File access method and device, server and medium

Abstract

The invention provides a file access method and device, a server and a medium, and can be applied to the technical field of Internet. The method is applied to a file management server and comprises the steps that a first access request sent by a client server is received, and the first access request carries index information corresponding to a first file; obtaining a file security level stored corresponding to the index information; based on an authentication strategy corresponding to the file security level, the first access request is authenticated to obtain an authentication result, and the authentication result indicates that authentication is passed or not passed; and if the authentication result shows that the authentication is passed, obtaining a file storage address stored corresponding to the index information, reading the first file from a storage space indicated by the file storage address, and returning the first file. According to the method, the file is refined, the corresponding file security level is set for the file, and the authentication strategy corresponding to each file security level is set, so that the authentication flexibility is higher.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a file access method, device, server and medium. Background Art

[0002] Currently, users can manage files through distributed file systems. The functions of distributed file systems include: file storage, file synchronization, file upload, file download, etc., which solves the problems of large-capacity storage and load balancing. In order to ensure file security and prevent files from being stolen, distributed file systems also provide authentication services.

[0003] In the related art, when a user terminal initiates an access request to a file, the distributed file system first authenticates the access request, and processes the access request if the authentication is successful. However, the related art generally provides the same authentication service for files that need authentication, which is less flexible. Summary of the invention

[0004] The present application provides a file access method, device, server and medium, which are used to solve the problem that the related art generally provides the same authentication service for files that need to be authenticated, but has poor flexibility.

[0005] In a first aspect, the present application provides a file access method, which is applied to a file management server, comprising:

[0006] Receive a first access request sent by a client server, where the first access request carries index information corresponding to a first file;

[0007] Obtaining a file security level stored corresponding to the index information;

[0008] Based on the authentication policy corresponding to the file security level, authenticating the first access request to obtain an authentication result, wherein the authentication result indicates whether the authentication is passed or not;

[0009] If the authentication result indicates that the authentication is successful, the file storage address stored corresponding to the index information is obtained, the first file is read from the storage space indicated by the file storage address, and the first file is returned.

[0010] In a second aspect, the present application provides a file access method, applied to a client server, comprising:

[0011] receiving a second access request sent by a user terminal, where the second access request carries a file identifier corresponding to the first file;

[0012] Obtaining index information stored corresponding to the file identifier;

[0013] Sending a first access request to a file management server, the first access request carrying the index information, so that the file management server obtains a file security level stored corresponding to the index information, authenticates the second access request based on an authentication policy corresponding to the file security level to obtain an authentication result, and if the authentication result indicates that the authentication is passed, obtains a file storage address stored corresponding to the index information, reads the first file from a storage space indicated by the file storage address, and returns the first file;

[0014] The first file is returned to the user terminal.

[0015] In a third aspect, the present application provides a file access device, which is arranged in a file management server, and the device comprises:

[0016] A receiving module, configured to receive a first access request sent by a client server, wherein the first access request carries index information corresponding to a first file;

[0017] An acquisition module, used to acquire the file security level stored corresponding to the index information;

[0018] An authentication module, configured to authenticate the first access request based on an authentication policy corresponding to the file security level to obtain an authentication result, wherein the authentication result indicates whether the authentication is passed or not;

[0019] The acquisition module is further configured to acquire a file storage address stored corresponding to the index information if the authentication result indicates that the authentication is successful, read the first file from the storage space indicated by the file storage address, and return the first file.

[0020] In a fourth aspect, the present application provides a file access device, which is arranged in a client server, and the device comprises:

[0021] A receiving module, configured to receive a second access request sent by a user terminal, wherein the second access request carries a file identifier corresponding to the first file;

[0022] An acquisition module, used to acquire index information stored corresponding to the file identifier;

[0023] a sending module, configured to send a first access request to a file management server, wherein the first access request carries the index information, so that the file management server obtains a file security level stored corresponding to the index information, authenticates the second access request based on an authentication policy corresponding to the file security level to obtain an authentication result, and if the authentication result indicates that the authentication is passed, obtains a file storage address stored corresponding to the index information, reads the first file from a storage space indicated by the file storage address, and returns the first file;

[0024] The sending module is further used to return the first file to the user terminal.

[0025] In a fifth aspect, the present application provides a file management server, comprising: a processor, and a memory and a transceiver communicatively connected to the processor;

[0026] The memory stores computer-executable instructions; the transceiver is used to send and receive data with the client server;

[0027] The processor executes the computer-executable instructions stored in the memory to implement the file access method as described in the first aspect.

[0028] In a sixth aspect, the present application provides a client server, comprising: a processor, and a memory and a transceiver communicatively connected to the processor;

[0029] The memory stores computer-executable instructions; the transceiver is used to send and receive data with the file management server and the user terminal respectively;

[0030] The processor executes the computer-executable instructions stored in the memory to implement the file access method as described in the second aspect.

[0031] In a seventh aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer execution instructions, and when the computer execution instructions are executed by a processor, they are used to implement the file access method described in the first aspect or the second aspect.

[0032] In an eighth aspect, the present application provides a computer program product, comprising computer execution instructions, which, when executed by a processor, implement the file access method described in the first aspect or the second aspect.

