another example is that when the server receives login information from multiple clients, it randomly assigns a corresponding connection validity period to each client, where the sum of the connection validity periods assigned to all clients is a preset duration threshold. Yet another example is that the server can also determine the currently assigned connection duration based on the client's historical connection duration within a preset time period. For instance, if a client's connection duration within a month is 30 hours, and its historical connection duration within that month is 5 hours, then a connection duration of 25 hours can be assigned to that client. It should be noted that the above-described determination of connection duration is illustrative and does not limit the specific method or duration of connection duration determination in this application.

[0040] In the specific implementation process, determining the connection validity period and sending the first token information to the client based on the client's login information includes: after the login information is verified, determining the connection validity period and sending the first token information to the client. Understandably, if the login information fails verification, the first token information will not be sent to the client.

[0041] For example, the first token information is used to indicate the client's corresponding identity information and data processing permissions, so that the client can determine the corresponding data processing request.

[0042] Optionally, the first token information includes token information.

[0043] Step S103: Obtain the data processing request determined by the client based on the first token information. The data processing request includes the second token information.

[0044] For example, after receiving the first token information, the client determines the data processing request based on the first token information. It is understood that the data processing request includes the second token information, which is determined by the client based on the first token information and the identity information and data processing permissions stored in the client.

[0045] For example, after the client confirms the first token information, it sends a data processing request to the server, so that the server can receive the data processing request containing the second token information sent by the client.

[0046] In some embodiments, obtaining the data processing request determined by the client based on the first token information includes: if the identity information stored by the client is different from the identity information corresponding to the first token information, obtaining the second token information sent by the client that includes the identity information stored by the client and the identity information corresponding to the first token information.

[0047] For example, after receiving the first token information, the client determines whether the identity information corresponding to the first token information is the same as the identity information stored locally. If the identity information stored locally by the client is different from the identity information corresponding to the first token information, the client determines the second token information, which includes the identity information stored locally and the identity information corresponding to the first token information, and sends the second token information to the server so that the server can determine the identity information corresponding to the client.

[0048] In some embodiments, determining the client's identity information based on the second token information includes: if the second token information includes the client's stored identity information and the identity information contained in the first token information, determining the client's behavioral data when sending the second token information; obtaining the client's historical behavioral data; and determining the client's identity information based on the client's historical behavioral data and the behavioral data corresponding to when the client sent the second token information.

[0049] Understandably, if the identity information stored by the client is different from the identity information contained in the first token information, that is, the default identity information of the client is different from the default identity information of the server, the client's identity information can be determined by the behavioral data corresponding to the client sending the second token information and historical behavioral data.

[0050] For example, if the behavioral data corresponding to the client sending the second token information is the same as the historical behavioral data, the client's identity information can be determined as the identity information contained in the first token; if the behavioral data corresponding to the client sending the second token information is different from the historical behavioral data, the client's identity information can be determined as the identity information stored in the client, or the two can be compared to determine the identity information corresponding to the lower privilege.

[0051] Understandably, if the identity information stored in the client is different from the identity information contained in the first token, it is determined that the identity information stored in the client and the identity information stored in the server have not been synchronized. The identity information corresponding to the client is determined by determining the client's behavior data when sending the second token and historical data, so as to improve the accuracy of the client's identity information determination and enhance the security of the data stored in the server.

[0052] In other embodiments, if the identity information stored by the client is the same as the identity information corresponding to the first token information, the second token information containing the identity information corresponding to the first token sent by the client is obtained.

[0053] For example, if the identity information stored locally on the client is the same as the identity information corresponding to the first token information, then the identity information stored locally or the identity information corresponding to the first token information is used to determine the second token information, and the second token information is sent to the client.

[0054] It should be noted that the first token information may also include information required for communication between the client and the server, such as the server address and the token validity period. This application does not limit the information contained in the first token information.

[0055] Step S104: Determine the client's identity information and data processing permissions based on the second token information.

