Access method and device of cloud storage system, electronic equipment and computer medium

Abstract

The present disclosure relates to a cloud storage system access method and device, electronic equipment and computer readable medium, belonging to the technical field of Internet. The method comprises: establishing mutual authentication between the client, cloud storage gateway and zero trust controller, and sending an access token to the client through the zero trust controller; the client sends an access request of the cloud storage system and the access token to the cloud storage gateway corresponding to the cloud storage system; the cloud storage gateway performs security detection on the access request of the client based on a security detection strategy; when the access request of the client is detected, the cloud storage gateway executes the access operation of the cloud storage system according to the access request and the access token of the client, and returns the access operation result to the client. The present disclosure can improve the access security of the cloud storage system by realizing mutual authentication among the client, cloud storage gateway and zero trust controller, and performing security detection on the access request of the client.

Description

Technical Field

[0001] This disclosure relates to the field of Internet technology, and more specifically, to a method for accessing a cloud storage system, a device for accessing a cloud storage system, an electronic device, and a computer-readable medium. Background Technology

[0002] Cloud storage refers to a system that uses cluster applications, grid technology, or distributed file systems to bring together various types of storage devices on a network to work together and provide data storage and business access functions, ensuring data security and saving storage space, such as distributed storage cloud disk systems.

[0003] Currently, the following security issues may exist during access to cloud storage systems: 1. Unauthorized, unauthorized, or accidental manipulation of cloud disk files by client users; 2. Cloud disk files uploaded or shared by client users may carry viruses or malicious software; 3. There is a risk of identity theft in various components, especially the significant risk of data leakage, unauthorized access, and damage to the cloud storage system caused by impersonating client users.

[0004] Therefore, there is an urgent need in the field for an access method for cloud storage systems that can improve access security.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide a method for accessing a cloud storage system, a device for accessing a cloud storage system, an electronic device, and a computer-readable medium, thereby improving the access security of the cloud storage system to at least a certain extent.

[0007] According to a first aspect of this disclosure, a method for accessing a cloud storage system is provided, comprising:

[0008] Establish two-way authentication between the client, the cloud storage gateway, and the zero trust controller, and send the access token of the cloud storage system to the client through the zero trust controller;

[0009] The client sends the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system.

[0010] The cloud storage gateway obtains the security detection policy through the zero-trust controller and performs security detection on the client's access request based on the security detection policy;

[0011] When the client's access request passes the detection, the cloud storage gateway executes the access operation of the cloud storage system based on the client's access request and the access token, and returns the access operation result of the cloud storage system to the client.

[0012] In one exemplary embodiment of this disclosure, the step of establishing bidirectional authentication between the client, the cloud storage gateway, and the zero-trust controller, and sending the access token of the cloud storage system to the client through the zero-trust controller, includes:

[0013] Establish two-way authentication between the zero-trust controller and the cloud storage gateway, as well as two-way authentication between the zero-trust controller and the client;

[0014] The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and verifies the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy.

[0015] If the client meets the multi-factor authentication policy, then a two-way authentication is established between the client and the cloud storage gateway;

[0016] After successful authentication, the zero-trust controller sends the list of cloud storage gateways corresponding to the multiple cloud storage systems that the client is allowed to connect to, along with access tokens, to the client.

[0017] In one exemplary embodiment of this disclosure, the zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and verifies the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy, including:

[0018] The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and calls the single-factor authentication module in the zero-trust controller based on the multi-factor authentication policy.

[0019] The zero-trust controller performs various single-factor authentication operations on the client information through the single-factor authentication module. If all the single-factor authentication operations pass, the client is determined to meet the multi-factor authentication strategy.

[0020] In one exemplary embodiment of this disclosure, the step of establishing two-way authentication between the client and the zero-trust controller or the cloud storage gateway includes:

[0021] The client initiates a single-packet authorization to the zero-trust controller or the cloud storage gateway;

[0022] If the single packet authorization fails, the zero-trust controller or the cloud storage gateway will directly discard the single packet.

[0023] If the single-packet authorization is successful, a bidirectional secure transport layer protocol connection is established between the client and the zero-trust controller or the cloud storage gateway to complete the bidirectional authentication between the client and the zero-trust controller or the cloud storage gateway.

[0024] In one exemplary embodiment of this disclosure, the security detection policy includes a secure access policy and a security protection policy. The cloud storage gateway obtains the security detection policy through the zero-trust controller and performs security detection on the client's access request based on the security detection policy, including:

[0025] The cloud storage gateway obtains the security access policy and security protection policy of the cloud storage system through the zero trust controller;

[0026] The cloud storage gateway initiates a security access monitoring process based on the security access policy, and also initiates a security protection monitoring process based on the security protection policy.