[0033] The file access method, device, server and medium provided by the present application store the index information and file security level corresponding to the first file in advance, and first obtain the file security level stored corresponding to the index information carried by the first access request after receiving the first access request sent by the client server, so that the first access request can be authenticated according to the authentication policy corresponding to the file security level. Only when the authentication is passed, the first access request is processed, that is, the first file is obtained and returned. It can be seen that the present application refines the file, sets the corresponding file security level for the file, and sets the authentication policy corresponding to each file security level. The authentication flexibility is higher, and the user can also dynamically expand the file security level and the corresponding authentication policy as needed. The scalability is stronger and it is easy to meet the personalized needs of users. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0035] Figure 1 is a structural schematic diagram of an application scenario according to an exemplary embodiment;

[0036] Figure 2 is a flowchart of a file access method according to an exemplary embodiment;

[0037] Figure 3 is a flowchart of a file access method according to another exemplary embodiment;

[0038] Figure 4 is a schematic diagram showing a file access process according to an exemplary embodiment;

[0039] Figure 5 is a schematic diagram showing a file access process according to another exemplary embodiment;

[0040] Figure 6 is a schematic diagram showing a file upload process according to an exemplary embodiment;

[0041] Figure 7 is a schematic diagram of a file upload process according to another exemplary embodiment;

[0042] Figure 8 is a schematic diagram showing a level configuration process according to an exemplary embodiment;

[0043] Fig. 9 is a schematic diagram showing a file cleaning process according to an exemplary embodiment;

[0044] Fig.10 is a schematic diagram showing a file management stage according to an exemplary embodiment;

[0045] Fig.11 is a structural diagram of a file access device according to an exemplary embodiment;

[0046] Fig.12 is a structural schematic diagram of a file access device according to another exemplary embodiment;

[0047] Fig.13 is a schematic diagram showing the structure of a file management server according to an exemplary embodiment;

[0048] Fig.14 The diagram is a schematic diagram showing the structure of a client server according to an exemplary embodiment.

[0049] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0050] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0051] The terms "first", "second", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. In the description of the following embodiments, "multiple" means more than two, unless otherwise clearly and specifically defined.

[0052] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0053] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0054] Currently, users can manage files through distributed file systems. The functions of distributed file systems include: file storage, file synchronization, file upload, file download, etc., which solve the problems of large-capacity storage and load balancing. In order to ensure file security and prevent files from being stolen, distributed file systems also provide authentication services. For example, FastDFS (Distributed File System) is an open source lightweight distributed file system. FastDFS supports authenticated and unauthenticated services, but authenticated resources and unauthenticated resources cannot be stored in the same group; storage services (Storage Server) in unauthenticated groups can only connect to unauthenticated tracking servers (Tracker Server), and storage services in authenticated groups can only connect to authenticated tracking servers.

[0055] In the related art, when a user terminal initiates an access request to a file, the distributed file system first authenticates the access request, and processes the access request if the authentication is successful. For example, FastDFS uses a token mechanism to prevent file theft. However, the related art generally provides the same authentication service for files that need authentication, which is less flexible.

[0056] In view of the technical problem that the same authentication service is provided for files that need to be authenticated in the related art, but the flexibility is poor, the inventor found in the research that in order to solve this problem, different authentication strategies can be provided for different files, which is more targeted. Considering the large number of files, the files can be classified first, and then the corresponding authentication strategies are set for files of different categories, which is more flexible. Specifically, by storing the index information and file security level corresponding to the first file in advance, after receiving the first access request sent by the client server, the file security level corresponding to the index information carried by the first access request is first obtained, so that the first access request can be authenticated according to the authentication strategy corresponding to the file security level. Only when the authentication is passed, the first access request is processed, that is, the first file is obtained and returned. It can be seen that the present application refines the file, sets the corresponding file security level for the file, and sets the authentication strategy corresponding to each file security level, so that the authentication flexibility is higher, and the user can also dynamically expand the file security level and the corresponding authentication strategy as needed, so that the scalability is stronger and it is easy to meet the personalized needs of users.

[0057] The following is an introduction to the application scenarios of the file access method provided in the embodiments of the present application.

[0058] Figure 1 is a schematic diagram showing an application scenario according to an exemplary embodiment. Figure 1As shown, the application scenario includes: a user terminal 1, a client server 2 and a file management server 3. Each device is connected via a network.

[0059] Among them, the user terminal 1 is a terminal used by the user. A browser is installed on the user terminal 1, and the user can trigger the user terminal 1 to display the website corresponding to the file management system in the browser. The file management system includes a client server 2 and a file management server 3. The client server 2 is a backend server corresponding to the website, which is used to provide a front-end interface corresponding to the website and to interact with the user terminal 1 for data. The file management server 3 is used for file management.

[0060] In this embodiment, when the user has an access demand for the first file, the user terminal 1 is triggered to display the front-end interface, and a second access request is triggered in the front-end interface, thereby triggering the user terminal 1 to send the second access request to the client server 2. Accordingly, the client server 2 responds to the second access request, obtains the index information corresponding to the first file, and sends the first access request to the file management server 3, so that the file management server 3 obtains the file security level stored corresponding to the index information, and authenticates the first access request based on the authentication policy corresponding to the file security level to obtain an authentication result. If the authentication result indicates that the authentication is successful, the first access request is processed and the first file is returned, so that the user terminal 1 performs subsequent operations based on the first file, for example, the subsequent operation may be to display the first file or download the first file locally.

