Data access method and device

Abstract

The present application discloses a data access method and device. When a user device needs to transmit data to a data server, it sends a data access request to the data server, and the data access request includes the account and password of the user device. After receiving the data access request, the data server will use the locally stored account and password to authenticate the data transmission request, so that after the authentication is passed, it will send an authentication pass message to the user device, so that the user device can transmit data to the data server. That is, in this application, the data server deploys the authentication function, and obtains the login information (account and password) required for authentication from the authentication server. The authentication operation is performed by the data server itself without accessing the authentication server, thereby blocking the operation of accessing the authentication server to query the account and password when multiple data servers are attacked, reducing the access pressure of the authentication server and improving the stability of the service.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data access method and device. Background Art

[0002] In the modern information environment, the security of data transmission and network connection is crucial. As a network security protocol, the Secure Shell (SSH) protocol plays a vital role in the field of network security. It implements secure access and file transfer through encryption and authentication mechanisms. For multiple data centers, the Lightweight Directory Access Protocol (LDAP) can be used to manage accounts. Each data server will connect to the LDAP server of the authentication server through the LDAP client to perform unified authentication.

[0003] like Figure 1 As shown in the figure, an SSH Client is installed on the user device, an LDAP Client and an SSH Server are installed on the data server (such as a Linux / Unix host), and an LDAP Server is installed on the authentication server. The SSH Client on the user device uses the LDAP account to request to upload files to or download files from the data server. After receiving the request, the SSH Server on the data server requests authentication from the authentication server through the LDAP Client, so that data transmission can be performed if the authentication is successful.

[0004] Since there are dozens or even hundreds of data servers distributed in different data centers, and attackers will continuously attack multiple data servers (Linux / Unix hosts), when the attack frequency is too high, the authentication server will be overloaded, causing the entire service to fail, and reliability and availability will be greatly reduced. Summary of the invention

[0005] In view of this, an embodiment of the present application provides a data access method and device to reduce the pressure on the authentication server and improve service stability.

[0006] To solve the above problems, the technical solutions provided in the embodiments of the present application are as follows:

[0007] In a first aspect of the present application, a data access method is provided, which is applied to a user device and includes:

[0008] Sending a data access request to a data server, wherein the data access request includes an account number of the user device and a password corresponding to the account number, and the data access request is used to request to log in to the data server;

[0009] In response to receiving an authentication success message sent by the data server, access is made to the data server. The authentication success message is generated by the data server after authenticating the account and password in the data transmission request based on the locally stored account and password. The account and password stored locally in the data server are obtained by the data server from the authentication server.

[0010] In a second aspect of the present application, a data access method is provided, which is applied to a data server and includes:

[0011] Receiving a data access request sent by a user device, wherein the data access request includes an account number of the user device and a password corresponding to the account number;

[0012] authenticating the account number and the password in the data access request according to a locally stored account number and password, wherein the locally stored account number and password are obtained by the data server from an authentication server;

[0013] If the authentication is successful, an authentication success message is sent to the user equipment, so that the user equipment transmits data to the data server.

[0014] In a third aspect of the present application, a data access method is provided, which is applied to an authentication server and includes:

[0015] Receiving a first query request sent by a data server, the first query request including an account of a user device, the first query request being used to request to obtain login information corresponding to the account, the login information including a password corresponding to the account;

[0016] Obtain corresponding login information according to the account in the first query request;

[0017] A first response message is sent to the data server, wherein the first response message includes login information corresponding to the account, so that the data server authenticates the data transmission request sent by the user device, so as to allow the user device to transmit data after the authentication is passed.

[0018] In a fourth aspect of the present application, a data access device is provided, the device being applied to a user equipment, comprising:

[0019] a sending unit, configured to send a data access request to a data server, wherein the data access request includes an account number of the user device and a password corresponding to the account number, and the data access request is used to request to log in to the data server;

[0020] An access unit is used to access the data server in response to receiving an authentication success message sent by the data server, wherein the authentication success message is generated by the data server after authenticating the account and the password in the data transmission request based on the locally stored account and password, and the account and password stored locally in the data server are obtained by the data server from the authentication server.