[0027] The cloud storage gateway uses the security access monitoring process to match the client's access request with the feature information in the access token to determine whether the client's access request meets the security access policy.

[0028] The cloud storage gateway detects the client's access requests through the security protection monitoring process and determines whether the client's access requests meet the security protection policy.

[0029] If the client's access request satisfies both the security access policy and the security protection policy, then the client's access request is deemed to have passed the detection.

[0030] In one exemplary embodiment of this disclosure, the method further includes:

[0031] If the client's access request does not simultaneously satisfy the security access policy and the security protection policy, the cloud storage gateway rejects the client's access request and performs corresponding security protection actions based on the client's access request.

[0032] In one exemplary embodiment of this disclosure, the method further includes:

[0033] The cloud storage gateway reports the client's access request processing information to the zero-trust controller at preset time intervals;

[0034] The zero-trust controller updates the security detection policy based on the access request handling information reported by the cloud storage gateway, and then sends the updated security detection policy to the cloud storage gateway.

[0035] According to a second aspect of this disclosure, an access device for a cloud storage system is provided, comprising:

[0036] The two-way authentication establishment module is used to establish two-way authentication between the client, the cloud storage gateway, and the zero trust controller, and to send the access token of the cloud storage system to the client through the zero trust controller.

[0037] An access request sending module is used for the client to send the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system.

[0038] An access request detection module is used by the cloud storage gateway to obtain a security detection policy through the zero-trust controller and to perform security detection on the client's access request based on the security detection policy.

[0039] The access result return module is used to, when the client's access request is detected as passed, have the cloud storage gateway perform the access operation of the cloud storage system according to the client's access request and the access token, and return the access operation result of the cloud storage system to the client.

[0040] According to a third aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform an access method of any of the preceding cloud storage systems by executing the executable instructions.

[0041] According to a fourth aspect of this disclosure, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the access method of the cloud storage system described in any of the preceding claims.

[0042] The exemplary embodiments disclosed herein can have the following beneficial effects:

[0043] In the cloud storage system access method of the exemplary implementation of this disclosure, on the one hand, by establishing two-way authentication between the client, the cloud storage gateway, and the zero-trust controller, the zero-trust security concept embodies the security concept centered on the identity of the access subject and object, preventing client identity impersonation and "man-in-the-middle attacks" carried out by impersonating the cloud storage gateway; on the other hand, by continuously and dynamically detecting and filtering the compliance of the client's access requests with security access policy rules, as well as detecting and filtering antivirus and anti-malware, the access security of the cloud storage system can be further improved.

[0044] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0045] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0046] Figure 1 A flowchart illustrating an access method for a cloud storage system according to an exemplary embodiment of this disclosure is shown.

[0047] Figure 2 The illustration shows a schematic diagram of a cloud storage system deployment based on zero-trust access control according to a specific embodiment of the present disclosure;

[0048] Figure 3 This illustration shows a flowchart of establishing two-way authentication between a client, a cloud storage gateway, and a zero-trust controller according to an example implementation of this disclosure.

[0049] Figure 4 A schematic diagram illustrating the process of client access request security detection according to an exemplary embodiment of this disclosure is shown;

[0050] Figure 5 A flowchart illustrating an authentication and authorization method for a cloud storage system according to a specific embodiment of the present disclosure is shown.

[0051] Figure 6 A flowchart illustrating a cloud disk access method of a cloud storage system according to a specific embodiment of the present disclosure is shown.

[0052] Figure 7 A block diagram of an access device for a cloud storage system according to an exemplary embodiment of the present disclosure is shown;

[0053] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the embodiments of the present disclosure is shown. Detailed Implementation

[0054] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0055] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0056] This example implementation first provides a method for accessing a cloud storage system. (See reference...) Figure 1 As shown, the access method for the above-mentioned cloud storage system may include the following steps:

[0057] Step S110. Establish two-way authentication between the client, cloud storage gateway, and zero trust controller, and send the access token of the cloud storage system to the client through the zero trust controller.

[0058] Step S120. The client sends the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system.

[0059] Step S130. The cloud storage gateway obtains the security detection policy through the zero trust controller and performs security detection on the client's access request based on the security detection policy.

[0060] Step S140. When the client's access request passes the detection, the cloud storage gateway executes the access operation of the cloud storage system based on the client's access request and access token, and returns the access operation result of the cloud storage system to the client.

