Identity detection method, apparatus, device, storage medium, and program product

Abstract

The present application provides an identity detection method, device, equipment, storage medium and program product, comprising: after sending an upload address of a to-be-uploaded file to a client, storing file information of the to-be-uploaded file and the upload address of the to-be-uploaded file to a first storage area; creating a verification message; after obtaining an association request sent by the client, deleting the file information in the first storage area; detecting whether the first storage area stores the file information based on the verification message; if the first storage area does not store the file information, authenticating that the identity of the client is legal; if the first storage area stores the file information, authenticating that the identity of the client is illegal; wherein the association request is used to request binding the upload address and the identifier of the client after the client uploads the to-be-uploaded file to the upload address. To ensure the legal use of storage resources and improve the accuracy of identity detection.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to an identity detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] Cloud storage services are data storage services based on cloud computing technology. Users can upload data to a cloud storage provider's servers via the internet for storage, or download data from the provider's servers for access and use. Cloud storage services typically feature high availability, scalability, flexibility, and security. Users pay only as needed and can flexibly adjust storage capacity and usage methods according to their actual needs.

[0003] Client-side direct upload service refers to the process where clients such as browsers and mobile applications directly upload data to cloud storage services without going through the server as an intermediary. This can improve upload efficiency and security, and reduce the burden on the server.

[0004] To prevent file upload services from being stolen, cloud storage providers first issue temporary credentials and other signature information to clients who have purchased cloud storage services. When a client uploads a file directly, the cloud storage provider requires the client to report the corresponding signature information. For example, taking a user changing their profile picture on the client side as an example, the client can first obtain a temporary credential and upload address from the server, and then upload the new profile picture to the cloud storage based on the temporary credential and upload address. After successful upload, the client can store the user's identification (ID) and upload address on the server so that the server can display the changed profile picture.

[0005] However, clients who have not purchased cloud storage services may obtain temporary credentials and upload addresses from the cloud storage provider's server by means of identity forgery, so as to store their own data in the cloud for free. This illegally uses the cloud storage services purchased by the server, causing resource damage to both the server and the client that purchased the cloud storage services. Summary of the Invention

[0006] This application provides an identity detection method, apparatus, device, storage medium, and program product to ensure the legitimate use of storage resources and improve the accuracy of identity detection.

[0007] Firstly, this application provides an identity verification method applied to an electronic device. The method includes: after sending the upload address of a file to be uploaded to a client, storing the file information and the upload address of the file to be uploaded in a first storage area; creating a verification message; after receiving an association request sent by the client, deleting the file information in the first storage area; detecting whether the first storage area stores file information based on the verification message; if the first storage area does not store file information, then the client's identity is verified as legitimate; if the first storage area stores file information, then the client's identity is verified as illegitimate; wherein the association request is used to request binding the upload address with the client's identifier after the client uploads the file to the upload address.

[0008] Optionally, the creation of the verification message includes: creating a verification delay message in the message queue; detecting whether the first storage area stores file information based on the verification message includes: in response to the delay time of the arrival of the verification delay message, detecting whether the first storage area stores file information by the upload address.

[0009] Optionally, the above delay time is the maximum time interval for the client to upload files.

[0010] Optionally, the aforementioned electronic device includes an application server and a business server; deleting file information in the first storage area includes: sending a deletion request including the file address to the application server through the business server; and in response to the deletion request, querying and deleting the file information from the first storage area based on the file address through the application server.

[0011] Optionally, after the aforementioned authentication client identity is invalid, the process also includes: deleting the file to be uploaded from the storage area corresponding to the upload address, storing the file to be uploaded in a second storage area for backup purposes; setting the lifecycle of the file to be uploaded in the second storage area; and deleting the file to be uploaded from the second storage area when the lifecycle is reached.

[0012] Optionally, before deleting the file information in the first storage area, the method further includes: responding to the association request, performing initial authentication on the client's identity to obtain an initial authentication result; deleting the file information in the first storage area includes: deleting the file information in the first storage area when the initial authentication result indicates that the client's identity is legitimate.

[0013] Optionally, if the initial authentication result indicates that the client's identity is invalid, the file information in the first storage area will not be deleted.