[0021] In a fifth aspect of the present application, a data access device is provided, the device being applied to a data server, comprising:

[0022] A receiving unit, configured to receive a data access request sent by a user device, wherein the data access request includes an account number of the user device and a password corresponding to the account number;

[0023] a processing unit, configured to authenticate the account number and the password in the data access request according to a locally stored account number and password, wherein the locally stored account number and password are obtained by the data server from an authentication server;

[0024] The sending unit is used to send an authentication success message to the user equipment if the authentication is successful, so that the user equipment transmits data to the data server.

[0025] In a sixth aspect of the present application, a data access device method is provided, wherein the device is applied to an authentication server, comprising:

[0026] A receiving unit, configured to receive a first query request sent by a data server, wherein the first query request includes an account number of a user device, and the first query request is used to request to obtain login information corresponding to the account number, wherein the login information includes a password corresponding to the account number;

[0027] A processing unit, configured to obtain corresponding login information according to the account in the first query request;

[0028] A sending unit is used to send a first response message to the data server, wherein the first response message includes login information corresponding to the account, so that the data server authenticates the data transmission request sent by the user device, so as to allow the user device to transmit data after the authentication is passed.

[0029] In a seventh aspect of the embodiments of the present application, an electronic device is provided, including: a processor, a memory;

[0030] The memory is used to store computer-readable instructions or computer programs;

[0031] The processor is used to read the computer-readable instructions or the computer program so that the electronic device implements the data access method described in the first aspect, the second aspect or the third aspect.

[0032] In an eighth aspect of the present application, a computer-readable storage medium is provided, wherein instructions are stored in the computer-readable storage medium. When the instructions are executed on a device, the device executes the data access method described in the first aspect, the second aspect, or the third aspect.

[0033] In a ninth aspect of the present application, a computer program product is provided. When the computer program product is run on a computer, the computer is enabled to execute the data access method described in the first aspect, the second aspect or the third aspect.

[0034] It can be seen that the embodiments of the present application have the following beneficial effects:

[0035] In this application, when the user device needs to transmit data to the data server, it sends a data access request to the data server, and the data access request includes the account and password of the user device. After receiving the data access request, the data server will use the locally stored account and password to authenticate the data transmission request, so that after the authentication is passed, it will send an authentication pass message to the user device, so that the user device can transmit data to the data server. That is, in this application, the data server deploys the authentication function, and obtains the login information (account and password) required for authentication from the authentication server. The authentication operation is performed by the data server itself without accessing the authentication server, thereby blocking the operation of accessing the authentication server to query the account and password when multiple data servers are attacked, reducing the access pressure of the authentication server and improving the stability of the service. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 The following is a schematic diagram of a data access scenario;

[0037] Figure 2 An interactive diagram of a data access method provided in an embodiment of the present application;

[0038] Figure 3 Another data access method interaction diagram provided in an embodiment of the present application;

[0039] Figure 4 A structural diagram of a data access device provided in an embodiment of the present application;

[0040] Figure 5 A structural diagram of another data access device provided in an embodiment of the present application;

[0041] Figure 6 A structural diagram of another data access device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0043] The inventor of this application has found through research that when an attacker continuously attacks multiple hosts, the hosts will continuously access the LDAP Server for authentication, causing the LDAP Server to be overloaded, which may cause the entire cloud service to fail, and the reliability and availability will be greatly reduced.

[0044] Based on this, this application provides a data access method, where each host (data server) uses a local authentication service to authenticate the data transmission request of the user device. Even if the attack frequency is high, since the data server has an authentication function, it can block access to the authentication server, thereby reducing the access pressure of the authentication server and providing service stability. For example, the data server uses a local LDAP server instead of the LDAP server of the authentication server, thereby preventing the access pressure from being accumulated on the LDAP server of the authentication server when multiple hosts are attacked.

[0045] In an LDAP system, there are usually LDAP servers and LDAP clients, which play different roles and functions. The LDAP server is responsible for storing and managing directory data, such as user accounts and passwords, and responding to requests from LDAP clients. The LDAP client is an application or tool that uses the LDAP protocol to communicate with the LDAP server to perform operations to query and manage directory data.

[0046] The use of SSH protocol usually involves SSH client and SSH server. SSH client refers to the application or tool used to connect to the remote SSH server, which can realize remote login, file transfer, security authentication and other functions. SSH server runs SSH protocol and accepts connection requests from SSH client, which can realize remote login and access control, file transfer. Among them, SSH server supports Secure Copy Protocol (SCP) and SSH File Transfer Protocol, allowing clients to upload and download files securely.

