Security protection access method and device, equipment and storage medium

Abstract

The application relates to the field of financial technology, and discloses a security protection access method, device, equipment and storage medium. The security protection access method comprises the following steps: when a user logs in an application server, receiving a username of a legal user and an object name corresponding to the username sent by the application server and storing the username and the object name; preconfiguring an effective time of a readable state of an object and establishing an association relationship among the username, the object name and the effective time; receiving a first access request sent by a client and containing access permission information and object storage path information; judging whether the access permission information is legal according to the association relationship; if yes, responding to the first access request, reading a target object according to the object storage path information and sending the target object to the client. Through the above method, the security of data storage access in a financial application scene can be improved, and the risk of illegal access to privacy can be reduced.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a secure access method, apparatus, device, and storage medium. Background Technology

[0002] Internet applications store many objects, such as images, audio, video, and PDF files, using public cloud storage. When accessed from the front end, to ensure response time and download speed, the browser typically accesses these stored objects directly via HTTP, without authentication or authorization control through the application's backend server and gateway. In financial applications, transaction and payment data contain personal privacy information; accessing them without authentication poses a serious risk of violations.

[0003] With the widespread adoption and rapid development of the Internet and network applications, data storage has exploded, leading to increasingly higher requirements for data reliability and a growing variety of devices accessing data. For large amounts of object files, traditional system design approaches, which rely on application backend authentication and authorization, require data to be transmitted through the application backend server and gateway. This increases infrastructure costs and hinders frontend responsiveness. Summary of the Invention

[0004] This invention provides a secure access protection method, apparatus, device, and storage medium, which can improve the security of data storage access in financial application scenarios and reduce the risk of unauthorized access to privacy.

[0005] To solve the above-mentioned technical problems, one technical solution adopted by the present invention is to provide a secure access protection method applied to a cloud storage server, the secure access protection method comprising:

[0006] When a user logs into the application server, the system receives the username of the legitimate user and the object name corresponding to the username from the application server and stores the username and the object name.

[0007] Pre-configure the object to a readable state with a valid time and establish the association between the username, the object name, and the valid time;

[0008] Receive the first access request sent by the client, which contains access permission information and object storage path information;

[0009] Determine whether the access permission information is valid based on the aforementioned relationship;

[0010] If so, in response to the first access request, the target object is read according to the object storage path information and sent to the client.

[0011] According to one embodiment of the present invention, the access permission information includes the target username, the target object name, and the validity period of the user token, and the step of determining whether the access permission information is valid based on the association includes:

[0012] Determine whether the target username is the same as the username associated with the relationship;

[0013] Determine whether the target object name is the same as the associated object name;

[0014] Determine whether the validity period of the user token meets the validity period of the association relationship;

[0015] If the target username is the same as the username in the association, the target object name is the same as the object name in the association, and the validity period of the user token meets the validity period of the association, then the access permission information is deemed valid.

[0016] According to one embodiment of the present invention, after establishing the association between the username, the object name, and the validity period, the method further includes:

[0017] The association is cached and a notification message is sent to the application server.

[0018] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is: to provide a secure access protection method applied to an application server, the secure access protection method comprising:

[0019] When receiving a second access request initiated by the client, obtain the user token, object name, and object storage path information, wherein the user token includes the username;

[0020] Upon receiving a notification message from the cloud storage server, a first access request is generated based on the object storage path information, the object name, and the user token, and the first access request is sent to the client in response to the second access request.

[0021] According to one embodiment of the present invention, when receiving a second access request initiated by a client, obtaining the user token, object name, and object storage path information further includes:

[0022] When receiving a second access request initiated by the client, verify whether the user is a legitimate user based on the logged-in username and password;

[0023] If so, then obtain the object name and send the username and the object name to the cloud storage server.

[0024] According to one embodiment of the present invention, after receiving a prompt message from the cloud storage server, generating a first access request based on the object storage path information, the object name, and the user token, and sending the first access request to the client in response to the second access request further includes:

[0025] Pre-configure the validity period of the user token;

[0026] The user token is encrypted;

[0027] A first access request is generated based on the object storage path information, the object name, and the encrypted user token, and the first access request is sent to the client in response to the second access request.