[0014] Secondly, this application provides an identity detection device, comprising: a storage module, a creation module, a first deletion module, a detection module, and a first authentication module. The storage module is used to store the file information and the upload address of the file to be uploaded in a first storage area after sending the upload address to the client. The creation module is used to create a verification message. The first deletion module is used to delete the file information in the first storage area after receiving an association request from the client. The detection module is used to detect whether the first storage area stores file information based on the verification message. The first authentication module is used to authenticate the client's identity as legitimate if the first storage area does not store file information, and to authenticate the client's identity as illegitimate if the first storage area stores file information. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to the upload address.

[0015] Optionally, a module is created specifically for: creating a verification delay message in a message queue; and detecting whether file information is stored in the first storage area based on the verification message, including: detecting whether file information is stored in the first storage area by means of the upload address in response to the delay time of the arrival of the verification delay message.

[0016] Optionally, the delay time is the maximum time interval for the client to upload files.

[0017] Optionally, the first deletion module is specifically used to: send a deletion request including the file address to the application server through the business server; and in response to the deletion request, query and delete the file information from the first storage area through the application server based on the file address.

[0018] Optionally, the identity verification device further includes: a moving module, a setting module, and a second deletion module, wherein the moving module is used to delete the file to be uploaded from the storage area corresponding to the upload address and store the file to be uploaded in the second storage area for backup; the setting module is used to set the lifecycle of the file to be uploaded in the second storage area; and the second deletion module is used to delete the file to be uploaded from the second storage area when the lifecycle is reached.

[0019] Optionally, the identity detection device further includes: a second authentication module, wherein the second authentication module is used to perform initial authentication of the client's identity in response to an association request and obtain an initial authentication result; and a first deletion module, specifically used to delete file information in the first storage area when the initial authentication result indicates that the client's identity is legitimate.

[0020] Optionally, the first deletion module is specifically used to: not delete file information in the first storage area when the initial authentication result indicates that the client's identity is invalid.

[0021] Thirdly, this application provides an electronic device, including: a processor and a memory, the memory for storing a computer program, and the processor for calling and running the computer program stored in the memory to perform the methods as described in the first aspect or its various implementations.

[0022] Fourthly, this application provides a computer-readable storage medium for storing a computer program that causes a computer to perform the methods described in the first aspect or its various implementations.

[0023] Fifthly, this application provides a computer program product including computer program instructions that cause a computer to perform the methods as described in the first aspect or its various implementations.

[0024] Sixthly, this application provides a computer program that causes a computer to perform the methods described in the first aspect or its various implementations.

[0025] According to the technical solution of this application, after sending the upload address of the file to be uploaded to the client, the electronic device stores the file information and the upload address of the file to be uploaded in the first storage area. Then, the electronic device can create a verification message. After obtaining the association request sent by the client, it deletes the file information in the first storage area. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to the upload address. Then, it can detect whether the first storage area stores file information based on the verification message. If the first storage area does not store file information, the client's identity is authenticated as legitimate; if the first storage area stores file information, the client's identity is authenticated as illegitimate. It is understandable that a client that has not purchased cloud storage services steals the upload address to use free storage services and will not send an association request to the electronic device. Therefore, for clients that have not purchased cloud storage services, the electronic device cannot obtain the association request, and therefore will not delete the file information in the first storage area. Consequently, when detecting based on the verification message, it will inevitably detect that the first storage area stores file information. Based on this, the electronic device can determine that the client who has not purchased cloud storage services is illegitimate. After uploading a file to be uploaded according to the upload address, the client that purchased the cloud storage service sends an association request to the electronic device. This request requests the electronic device to bind the upload address to the client's identifier, allowing the client to subsequently use the file to be uploaded from that address. Therefore, the electronic device will inevitably receive this association request and delete the file information in the first storage area. Consequently, during verification based on the verification message, it will be able to detect that no file information is stored in the first storage area. Based on this, the electronic device can determine that the client's identity is legitimate. This not only improves the accuracy of identity verification but also ensures the legitimate use of storage resources. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 An application scenario diagram provided for an embodiment of this application;

[0028] Figure 2 A flowchart illustrating an identity detection method provided in an embodiment of this application;

[0029] Figure 3A schematic diagram illustrating an identity detection method provided in an embodiment of this application;

[0030] Figure 4 A schematic diagram illustrating another identity detection method provided in an embodiment of this application;

[0031] Figure 5 A schematic diagram illustrating another identity detection method provided in an embodiment of this application;

[0032] Figure 6 A schematic diagram illustrating yet another identity detection method provided in an embodiment of this application;

[0033] Figure 7 A schematic diagram of an identity detection device 700 provided in an embodiment of this application;

[0034] Figure 8 This is a schematic block diagram of an electronic device 800 provided in an embodiment of this application. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0037] As mentioned above, clients that have not purchased cloud storage services may obtain temporary credentials and upload addresses from servers that have purchased cloud storage services by means of identity forgery, so as to store their own data in the cloud for free, thereby illegally using the cloud storage services purchased by the server and causing resource damage to both the server and the clients that have purchased cloud storage services.