[0061] In the cloud storage system access method of the exemplary implementation of this disclosure, on the one hand, by establishing two-way authentication between the client, the cloud storage gateway, and the zero-trust controller, the zero-trust security concept embodies the security concept centered on the identity of the access subject and object, preventing client identity impersonation and "man-in-the-middle attacks" carried out by impersonating the cloud storage gateway; on the other hand, by continuously and dynamically detecting and filtering the compliance of the client's access requests with security access policy rules, as well as detecting and filtering antivirus and anti-malware, the access security of the cloud storage system can be further improved.

[0062] Below, in conjunction with Figures 2 to 6 The steps described above in this example implementation will be explained in more detail.

[0063] In step S110, a two-way authentication is established between the client, the cloud storage gateway, and the zero trust controller, and the access token of the cloud storage system is sent to the client through the zero trust controller.

[0064] In this example implementation, access to the cloud storage system mainly involves three components: the client, the cloud storage gateway, and the zero-trust controller. Figure 2 This illustration shows a cloud storage system deployment diagram based on zero-trust access control according to a specific embodiment of the present disclosure, with the functions of each component as follows:

[0065] Client-side: MFA (Multi-Factor Authentication) enables multi-factor authentication and file management, allowing users to upload, download, delete, and share files on the cloud drive, as well as perform CRUD operations on folders. Client components can be implemented as an SDK (Software Development Kit), an APP (Application), or a WEB (World Wide Web) front-end.

[0066] Cloud storage gateway: As a gateway for distributed storage clouds, such as Ceph (a distributed storage system), it provides a RESTful API (Representational State Transfer) (Application Programming Interface) to the outside world; it implements two-way authentication with clients and the zero-trust controller; based on the security access policy rules, anti-virus and anti-malware (worm, backdoor, Trojan) rules issued by the zero-trust controller, it performs security access policy rule compliance detection and filtering control on cloud disk file access requests, as well as anti-virus and anti-malware detection and filtering control.

[0067] Zero Trust Controller: Provides global IAM (Identity and Access Management) management and can connect to optional authentication and authorization services, such as multi-factor authentication, including account password / mobile phone verification code / face authentication / PKI (Public Key Infrastructure) certificates, device authentication, OAuth (an open security protocol), etc.; the access control engine calls trust algorithms and security policy libraries, permission authorization libraries and runtime environment libraries to make permission authorization judgments; the security engine implements security policy management and decision control for file antivirus and anti-malware.

[0068] In this example implementation, such as Figure 3 As shown, establishing two-way authentication between the client, cloud storage gateway, and zero-trust controller, and sending the cloud storage system access token to the client through the zero-trust controller, can specifically include the following steps:

[0069] Step S310. Establish two-way authentication between the zero trust controller and the cloud storage gateway, as well as two-way authentication between the zero trust controller and the client.

[0070] In this example implementation, the zero-trust controller establishes an mTLS (Mutual Transport Layer Security) connection with the cloud storage gateway, negotiates keys, and completes two-way authentication.

[0071] In this example implementation, the steps for establishing two-way authentication between the client and the zero-trust controller are as follows: the client initiates a single-packet authorization to the zero-trust controller; if the single-packet authorization fails, the zero-trust controller directly discards the single packet; if the single-packet authorization passes, a two-way secure transport layer protocol connection is established between the client and the zero-trust controller to complete the two-way authentication between the client and the zero-trust controller.

[0072] The client initiates a Single Packet Authorization (SPA) request to the Zero Trust controller. If SPA authorization fails, the Zero Trust controller discards the SPA packet without responding to the client. If SPA authorization succeeds, the client and Zero Trust controller establish a mutual TLS (mTLS) connection, negotiate keys, and complete mutual authentication. The SPA authorization mechanism significantly reduces the network attack surface.

[0073] Step S320. The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and verifies the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy.

[0074] In this example implementation, the zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and calls the single-factor authentication module in the zero-trust controller based on the multi-factor authentication policy. Then, the single-factor authentication module performs various single-factor authentication operations on the client information. If all single-factor authentication operations pass, it is determined that the client meets the multi-factor authentication policy.

[0075] The Zero Trust Controller invokes the single-factor authentication module involved in the MFA multi-factor authentication policy to verify relevant client information. Authentication activities can include account password authentication, PKI certificate authentication, facial recognition, and other optional authentications. Authentication activities are optional and can be performed concurrently; the selection of an authentication activity depends on whether the Zero Trust Controller client's MFA multi-factor authentication policy includes that authentication.

[0076] Step S330. If the client meets the multi-factor authentication policy, then establish two-way authentication between the client and the cloud storage gateway.

[0077] The zero-trust controller summarizes the authentication activity results and determines whether the client meets the multi-factor authentication policy.

[0078] If the Zero Trust controller determines that the client does not meet the multi-factor authentication policy, the client authentication fails, and the Zero Trust controller sends an authentication failure message to the client.