[0028] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is: to provide a security protection access device applied to a cloud storage server, comprising:

[0029] The first receiving module is used to receive the username of a legitimate user and the object name corresponding to the username sent by the application server when the user logs in to the application server, and to store the username and the object name.

[0030] The pre-configuration and establishment module is used to pre-configure the object as a readable valid time and establish the association between the username, the object name and the valid time.

[0031] The second receiving module is used to receive the first access request sent by the client, which contains access permission information and object storage path information;

[0032] The judgment module is used to determine whether the access permission information is legal based on the association relationship;

[0033] The response module is configured to, in response to the first access request, read the target object based on the object storage path information and send it to the client.

[0034] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is: to provide a security protection access device applied to an application server, comprising:

[0035] The acquisition module is used to acquire the user token, object name, and object storage path information when receiving a second access request initiated by the client. The user token includes the username.

[0036] The generation module is used to generate a first access request based on the object storage path information, the object name, and the user token after receiving a prompt message from the cloud storage server, and send the first access request to the client in response to the second access request.

[0037] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is to provide a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the security protection access method when executing the computer program.

[0038] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is to provide a computer storage medium on which a computer program is stored, wherein the computer program implements the above-mentioned security protection access method when executed by a processor.

[0039] The beneficial effects of this invention are: after the application server performs the first authentication of the user, it adds information interaction between the client and the cloud storage server to perform a second access permission verification. The target object can be obtained as long as the two verifications are successful, which can improve the security of data storage access in financial application scenarios and reduce the risk of unauthorized access to privacy. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the architecture of the security protection access system according to an embodiment of the present invention;

[0041] Figure 2 This is a flowchart illustrating the secure access protection method according to the first embodiment of the present invention;

[0042] Figure 3 This is a flowchart illustrating the secure access protection method according to the second embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the security protection access device according to the first embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of the security protection access device according to the second embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention;

[0046] Figure 7 This is a schematic diagram of the structure of a computer storage medium according to an embodiment of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0048] The terms "first," "second," and "third" used in this invention are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified. All directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of this invention are only used to explain the relative positional relationships and movements between components in a specific orientation (as shown in the figures). If the specific orientation changes, the directional indications also change accordingly. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0049] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0050] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture of a security access system according to an embodiment of the present invention. The security access system 100 includes a client 10, an application server 20, and a cloud storage server 30.

[0051] Client 10 initiates a second access request to application server 20 and retrieves a first access request from application server 20. It then sends the first access request to cloud storage server 30 and receives the target object returned by cloud storage server 30. In financial application scenarios, the target object includes, but is not limited to, business data, transaction data, and payment data.

[0052] Application server 20 receives the second access request sent by client 10, verifies whether the user is a legitimate user based on the logged-in username and password, and if so, obtains the object name and sends the username and object name to cloud storage server 30. After receiving the prompt message sent by cloud storage server 30, it extracts the user token and obtains the object storage path information, the user token including the username; it generates a first access request based on the object storage path information, object name, and user token, and sends the first access request to client 10 in response to the second access request.

[0053] The cloud storage server 30 is an object storage device that can store objects such as images, audio, video, and PDF files in the financial field. The cloud storage server 30 is used to receive and store the username and corresponding object name of the legitimate user sent by the application server 20; pre-configure the validity period of the object as readable and establish the association between the username, object name, and validity period; cache the association and send a prompt message to the application server 20; receive the first access request sent by the client 10 containing access permission information and object storage path information; determine whether the access permission information is legitimate based on the association; if so, respond to the first access request, read the target object according to the object storage path information, and send it to the client 10.

[0054] Figure 2 This is a flowchart illustrating the secure access protection method according to the first embodiment of the present invention. It should be noted that if substantially the same result is achieved, the method of the present invention does not necessarily require further clarification. Figure 2 The illustrated process sequence is limited. For example... Figure 2 As shown, this security access protection method is applied to cloud storage servers and includes the following steps:

[0055] Step S201: When a user logs into the application server, the system receives the username of the legitimate user and the object name corresponding to the username from the application server and stores the username and object name.