[0038] To address the aforementioned technical issues, this application can, after sending the upload address of the file to be uploaded to the client, store the file information and upload address of the file to be uploaded in a first storage area and create a verification message. After receiving the association request sent by the client, the file information in the first storage area is deleted. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to the upload address. Subsequently, the verification message can be used to detect whether the first storage area stores file information. If the first storage area does not store file information, the client's identity is authenticated as legitimate; if the first storage area stores file information, the client's identity is authenticated as illegitimate. In this process, since clients who haven't purchased cloud storage services steal upload addresses to use free storage services, clients who have purchased cloud storage services will request the electronic device to bind the upload address with their own identifier to use the files to be uploaded from that address later. Therefore, clients who haven't purchased cloud storage services won't send an association request to the electronic device, while clients who have purchased cloud storage services will. Based on this, the electronic device cannot obtain the association request from clients who haven't purchased cloud storage services, and thus will not delete the file information in the first storage area. Consequently, during verification message-based detection, it will inevitably detect that the first storage area contains file information, thus determining that the client who hasn't purchased cloud storage services is illegitimate. For clients who have purchased cloud storage services, the electronic device will inevitably obtain their association request and delete the file information in the first storage area. Therefore, during verification message-based detection, it will inevitably detect that the first storage area does not contain file information, thus determining that the client who has purchased cloud storage services is legitimate. This not only improves the accuracy of identity verification but also ensures the legitimate use of storage resources.

[0039] It should be understood that the technical solution of this application can be applied to the following scenarios, but is not limited to:

[0040] In some possible implementations, the technical solution of this application can be used to detect whether the identity of a device using storage services is legitimate. For example, this application can be applied to detect whether the identity of a client using cloud storage services is legitimate, and this application does not impose any limitations on this.

[0041] In some possible ways, Figure 1 An application scenario diagram provided for an embodiment of this application, such as... Figure 1 As shown, this application scenario may include a terminal device 110 and an electronic device 120. The terminal device 110 can establish a connection with the electronic device 120 through a wired network or a wireless network.

[0042] For example, terminal device 110 can be a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, in-vehicle device, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc., but is not limited to these. Electronic device 120 can be a server of a cloud storage provider, which can provide cloud storage services to clients, etc. Of course, it can also be a server that can provide other storage services besides cloud storage services. Specifically, electronic device 120 can be a single server, a server cluster composed of multiple servers, or a cloud platform control center. This application embodiment does not limit this.

[0043] For example, a client can be installed in the terminal device 110. The client can upload the file to be uploaded to the cloud storage provided by the electronic device 120. The electronic device 120 can detect the identity of the client to determine whether the client is a legitimate device that has purchased cloud storage services.

[0044] also, Figure 1 An electronic device and a terminal device are given as examples, but in practice, other numbers of electronic devices and terminal devices may be included, and this application does not limit them.

[0045] In other possible implementations, the technical solution of this application may also be executed by the aforementioned terminal device 110, or by the aforementioned electronic device 120, and this application does not impose any restrictions on this.

[0046] After introducing the application scenarios of the embodiments of this application, the technical solution of this application will be described in detail below:

[0047] Figure 2 A flowchart illustrating an identity detection method provided in this application embodiment, the method can be performed by, for example... Figure 1 The electronic device 120 shown performs, but is not limited to, its functions. For example... Figure 2 As shown, the method may include the following steps:

[0048] S210: After sending the upload address of the file to be uploaded to the client, store the file information of the file to be uploaded and the upload address of the file to be uploaded in the first storage area;

[0049] S220: Create a verification message;

[0050] S230: After receiving the association request sent by the client, delete the file information in the first storage area. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to be uploaded to the upload address.

[0051] S240: Detect whether the first storage area stores file information based on the verification message. If the first storage area does not store file information, execute S250. If the first storage area stores file information, execute S260.