[0079] If the zero-trust controller determines that the client meets the multi-factor authentication policy, the client authentication is successful, and a two-way authentication is established between the client and the cloud storage gateway.

[0080] In this example implementation, the steps for establishing two-way authentication between the client and the cloud storage gateway are as follows: the client initiates a single-packet authorization to the cloud storage gateway; if the single-packet authorization fails, the cloud storage gateway directly discards the single packet; if the single-packet authorization passes, a two-way secure transport layer protocol connection is established between the client and the cloud storage gateway to complete the two-way authentication between the client and the cloud storage gateway.

[0081] The client initiates a single-package authorization for the SPA to the cloud storage gateway. If the SPA authorization fails, the cloud storage gateway discards the SPA and does not respond to the client; if the SPA authorization succeeds, the client and the cloud storage gateway establish a bidirectional mTLS connection, negotiate the key, and complete bidirectional authentication.

[0082] Step S340. After successful authentication, the Zero Trust Controller sends the list of cloud storage gateways corresponding to the multiple cloud storage systems that the client is allowed to connect to, along with the access tokens, to the client.

[0083] The Zero Trust controller determines the list of cloud storage gateways that clients are allowed to connect to and the access tokens issued to the clients, and notifies both the cloud storage gateways and the clients via a TLS secure channel. An access token is a string credential representing that a client is authorized to access protected resources. It typically includes an access token identifier, client ID, protected resource, scope of permissions, expiration timestamp, and other information related to the authorization decision. Access tokens are usually opaque to the client; that is, the client does not understand the meaning of the token, but the authorization server (in this case, the Zero Trust controller) and the resource server (in this case, the cloud storage gateway) do.

[0084] By implementing MFA multi-factor authentication on the client, in addition to the traditional cloud storage account password, one or two additional authentication methods can be used, such as mobile phone verification code, image verification code, OT (One Time Password), CA (Certificate Authority) certificate, or even biometric authentication such as facial recognition and fingerprint recognition, which can greatly enhance the security of client login.

[0085] In step S120, the client sends the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system.

[0086] In this example implementation, the client can send a request to access the cloud storage system and an access token to the cloud storage gateway via a TLS secure channel. The client's access request can include operations such as uploading, downloading, deleting, and sharing files on the cloud drive, as well as adding, deleting, modifying, and querying folders.

[0087] In step S130, the cloud storage gateway obtains the security detection policy through the zero-trust controller and performs security detection on the client's access request based on the security detection policy.

[0088] In this example implementation, the security detection strategy includes a secure access strategy and a security protection strategy. The security protection strategy may include rules for antivirus and anti-malware (worms, backdoors, Trojans).

[0089] In this example implementation, such as Figure 4 As shown, the cloud storage gateway obtains the security detection policy through the zero-trust controller and performs security checks on client access requests based on the security detection policy. Specifically, this may include the following steps:

[0090] Step S410. The cloud storage gateway obtains the security access policy and security protection policy of the cloud storage system through the zero trust controller.

[0091] The Zero Trust controller determines the secure access policies and security protection policies (anti-virus, anti-malware) for accessing the cloud storage system. The cloud storage gateway can receive the secure access policies and security protection policies for accessing the cloud storage system issued by the Zero Trust controller through a TLS secure channel.

[0092] Step S420. The cloud storage gateway starts a security access monitoring process based on the security access policy and a security protection monitoring process based on the security protection policy.

[0093] The cloud storage gateway initiates relevant dynamic monitoring processes based on the security access policies and security protection policies issued by the zero-trust controller.

[0094] Step S430. The cloud storage gateway uses a secure access monitoring process to match the client's access request with the feature information in the access token to determine whether the client's access request meets the secure access policy.

[0095] The cloud storage gateway parses the client's access token and compares it with the client's access request information. The security access monitoring process and the security protection monitoring process detect and match the relevant feature information of the access token and the access request.

[0096] Step S440. The cloud storage gateway detects the client's access request through the security protection monitoring process and determines whether the client's access request meets the security protection policy.

[0097] The secure access monitoring process can detect and filter cloud drive file access requests to ensure compliance with security access policy rules. Especially when clients upload or share cloud drive files, the security protection monitoring process can detect and filter viruses and malware. The secure access monitoring process and the security protection monitoring process can run concurrently.

[0098] Step S450. If the client's access request satisfies both the security access policy and the security protection policy, then the client's access request is deemed to have passed the detection.

[0099] The cloud storage gateway aggregates the processing results of the security access monitoring process and the security protection monitoring process to determine whether all client cloud disk file access requests meet the requirements of the security access policy and the security protection policy. If the client's access request meets both the security access policy and the security protection policy, the client's access request is deemed to have passed the detection.