[0056] For example, the server can determine the client's identity information and data processing permissions based on the second token information. Specifically, when the second token information contains the client's stored identity information and the identity information contained in the first token information, the server can determine the client's identity information through the client's behavior data when sending the second token information and historical behavior data, as described above, and will not be repeated here.

[0057] For example, after determining the client's identity information, the data processing permissions corresponding to the identity information are determined. For example, the identity information includes device terminal, device management terminal, group management terminal, tenant terminal, and system management terminal.

[0058] Optionally, the data processing permissions corresponding to the system management terminal include authorizing the opening of accounts for tenant terminals and setting the data processing permissions or identity information corresponding to tenant terminals; the data processing permissions corresponding to the tenant terminals include authorizing the opening of accounts for group management terminals and setting the data processing permissions or identity information for group management terminals; the data processing permissions corresponding to the group management terminals can set the data processing permissions corresponding to the device management terminals; the data processing permissions corresponding to the device management terminals include creating and allocating device terminals in the IoT system, managing various permissions and functions of device terminals, and viewing the data of device terminals.

[0059] Understandably, dividing terminal identity information into multiple segments with different data processing permissions strengthens the management of privileged accounts and privileged access behaviors. For example, a group management terminal can set permissions or adjust identity information for a device management terminal, but cannot see the group information of the tenant terminal. This strengthens the management of privileged access behaviors of privileged accounts, allowing terminals with different data processing permissions to query different data or have different permissions for data processing, thereby improving the security of data storage.

[0060] For example, when a client with special identity information accesses and processes data, the client needs to be monitored. However, if a client with an ordinary identity accesses and processes data, no monitoring is required to reduce the computational load on the server.

[0061] For example, when a client whose identity information is one of the group management terminal, tenant terminal, or system management terminal accesses and processes data, the client's behavioral data is monitored; if a client whose identity information is a device terminal or device management terminal accesses and processes data, then there is no need to monitor the client's behavioral data.

[0062] Step S105: Within the effective connection duration, determine the data to be processed based on the client's data processing request; and process the target data in the data to be processed and / or send the target data to the client based on the identity information and data processing permissions.

[0063] For example, within the effective duration of the connection, the server can determine the data to be processed based on the client's data processing request, and process the target data in the data to be processed and / or send the target data to the client according to the identity information and data processing permissions.

[0064] For example, within the effective duration of the connection, the data to be processed is determined based on the data processing request sent by the client, and the target data in the data to be processed is determined based on the identity information and data processing permissions. It can be understood that the data processing request includes processing data A and data B, but the client's identity information and data processing permissions determine that the client can only process data B. Therefore, data B is taken as the target data and data B is processed accordingly.

[0065] For example, the data to be processed includes at least one of the following: identity information, data processing permissions, terminal information of other clients in the Internet of Things besides the client currently sending the data request, and information stored on the server. By using the client's identity information and corresponding data processing permissions, the target data that can be processed is determined and processed, such as modifying the identity information, modifying the data processing permissions, and sending the terminal information and / or information stored on the server to the client.

[0066] In the specific implementation process, the server stores customer A's historical electronic payment slips, insurance bills, transaction records, credit card information, and other electronic billing information. It may also store electronic business licenses, electronic signatures, and other information. When customer A or customer B needs to query at least one of customer A's historical electronic payment slips, payment account information, transaction records, electronic business licenses, or electronic signatures, the server obtains the login information of the client corresponding to customer A or customer B. Based on the login information, it determines the valid connection duration between the client and the server, and performs information exchange within the valid connection duration. For example, after the server and client successfully connect, the server also sends a first token to the client. Upon receiving the first token, the client determines whether the first token matches the stored identity information and obtains the customer's information query operation. Based on the client's stored identity information and the customer's information query operation, the server determines a data processing request and sends the corresponding target data to the client and / or processes the target data accordingly. For example, if customer B queries customer A's transaction history for the first historical time period on the client side, after the server determines customer B's client identity information and data processing permissions, if the client's identity information determines that the client has the permission to query complete transaction history information, then the server can send customer A's transaction history for the first historical time period to the client according to the client's request to query customer A's transaction history for the first historical time period; if the client's identity information determines that the client has the permission to view partial transaction history, then the server can send the transaction history for the second historical time period to the client according to the client's request to query customer A's transaction history for the first historical time period, wherein the start time of the second historical time period is equal to or later than the start time of the first historical time period, and the end time of the second historical time period is earlier than the end time of the first historical time period.