[0052] S250: The client's identity is verified;

[0053] S260: The client's identity is invalid.

[0054] It should be noted that this application will use the example of an electronic device being a server or other server-side device to introduce the technical solution of this application. When the electronic device is another device, the corresponding embodiment is similar to that here. In order to avoid repetition, this application will not elaborate on it.

[0055] It should be noted that in this embodiment, the first client is a legitimate client, and the second client is an illegitimate client. For example, in a cloud storage scenario, the first client may be a client that has purchased cloud storage services from a cloud storage provider, and can upload data to the server and download data from the server for access and use; the second client may be a client that has not purchased cloud storage services from the server, and can use methods such as identity forgery to illegally store its own data in the cloud for free.

[0056] In existing technologies, such as Figure 3 As shown, the server-side includes a product upload server and a product business server. For example, combining... Figure 3 Taking changing a user's avatar as an example, when the first client changes the user's avatar using the cloud storage service provided by the server, it calls the product upload server's interface to obtain the upload address and temporary credentials for the user's avatar. Then, the first client uploads the user's avatar to the server's cloud storage based on the upload address and temporary credentials. After successful upload, the first client submits the user ID and the aforementioned upload address to the product business server. The product business server can bind the user ID and upload address to resources, that is, record the user ID and upload address in the database. Later, when the first client needs to display the user's avatar, it can send the user ID to the server. The server can retrieve the aforementioned address from the database based on the user ID, retrieve the user's avatar from the cloud storage based on the upload address, and send it to the first client, so that the first client can display the user's avatar.

[0057] From the above process, it can be determined that uploading and downloading user avatars and other files to cloud storage requires three steps in sequence: obtaining the upload address and temporary credentials, uploading the file to cloud storage, and resource binding. In other words, the client needs to initiate three independent requests. The interfaces corresponding to these three independent requests are handled and maintained separately by the server-side product upload server, cloud storage service server, and product business server. These are handled by three different modules on the server side, and there is no communication between these modules. Therefore, for the second client, such as... Figure 4 As shown, by orchestrating the API call process or blocking the API corresponding to the third step, one can obtain the upload address and credentials by forging identities and other means, upload their own data to cloud storage without binding resources, and thus use the cloud storage service provided by the server as their own free cloud storage service.

[0058] Therefore, it's clear that when the first client uses the cloud storage service provided by the server, it will always perform a third step: resource binding. For example, when the first client uploads a user avatar to cloud storage, it will request the server to bind the upload address and user ID. This allows the server to retrieve and display the user avatar from cloud storage in subsequent scenarios where the avatar is used; otherwise, the avatar will not be displayed on the first client. Similarly, when the first client uploads a song to cloud storage, it will request the server to bind the upload address and user ID. This allows the server to retrieve and play the song from cloud storage in subsequent scenarios where the song is played; otherwise, the song will not be playable on the first client. However, the second client, which steals the upload address to use the free storage service, will not perform this third step and will not request resource binding from the server. Based on this, the server cannot obtain the association request from the second client, and therefore will not delete the file information in the first storage area. Consequently, during verification message-based checks, the server will inevitably detect that the first storage area contains file information, thus determining that the second client's identity is illegitimate. Conversely, the server will obtain the association request sent by the first client and delete the file information in the first storage area. Therefore, during verification message-based checks, the server will inevitably detect that the first storage area does not contain file information, thus determining that the first client's identity is legitimate. This not only improves the accuracy of identity verification but also ensures the legitimate use of storage resources.

[0059] In some possible implementations, the file information of the file to be uploaded can be at least one of the following, but is not limited to: the file identifier of the file to be uploaded, and the client identifier of the client that sent the file to be uploaded. The client identifier can be the user identifier of the user logged into the client, such as a user ID. The file identifier can be information used to uniquely describe the file to be uploaded.

[0060] In some implementations, the first storage area can be a storage area in a local database on the server or in a cloud database, and this storage area can be a cache area.

[0061] In some implementations, creating a verification message may include creating a verification delay message in a message queue. Detecting whether file information is stored in the first storage area based on the verification message includes: detecting whether file information is stored in the first storage area via the upload address in response to the delay time of the arrival of the verification delay message.