[0047] Data Store (DS) services refer to services that provide data storage and management functions. This service can include various forms of data storage and access, such as database services, file storage services, etc. The main functions include data creation, reading, updating and deletion, as well as data security, backup and recovery. In a cloud computing environment, DS services usually refer to cloud database services, which provide flexible data storage and management, enabling applications to efficiently store and access data.

[0048] Application Server (AS) service refers to the service used to host and execute applications. This service provides the operating environment and support required by applications, including application deployment, management, scheduling, monitoring and other functions.

[0049] To facilitate understanding of the specific implementation of the present application, an explanation will be given below with reference to the accompanying drawings.

[0050] See also Figure 2 , which is an interactive diagram of a data access method provided by an embodiment of the present application, such as Figure 2 As shown, the method includes:

[0051] S201: A user device sends a data access request to a data server. The data access request includes an account number of the user device and a password corresponding to the account number.

[0052] The user device is deployed with an SSH client, which sends a data access request to an SSH server in the data server. The data server provides data access services to the user device, such as storing files sent by the user device or providing files required to be downloaded to the user device.

[0053] In some implementations, for a user device of a legitimate source, before accessing the data server, it can send a notification message to the data server, the notification message including the account number, so as to notify the data server through the notification message that the user device is about to access. Specifically, the user device can send the notification message to the data server via the http protocol.

[0054] As for the attack source, since there is no process to query DS through https protocol during the attack, it will directly use SSH client to try to log in to the data server. At this time, the data server uses local LDAP service authentication, which will not put any pressure on the authentication server, thereby improving the stability of the entire cloud service.

[0055] S202: The data server authenticates the account number and password in the data access request according to the account number and password stored locally.

[0056] S203: If the authentication is successful, the data server sends an authentication success message to the user equipment.

[0057] In this embodiment, after receiving the data access request, the SSH server in the data server can authenticate the data access request using the locally stored account and password, wherein the account and password stored in the data server are obtained from the authentication server.

[0058] Specifically, after receiving the notification message sent by the user device, the data server first queries locally whether there is login information (such as account number and password) corresponding to the user device. If not, a first query request is sent to the authentication server, and the first query request includes the account number of the user device, so as to obtain the login information corresponding to the account number through the first query request. After receiving the first query request, the authentication server obtains the login information corresponding to the account number and sends a first response message to the data server. The first response message includes the login information corresponding to the account number. The authentication server is used to provide legal authentication services. In this embodiment, it can store a large number of user accounts and passwords and provide the account numbers and passwords to the data server.

[0059] The data server may store multiple accounts and passwords corresponding to each account, so that when a user device requests access, the account and password sent by the user device may be authenticated, and after the authentication is successful, an authentication success message may be sent to the user device.

[0060] When the user needs to change the password, the password change operation can be triggered, and the authentication server will record the updated password and the corresponding update time. In order to prevent the user from changing the password, which will cause the data server to be unable to effectively authenticate the user's device, it is necessary to synchronize the latest password to the data server in a timely manner. Specifically, before authenticating the account and password in the data transmission request based on the locally stored account and password, the synchronization of the latest password can be achieved in the following ways:

[0061] One is to obtain the update time corresponding to the locally stored password and determine whether the time difference between the update time and the current time is greater than a preset time threshold. If greater, it is necessary to query the latest password from the authentication server, that is, send a second query request to the authentication server, the second query request includes an account number, and is used to request to obtain the latest password corresponding to the account number.

[0062] After receiving the second query request, the authentication server obtains the password corresponding to the account in the second query request, and sends a second response message to the data server, where the second response message includes the latest password corresponding to the account.

[0063] After receiving the second response message, the data server uses the latest password in the second response message to update the password of the local account and records the update time. Specifically, after receiving the second response message, the data server can first determine whether the latest password in the second response message is the same as the local password. If they are different, the update operation is performed and the update time is recorded. If they are the same, the update operation may not be performed, but the update time still needs to be recorded to determine the next query time.