[0061] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0062] Figure 2 1 is a flowchart of a file access method according to an exemplary embodiment. The execution subject of the file access method provided by the present application is a file access device, which is integrated in a file management server. Figure 2 As shown, the file access method provided in this embodiment includes the following steps:

[0063] Step S101: receiving a first access request sent by a client server, where the first access request carries index information corresponding to a first file.

[0064] In this embodiment, the file management server is connected to the client server through a network, the file management server is used to perform file management, and the client server is used to perform data interaction with the user terminal. Among them, the first file is a document, a picture, an attachment, etc., and this embodiment does not limit the type of the first file. The first access request is triggered by the client server when it receives the second access request sent by the user terminal, and the second access request is for the first file. The first access request carries index information corresponding to the first file, and the index information can uniquely identify the first file. Optionally, the index information includes an encoded string, for example, the IP (Internet Protocol) address of the file management server, the file creation time, the file size, and the random number corresponding to the first file are spliced, and then the spliced ​​binary string is encoded to obtain the index information. The index information can be regarded as the "logical address" corresponding to the first file. The "logical address" is not the logical address corresponding to the physical address storing the first file, but an identifier used to distinguish different files. In this embodiment, the first access request is first authenticated, and the first file is obtained and returned only after the authentication is passed. Correspondingly, when the file management server receives the first access request, step S102 is executed.

[0065] Step S102: Obtain the file security level stored corresponding to the index information.

[0066] In this embodiment, when the file management server receives the first access request, it queries the file security level corresponding to the first file. Specifically, the file management server obtains the file security level stored corresponding to the index information, and the obtained file security level is the file security level corresponding to the first file. Among them, the file security level corresponding to the first file is used to indicate the degree of publicity of the first file. In this embodiment, multiple file security levels are set in advance, and different file security levels correspond to different degrees of publicity. For example, the higher the file security level, the lower the degree of publicity, and vice versa, the lower the file security level, the higher the degree of publicity. The file management server is connected to the database network, and multiple files are stored in the database, and each file has a corresponding file security level. For each file in the multiple files, the file management server stores the index information and file security level corresponding to the file in advance. Optionally, the file management server stores the index information and file security level corresponding to the multiple files in the file storage table, and accordingly, when the file management server receives the first access request, it obtains the file security level stored corresponding to the index information corresponding to the first file from the file storage table.

[0067] Step S103: Based on the authentication policy corresponding to the file security level, the first access request is authenticated to obtain an authentication result, where the authentication result indicates whether the authentication is passed or not.

[0068] In this embodiment, corresponding authentication policies are set in advance for each file security level, and different authentication policies are corresponding to different file security levels. After obtaining the file security level corresponding to the first file, the file management server authenticates the first access request based on the authentication policy corresponding to the file security level to obtain an authentication result. The representation of the authentication result can be set as needed, for example, the authentication result is 0 or 1, 1 means authentication passed, and 0 means authentication failed.

[0069] Step S104: if the authentication result indicates that the authentication is successful, then the file storage address stored corresponding to the index information is obtained, the first file is read from the storage space indicated by the file storage address, and the first file is returned.

[0070] Among them, the authentication result indicates that the authentication is passed, indicating that the user terminal has the right to access the first file, and the file management server processes the first access request. This embodiment also stores index information and file storage addresses in advance, so the file management server can directly obtain the file storage address stored corresponding to the index information, thereby reading the first file and returning the first file. Optionally, the file management server stores the index information, file security level and file storage address in correspondence, thereby saving storage space and facilitating query. Among them, the file storage address is used to indicate the storage space for storing the first file. Optionally, the file storage address is represented by a logical address, and the storage space is represented by a physical address, and the physical address is obtained by mapping the logical address. It should be noted that the logical address is different from the "logical address" in the above step S101.

[0071] In this embodiment, by storing the index information and the file security level corresponding to the first file in advance, after receiving the first access request sent by the client server, the file security level stored corresponding to the index information carried by the first access request is first obtained, so that the first access request can be authenticated according to the authentication policy corresponding to the file security level. Only when the authentication is passed, the first access request is processed, that is, the first file is obtained and returned. It can be seen that the present application refines the file, sets the corresponding file security level for the file, and sets the authentication policy corresponding to each file security level. The authentication flexibility is higher, and the user can also dynamically expand the file security level and the corresponding authentication policy as needed. The scalability is stronger and it is easy to meet the personalized needs of users.

[0072] Above Figure 2The illustrated embodiment illustrates the file access method provided by the present application by taking processing a first access request for a first file from the file management server side as an example. The following illustrates the file access method provided by the present application by taking triggering a first access request for a first file from the client server side as an example.

[0073] Figure 3 1 is a flowchart of a file access method according to another exemplary embodiment. The execution subject of the file access method provided by the present application is a file access device, which is integrated in a client server. Figure 3 As shown, the file access method provided in this embodiment includes the following steps:

[0074] Step S201: receiving a second access request sent by a user terminal, where the second access request carries a file identifier corresponding to a first file.

[0075] In this embodiment, when the user has an access demand for the first file, the user terminal is triggered to generate a second access request, and after generating the second access request, the user terminal sends the second access request to the client server. The file identifier corresponding to the first file may be a file name.

[0076] Step S202, obtaining index information stored corresponding to the file identifier.

[0077] In this embodiment, the client server stores the file identifier and index information corresponding to the first file in advance, so that after receiving the second access request, the client server directly obtains the index information stored corresponding to the file identifier.