[0062] Optionally, the verification message may include the upload address. Upon reaching the delay time, the server can respond to the delay time by checking whether the first storage area stores file information using the upload address in the verification message. Alternatively, the verification message may include information instructing the server to obtain the upload address. Thus, upon reaching the delay time, the server can respond to the verification delay message, obtain the upload address, and check whether the first storage area stores file information based on the obtained upload address.

[0063] Optionally, when creating a verification delay message, the server can also set the delay time for the verification delay message. The delay time can be the maximum time interval between client file uploads, for example, the delay time can be 1 day. This allows the server to verify the identity of the client before the client uploads the next file to be uploaded, thereby minimizing the number of times a second client steals the server's storage resources.

[0064] For example, in conjunction with the above embodiments, after the server sends the upload address and credentials to the client, it can write the file information and upload address of the file to be uploaded into a cache area. This cache area can store the file information and upload address in a key-value pair, where the key in the cache area is the upload address and the value is the file information. Next, the server can create a delayed message in the message queue, so that when the delay time of the delayed message arrives, it can check whether the file information corresponding to the upload address exists in the cache area.

[0065] In some implementation methods, the electronic device, such as the server, may include an application server and a business server. The above-mentioned deletion of file information in the first storage area may include: sending a deletion request including the file address to the application server through the business server; and in response to the deletion request, querying and deleting the file information from the first storage area according to the file address through the application server.

[0066] For example, after sending the upload address of the file to be uploaded to the client, the application server can store the file information and upload address of the file to be uploaded in a key-value pair in a cache area and create a verification message. Then, the business server can obtain the association request sent by the client and send a deletion request including the file address to the application server. This deletion request can be an acknowledgment (ACK) string, and the parameter of the ACK request can be the file address, indicating that the business server has received the association request sent by the client and requests the application server to delete the file information corresponding to the file address. In response to the deletion request, the application server can use the file address in the ACK request as the key to query and delete the corresponding file information from the aforementioned cache area. Next, the application server can check whether the first storage area stores file information based on the verification message.

[0067] In the above process, the server can receive the association request sent by the client based on the business server, and after obtaining the association request, send a deletion request to the application server to request the application server to delete the file information in the first storage area. In this way, the communication between the business server and the application server can be realized (that is, the communication between the product upload server and the product business server in the above embodiment). This ensures that the deletion of the file information in the first storage area occurs after receiving the association request. That is, it can be ensured that the file information in the first storage area will definitely be deleted for the first client, but will definitely not be deleted for the second client. In other words, in the absence of storage resource theft, i.e., for the first client, when using cloud storage services... After the server provides the storage service and binds the resources, the server will delete the file information in the first storage area. In the event of storage resource theft, i.e., for clients with illegitimate identities such as the second client, after they use the storage service provided by the server such as the cloud storage service, the server will not delete the file information in the first storage area because the third step in the legitimate process (i.e., the process of the first client using the cloud storage service in the above embodiment) is missing. That is, the corresponding file information is still retained in the first storage area. Then, the server can accurately determine whether the identity of the client using the storage service is legitimate by detecting the corresponding file information in the first storage area based on the verification message. Therefore, the above embodiment can further ensure the accuracy of client identity verification.

[0068] In some possible implementations, after the aforementioned authentication client identity is invalid, the process also includes: deleting the file to be uploaded from the storage area corresponding to the upload address, storing the file to be uploaded in a second storage area for backup purposes; setting the lifecycle of the file to be uploaded in the second storage area; and deleting the file to be uploaded from the second storage area when the lifecycle is reached.

[0069] For example, the second storage area can be a storage area in the server's local database or a cloud database, which can store uploaded files deleted from the storage area corresponding to the upload address, in order to back up the uploaded files.

[0070] Furthermore, the second storage area can differ from the first storage area. For example, the first access address of the first storage area and the second access address of the second storage area are different. When storing file information and upload addresses in the first storage area, the server can first determine the first access address, access the first storage area based on the first access address, and thus store the file information and upload addresses in the first storage area. After authenticating the client's identity as invalid, the server can first determine the second access address, access the second storage area based on the second access address, store the uploaded file in the storage area corresponding to the upload address in the second storage area, and delete the file to be uploaded from the storage area corresponding to the upload address.