[0064] Specifically, in this implementation, the data server is configured with a DS service. Every time the DS queries the local account and password corresponding to the user device, it will query the time when the local password is updated. If it exceeds a certain time threshold, such as 5 minutes, it will query the latest password from the authentication server again. If the latest password is different from the local LDAP password, the local password will be updated. At the same time, regardless of whether the local password is updated, the timestamp of this query is recorded to facilitate the judgment of the next query time.

[0065] Another method is to obtain the update time corresponding to the locally stored password and determine whether the time difference between the update time and the current time is greater than a preset time threshold. If greater, a third query request is sent to the authentication server, the third query request being used to request the latest update time corresponding to the password of the account recorded in the authentication server.

[0066] After receiving the third query request, the authentication server obtains the latest update time of the password of the account recorded locally, and sends a third response message to the data server, where the third response message includes the latest update time of the password of the account.

[0067] After receiving the third response message, the data server determines whether the update time of the local record is earlier than the latest update time in the third response message. If yes, it indicates that the user has changed the password, and then sends a fourth query request to the authentication server, the fourth query request is used to request the latest password corresponding to the account. The fourth query request includes the account number.

[0068] After receiving the fourth query request, the authentication server queries the latest password corresponding to the account, and sends a fourth response message to the data server, where the fourth response message includes the latest password corresponding to the account.

[0069] After receiving the fourth response message, the data server updates the locally stored password using the latest password in the fourth response message and records the update time.

[0070] Specifically, in this implementation, an AS service can be enabled on the authentication server to record the modification time of each user's most recent password change. Every time the DS queries the login information of the user's device locally, it will query the time when the local password was last updated. If it exceeds a certain time threshold, such as 5 minutes, it will query the AS to see if the password has been modified. If it has not been modified, no additional operations are required; otherwise, the DS uses the LDAP protocol to synchronize the latest password from the authentication server to the local. Regardless of whether the password is updated, the timestamp of this query will be recorded, so as to facilitate the determination of the next query time.

[0071] S204: After receiving the authentication success message, the user equipment accesses the data server.

[0072] In this embodiment, the data server authenticates the user device, and after the authentication is passed, the user device can access the data server, for example, to upload files to the data server or download files from the data server.

[0073] To facilitate understanding of the specific implementation framework of this application, Figure 3 As shown, the following execution steps may be included:

[0074] S301: A user device sends a notification message to a data server, where the notification message includes an account corresponding to the user device.

[0075] That is, before the user equipment sends a data access request to the data server, it first sends a notification message to the data server, so as to notify the data server through the notification message that the user equipment is about to access it.

[0076] S302: The data server sends a reply message to the user equipment.

[0077] That is, after receiving the notification message sent by the user equipment, the data server may return a reply message to the user equipment to inform the user equipment that the notification message has been received.

[0078] S303: The data server determines whether the login information corresponding to the user device is stored locally. If not, execute S304; otherwise, execute S308.

[0079] In this embodiment, a DS service may be configured on the data server. Before the user device accesses the data server through the SSH client, the user device may tell the DS service through the http protocol that the user device will access the data server next. At this time, the DS service actively queries the local LDAP server for the login information of the user device, which includes the account number and password.

[0080] S304: The data server sends a first query request to the authentication server.

[0081] The first query request includes an account of a user device, and is used to request login information corresponding to the account.

[0082] S305: The authentication server obtains corresponding login information according to the first query request.

[0083] S306: The authentication server sends a first response message to the data server, where the first response message includes login information corresponding to the account.

[0084] S307: The user equipment sends a data access request to the data server.

[0085] S308: The data server uses the locally stored account and password to authenticate the account and password in the data access request.

[0086] S309: If the authentication is successful, the data server sends an authentication success message to the user equipment.

[0087] S310: In response to receiving the authentication success message, the user equipment accesses the data server.

[0088] It should be noted that this embodiment does not limit the execution order of the above S303-S306 and S307, and the two can be performed simultaneously, or S307 can be performed first and then S303-S306.

[0089] It should be noted that the specific implementation of each step in the above embodiment can be found in Figure 2 The relevant description in the method.

[0090] Based on the above method embodiment, an embodiment of the present application provides a data access device, which will be described below in conjunction with the accompanying drawings.

[0091] See also Figure 4 , this figure is a structural diagram of a data access device provided in an embodiment of the present application. The device 400 is applied to a user device and includes: a sending unit 401 and an access unit 402.