[0078] Step S203, sending a first access request to the file management server, the first access request carrying index information, so that the file management server obtains the file security level stored corresponding to the index information, authenticates the second access request based on the authentication policy corresponding to the file security level to obtain an authentication result, if the authentication result indicates that the authentication is successful, obtains the file storage address stored corresponding to the index information, reads the first file from the storage space indicated by the file storage address and returns the first file.

[0079] In this embodiment, after obtaining the index information, the client server generates a first access request and sends the first access request to the file management server, thereby obtaining the first file with the help of the file management server. Figure 2 The illustrated embodiments will not be described in detail here.

[0080] Step S204: Return the first file to the user terminal.

[0081] In this embodiment, after the client server receives the first file returned by the file management server, it returns the first file to the user terminal so that the user terminal receives the first file and performs subsequent operations based on the first file, for example, the subsequent operation may be to display the first file or download the first file locally.

[0082] In this embodiment, when a second access request for a first file is received from a user terminal, index information corresponding to the first file is first obtained, and then the first access request is sent to the file management server to obtain the first file with the help of the file management server. Since the file management server has previously stored the index information and the file security level corresponding to the first file, after receiving the first access request sent by the client server, the file security level stored corresponding to the index information can be obtained, and then the first access request can be authenticated according to the authentication policy corresponding to the file security level. Only when the authentication is passed is the first access request processed, that is, the first file is obtained and returned. It can be seen that the present application refines the file, sets the corresponding file security level for the file, and sets the authentication policy corresponding to each file security level. The authentication flexibility is higher, and the user can also dynamically expand the file security level and the corresponding authentication policy as needed. The scalability is stronger and it is easy to meet the personalized needs of users.

[0083] In the above Figure 2 as well as Figure 3 On the basis of the illustrated embodiment, the file access method provided by the present application is described in detail below by taking the file access process for the first file as an example.

[0084] Figure 4 is a schematic diagram showing a file access process according to an exemplary embodiment. Figure 4 As shown, the file access process provided by this embodiment includes the following steps:

[0085] Step S301: The user terminal sends a second access request to the client server, where the second access request carries a file identifier corresponding to the first file.

[0086] The second access request may be a file download request or a file viewing request.

[0087] Step S302: In response to receiving the second access request, the client server obtains index information stored corresponding to the file identifier.

[0088] Step S303: the client server sends a first access request to the file management server, where the first access request carries index information.

[0089] The client server calls an upload API (Application Programming Interface) of the file management server to send a first access request to the file management server.

[0090] Step S304: In response to receiving the first access request, the file management server obtains the file security level stored corresponding to the index information.

[0091] In this embodiment, the implementation of steps S301 to S303 is the same as that of steps S201 to S203, which will not be described in detail here. The implementation of step S304 is the same as that of steps S101 to S102, which will not be described in detail here.

[0092] Step S305: The file management server authenticates the second access request based on the authentication policy corresponding to the file security level to obtain an authentication result, where the authentication result indicates whether the authentication is passed or not.

[0093] This embodiment sets multiple file security levels in advance, and different file security levels correspond to different degrees of publicity. Optionally, the file security level includes personal level, platform level or public level. Among them, the degree of publicity corresponding to the personal level, platform level and public level increases in sequence, and the levels decrease in sequence, with the personal level being high, the platform level being medium, and the public level being low. Accordingly, the implementation of step S305 includes the following multiple situations:

[0094] The first case: the obtained file security level is personal level. When the file security level is personal level, if the first access request also carries the requester account and the requester account is the same as the uploader account corresponding to the first file, the authentication result is determined to be authentication passed; if the first access request does not carry the requester account, or the first access request also carries the requester account but the requester account is different from the uploader account, the authentication result is determined to be authentication failed. Among them, the requester account is the account logged in by the user terminal, and it is also the account that triggers the second access request. If the user terminal is currently logged in with an account, and the second access request is triggered by the account, the first access request carries the account, which is also the requester account. If the user terminal is not currently logged in with an account, and the second access request is triggered without logging in with an account, the first access request does not carry the requester account. Among them, the uploader account corresponding to the first file is the account that uploaded the first file. The uploader account can be regarded as the owner of the first file.

[0095] Among them, files with a file security level of personal level can only be accessed by the corresponding uploader account. Accordingly, if the first access request does not carry the requester account, it means that the user terminal is not currently logged in to the account, and the file management server cannot know whether the user currently operating the user terminal is the user referred to by the uploader account, and the authentication result is determined to be authentication failure. If the first access request carries the requester account, but the requester account is different from the uploader account, it means that the user referred to by the requester account is very likely not the user referred to by the uploader account, and the authentication result is determined to be authentication failure. If the first access request carries the requester account, and the requester account is the same as the uploader account, it means that the user referred to by the requester account is very likely to be the user referred to by the uploader account, and the authentication result is determined to be authentication passed.

[0096] The second situation: the obtained file security level is the platform level. In the case where the file security level is the platform level, if the first access request does not carry the requester account, the authentication result is determined to be authentication failure; if the first access request also carries the requester account, then based on the type of the platform level, the first access request is authenticated to obtain the authentication result. Among them, files with a file security level of the platform level are accessed by a logged-in account. If the first access request does not carry the requester account, it means that the user terminal is not currently logged in to the account, and the authentication result is determined to be failure. If the first access request also carries the requester account, it means that the user terminal is currently logged in to the requester account, and then further authentication is performed according to the type of the platform level.