[0071] For example, in conjunction with the above embodiments, after the server consumes the verification delay message, it queries the corresponding file information from the cache area. If the corresponding file information is not found in the cache area, it can be determined that the cache area does not store the corresponding file information. At this time, it can be determined that the client's identity is invalid. Then, the server can move the file to be uploaded by the invalid client, i.e., the second client, to another storage area, i.e., the second storage area, from the original address. The server can also delete the file to be uploaded by configuring a longer file lifecycle, which can be one month. This not only releases the storage area illegally occupied by the second client, but also allows the file to be recovered by rollback if it is found that the file was accidentally deleted due to some abnormal reason.

[0072] In some implementations, before deleting the file information in the first storage area, the method further includes: responding to an association request, performing initial authentication on the client's identity, and obtaining an initial authentication result. Deleting the file information in the first storage area includes: deleting the file information in the first storage area if the initial authentication result indicates the client's identity is valid; and not deleting the file information in the first storage area if the initial authentication result indicates the client's identity is invalid.

[0073] In the above process, after receiving the association request and before deleting the corresponding file information from the first storage area, the server can first perform initial authentication of the client's identity to prevent the second client from being mistakenly judged as legitimate when checking the verification message results because the second client also sends an association request like the first client, thereby further improving the accuracy of identity verification.

[0074] In some possible implementations, in conjunction with the above embodiments, the application server is a product upload server, and the business server is a product business server. For the first client, such as... Figure 5 As shown, after obtaining the upload address and credentials from the product upload server, the product upload server can write the file address (upload address) and file information into the cache and create a delay message. Then, after the first client uploads the file and requests the binding of the file and resource to the product business server (i.e., binding the first client's address with the upload address), the product business server can perform resource binding, that is, record the first client's address and upload address in the database. Next, the server's risk control service can perform initial authentication on the first client, that is, perform anti-fraud and anti-spam verification. At the same time, the product business server can send an ACK request to the product upload server through an ACK callback to request the product upload server to delete the corresponding file information from the cache area. Then, the product upload server can delete the corresponding file information from the cache area. When the delay time of the delay message arrives, the product upload server will not find the corresponding file information in the cache area, thus confirming the legitimacy of the first client's identity.

[0075] As for the second client, such as Figure 6 As shown, after obtaining the upload address and credentials from the product upload server, the product upload server can write the file information into the cache and create a delay message, similar to the process described above. After the second client uploads the file, it will not execute step three above, that is, it will not request the binding of the file and resources from the product business server. Therefore, the product business server will not send a deletion request to the product upload server, and the product upload server will not delete the corresponding file information from the cache area. Thus, when the delay time of the delay message arrives, the product upload server will definitely find the corresponding file information in the cache area, and can then determine that the identity of the second client is invalid. Then, the product upload server can move the file from the original address to a new address. For example, it can move the file uploaded by the second client to cloud storage 1 to cloud storage 2 and configure the corresponding lifecycle. After the lifecycle, if there is no business feedback of accidental deletion, the file will be cleaned up from cloud storage 2.

[0076] Through the technical solution of this application, the server can detect illegal file uploads more effectively and automatically, and detect and identify the client's identity more accurately. It can not only automatically handle illegal files after they are detected, but also has low detection costs, low workload for business integration, and a mechanism for recovering accidentally deleted files.

[0077] It should be noted that all the above technical solutions can be combined in any way to form optional embodiments of this application, and will not be described in detail here.

[0078] Figure 7 This is a schematic diagram of an identity detection device 700 provided in an embodiment of this application.

[0079] like Figure 7 As shown, the identity verification device 700 includes: a storage module 701, a creation module 702, a first deletion module 703, a detection module 704, and a first authentication module 705. The storage module 701 stores the file information and the upload address of the file to be uploaded in a first storage area after sending the upload address to the client. The creation module 702 creates a verification message. The first deletion module 703 deletes the file information in the first storage area after receiving an association request from the client. The detection module 704 detects whether the first storage area stores file information based on the verification message. The first authentication module 705 authenticates the client's identity as legitimate if the first storage area does not store file information, and as illegitimate if the first storage area stores file information. The association request requests that the upload address be bound to the client's identifier after the client uploads the file to the upload address.

[0080] In some implementations, module 702 is specifically used to: create a verification delay message in a message queue; and detect whether file information is stored in the first storage area based on the verification message, including: detecting whether file information is stored in the first storage area by means of the upload address in response to the delay time of the arrival of the verification delay message.

[0081] In some implementations, the delay time is the maximum time interval between client file uploads.