[0067] It should be noted that the client can also query or request other information from the server, such as providing the client with electronic signatures, electronic business licenses, insurance bill information, credit card information, loan information, etc.; the permissions corresponding to the identity information may also include other permissions, such as modification permissions, deletion permissions, etc. This application does not limit the information queried or processed or the permissions corresponding to the identity information.

[0068] The data access method provided in the above embodiments obtains the client's login information; if the login information is verified, determines the effective duration of the connection and sends a first token to the client; obtains the data processing request determined by the client based on the first token, the data access request including a second token; determines the client's identity information and data processing permissions based on the second token; within the effective duration of the connection, determines the data to be processed based on the client's data processing request; and processes and / or sends the target data in the data to be processed to the client based on the identity information and data processing permissions. By verifying the login information, determining the effective duration of the connection, and sending the first token to the client, the method can achieve a communication connection between the client and the server within the effective duration of the connection, reducing the risk of information leakage due to excessively long connection times. At the same time, it enables the client to determine a data processing request including the second token based on the first token, so as to synchronize the identity information and data processing permissions corresponding to the client in the server and the client, and can process the target data based on the synchronized identity information and data processing permissions. This improves the security of information stored on the server, such as customer transaction records, insurance bills, loans, electronic business licenses, electronic signatures, etc.

[0069] In some embodiments, the method further includes: acquiring current behavior data of the client and corresponding historical behavior data of the client; determining whether the current behavior data meets preset conditions based on the historical behavior data; and determining data to be processed based on the client's data processing request within the effective duration of the connection, including: if the current behavior data meets preset conditions within the effective duration of the connection, determining data to be processed based on the client's data processing request.

[0070] For example, the current behavior data and corresponding historical behavior data of the client are obtained, and the current behavior data is determined based on the historical behavior data to determine whether the current behavior data meets the preset conditions, thereby determining the legality of the current information interaction between the client and the server. This allows the client to disconnect the communication connection with the server in a timely manner when illegal information interaction occurs between the client and the server, thereby reducing the risk of data leakage.

[0071] For example, within the effective duration of the connection, if the current behavioral data meets the preset conditions, the data to be processed is determined according to the client's data processing request, and the target data in the data to be processed is processed according to the client's identity information and data processing permissions.

[0072] In other embodiments, within the effective connection duration, the data to be processed is determined based on the client's data processing request, including: if the current behavior data does not meet the preset conditions within the effective connection duration, the client's data processing request is rejected, and a request failure message is sent to the client.

[0073] For example, if the current behavior data fails to meet the preset conditions within the valid connection duration, the client's data processing request will be rejected, and a request failure message will be sent to the client.

[0074] Optionally, the server can reject the client's data processing request, send request failure and connection failure information to the client, and disconnect the communication connection with the client to reduce the risk of data leakage on the server side.

[0075] In some embodiments, behavioral data includes the data type of access data; if the data type of the data to be processed is the same as the data type of the historical access data, it is determined that the current behavioral data meets the preset conditions.

[0076] Optionally, the behavioral data includes the data type of the access data. If the data type of the data to be processed is the same as the data type of the client's historical access data, then the client is determined to be the same client that accessed and processed the data in the past. No malicious access was found, and the current behavioral data is determined to meet the preset conditions.

[0077] In other embodiments, the behavioral data includes access frequency; if the current access frequency is within a preset frequency range determined based on historical access frequencies, the current behavioral data is determined to meet preset conditions.