[0092] A sending unit 401 is used to send a data access request to a data server, wherein the data access request includes an account number of the user device and a password corresponding to the account number, and the data access request is used to request to log in to the data server;

[0093] The access unit 402 is used to access the data server in response to receiving an authentication success message sent by the data server, wherein the authentication success message is generated by the data server after authenticating the account and the password in the data transmission request based on the locally stored account and password, and the account and password stored locally in the data server are obtained by the data server from the authentication server.

[0094] In some implementations, the sending unit 401 is further used to send a notification message to the data server before sending a data access request to the data server, the notification message including the account number, and the notification message is used to notify the data server that the user device is about to access.

[0095] See also Figure 5 , this figure is a structural diagram of another data access device provided in an embodiment of the present application. The device 500 is applied to a data server and includes: a receiving unit 501, a processing unit 502 and a sending unit 503.

[0096] A receiving unit 501 is configured to receive a data access request sent by a user device, wherein the data access request includes an account number of the user device and a password corresponding to the account number;

[0097] The processing unit 502 is used to authenticate the account number and the password in the data access request according to the locally stored account number and password, where the locally stored account number and password are obtained by the data server from an authentication server;

[0098] The sending unit 503 is configured to send an authentication success message to the user equipment if the authentication succeeds, so that the user equipment transmits data to the data server.

[0099] In some implementations, the receiving unit 501 is further configured to receive a notification message sent by the user equipment before receiving the data transmission request sent by the user equipment, the notification message including the account number, and the notification message being used to notify the data server that the user equipment is about to access;

[0100] In some implementations, the processing unit 502 is further configured to determine whether the account exists locally after receiving the notification message sent by the user equipment and before receiving the data transmission request sent by the user equipment;

[0101] The sending unit 503 is further configured to send a first query request to the authentication server if the account does not exist locally, the first query request including the account, the first query request being used to request to obtain login information corresponding to the account, the login information including a password corresponding to the account;

[0102] The receiving unit 501 is further configured to receive a first response message sent by the authentication server, where the first response message includes login information corresponding to the account.

[0103] In some embodiments, the processing unit 502 is further configured to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold before authenticating the account and the password in the data transmission request according to the locally stored account and password;

[0104] If yes, the sending unit 503 is further used to send a second query request to the authentication server, where the second query request includes the account number, and the second query request is used to request to obtain the latest password corresponding to the account number;

[0105] The receiving unit 501 is further configured to receive a second response message sent by the authentication server, where the second response message includes the latest password corresponding to the account;

[0106] The processing unit 502 is further configured to update the password of the local account using the latest password in the second response message; and record the update time corresponding to the update.

[0107] In some embodiments, the processing unit 502 is further configured to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold before authenticating the account and the password in the data transmission request according to the locally stored account and password;

[0108] If yes, the sending unit 503 is further used to send a third query request to the authentication server, wherein the third query request is used to request to obtain the latest update time corresponding to the password of the account in the authentication server;

[0109] The receiving unit 501 is further configured to receive a third response message sent by the authentication server, wherein the third message includes the latest update time corresponding to the password of the account;

[0110] The sending unit 503 is further configured to send a fourth query request to the authentication server if the update time corresponding to the password of the account recorded locally is earlier than the latest update time, wherein the fourth query request is used to request the latest password corresponding to the account;

[0111] The receiving unit 501 is further configured to receive a fourth response message sent by the authentication server, wherein the fourth response message includes the latest password corresponding to the account;

[0112] The processing unit 502 is further configured to update the password of the local account using the latest password in the fourth response message; and record the update time corresponding to the update.

[0113] See also Figure 6 , this figure shows another data access device provided by the present application. The device 600 is applied to an authentication server and includes: a receiving unit 601, a processing unit 602 and a sending unit 603.

[0114] A receiving unit 601 is configured to receive a first query request sent by a data server, wherein the first query request includes an account number of a user device, and the first query request is used to request to obtain login information corresponding to the account number, wherein the login information includes a password corresponding to the account number;

[0115] Processing unit 602, configured to obtain corresponding login information according to the account in the first query request;

[0116] The sending unit 603 is used to send a first response message to the data server, wherein the first response message includes the login information corresponding to the account, so that the data server authenticates the data transmission request sent by the user device, so as to allow the user device to transmit data after the authentication is passed.