[0097] Optionally, the platform level belongs to the access type or the authorization type. If the platform level belongs to the access type, the platform level is specifically the platform access level. If the platform level belongs to the authorization type, the platform level is specifically the platform authorization level. The degree of publicity corresponding to the platform access level is higher than the platform authorization level, and the level of the platform access level is lower than the platform authorization level. Specifically, the platform access level is intermediate, and the platform authorization level is intermediate to high. Correspondingly, based on the type to which the platform level belongs, the implementation method of authenticating the first access request to obtain the authentication result includes: when the platform level belongs to the access type, determining that the authentication result is authentication passed; when the platform level belongs to the authorization type, if the first client identifier carried by the first access request is the same as the second client identifier corresponding to the first file, determining that the authentication result is authentication passed, the first client identifier is the identifier corresponding to the client server, and the second client identifier is the identifier corresponding to the client server that uploaded the first file; if the first client identifier carried by the first access request is different from the second client identifier, determining that the authentication result is authentication failed.

[0098] Among them, in the case where the platform level belongs to the access type, the authentication result can be directly determined as authentication passed. In the case where the platform level belongs to the authorization type, authentication is further performed based on whether the first client identifier carried by the first access request is the same as the second client identifier corresponding to the first file. Among them, the first client identifier is the identifier corresponding to the client server that sends the first access request, and the second client identifier is the identifier corresponding to the client server that uploads the first file. If the first client identifier is the same as the second client identifier, it means that the client server that sends the first access request is the same as the client server that uploads the first file, and the website logged in by the requester's account is provided by the client server, then the authentication result is determined to be passed. If the first client identifier is different from the second client identifier, it means that the client server that sends the first access request is different from the client server that uploads the first file, then the authentication result is determined to be failed.

[0099] This implementation method further divides the file security level and performs authentication according to the type of the platform level, thereby enriching the authentication method and improving the authentication accuracy.

[0100] The third case: the obtained file security level is public. When the file security level is public, the authentication result is determined to be authentication passed. In this case, the file security level is low and the corresponding degree of publicity is high, so the authentication result can be directly determined to be authentication passed.

[0101] This embodiment sets different authentication strategies for the three file security levels of personal level, platform level and public level, so that the first access request can be authenticated according to the file security level corresponding to the first file. The authentication strategies are relatively rich and fully guarantee the security of the file.

[0102] The following description is made by taking the authentication result indicating that the authentication is passed as an example, referring to step S306 to step S307.

[0103] Step S306: If the authentication result indicates that the authentication is successful, the file management server obtains the file storage address stored corresponding to the index information.

[0104] In this embodiment, after storing the first file, the file management server also stores the index information corresponding to the first file and the file storage address in correspondence. Optionally, the file management server stores the index information, file security level and file storage address corresponding to each of the multiple files in the file storage table. Accordingly, if the authentication result indicates that the authentication is passed, the file management server obtains the file storage address corresponding to the index information corresponding to the first file from the file storage table.

[0105] Step S307: the file management server reads the first file from the storage space indicated by the file storage address and returns the first file.

[0106] Optionally, the first file is returned in the form of a file stream.

[0107] Step S308: the client server returns the first file to the user terminal.

[0108] The following is an example in which the authentication result indicates that the authentication failed. Optionally, the file access method provided by the present application also includes the following steps: if the authentication result indicates that the authentication failed, the file management server returns access failure information to the client server. Accordingly, the client server forwards the access failure information to the user terminal in response to receiving the access failure information sent by the file management server. Among them, if the authentication result indicates that it failed, indicating that the user terminal does not have the authority to access the first file, the file management server returns the access failure information to the client server, so that the client server forwards the access failure information to the user terminal. In response to receiving the access failure information, the user terminal displays a first prompt message, and the first prompt message is used to prompt that the file access failed. After the user using the user terminal sees the first prompt message, he can know that the access to the first file failed.

[0109] The above implementation ensures the integrity of the file access process by returning access failure information when authentication fails.

[0110] For example, Figure 5 is a schematic diagram showing a file access process according to another exemplary embodiment. Figure 5 As shown, the file access process includes the following steps:

[0111] Step S401: receiving an access request for a file.

[0112] Step S402: Obtain the file security level from the file storage table according to the index information.

[0113] Step S403: Authentication is performed according to the file security level.

[0114] Step S404, determine whether the authentication is successful.

[0115] If the authentication passes, execute step S405; if the authentication fails, execute step S406.

[0116] Step S405, obtain the file storage address, read the file and return the file.

[0117] Step S406, returning access failure information.

[0118] The implementation of steps S401 to S406 refers to the above steps S301 to S308 and will not be described in detail here.

[0119] Above Figure 4 The illustrated embodiment illustrates the file access method provided by the present application by taking the file access process for the first file as an example. The following illustrates the file access method provided by the present application by taking the file upload process for the second file as an example.

[0120] Figure 6 is a schematic diagram showing a file upload process according to an exemplary embodiment. Figure 6 As shown, the file upload process provided in this embodiment includes the following steps:

[0121] Step S501: In response to the upload control being triggered, the user terminal sends a second upload request to the client server, where the second upload request carries the second file, the uploader account, and a control identifier corresponding to the upload control.

[0122] When the user has a need to upload the second file, the user terminal is triggered to display the front-end interface corresponding to the website, and the front-end interface displays an upload control. The user triggers the upload control, and the user terminal responds to the upload control being triggered, obtains the second file, generates a second upload request, and sends the second upload request to the client server. The uploader account is the account currently logged in to the website displayed by the user terminal.