[0078] Optionally, the behavioral data also includes access frequency. If the current access frequency is within a preset frequency range determined based on historical access frequencies, then the current behavioral data is determined to meet the preset conditions.

[0079] In the specific implementation process, the current access frequency can be determined by the number of accesses within the time period from the current moment to the first moment. Understandably, the historical access frequency is determined by the number of accesses within the time period from the second moment to the third moment. Here, the current moment is earlier than the first moment, the first moment is earlier than or equal to the second moment, the second moment is earlier than the third moment, and the time difference between the time period from the current moment to the first moment and the time period from the second moment to the third moment is less than a preset time period threshold. For example, the current access frequency is determined by the number of accesses within the past six months from today to six months ago, while the historical access frequency can be determined by the number of accesses within the time period from six months ago to twelve months ago.

[0080] For example, if the historical access frequency is determined to be 50 times per month in the above manner, the preset frequency range determined based on the historical access frequency can be 0 to 70 times per month, or 30 to 70 times per month. It can be set according to the specific usage situation, and this application does not limit it.

[0081] In some other embodiments, the behavioral data includes access traffic; if the current access traffic is less than or equal to a traffic threshold determined based on historical access traffic, the current behavioral data is determined to meet a preset condition.

[0082] Optionally, the behavioral data also includes access traffic. If the current access traffic is less than or equal to a traffic threshold determined based on historical access traffic, the current behavioral data is determined to meet preset conditions.

[0083] In specific implementation, current access traffic refers to the access traffic generated by the data access and processing performed in the current instance, while historical access traffic refers to the access traffic generated by the previous data access and processing. In other implementations, current access traffic can be determined in the same way as determining the current access frequency. Similarly, historical access traffic can be determined in the same way as historical access frequency. That is, the access traffic within a recent period is counted to determine current access traffic, and the access traffic within a historical period is counted to determine historical access traffic. This application does not limit the methods for determining current access traffic and historical access traffic.

[0084] It is understandable that the traffic threshold determined based on historical access traffic can be determined in a way that determines a preset frequency range, which will not be elaborated here.

[0085] In some other embodiments, the behavioral data includes access time; if the current access time is within a preset access time range determined based on historical access times, the current behavioral data is determined to meet preset conditions.

[0086] Optionally, the behavioral data also includes access time, which indicates the time when the client accesses the data. For example, if the access is made at 11:00 AM Beijing time, and the current access time is within a preset access time range determined based on historical access times, the current behavioral data is determined to meet the preset conditions.

[0087] In the specific implementation process, the current access time and historical access time can be determined in the same way as the current access traffic and historical access traffic, which will not be described here.

[0088] For example, if the historical access time is between 1 PM and 3 PM Beijing time, it can be determined that the client often accesses the site in the afternoon. Therefore, the preset access time range can be set to between 12 PM and 5 PM Beijing time. It is understandable that if the client accesses the site at 2 AM, it can be determined that the current behavior data does not meet the preset conditions.

[0089] It is understood that the implementation examples corresponding to the data types, access frequencies, access traffic, and access times of the accessed data mentioned above can be combined. For example, behavioral data includes the data types and access frequencies of the accessed data, and the corresponding implementation examples are as described above, and will not be repeated here.

[0090] In some embodiments, the method further includes: obtaining the number of times the client's historical behavior data corresponding to a historical time did not meet the preset conditions; and adjusting at least one of the preset frequency range, traffic threshold, and access time range based on the number of times the historical behavior data did not meet the preset conditions.

[0091] For example, if a client fails to meet the preset conditions multiple times, at least one of the preset frequency range, traffic threshold, and access time range can be adjusted to monitor the client more accurately. For instance, if a client fails to meet the traffic threshold multiple times, the traffic threshold corresponding to that client can be lowered to monitor the client's behavior data more strictly, thereby improving the security of data on the server.

[0092] In some embodiments, the method further includes: if a data processing request sent by the client is obtained after the connection validity period has elapsed, rejecting the data processing request and sending a connection failure message to the client.