[0056] In step S201, when a user logs into the application server, the application server verifies the user's identity. In one possible embodiment, user authentication is performed based on the username and password used for login. If login is successful, the user is determined to be a legitimate user; if login fails, the user is determined to be an illegitimate user. After determining that the user is a legitimate user, the application server determines the user's access object, obtains the object name, and sends the username and object name to the cloud storage server. When the application server sends the username and object name to the cloud storage server for the first time, the cloud storage server records and stores the username and object name.

[0057] Step S202: Pre-configure the object as a readable valid time and establish the association between the username, object name and valid time.

[0058] In step S202, the cloud storage server pre-configures the object corresponding to the object name to be readable within the valid time period. Outside of this valid time period, the object is unreadable by default to prevent unauthorized access. In one feasible embodiment, the valid time includes a start time and a readable duration, for example, a start time of 9:00 and a readable duration of 10 minutes; establishing an association between the username, object name, and valid time indicates that the object is readable by the user corresponding to the username between 9:00 and 9:10.

[0059] In one feasible embodiment, after the association is established, the cloud storage server caches the association and sends a notification message to the application server. The notification message is used to notify the application server that the cloud storage server is ready to provide object access services.

[0060] Step S203: Receive the first access request sent by the client, which contains access permission information and object storage path information.

[0061] In step S203, in this embodiment, the access permission information is used to verify whether the client has permission to access the target object. This information may include the target username, the target object name, and the validity period of the user token. The object storage path information is the path information of the target object that the client wants to access, specifically the directory level of the target object, the target object name, etc., and may include the cloud storage server domain name, such as the hostname and port number. The target object can be an image, audio, video, PDF file, etc. After receiving the prompt message from the cloud storage server, the application server extracts the user token, username, object name, and object storage path information, and generates a URL link, i.e., the first access request, based on these information. The application server sends the first access request to the client. Upon receiving the first access request, the client directly forwards it to the cloud storage server. In this embodiment, the client obtains the first access request through the application server, which effectively prevents the client from obtaining access permission information, thereby ensuring the security of data access.

[0062] Step S204: Determine whether the access permission information is valid based on the association relationship.

[0063] In step S204, the access permission information is matched with the association relationship. If they match, the access permission information is valid; otherwise, it is invalid. Specifically, it is determined whether the target username is the same as the username of the association relationship; whether the target object name is the same as the object name of the association relationship; and whether the validity period of the user token meets the validity period of the association relationship. If all three conditions are met simultaneously—the target username is the same as the username of the association relationship, the target object name is the same as the object name of the association relationship, and the validity period of the user token meets the validity period of the association relationship—then the access permission information is deemed valid; otherwise, it is deemed invalid.

[0064] In this embodiment, determining whether the validity period of a user token satisfies the validity time of the association relationship specifically involves determining whether the readable duration of the user token's validity period and the validity time are the same, and whether the duration of the current time and the start time are within the readable duration range. If so, the validity period of the user token satisfies the validity time of the association relationship.

[0065] Step S205: If yes, then in response to the first access request, read the target object according to the object storage path information and send it to the client.

[0066] In step S205, if the access permission information is valid, it indicates that the client has access permission to the target object. Therefore, the cloud storage server reads the target object and sends the target object, thereby responding to the client's first access request.

[0067] The security protection access method of the first embodiment of the present invention adds information interaction between the client and the cloud storage server to perform a second access permission verification after the application server performs the first authentication of the user. The target object can be obtained after both verifications are passed, which can improve the security of data storage access and reduce the risk of unauthorized access to privacy.

[0068] Figure 3 This is a flowchart illustrating the secure access protection method according to the second embodiment of the present invention. It should be noted that if substantially the same result is achieved, the method of the present invention does not necessarily require further clarification. Figure 3 The illustrated process sequence is limited. For example... Figure 3 As shown, this secure access protection method, applied to an application server, includes the following steps:

[0069] Step S301: When receiving the second access request initiated by the client, obtain the user token, object name, and object storage path information.

[0070] In step S301, the user token includes the username. The client initiates a second access request to the application server, verifying the user's legitimacy based on the logged-in username and password. Specifically, user authentication is performed based on the logged-in username and password. If login is successful, the user is determined to be legitimate; if login fails, the user is determined to be illegitimate. After determining the user to be legitimate, the application server obtains the object name and sends the username and object name to the cloud storage server.