[0117] In some implementations, the receiving unit 601 is further configured to receive a second query request sent by the data server, the second query request including the account number, and the second query request is configured to request to obtain the latest password corresponding to the account number;

[0118] The processing unit 602 is further configured to obtain the corresponding latest password according to the account in the second query request;

[0119] The sending unit 603 is further configured to send a second response message to the data server, where the second response message includes the latest password corresponding to the account.

[0120] In some implementations, the receiving unit 601 is further configured to receive a third query request sent by the data server, wherein the third query request is configured to request to obtain the latest update time corresponding to the password of the account in the authentication server;

[0121] The processing unit 602 is further configured to obtain the latest update time corresponding to the password of the account according to the third query request;

[0122] The sending unit 603 is further configured to send a third response message to the data server, wherein the third response message includes the latest update time corresponding to the password of the account;

[0123] The receiving unit 601 is further configured to receive a fourth query request sent by the data server if the update time corresponding to the password of the account locally recorded by the data server is earlier than the latest update time, wherein the fourth query request is used to request the latest password corresponding to the account;

[0124] The processing unit 602 is further configured to obtain a corresponding latest password according to the account in the fourth query request;

[0125] The sending unit 603 is further configured to send a fourth response message to the data server, where the fourth response message includes the latest password corresponding to the account.

[0126] In some implementations, the processing unit 602 is further configured to record the updated password and the update time in response to a password modification operation triggered by the user through the account.

[0127] It should be noted that the information execution process and other contents of each unit in the above-mentioned device embodiment can be specifically referred to the description in the method embodiment shown in the above-mentioned application, and will not be repeated here.

[0128] In addition, the embodiment of the present invention also provides a data access system, including: a user device, a data server and an authentication server.

[0129] The user equipment may execute S201, S204, S301 and S307 in the above method embodiment.

[0130] The data server may execute S202, S203, S302, S303, S304, S308 and S309 in the above method embodiments.

[0131] The authentication server may execute S305 and S306 in the above method embodiment.

[0132] An embodiment of the present application provides an electronic device, including: a processor, a memory;

[0133] The memory is used to store computer-readable instructions or computer programs;

[0134] The processor is used to read the computer-readable instructions or the computer program so that the device implements the data access method.

[0135] An embodiment of the present application provides a computer-readable storage medium, including instructions or computer programs, which, when executed on a computer, enable the computer to execute the above-mentioned data access method.

[0136] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0137] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0138] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0139] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0140] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data access method, characterized in that: The method is applied to a user equipment, comprising: Sending a data access request to a data server, wherein the data access request includes an account number of the user device and a password corresponding to the account number, and the data access request is used to request to log in to the data server; In response to receiving an authentication pass message sent by the data server, accessing the data server, the authentication pass message being generated by the data server after authenticating the account number and the password in the data transmission request based on the account number and the password stored locally, the account number and the password stored locally in the data server being obtained by the data server from an authentication server; Wherein, before the data server authenticates the account and the password in the data transmission request based on the locally stored account and password, it is also used to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold; if so, send a second query request to the authentication server, the second query request includes the account, and the second query request is used to request to obtain the latest password corresponding to the account; receive a second response message sent by the authentication server, the second response message includes the latest password corresponding to the account; use the latest password in the second response message to update the local password of the account; record the update time corresponding to this update; or, it is also used to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold; if so, send a second query request to the authentication server Send a third query request, the third query request is used to request the latest update time corresponding to the password of the account in the authentication server; receive a third response message sent by the authentication server, the third response message includes the latest update time corresponding to the password of the account; if the update time corresponding to the password of the account recorded locally is earlier than the latest update time, send a fourth query request to the authentication server, the fourth query request is used to request the latest password corresponding to the account; receive a fourth response message sent by the authentication server, the fourth response message includes the latest password corresponding to the account; use the latest password in the fourth response message to update the local password of the account; record the update time corresponding to this update.

2. The method according to claim 1, characterized in that Before sending the data access request to the data server, the method further includes: A notification message is sent to a data server, wherein the notification message includes the account number, and the notification message is used to notify the data server that the user device is about to access.