[0093] For example, if the connection validity period is exceeded, a connection failure message is sent to the client and the communication between the server and the client is disconnected to avoid the communication time between the client and the server being too long and to reduce the risk of server data leakage.

[0094] Please see Figure 3 , Figure 3This is a schematic diagram of a data access device provided in an embodiment of this application. The data access device can be configured in a server or terminal on the server side to execute the aforementioned data access method.

[0095] like Figure 3 As shown, the data access device includes: a login information acquisition module 110, a login information verification module 120, a data processing request acquisition module 130, an identity information determination module 140, and a data processing module 150.

[0096] The login information acquisition module 110 is used to acquire the client's login information.

[0097] The login information verification module 120 is used to determine the effective duration of the connection based on the login information and to send the first token information to the client.

[0098] The data processing request acquisition module 130 is used to acquire the data processing request determined by the client based on the first token information, wherein the data access request includes the second token information.

[0099] The identity information determination module 140 is used to determine the client's identity information and data processing permissions based on the second token information.

[0100] The data processing module 150 is configured to determine the data to be processed based on the data processing request of the client within the effective connection duration; and to process the target data in the data to be processed based on the identity information and the data processing permissions and / or send the target data to the client.

[0101] For example, the data processing request acquisition module 130 is further configured to acquire second token information sent by the client that contains the identity information stored by the client and the identity information contained in the first token information if the identity information stored by the client is different from the identity information contained in the first token information.

[0102] If the identity information stored by the client is the same as the identity information contained in the first token information, then the second token information containing the identity information corresponding to the first token sent by the client is obtained.

[0103] For example, the identity information determination module 140 is further configured to: determine the behavioral data corresponding to when the client sends the second token information if the second token information includes the identity information stored by the client and the identity information contained in the first token information; obtain the client's historical behavioral data; and determine the client's identity information based on the client's historical behavioral data and the behavioral data corresponding to when the client sends the second token information.

[0104] For example, the data access device also includes a behavior data acquisition module and a preset condition determination module.

[0105] The behavior data acquisition module is used to acquire the current behavior data of the client and the corresponding historical behavior data of the client.

[0106] The preset condition determination module is used to determine whether the current behavior data meets the preset conditions based on the historical behavior data.

[0107] The data processing module 150 is further configured to determine the data to be processed based on the client's data processing request if the current behavior data meets the preset conditions within the effective connection duration.

[0108] If the current behavior data does not meet the preset conditions within the valid connection period, the data processing request from the client is rejected, and a request failure message is sent to the client.

[0109] For example, the preset condition determination module is also used for at least one of the following:

[0110] If the data type of the data to be processed is the same as the data type of the historical access data, it is determined that the current behavior data meets the preset conditions;

[0111] If the current access frequency is within a preset frequency range determined based on historical access frequencies, the current behavior data is determined to meet preset conditions;

[0112] If the current access traffic is less than or equal to the traffic threshold determined based on the historical access traffic, the current behavior data is determined to meet the preset conditions;

[0113] If the current access time falls within a preset access time range determined based on historical access times, the current behavior data is determined to meet the preset conditions.

[0114] For example, the data access device also includes a number of times determination module and a condition adjustment module;

[0115] The frequency determination module is used to obtain the number of times that the client's historical behavior data at a historical time did not meet the preset conditions.

[0116] The condition adjustment module is used to adjust at least one of the preset frequency range, the traffic threshold, and the preset access time range based on the number of times the historical behavior data fails to meet the preset conditions.

[0117] For example, the data processing module 150 is further configured to, if the connection validity period has elapsed, receive a data processing request sent by the client, reject the data processing request, and send a connection failure message to the client.

[0118] Please see Figure 4 , Figure 4 This is a schematic block diagram illustrating the structure of a computer device provided in an embodiment of this application. The computer device may be a server or a terminal.

[0119] like Figure 4 As shown, the computer device includes a processor, a memory, and a network interface connected via a system bus, wherein the memory may include a storage medium and internal memory.