[0071] Step S302: After receiving the prompt message sent by the cloud storage server, generate a first access request based on the object storage path information, object name, and user token, and send the first access request to the client in response to the second access request.

[0072] In step S302, after receiving the prompt message from the cloud storage server, the validity period of the user token is pre-configured; the user token is encrypted; a first access request is generated based on the object storage path information, the object name, and the encrypted user token, and the first access request is sent to the client in response to the second access request. This embodiment protects the first access request by encrypting the user token, thereby enhancing the security of data access and reducing the risk of unauthorized access to privacy.

[0073] The security protection access method of the second embodiment of the present invention protects the first access request by authenticating the user on the application server and encrypting the user token, thereby improving the security of data storage access and reducing the risk of unauthorized access to privacy.

[0074] Figure 4 This is a schematic diagram of the structure of a security access protection device according to an embodiment of the present invention. Figure 4 As shown, the security protection access device 40 is applied to a cloud storage server and includes a first receiving module 41, a pre-configuration and establishment module 42, a second receiving module 43, a judgment module 44, and a response module 45.

[0075] The first receiving module 41 is used to receive the username of a legitimate user and the object name corresponding to the username sent by the application server when the user logs in to the application server, and to store the username and object name.

[0076] The pre-configuration and establishment module 42 is used to pre-configure the validity period of an object as readable and establish the association between the username, object name and validity period;

[0077] The second receiving module 43 is used to receive the first access request sent by the client, which contains access permission information and object storage path information;

[0078] Module 44 is used to determine whether the access permission information is valid based on the association relationship;

[0079] The response module 45 is used to respond to the first access request if the request is yes, read the target object according to the object storage path information and send it to the client.

[0080] Figure 5 This is a schematic diagram of the structure of a security access protection device according to an embodiment of the present invention. Figure 5 As shown, the security access protection device 50 is applied to an application server and includes an acquisition module 51 and a generation module 52.

[0081] When receiving a second access request initiated by the client, the acquisition module 51 acquires the user token, object name, and object storage path information. The user token includes the username.

[0082] The generation module 52 is used to generate a first access request based on the object storage path information, object name and user token after receiving the prompt message sent by the cloud storage server, and send the first access request to the client in response to the second access request.

[0083] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Figure 6 As shown, the computer device 60 includes a processor 61 and a memory 62 coupled to the processor 61.

[0084] The memory 62 stores program instructions for implementing the security protection access method described in any of the above embodiments.

[0085] In one embodiment, the security protection access method is applied to a cloud storage server, and the security protection access method includes:

[0086] When a user logs into the application server, the system receives the username of the legitimate user and the object name corresponding to the username from the application server and stores the username and the object name.

[0087] Pre-configure the object to a readable state with a valid time and establish the association between the username, the object name, and the valid time;

[0088] Receive the first access request sent by the client, which contains access permission information and object storage path information;

[0089] Determine whether the access permission information is valid based on the aforementioned relationship;

[0090] If so, in response to the first access request, the target object is read according to the object storage path information and sent to the client.

[0091] In another embodiment, the security protection access method is applied to an application server, and the security protection access method includes:

[0092] When receiving a second access request initiated by the client, obtain the user token, object name, and object storage path information, wherein the user token includes the username;

[0093] Upon receiving a notification message from the cloud storage server, a first access request is generated based on the object storage path information, the object name, and the user token, and the first access request is sent to the client in response to the second access request.

[0094] The processor 61 is used to execute program instructions stored in the memory 62 for secure access.

[0095] The processor 61 can also be referred to as a CPU (Central Processing Unit). The processor 61 may be an integrated circuit chip with signal processing capabilities. The processor 61 can also be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor.

[0096] See Figure 7 , Figure 7 This is a schematic diagram of the structure of a computer storage medium according to an embodiment of the present invention. The computer storage medium of this embodiment stores a program file 71 capable of implementing all the above methods. This program file 71 can be stored in the computer storage medium in the form of a software product, and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0097] In one embodiment, the security protection access method is applied to a cloud storage server, and the security protection access method includes:

[0098] When a user logs into the application server, the system receives the username of the legitimate user and the object name corresponding to the username from the application server and stores the username and the object name.