[0100] In addition, if a client's access request does not simultaneously meet both the security access policy and the security protection policy, the cloud storage gateway will reject the client's access request and execute corresponding security protection actions based on the client's access request.

[0101] If a client's cloud drive file access request does not fully meet the requirements of the security access policy and security protection policy, the cloud storage gateway will reject the client's access request. When a major security risk event is detected (such as the discovery of viruses or malware in uploaded or shared files), security protection actions will be taken (isolate the virus, remove the malware, and terminate the session connection), and the information will be reported to the zero trust controller and the client will be notified.

[0102] In step S140, when the client's access request is detected as successful, the cloud storage gateway performs the access operation of the cloud storage system based on the client's access request and access token, and returns the access operation result of the cloud storage system to the client.

[0103] In this example implementation, if all client access requests meet the requirements of the security access policy and security protection policy, the cloud storage gateway locates the cloud disk file in the cloud storage system that the client wants to access, performs the operation within the access token permission scope, and returns the access operation result of the cloud storage system to the client.

[0104] In this example implementation, the cloud storage gateway can also report the client's access request handling information to the zero trust controller at preset time intervals. The zero trust controller updates the security detection policy based on the access request handling information reported by the cloud storage gateway and sends the updated security detection policy to the cloud storage gateway.

[0105] The cloud storage gateway periodically reports client access request handling information to the zero-trust controller, including the handling results of cloud disk file access requests and related access logs. After summarizing the relevant information, the zero-trust controller updates the client security access policy and security protection policy, and distributes them to the cloud storage gateway to achieve dynamic access control.

[0106] like Figure 5 The diagram shown is a flowchart illustrating the authentication and authorization method of a cloud storage system in a specific embodiment of this disclosure. It serves as an example of the aforementioned two-way authentication steps in this exemplary embodiment. The specific steps of the flowchart are as follows:

[0107] Step S502. The zero-trust controller and the cloud storage gateway complete two-way identity authentication.

[0108] The zero-trust controller establishes a two-way mTLS connection with the cloud storage gateway, negotiates keys, and completes two-way authentication.

[0109] Step S504. The client and the zero-trust controller complete two-way authentication.

[0110] The client initiates a single-packet authorization for the SPA to the Zero Trust controller. If the SPA authorization fails, the Zero Trust controller discards the SPA packet without responding to the client; if the SPA authorization succeeds, the client and the Zero Trust controller establish a two-way mTLS connection, negotiate the key, and complete two-way authentication.

[0111] Step S506. The zero-trust controller invokes the MFA multi-factor authentication strategy to verify the relevant client information.

[0112] The zero-trust controller invokes the (single-factor) authentication authorization module involved in the MFA multi-factor authentication strategy to verify relevant client information.

[0113] Step S508. The zero-trust controller performs the authentication activity.

[0114] Authentication activities (account password authentication, PKI certificate authentication, face authentication, and other optional authentications) are optional and can be performed concurrently. Whether an authentication activity is selected depends on whether the zero trust controller client's MFA multi-factor authentication policy includes that authentication.

[0115] Step S510. The zero-trust controller determines whether the client meets the multi-factor authentication policy.

[0116] The zero-trust controller aggregates the authentication activity results and determines whether the client meets the multi-factor authentication policy.

[0117] Step S512. The zero-trust controller sends an authentication failure message to the client.

[0118] If the Zero Trust controller determines that the client does not meet the multi-factor authentication policy, the client authentication fails, and the Zero Trust controller sends an authentication failure message to the client.

[0119] Step S514. The zero-trust controller determines the list of cloud storage gateways that the client is allowed to connect to and the access tokens issued to the client.

[0120] If the Zero Trust controller determines that the client meets the multi-factor authentication policy, the client authentication is successful. The Zero Trust controller then determines the list of cloud storage gateways that the client is allowed to connect to and the access token issued to the client, and notifies the cloud storage gateways and the client via a TLS secure channel.

[0121] Step S516. The client and the cloud storage gateway complete two-way authentication.

[0122] The client initiates a single-package authorization for the SPA to the cloud storage gateway. If the SPA authorization fails, the cloud storage gateway discards the SPA and does not respond to the client; if the SPA authorization succeeds, the client and the cloud storage gateway establish a bidirectional mTLS connection, negotiate the key, and complete bidirectional authentication.

[0123] like Figure 6 The diagram shown is a flowchart illustrating a cloud disk access method of a cloud storage system in a specific embodiment of this disclosure. It serves as an example of the access steps of the cloud storage system described in this exemplary embodiment. The specific steps of the flowchart are as follows:

[0124] Step S602. The zero-trust controller determines the secure access policy and security protection policy for accessing files on the cloud disk.