[0123] Step S502, in response to receiving the second upload request, if the client server obtains the file security level stored corresponding to the control identifier, it sends a first upload request to the file management server, and the first upload request carries the second file, the uploader account and the file security level.

[0124] In this embodiment, there are a large number of upload controls for uploading files in the front-end interface, and the client server sets the file security level corresponding to the upload control in advance, and stores the corresponding relationship between the control identifier corresponding to the upload control and the file security level. Accordingly, the client server receives the second upload request triggered by the upload control sent by the user terminal, obtains the file security level stored corresponding to the control identifier corresponding to the upload control from the corresponding relationship between the stored control identifier and the file security level, and generates a first upload request if the file security level stored corresponding to the control identifier is obtained, and sends the first upload request to the file management server.

[0125] The above steps are explained by taking the example of obtaining the file security level stored corresponding to the control identifier, and the following steps are explained by taking the example of not obtaining the file security level stored corresponding to the control identifier. Optionally, the file access method provided by the present application also includes the following steps: if the file security level stored corresponding to the control identifier is not obtained, an upload failure message is sent to the user terminal. Among them, the file security level corresponding to the control identifier is used by the file management server to set a corresponding file security level for the second file. If the file security level stored corresponding to the control identifier is not obtained, it means that the corresponding file security level is not set for the upload control, and the upload failure message is directly returned. In response to receiving the upload failure message, the user terminal displays a second prompt message, and the second prompt message is used to prompt that the file upload failed. After seeing the second prompt message, the user using the user terminal can know that the upload of the second file has failed.

[0126] The above implementation ensures the integrity of the file upload process by returning upload failure information when the file security level stored corresponding to the control identifier is not obtained.

[0127] Step S503: In response to receiving the first upload request, the file management server generates index information corresponding to the second file and stores the second file.

[0128] The index information corresponding to the second file is used to uniquely identify the second file, so that the file management server can distinguish different files. The file management server determines the file storage address corresponding to the second file, and stores the second file in the storage space indicated by the file storage address.

[0129] Step S504: the file management server stores index information, file security level, uploader account and file storage address corresponding to the second file.

[0130] Optionally, the file management server stores the index information, file security level, uploader account and file storage address corresponding to the second file in the file storage table. Optionally, the first access request also carries the file identifier corresponding to the second file, and the file management server also stores the file identifier accordingly, for example, the file identifier is the file name. Optionally, the file management server also stores the request time of the second access request, which is also the upload time of the second file.

[0131] Step S505: The file management server returns index information and an upload result to the client server, where the upload result indicates that the upload is successful.

[0132] Step S506: the client server stores the file identifier and index information corresponding to the second file in correspondence, and returns the upload result to the user terminal.

[0133] In this embodiment, the file upload process is implemented by data interaction between the user terminal, the client server and the file management server. By setting the corresponding file security level for the upload control, the file security level is automatically set for the file uploaded through the upload control. No additional operation by the user is required, the operation is simple, and the degree of automation is high.

[0134] For example, Figure 7 is a schematic diagram showing a file upload process according to another exemplary embodiment. Figure 7 As shown, the file upload process includes the following steps:

[0135] Step S601: receiving a request to upload a file.

[0136] Step S602, obtaining the file security level corresponding to the upload control.

[0137] If the file security level corresponding to the upload control is not obtained, step S603 is executed; if the file security level corresponding to the upload control is obtained, step S604 is executed.

[0138] Step S603, return upload failure information.

[0139] Step S604: Upload the file to the file management server in the intranet environment.

[0140] The intranet environment refers to the network between the client server and the file management server, and the user terminal cannot communicate with the file management server through this network.

[0141] Step S605, storing the file, and correspondingly storing index information, file security level, file name, file storage address and upload time.

[0142] Step S606, returning index information.

[0143] The implementation of steps S601 to S606 refers to the above steps S501 to S506, which will not be described again.

[0144] Based on the above embodiment, the level configuration process is described below. For example, Figure 8 is a schematic diagram showing a level configuration process according to an exemplary embodiment. Figure 8 As shown, the configuration process at this level includes the following steps:

[0145] Step S701, sort out the controls that can upload files.

[0146] Step S702, defining the file security level.

[0147] Among them, the technical personnel first sorted out the controls on the website that can upload files, and defined multiple file security levels as needed according to the characteristics of different controls and the types of uploaded files, such as personal level (INTERNAL), platform authorization level (PRIVATE), platform access level (PROTECT), and public level (PUBLIC).

[0148] Step S703: define a corresponding authentication policy for the file security level.

[0149] Step S704: configure corresponding file security levels for the sorted upload controls.

[0150] Among them, the technicians first define the corresponding authentication strategy for each file security level, then configure the corresponding file security level for the sorted controls, and bind the control identifier corresponding to the upload control with the corresponding file security level, such as storing the corresponding relationship between the control identifier and the file security level. For example, the upload control corresponding to documents such as certificates and contracts is configured at the personal level, the upload control with file permissions is configured at the platform authorization level, the upload control corresponding to order information, attachments, etc. is configured at the platform access level, and for files that can be made public to users, such as introductions and marketing files, the corresponding upload control is configured at the public level.