[0082] In some implementations, the first deletion module 703 is specifically used to: send a deletion request, including the file address, to the application server through the business server; and in response to the deletion request, query and delete the file information from the first storage area based on the file address through the application server.

[0083] In some implementations, the identity verification device further includes: a movement module 706, a setting module 707, and a second deletion module 708. The movement module 706 is used to delete the file to be uploaded from the storage area corresponding to the upload address and store the file to be uploaded in the second storage area for backup. The setting module 707 is used to set the lifecycle of the file to be uploaded in the second storage area. The second deletion module 708 is used to delete the file to be uploaded from the second storage area when the lifecycle is reached.

[0084] In some implementations, the identity verification device further includes: a second authentication module 709, wherein the second authentication module 709 is used to perform initial authentication of the client's identity in response to an association request and obtain an initial authentication result; and a first deletion module 703, specifically used to delete file information in the first storage area when the initial authentication result indicates that the client's identity is legitimate.

[0085] In some implementations, the first deletion module 703 is specifically used to: not delete file information in the first storage area when the initial authentication result indicates that the client's identity is invalid.

[0086] It should be understood that the device embodiments and method embodiments can correspond to each other, and similar descriptions can be found in the method embodiments. To avoid repetition, further details are omitted here. Specifically, Figure 7 The apparatus 700 shown can execute the above-described method embodiments, and the aforementioned and other operations and / or functions of each module in the apparatus 700 are respectively for implementing the corresponding processes in the above-described methods. For the sake of brevity, they will not be described in detail here.

[0087] The apparatus 700 of this application embodiment has been described above from the perspective of functional modules in conjunction with the accompanying drawings. It should be understood that this functional module can be implemented in hardware, in software instructions, or in a combination of hardware and software modules. Specifically, the steps of the method embodiments in this application can be completed by integrated logic circuits in the processor's hardware and / or by software instructions. The steps of the method disclosed in this application embodiment can be directly embodied as being executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. Optionally, the software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps in the above method embodiments.

[0088] Figure 8 This is a schematic block diagram of an electronic device 800 provided in an embodiment of this application.

[0089] like Figure 8 As shown, the electronic device 800 may include:

[0090] The system includes a memory 810 and a processor 820. The memory 810 stores computer programs and transfers the program code to the processor 820. In other words, the processor 820 can retrieve and run the computer program from the memory 810 to implement the methods described in the embodiments of this application.

[0091] For example, the processor 820 can be used to execute the above-described method embodiments according to instructions in the computer program.

[0092] In some embodiments of this application, the processor 820 may include, but is not limited to:

[0093] General-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0094] In some embodiments of this application, the memory 810 includes, but is not limited to:

[0095] Volatile memory and / or non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0096] In some embodiments of this application, the computer program may be divided into one or more modules, which are stored in the memory 810 and executed by the processor 820 to perform the method provided in this application. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device.

[0097] like Figure 8 As shown, the electronic device may further include:

[0098] Transceiver 830, which can be connected to processor 820 or memory 810.

[0099] The processor 820 can control the transceiver 830 to communicate with other devices; specifically, it can send information or data to other devices or receive information or data sent by other devices. The transceiver 830 may include a transmitter and a receiver. The transceiver 830 may further include antennas, and the number of antennas may be one or more.

[0100] It should be understood that the various components in the electronic device are connected through a bus system, which includes a data bus, a power bus, a control bus, and a status signal bus.

[0101] This application also provides a computer storage medium storing a computer program thereon, which, when executed by a computer, enables the computer to perform the methods of the above-described method embodiments. Alternatively, embodiments of this application also provide a computer program product containing instructions that, when executed by a computer, cause the computer to perform the methods of the above-described method embodiments.

[0102] When implemented using software, it can be implemented entirely or partially as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, the computer can perform all or part of the corresponding processes in the methods of the embodiments of this application, producing the functions achievable by the methods of the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital video discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0103] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0105] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. For example, the functional modules in the various embodiments of this application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0106] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An identity verification method, characterized in that, The method is applied to an electronic device, and the method includes: After sending the upload address of the file to be uploaded to the client, the file information of the file to be uploaded and the upload address of the file to be uploaded are stored in the first storage area; Create a verification message; After receiving the association request sent by the client, the file information in the first storage area is deleted; Based on the verification message, detect whether the first storage area stores the file information; If the first storage area does not store the file information, then the client's identity is verified as legitimate; If the first storage area stores the file information, then the client's identity is invalid. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to be uploaded to the upload address.