[0125] The Zero Trust Controller determines the set of security access policy rules and security protection policies (anti-virus, anti-malware) for accessing files on the cloud drive.

[0126] Step S604. The cloud storage gateway starts the relevant dynamic monitoring process.

[0127] The cloud storage gateway receives the set of security access policy rules and security protection policies for accessing cloud disk files issued by the zero trust controller through the TLS secure channel, and starts the relevant dynamic listening process.

[0128] Step S606. The client sends an access request and access token to the cloud storage gateway.

[0129] The client sends a request to access files on the cloud drive and an access token to the cloud storage gateway via a TLS secure channel. Client requests to access files on the cloud drive include operations such as uploading, downloading, deleting, and sharing files, as well as creating, deleting, modifying, and querying folders.

[0130] Step S608. The cloud storage gateway performs access request detection.

[0131] The cloud storage gateway parses the client's access token, compares it with the client's cloud disk file access request information, and the security access monitoring process and security protection monitoring process detect and match relevant feature information.

[0132] Step S610. The cloud storage gateway runs the security access monitoring process and the security protection monitoring process.

[0133] The secure access monitoring process and the security protection monitoring process (anti-virus, anti-malware) run concurrently. The secure access monitoring process checks and filters cloud drive file access requests to ensure compliance with security access policy rules. Specifically, when clients upload or share cloud drive files, the security protection monitoring process detects and filters viruses and malware.

[0134] Step S612. The cloud storage gateway determines whether the client's access request meets the requirements of the security access policy and security protection policy.

[0135] The cloud storage gateway aggregates the processing results of the security access monitoring process and the security protection monitoring process to determine whether all client cloud disk file access requests meet the requirements of the security access policy and the security protection policy.

[0136] Step S614. The cloud storage gateway rejects the client's access request.

[0137] If a client's cloud disk file access request does not fully meet the requirements of the security access policy and security protection policy, the cloud storage gateway will reject the client's cloud disk access request. When a major security risk event is detected (such as the discovery of viruses or malware in uploaded or shared files), security protection actions will be taken (such as isolating viruses, removing malware, and terminating session connections), and the information will be reported to the zero trust controller and the client will be notified.

[0138] Step S616. The cloud storage gateway performs an access operation.

[0139] If all client cloud disk file access requests meet the requirements of the security access policy and security protection policy, the cloud storage gateway will locate the cloud disk file in the distributed storage cloud that the client wants to access, perform the operation within the access token permission scope, and return the cloud disk access operation result to the client.

[0140] Step S618. The cloud storage gateway periodically reports client access request handling information to the zero trust controller.

[0141] The cloud storage gateway periodically reports the handling of client cloud disk file access requests and related context information in the access logs to the zero trust controller.

[0142] Step S620. The zero-trust controller updates the security access policy and security protection policy.

[0143] After aggregating relevant information, the Zero Trust Controller updates the client's cloud disk file security access policy and security protection policy, and distributes them to the cloud storage gateway to achieve dynamic access control.

[0144] It should be noted that although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0145] Furthermore, this disclosure also provides an access device for a cloud storage system. (See reference) Figure 7As shown, the access device of this cloud storage system may include a two-way authentication establishment module 710, an access request sending module 720, an access request detection module 730, and an access result return module 740. Wherein:

[0146] The two-way authentication establishment module 710 can be used to establish two-way authentication between the client, the cloud storage gateway and the zero trust controller, and send the access token of the cloud storage system to the client through the zero trust controller.

[0147] The access request sending module 720 can be used by the client to send the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system.

[0148] The access request detection module 730 can be used by the cloud storage gateway to obtain the security detection policy through the zero trust controller and perform security detection on the client's access request based on the security detection policy.

[0149] The access result return module 740 can be used to perform access operations of the cloud storage system based on the client's access request and access token when the client's access request is detected as successful, and return the access operation results of the cloud storage system to the client.

[0150] In some exemplary embodiments of this disclosure, the two-way authentication establishment module 710 may include a controller authentication establishment unit, an authentication policy judgment unit, a client authentication unit, and an access token sending unit. Wherein:

[0151] The controller authentication establishment unit can be used to establish two-way authentication between the zero-trust controller and the cloud storage gateway, as well as two-way authentication between the zero-trust controller and the client;

[0152] The authentication policy judgment unit can be used by the zero-trust controller to obtain the multi-factor authentication policy corresponding to the client, and to verify the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy.