3. A data access method, characterized in that: The method is applied to a data server and comprises: Receiving a data access request sent by a user device, wherein the data access request includes an account number of the user device and a password corresponding to the account number; authenticating the account number and the password in the data access request according to a locally stored account number and password, wherein the locally stored account number and password are obtained by the data server from an authentication server; If the authentication is successful, sending an authentication success message to the user equipment so that the user equipment transmits data to the data server; Before authenticating the account number and the password in the data transmission request according to the locally stored account number and password, the method further includes: Determine whether the time difference between the update time corresponding to the password of the account stored locally and the current time is greater than a preset time threshold; if so, send a second query request to the authentication server, the second query request includes the account, and the second query request is used to request to obtain the latest password corresponding to the account; receive a second response message sent by the authentication server, the second response message includes the latest password corresponding to the account; use the latest password in the second response message to update the local password of the account; record the update time corresponding to this update; or, Determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold; if so, send a third query request to the authentication server, the third query request is used to request to obtain the latest update time corresponding to the password of the account in the authentication server; receive a third response message sent by the authentication server, the third response message includes the latest update time corresponding to the password of the account; if the update time corresponding to the locally recorded password of the account is earlier than the latest update time, send a fourth query request to the authentication server, the fourth query request is used to request the latest password corresponding to the account; receive a fourth response message sent by the authentication server, the fourth response message includes the latest password corresponding to the account; use the latest password in the fourth response message to update the local password of the account; record the update time corresponding to this update.

4. The method according to claim 3, characterized in that Before receiving the data transmission request sent by the user equipment, the method further includes: A notification message sent by the user equipment is received, wherein the notification message includes the account number, and the notification message is used to notify the data server that the user equipment is about to access.

5. The method according to claim 4, characterized in that After receiving the notification message sent by the user equipment and before receiving the data transmission request sent by the user equipment, the method further includes: Determine whether there is login information corresponding to the account locally, where the login information includes the password corresponding to the account; If the login information corresponding to the account does not exist locally, sending a first query request to the authentication server, where the first query request includes the account, and the first query request is used to request to obtain the login information corresponding to the account; A first response message sent by the authentication server is received, where the first response message includes login information corresponding to the account.

6. A data access method, characterized in that: The method is applied to an authentication server and includes: Receiving a first query request sent by a data server, the first query request including an account of a user device, the first query request being used to request to obtain login information corresponding to the account, the login information including a password corresponding to the account; Obtain corresponding login information according to the account in the first query request; Sending a first response message to the data server, wherein the first response message includes the login information, so that the data server authenticates the data transmission request sent by the user equipment, so as to allow the user equipment to transmit data after the authentication is passed; receiving a second query request sent by the data server, wherein the second query request includes the account number, and the second query request is used to request to obtain the latest password corresponding to the account number; Obtaining the latest password corresponding to the account in the second query request; Sending a second response message to the data server, wherein the second response message includes the latest password corresponding to the account; or, Receiving a third query request sent by the data server, wherein the third query request is used to request to obtain the latest update time corresponding to the password of the account in the authentication server; Obtaining the latest update time corresponding to the password of the account according to the third query request; Sending a third response message to the data server, wherein the third response message includes the latest update time corresponding to the password of the account; If the update time corresponding to the password of the account locally recorded by the data server is earlier than the latest update time, receiving a fourth query request sent by the data server, wherein the fourth query request is used to request the latest password corresponding to the account; Obtaining the corresponding latest password according to the account in the fourth query request; A fourth response message is sent to the data server, where the fourth response message includes the latest password corresponding to the account.

7. A data access device, characterized in that: The device is applied to user equipment, including: A sending unit, configured to send a data access request to a data server, wherein the data access request includes an account number of the user device and a password corresponding to the account number, and the data access request is used to request to log in to the data server; an access unit, configured to access the data server in response to receiving an authentication pass message sent by the data server, wherein the authentication pass message is generated by the data server after authenticating the account number and the password in the data transmission request based on the account number and the password stored locally, and the account number and the password stored locally in the data server are obtained by the data server from the authentication server; Wherein, before the data server authenticates the account and the password in the data transmission request based on the locally stored account and password, it is also used to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold; if so, send a second query request to the authentication server, the second query request includes the account, and the second query request is used to request to obtain the latest password corresponding to the account; receive a second response message sent by the authentication server, the second response message includes the latest password corresponding to the account; use the latest password in the second response message to update the local password of the account; record the update time corresponding to this update; or, it is also used to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold; if so, send a second query request to the authentication server Send a third query request, the third query request is used to request the latest update time corresponding to the password of the account in the authentication server; receive a third response message sent by the authentication server, the third response message includes the latest update time corresponding to the password of the account; if the update time corresponding to the password of the account recorded locally is earlier than the latest update time, send a fourth query request to the authentication server, the fourth query request is used to request the latest password corresponding to the account; receive a fourth response message sent by the authentication server, the fourth response message includes the latest password corresponding to the account; use the latest password in the fourth response message to update the local password of the account; record the update time corresponding to this update.