[0120] The storage medium may store the operating system and computer programs. The computer programs include program instructions, which, when executed, cause the processor to perform any data access method.

[0121] The processor provides computing and control capabilities, supporting the operation of the entire computer device.

[0122] Internal memory provides an environment for the execution of computer programs stored in storage media. When these computer programs are executed by the processor, the processor can perform any data access method.

[0123] This network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0124] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0125] In one embodiment, the processor is configured to run a computer program stored in memory to perform the following steps:

[0126] Obtain the client's login information;

[0127] The connection validity period is determined based on the login information, and the first token information is sent to the client.

[0128] Obtain the data processing request determined by the client based on the first token information, wherein the data processing request includes the second token information;

[0129] The client's identity information and data processing permissions are determined based on the second token information;

[0130] Within the effective connection duration, determine the data to be processed based on the client's data processing request; and process the target data in the data to be processed and / or send the target data to the client based on the identity information and the data processing permissions.

[0131] In one embodiment, when the processor implements the acquisition of the data processing request determined by the client based on the first token information, it is configured to:

[0132] If the identity information stored by the client is different from the identity information contained in the first token information, obtain the second token information sent by the client, which contains the identity information stored by the client and the identity information contained in the first token information;

[0133] If the identity information stored by the client is the same as the identity information contained in the first token information, then the second token information containing the identity information corresponding to the first token sent by the client is obtained.

[0134] In one embodiment, when the processor determines the client's identity information based on the second token information, it is configured to:

[0135] If the second token information includes the identity information stored by the client and the identity information contained in the first token information, determine the behavioral data corresponding to when the client sends the second token information;

[0136] Obtain the client's historical behavior data;

[0137] The client's identity information is determined based on the client's historical behavior data and the behavior data corresponding to when the client sends the second token information.

[0138] In one embodiment, the processor, when implementing the data access method, is also configured to implement:

[0139] Obtain the current behavior data of the client and the corresponding historical behavior data of the client;

[0140] Determine whether the current behavior data meets the preset conditions based on the historical behavior data;

[0141] When the processor determines the data to be processed based on the client's data processing request within the effective connection duration, it is configured to:

[0142] If the current behavior data meets the preset conditions within the effective connection duration, the data to be processed is determined according to the client's data processing request;

[0143] If the current behavior data does not meet the preset conditions within the valid connection period, the data processing request from the client is rejected, and a request failure message is sent to the client.

[0144] In one embodiment, when the processor determines whether the current behavior data meets preset conditions based on the historical behavior data, it is configured to perform at least one of the following:

[0145] If the data type of the data to be processed is the same as the data type of the historical access data, it is determined that the current behavior data meets the preset conditions;

[0146] If the current access frequency is within a preset frequency range determined based on historical access frequencies, the current behavior data is determined to meet preset conditions;

[0147] If the current access traffic is less than or equal to the traffic threshold determined based on the historical access traffic, the current behavior data is determined to meet the preset conditions;

[0148] If the current access time is within a preset access time range determined based on historical access times, the current behavior data is determined to meet the preset conditions.

[0149] In one embodiment, the processor, when implementing the data access method, is configured to:

[0150] The number of times the client's historical behavior data for a given historical time period did not meet preset conditions is obtained;

[0151] Adjust at least one of the preset frequency range, the traffic threshold, and the preset access time range based on the number of times the historical behavior data fails to meet the preset conditions.

[0152] In one embodiment, the processor, when implementing the data access method, is configured to:

[0153] If, after the specified connection validity period, a data processing request is received from the client, the data processing request is rejected, and a connection failure message is sent to the client.

[0154] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of data access described above can be referred to the corresponding process in the aforementioned data access control method embodiments, and will not be repeated here.

[0155] This application also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, and the method implemented when the program instructions are executed can be referred to various embodiments of the data access method of this application.

[0156] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.