[0153] The client authentication establishment unit can be used to establish two-way authentication between the client and the cloud storage gateway if the client meets the multi-factor authentication policy.

[0154] The access token sending unit can be used to send the list of cloud storage gateways corresponding to multiple cloud storage systems that the client is allowed to connect to, along with the access tokens, to the client after successful authentication.

[0155] In some exemplary embodiments of this disclosure, the authentication policy determination unit may include an authentication module invocation unit and an authentication operation execution unit. Wherein:

[0156] The authentication module calling unit can be used by the zero trust controller to obtain the multi-factor authentication policy corresponding to the client, and to call the single-factor authentication module in the zero trust controller based on the multi-factor authentication policy.

[0157] The authentication operation execution unit can be used by the zero-trust controller to perform various single-factor authentication operations on client information through the single-factor authentication module. If all single-factor authentication operations pass, the client is determined to meet the multi-factor authentication strategy.

[0158] In some exemplary embodiments of this disclosure, the client authentication establishment unit may include a single-packet authorization unit, a single-packet discarding unit, and a protocol connection unit. Wherein:

[0159] The single-packet authorization unit can be used by a client to initiate single-packet authorization to a zero-trust controller or cloud storage gateway;

[0160] The single packet discarding unit can be used to directly discard a single packet if authorization fails;

[0161] The protocol connection unit can be used to establish a bidirectional secure transport layer protocol connection between the client and the zero-trust controller or cloud storage gateway if single packet authorization is successful, thereby completing bidirectional authentication between the client and the zero-trust controller or cloud storage gateway.

[0162] In some exemplary embodiments of this disclosure, the access request detection module 730 may include a security policy acquisition unit, a monitoring process startup unit, a secure access monitoring unit, a security protection monitoring unit, and a request detection and determination unit. Wherein:

[0163] The security policy acquisition unit can be used by the cloud storage gateway to acquire the security access policy and security protection policy of the cloud storage system through the zero trust controller;

[0164] The monitoring process startup unit can be used by cloud storage gateways to start a secure access monitoring process based on a secure access policy, and to start a secure protection monitoring process based on a security protection policy.

[0165] The secure access monitoring unit can be used by cloud storage gateways to match client access requests with feature information in access tokens through a secure access monitoring process to determine whether the client's access request meets the secure access policy.

[0166] The security protection monitoring unit can be used by cloud storage gateways to detect client access requests through the security protection monitoring process and determine whether the client access requests meet the security protection policy.

[0167] The request detection and judgment unit can be used to determine that the client's access request passes the security access policy and security protection policy if the client's access request simultaneously meets both the security access policy and the security protection policy.

[0168] In some exemplary embodiments of this disclosure, the access request detection module 730 may further include an access request rejection unit, which can be used to reject the client's access request if the client's access request does not simultaneously satisfy the security access policy and the security protection policy, and to perform corresponding security protection actions based on the client's access request.

[0169] In some exemplary embodiments of this disclosure, the access device for a cloud storage system provided in this disclosure may further include a security policy update module, which may include a handling information reporting unit and a security policy update unit. Wherein:

[0170] The processing information reporting unit can be used by the cloud storage gateway to report the client's access request processing information to the zero trust controller at preset time intervals;

[0171] The security policy update unit can be used by the zero-trust controller to update the security detection policy based on the access request handling information reported by the cloud storage gateway, and then distribute the updated security detection policy to the cloud storage gateway.

[0172] The specific details of each module / unit in the access device of the aforementioned cloud storage system have been described in detail in the corresponding method embodiment section, and will not be repeated here.

[0173] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the embodiments of the present disclosure is shown.

[0174] It should be noted that, Figure 8 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0175] like Figure 8 As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 802 or programs loaded from storage section 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for system operation. The CPU 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0176] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0177] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs various functions defined in the system of this disclosure.

[0178] It should be noted that the computer-readable medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0179] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0180] In another aspect, this disclosure also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0181] It should be noted that although several modules for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules described above can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0182] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein.

[0183] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for accessing a cloud storage system, characterized in that, include: Establish two-way authentication between the client, the cloud storage gateway, and the zero trust controller, and send the access token of the cloud storage system to the client through the zero trust controller; The client sends the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system. The cloud storage gateway obtains a security detection policy through the zero-trust controller and performs security detection on the client's access request based on the security detection policy. The security detection policy includes a secure access policy and a security protection policy. The process of obtaining the security detection policy through the zero-trust controller and performing security detection on the client's access request includes: the cloud storage gateway obtaining the cloud storage system's secure access policy and security protection policy through the zero-trust controller; the cloud storage gateway initiating a secure access monitoring process based on the secure access policy and a security protection monitoring process based on the security protection policy; the cloud storage gateway matching the client's access request with the feature information in the access token through the secure access monitoring process to determine whether the client's access request satisfies the secure access policy; and the cloud storage gateway detecting the client's access request through the security protection monitoring process to determine whether the client's access request satisfies the security protection policy. If the client's access request satisfies both the secure access policy and the security protection policy, then the client's access request is deemed to have passed the detection. When the client's access request passes the detection, the cloud storage gateway executes the access operation of the cloud storage system based on the client's access request and the access token, and returns the access operation result of the cloud storage system to the client.