[0151] It should be noted that the above embodiment is described by taking the case where the user terminal triggers the file upload process when the upload control is triggered as an example. In other embodiments, the client server also provides external upload interfaces corresponding to each file security level, so that the third-party system can upload files by calling the corresponding upload interface. For example, 4 upload interfaces are provided, corresponding to the personal level, platform authorization level, platform access level and public level respectively. The implementation method of the third-party system triggering the file upload process is the same as the above embodiment, and will not be repeated here.

[0152] On the basis of the above embodiment, in an optional embodiment, the client server also sets a corresponding cleaning tag for the upload control in advance, and the cleaning tag is used to indicate whether cleaning is required. For example, a cleaning tag of 1 indicates that cleaning is required, and a cleaning tag of 0 indicates that cleaning is not required. In the case where the cleaning tag indicates that cleaning is required, the upload control also has a corresponding cleaning cycle, which is the storage period corresponding to the file uploaded by the upload control. Once the storage period of the file in the file management server exceeds the storage period, the file will no longer be stored. Accordingly, in response to receiving the second access request, the client server also obtains the cleaning cycle stored corresponding to the control identifier corresponding to the upload control, and carries the cleaning cycle in the first upload request. Correspondingly, the first upload request also carries the cleaning cycle corresponding to the second file. The file access method provided in this embodiment also includes the following steps: the file management server stores the file storage address, cleaning cycle, upload time and cleaning status corresponding to the second file in the file cleaning record table, and the cleaning status is uncleaved; the file management server periodically scans the file cleaning record table, and if the time interval between the current time and the upload time is greater than or equal to the cleaning cycle, the second file is deleted from the storage space indicated by the file storage address; the file management server determines the current time as the cleaning time corresponding to the second file, and adds the cleaning time corresponding to the second file in the file cleaning record table, and updates the cleaning status to cleaned.

[0153] Among them, after receiving the first upload request, the file management server also stores the file storage address, cleaning cycle, upload time and cleaning status corresponding to the second file in the file cleaning record table. The file cleaning record table stores multiple cleaning records, and each cleaning record corresponds to a file. The cleaning status indicates that it has not been cleaned or has been cleaned. For example, a cleaning status of 1 indicates that it has been cleaned, and a cleaning status of 0 indicates that it has not been cleaned. The time of the scheduled scan can be set as needed, and this embodiment does not limit this. The file management server can scan when the business is not busy, for example, scanning at 23:00 every day. When scanning the file cleaning record table, for the cleaning record corresponding to the second file, if the time interval between the current time and the upload time is greater than or equal to the cleaning cycle, it means that the storage time of the second file has reached the storage period. In this case, the file management server deletes the stored second file. After the deletion is successful, the cleaning time corresponding to the second file is added to the file cleaning record table and the cleaning status is updated. If the time interval between the current time and the upload time is less than the cleaning cycle, it means that the storage time of the second file has not reached the storage period, and the next cleaning record is scanned.

[0154] It should be noted that the number of files to be cleaned obtained by the scheduled scan may be large. The file management server can clean up each file to be cleaned up, and scan the next cleaning record after the cleaning is completed. Alternatively, the file management server can also add the scanned files to be cleaned up to the to-be-cleaned table, and after scanning the file cleaning record table, clean up the files in batches according to the to-be-cleaned table. After the cleaning is completed, the cleaning status of the corresponding files in the file cleaning record table is updated in batches, and the cleaning time is recorded.

[0155] In this embodiment, by setting a corresponding cleaning cycle for the second file and regularly scanning the file cleaning record table, a file cleaning function is provided, files that exceed the cleaning cycle are deleted in time, and zombie files that are no longer used for a long time are reduced to save storage space.

[0156] For example, Fig. 9 is a schematic diagram showing a file cleaning process according to an exemplary embodiment. Fig. 9 As shown, the file cleaning process includes the following steps:

[0157] Step S801, regularly scan the file cleaning record table.

[0158] Step S802: for each cleaning record, determine whether the time interval between the current time and the upload time is greater than or equal to the cleaning period.

[0159] If the time interval between the current time and the upload time is greater than or equal to the cleaning cycle, step S803 is executed; if the time interval between the current time and the upload time is less than the cleaning cycle, step S801 is continued.

[0160] Step S803, delete the file corresponding to the cleaning record, and update the cleaning status and record the cleaning time.

[0161] For example, Fig.10 is a schematic diagram showing a file management stage according to an exemplary embodiment. Fig.10 As shown, the file management stage includes the specification definition stage, the file upload stage, the file access stage and the file cleanup stage, wherein the specification definition stage includes defining the file security level, defining the authentication strategy corresponding to the file security level, and binding the upload control with the file security level. The file upload stage includes file security settings and file storage, and the file security settings refer to obtaining the file security level corresponding to the upload control. The file access stage includes requesting authentication and file acquisition. The file cleanup stage includes cleaning records and file cleanup.

[0162] This application uses a file management server to implement file management functions as an example for explanation. It is understandable that the file management server can also be subdivided into a tracking server and a storage server. The tracking server is used for scheduling, and the storage server is used for load balancing. See FastDFS in the related technology.