8. A data access device, characterized in that: The device is applied to a data server and includes: A receiving unit, configured to receive a data access request sent by a user device, wherein the data access request includes an account number of the user device and a password corresponding to the account number; a processing unit, configured to authenticate the account number and the password in the data access request according to a locally stored account number and password, wherein the locally stored account number and password are obtained by the data server from an authentication server; a sending unit, configured to send an authentication success message to the user equipment if the authentication succeeds, so that the user equipment transmits data to the data server; The processing unit is further configured to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold before authenticating the account and the password in the data transmission request according to the locally stored account and password; The sending unit is further configured to send a second query request to the authentication server if the time difference between the update time and the current time is greater than the preset time threshold, the second query request including the account number, and the second query request is used to request to obtain the latest password corresponding to the account number; The receiving unit is further configured to receive a second response message sent by the authentication server, wherein the second response message includes the latest password corresponding to the account; The processing unit is further configured to update the password of the local account using the latest password in the second response message; and record the update time corresponding to the update; or, The processing unit is further configured to determine whether the time difference between the update time corresponding to the locally stored password of the account and the current time is greater than a preset time threshold before authenticating the account and the password in the data transmission request according to the locally stored account and password; The sending unit is further configured to send a third query request to the authentication server if the time difference between the update time and the current time is greater than the preset time threshold, wherein the third query request is used to request to obtain the latest update time corresponding to the password of the account in the authentication server; The receiving unit is further configured to receive a third response message sent by the authentication server, wherein the third response message includes the latest update time corresponding to the password of the account; The sending unit is further configured to send a fourth query request to the authentication server if the update time corresponding to the password of the account recorded locally is earlier than the latest update time, wherein the fourth query request is used to request the latest password corresponding to the account; The receiving unit is further configured to receive a fourth response message sent by the authentication server, wherein the fourth response message includes the latest password corresponding to the account; The processing unit is further configured to update the password of the local account using the latest password in the fourth response message; and record the update time corresponding to the update.

9. A data access device, characterized in that: The device is applied to an authentication server and includes: A receiving unit, configured to receive a first query request sent by a data server, wherein the first query request includes an account number of a user device, and the first query request is used to request to obtain login information corresponding to the account number, wherein the login information includes a password corresponding to the account number; A processing unit, configured to obtain corresponding login information according to the account in the first query request; a sending unit, configured to send a first response message to the data server, wherein the first response message includes login information corresponding to the account, so that the data server authenticates the data transmission request sent by the user equipment, so as to allow the user equipment to transmit data after the authentication is passed; The receiving unit is further configured to receive a second query request sent by the data server, the second query request including the account number, and the second query request is configured to request to obtain the latest password corresponding to the account number; The processing unit is further configured to obtain the corresponding latest password according to the account in the second query request; The sending unit is further configured to send a second response message to the data server, wherein the second response message includes the latest password corresponding to the account; or, The receiving unit is further configured to receive a third query request sent by the data server, wherein the third query request is configured to request to obtain the latest update time corresponding to the password of the account in the authentication server; The processing unit is further configured to obtain the latest update time corresponding to the password of the account according to the third query request; The sending unit is further configured to send a third response message to the data server, wherein the third response message includes the latest update time corresponding to the password of the account; The receiving unit is further configured to receive a fourth query request sent by the data server if the update time corresponding to the password of the account locally recorded by the data server is earlier than the latest update time, wherein the fourth query request is used to request the latest password corresponding to the account; The processing unit is further configured to obtain a corresponding latest password according to the account in the fourth query request; The sending unit is further used to send a fourth response message to the data server, where the fourth response message includes the latest password corresponding to the account.

Images