[0099] Pre-configure the object to a readable state with a valid time and establish the association between the username, the object name, and the valid time;

[0100] Receive the first access request sent by the client, which contains access permission information and object storage path information;

[0101] Determine whether the access permission information is valid based on the aforementioned relationship;

[0102] If so, in response to the first access request, the target object is read according to the object storage path information and sent to the client.

[0103] In another embodiment, the security protection access method is applied to an application server, and the security protection access method includes:

[0104] When receiving a second access request initiated by the client, obtain the user token, object name, and object storage path information, wherein the user token includes the username;

[0105] Upon receiving a notification message from the cloud storage server, a first access request is generated based on the object storage path information, the object name, and the user token, and the first access request is sent to the client in response to the second access request.

[0106] The aforementioned computer storage media include: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks or optical disks, and other media that can store program code, or terminal devices such as computers, servers, mobile phones, and tablets.

[0107] In the embodiments provided by this invention, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0108] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0109] The above are merely embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A secure access protection method, characterized in that, The secure access protection method includes: When a user logs into the application server, the application server receives a second access request from the client, obtains the user token, object name, and object storage path information, where the user token includes the username; it verifies whether the user is a legitimate user based on the username and password; if so, it sends the username and object name to the cloud storage server. The cloud storage server receives the username of a legitimate user and the object name corresponding to the username from the application server and stores the username and the object name; the cloud storage server pre-configures the object to be in a readable state for a valid period and establishes an association between the username, the object name, and the valid period; after establishing the association, the cloud storage server caches the association and sends a prompt message to the application server; After receiving the prompt message sent by the cloud storage server, the application server generates a first access request based on the object storage path information, the object name, and the user token, and sends the first access request to the client in response to the second access request. The cloud storage server receives a first access request from the client, which contains access permission information and object storage path information. Determine whether the access permission information is valid based on the aforementioned relationship; If so, in response to the first access request, the target object is read according to the object storage path information and sent to the client.

2. The secure access protection method according to claim 1, characterized in that, The access permission information includes the target username, the target object name, and the validity period of the user token. Determining the validity of the access permission information based on the association includes: Determine whether the target username is the same as the username associated with the relationship; Determine whether the target object name is the same as the associated object name; Determine whether the validity period of the user token meets the validity period of the association relationship; If the target username is the same as the username in the association, the target object name is the same as the object name in the association, and the validity period of the user token meets the validity period of the association, then the access permission information is deemed valid.

3. The secure access protection method according to claim 1, characterized in that, The step of generating a first access request based on the object storage path information, the object name, and the user token after receiving the prompt message from the cloud storage server, and sending the first access request to the client in response to the second access request, further includes: Pre-configure the validity period of the user token; The user token is encrypted; A first access request is generated based on the object storage path information, the object name, and the encrypted user token, and the first access request is sent to the client in response to the second access request.

4. A security access device, characterized in that, include: The acquisition module is used when a user logs into the application server and the application server receives a second access request initiated by the client to acquire the user token, object name, and object storage path information. The user token includes the username. The module verifies whether the user is a legitimate user based on the username and password. If so, the username and the object name are sent to the cloud storage server; The first receiving module is used for the cloud storage server to receive the username of a legitimate user and the object name corresponding to the username from the application server and to store the username and the object name. The pre-configuration and establishment module is used by the cloud storage server to pre-configure the object as a readable state for a valid period and establish an association between the username, the object name, and the valid period; after the association is established, the cloud storage server caches the association and sends a prompt message to the application server; The generation module is used by the application server to generate a first access request based on the object storage path information, the object name, and the user token after receiving a prompt message from the cloud storage server, and then send the first access request to the client in response to the second access request. The second receiving module is used for the cloud storage server to receive a first access request sent by the client, which contains access permission information and object storage path information; The judgment module is used by the cloud storage server to determine whether the access permission information is legal based on the association relationship; The response module is configured such that, if so, the cloud storage server responds to the first access request by reading the target object according to the object storage path information and sending it to the client.

5. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the secure access protection method as described in any one of claims 1-3.

6. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the secure access protection method as described in any one of claims 1-3.

Images