2. The method according to claim 1, characterized in that, The creation of the verification message includes: Create a validation delayed message in the message queue; The step of detecting whether the first storage area stores the file information based on the verification message includes: In response to the delay time of the arrival of the verification delay message, the system detects whether the file information is stored in the first storage area via the upload address.

3. The method according to claim 2, characterized in that, The delay time is the maximum time interval for the client to upload files.

4. The method according to any one of claims 1-3, characterized in that, The electronic device includes an application server and a business server; Deleting the file information in the first storage area includes: The business server sends a deletion request, including the upload address, to the application server. In response to the deletion request, the application server queries and deletes the file information from the first storage area based on the upload address.

5. The method according to any one of claims 1-3, characterized in that, After verifying that the client's identity is invalid, the process also includes: The file to be uploaded is deleted from the storage area corresponding to the upload address, and the file to be uploaded is stored in the second storage area to back up the file to be uploaded; Set the lifecycle of the file to be uploaded in the second storage area; Upon reaching the end of its lifecycle, the file to be uploaded is deleted from the second storage area.

6. The method according to any one of claims 1-3, characterized in that, Before deleting the file information in the first storage area, the method further includes: In response to the association request, the client's identity is initially authenticated, and an initial authentication result is obtained; Deleting the file information in the first storage area includes: When the initial authentication result confirms that the client's identity is legitimate, the file information in the first storage area is deleted.

7. The method according to claim 6, characterized in that, Also includes: If the initial authentication result indicates that the client's identity is invalid, the file information in the first storage area will not be deleted.

8. An identity detection device, characterized in that, The identity detection device includes: a storage module, a creation module, a first deletion module, a detection module, and a first authentication module, wherein, The storage module is used to store the file information of the file to be uploaded and the upload address of the file to be uploaded into the first storage area after sending the upload address of the file to be uploaded to the client. The creation module is used to create verification messages; The first deletion module is used to delete the file information in the first storage area after obtaining the association request sent by the client; The detection module is used to: detect whether the first storage area stores the file information based on the verification message; The first authentication module is used for: If the first storage area does not store the file information, then the client's identity is verified as legitimate; If the first storage area stores the file information, then the client's identity is invalid. The association request is used to request that the upload address be bound to the client's identifier after the client uploads the file to be uploaded to the upload address.

9. The apparatus according to claim 8, characterized in that, The creation module is specifically used for: Create a validation delayed message in the message queue; The step of detecting whether the first storage area stores the file information based on the verification message includes: In response to the delay time of the arrival of the verification delay message, the system detects whether the file information is stored in the first storage area via the upload address.

10. The apparatus according to claim 9, characterized in that, The delay time is the maximum time interval for the client to upload files.

11. The apparatus according to any one of claims 8-10, characterized in that, The first deletion module is specifically used for: The business server sends a deletion request, including the upload address, to the application server. In response to the deletion request, the application server queries and deletes the file information from the first storage area based on the upload address.

12. The apparatus according to any one of claims 8-9, characterized in that, The identity detection device further includes: a movement module, a setting module, and a second deletion module, wherein, The mobile module is used to delete the file to be uploaded from the storage area corresponding to the upload address and store the file to be uploaded in a second storage area to back up the file to be uploaded; The setting module is used to set the lifecycle of the file to be uploaded in the second storage area; The second deletion module is used to delete the file to be uploaded from the second storage area when the life cycle is reached.

13. The apparatus according to any one of claims 8-10, characterized in that, The identity detection device further includes: a second authentication module, wherein... The second authentication module is used to perform initial authentication of the client's identity in response to the association request and obtain an initial authentication result; The first deletion module is specifically used for: When the initial authentication result confirms that the client's identity is legitimate, the file information in the first storage area is deleted.

14. The apparatus according to claim 13, characterized in that, The first deletion module is specifically used for: If the initial authentication result indicates that the client's identity is invalid, the file information in the first storage area will not be deleted.

15. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-7 by executing the executable instructions.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-7.

17. A computer program product containing instructions, characterized in that, When the computer program product is run on an electronic device, the electronic device performs the method of any one of claims 1-7 by executing the instructions contained in the computer program product.

Images