[0157] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0158] It should also be understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. It should be noted that, herein, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0159] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. The above descriptions are merely specific implementations of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data access method, characterized in that, Applied to the server side, the method includes: Obtain the client's login information; The connection validity period is determined based on the login information, and the first token information is sent to the client. Obtain the data processing request determined by the client based on the first token information, wherein the data processing request includes the second token information; The client's identity information and data processing permissions are determined based on the second token information; During the effective duration of the connection, determine the data to be processed according to the data processing request of the client; and process the target data in the data to be processed according to the identity information and the data processing permissions and / or send the target data to the client; The step of determining the client's identity information based on the second token information includes: If the second token information includes the identity information stored by the client and the identity information contained in the first token information, determine the behavioral data corresponding to when the client sends the second token information; obtain the client's historical behavioral data; determine the client's identity information based on the client's historical behavioral data and the behavioral data corresponding to when the client sends the second token information.

2. The data access method as described in claim 1, characterized in that, The step of obtaining the data processing request determined by the client based on the first token information includes: If the identity information stored by the client is different from the identity information contained in the first token information, obtain the second token information sent by the client, which contains the identity information stored by the client and the identity information contained in the first token information; If the identity information stored by the client is the same as the identity information contained in the first token information, then the second token information containing the identity information corresponding to the first token sent by the client is obtained.

3. The data access method as described in any one of claims 1-2, characterized in that, The method further includes: Obtain the current behavior data of the client and the corresponding historical behavior data of the client; Determine whether the current behavior data meets the preset conditions based on the historical behavior data; The step of determining the data to be processed based on the client's data processing request within the effective duration of the connection includes: If the current behavior data meets the preset conditions within the effective connection duration, the data to be processed is determined according to the client's data processing request; If the current behavior data does not meet the preset conditions within the effective connection period, the data processing request from the client is rejected, and a request failure message is sent to the client.

4. The data access method as described in claim 3, characterized in that, The behavioral data includes at least one of the following: data type of access data, access frequency, access traffic, and access time. Determining whether the current behavioral data meets preset conditions based on the historical behavioral data includes at least one of the following: If the data type of the data to be processed is the same as the data type of the historical access data, it is determined that the current behavior data meets the preset conditions; If the current access frequency is within a preset frequency range determined based on historical access frequencies, the current behavior data is determined to meet preset conditions; If the current access traffic is less than or equal to the traffic threshold determined based on the historical access traffic, the current behavior data is determined to meet the preset conditions; If the current access time is within a preset access time range determined based on historical access times, the current behavior data is determined to meet the preset conditions.

5. The data access method as described in claim 4, characterized in that, The method further includes: The number of times the client's historical behavior data for a given historical time period did not meet preset conditions is obtained; Adjust at least one of the preset frequency range, the traffic threshold, and the preset access time range based on the number of times the historical behavior data fails to meet the preset conditions.

6. The data access method according to any one of claims 1-2, characterized in that, The method further includes: If, after the specified connection validity period, a data processing request is received from the client, the data processing request is rejected, and a connection failure message is sent to the client.

7. A data access device, characterized in that, The data access device includes: The login information acquisition module is used to acquire the client's login information; The login information verification module is used to determine the effective duration of the connection based on the login information and to send the first token information to the client. A data processing request acquisition module is used to acquire a data processing request determined by the client based on the first token information, wherein the data access request includes second token information. An identity information determination module is used to determine the client's identity information and data processing permissions based on the second token information; The data processing module is configured to determine the data to be processed based on the client's data processing request within the effective duration of the connection; and to process target data in the data to be processed based on the identity information and the data processing permissions and / or send the target data to the client; The identity information determination module is further configured to: determine the behavioral data corresponding to when the client sends the second token information if the second token information includes the identity information stored by the client and the identity information contained in the first token information; obtain the client's historical behavioral data; and determine the client's identity information based on the client's historical behavioral data and the behavioral data corresponding to when the client sends the second token information.

8. A computer device, characterized in that, The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, it implements the steps of the data access method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the data access method as described in any one of claims 1 to 6.

Images