2. The access method for the cloud storage system according to claim 1, characterized in that, The process of establishing two-way authentication between the client, the cloud storage gateway, and the zero-trust controller, and sending the access token of the cloud storage system to the client through the zero-trust controller, includes: Establish two-way authentication between the zero-trust controller and the cloud storage gateway, as well as two-way authentication between the zero-trust controller and the client; The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and verifies the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy. If the client meets the multi-factor authentication policy, then a two-way authentication is established between the client and the cloud storage gateway; After successful authentication, the zero-trust controller sends the list of cloud storage gateways corresponding to the multiple cloud storage systems that the client is allowed to connect to, along with access tokens, to the client.

3. The access method for a cloud storage system according to claim 2, characterized in that, The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and verifies the client information based on the multi-factor authentication policy to determine whether the client meets the multi-factor authentication policy, including: The zero-trust controller obtains the multi-factor authentication policy corresponding to the client, and calls the single-factor authentication module in the zero-trust controller based on the multi-factor authentication policy. The zero-trust controller performs various single-factor authentication operations on the client information through the single-factor authentication module. If all the single-factor authentication operations pass, the client is determined to meet the multi-factor authentication strategy.

4. The access method for a cloud storage system according to claim 2, characterized in that, The steps for establishing two-way authentication between the client and the zero-trust controller or the cloud storage gateway include: The client initiates a single-packet authorization to the zero-trust controller or the cloud storage gateway; If the single packet authorization fails, the zero-trust controller or the cloud storage gateway will directly discard the single packet. If the single-packet authorization is successful, a bidirectional secure transport layer protocol connection is established between the client and the zero-trust controller or the cloud storage gateway to complete the bidirectional authentication between the client and the zero-trust controller or the cloud storage gateway.

5. The access method for a cloud storage system according to claim 1, characterized in that, The method further includes: If the client's access request does not simultaneously satisfy the security access policy and the security protection policy, the cloud storage gateway rejects the client's access request and performs corresponding security protection actions based on the client's access request.

6. The access method for a cloud storage system according to claim 1, characterized in that, The method further includes: The cloud storage gateway reports the client's access request processing information to the zero-trust controller at preset time intervals; The zero-trust controller updates the security detection policy based on the access request handling information reported by the cloud storage gateway, and then sends the updated security detection policy to the cloud storage gateway.

7. An access device for a cloud storage system, characterized in that, include: The two-way authentication establishment module is used to establish two-way authentication between the client, the cloud storage gateway, and the zero trust controller, and to send the access token of the cloud storage system to the client through the zero trust controller. An access request sending module is used to enable the client to send the access request to the cloud storage system and the corresponding access token to the cloud storage gateway corresponding to the cloud storage system. An access request detection module is used to enable the cloud storage gateway to obtain a security detection policy through the zero-trust controller, and to perform security detection on the client's access request based on the security detection policy. The security detection policy includes a secure access policy and a security protection policy. The cloud storage gateway obtaining the security detection policy through the zero-trust controller and performing security detection on the client's access request based on the security detection policy includes: the cloud storage gateway obtaining the cloud storage system's secure access policy and security protection policy through the zero-trust controller; the cloud storage gateway initiating a secure access monitoring process based on the secure access policy and a security protection monitoring process based on the security protection policy; the cloud storage gateway matching the client's access request with the feature information in the access token through the secure access monitoring process to determine whether the client's access request satisfies the secure access policy; the cloud storage gateway detecting the client's access request through the security protection monitoring process to determine whether the client's access request satisfies the security protection policy; if the client's access request simultaneously satisfies the secure access policy and the security protection policy, then the client's access request detection is deemed successful. The access result return module is used to, when the client's access request is detected as passed, have the cloud storage gateway perform the access operation of the cloud storage system according to the client's access request and the access token, and return the access operation result of the cloud storage system to the client.

8. An electronic device, characterized in that, include: processor; as well as A memory for storing one or more programs, which, when executed by the processor, cause the processor to implement the access method of the cloud storage system as described in any one of claims 1 to 6.

9. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the access method of the cloud storage system as described in any one of claims 1 to 6.

Images