[0163] The present application provides an efficient, dynamically scalable, easy to deploy and maintain file access solution, which realizes the grading and refinement of authentication in the file access process, and provides permission assignment for the entire link from upload to download. Specifically, it provides refined file security level management, personal level, platform level and public level; and provides different authentication strategies corresponding to different file security levels: the personal-level file authentication key is related to the requester's account, the platform-level file authentication key is related to the platform, and the public-level files can be accessed without obstacles. The authentication strategy is relatively rich, allowing the business party to choose flexibly. In addition, the client server opens a unique access method to the user terminal, and the client server and the file management server share the pressure in a distributed deployment manner, so that the request can be loaded to different services, and the processing logic of each service is consistent.

[0164] Fig.11 is a schematic diagram showing the structure of a file access device according to an exemplary embodiment. Fig.11 As shown, in this embodiment, the file access device 900 can be set in the file management server, and the file access device 900 includes:

[0165] A receiving module 901 is used to receive a first access request sent by a client server, where the first access request carries index information corresponding to a first file;

[0166] An acquisition module 902 is used to acquire a file security level stored corresponding to the index information;

[0167] An authentication module 903 is used to authenticate the first access request based on the authentication policy corresponding to the file security level to obtain an authentication result, where the authentication result indicates whether the authentication is passed or not;

[0168] The acquisition module 902 is used to acquire the file storage address stored corresponding to the index information if the authentication result indicates that the authentication is passed, read the first file from the storage space indicated by the file storage address and return the first file.

[0169] Optionally, the authentication module 903 is used to:

[0170] When the file security level is personal level, if the first access request also carries the requester account and the requester account is the same as the uploader account corresponding to the first file, the authentication result is determined to be authentication passed; if the first access request does not carry the requester account, or the first access request also carries the requester account but the requester account is different from the uploader account, the authentication result is determined to be authentication failed;

[0171] When the file security level is the platform level, if the first access request does not carry the requester account, the authentication result is determined to be authentication failure; if the first access request also carries the requester account, the first access request is authenticated based on the type of the platform level to obtain an authentication result;

[0172] When the file security level is the public level, the authentication result is determined to be authentication passed.

[0173] Optionally, the platform level belongs to the access type or the authorization type, and the authentication module 903 is used to:

[0174] In the case where the platform level belongs to the access type, the authentication result is determined to be authentication passed;

[0175] In the case of an authorization type at the platform level, if the first client identifier carried by the first access request is the same as the second client identifier corresponding to the first file, the authentication result is determined to be authentication passed, the first client identifier is the identifier corresponding to the client server, and the second client identifier is the identifier corresponding to the client server that uploaded the first file; if the first client identifier carried by the first access request is different from the second client identifier, the authentication result is determined to be authentication failed.

[0176] Optionally, the device further comprises:

[0177] The sending module is used to return access failure information to the client server if the authentication result indicates that the authentication fails.

[0178] Optionally, the device further comprises:

[0179] The receiving module 901 is further used to receive a first upload request sent by the client server, where the first upload request carries the second file, the file security level corresponding to the second file, and the uploader account;

[0180] A generating module, used to generate index information corresponding to the second file;

[0181] A storage module, used to store the second file, and correspondingly store index information, file security level, uploader account and file storage address corresponding to the second file;

[0182] The sending module is also used to return index information to the client server.

[0183] Optionally, the first upload request further carries a cleanup period corresponding to the second file, and the device further includes:

[0184] The storage module is further used to store the file storage address, cleaning cycle, upload time and cleaning status corresponding to the second file in the file cleaning record table, and the cleaning status is not cleaned;

[0185] A deletion module, used for periodically scanning the file cleaning record table, and if the time interval between the current time and the upload time is greater than or equal to the cleaning period, deleting the second file from the storage space indicated by the file storage address;

[0186] The storage module is further used to determine the current time as the cleaning time corresponding to the second file, add the cleaning time corresponding to the second file in the file cleaning record table, and update the cleaning state to cleaned.

[0187] The file access device provided in this embodiment can execute the technical solution of the corresponding method embodiment. Its implementation principle and technical effect are similar to those of the corresponding method embodiment, and will not be described in detail here.

[0188] Fig.12 is a schematic diagram showing the structure of a file access device according to another exemplary embodiment. Fig.12 As shown, in this embodiment, the file access device 1000 can be set in the client server, and the file access device 1000 includes:

[0189] The receiving module 1001 is configured to receive a second access request sent by a user terminal, where the second access request carries a file identifier corresponding to the first file;

[0190] The acquisition module 1002 is used to acquire the index information stored corresponding to the file identifier;

[0191] The sending module 1003 is used to send a first access request to the file management server, where the first access request carries index information, so that the file management server obtains the file security level stored corresponding to the index information, authenticates the second access request based on the authentication policy corresponding to the file security level to obtain an authentication result, and if the authentication result indicates that the authentication is passed, obtains the file storage address stored corresponding to the index information, reads the first file from the storage space indicated by the file storage address, and returns the first file;

[0192] The sending module 1003 is further configured to return the first file to the user terminal.

[0193] Optionally, the device further comprises:

[0194] The receiving module 1001 is further configured to receive a second upload request sent by a user terminal and triggered by an upload control, wherein the second upload request carries a second file, an uploader account, and a control identifier corresponding to the upload control;

[0195] The sending module 1003 is further used to send a first upload request to the file management server if the file security level stored corresponding to the control identifier is obtained, and the first upload request carries the second file, the uploader account and the file security level, so that the file management server generates index information corresponding to the second file and stores the second file, and stores the index information, file security level, uploader account and file storage address corresponding to the second file, and returns the index information and the upload result, and the upload result indicates that the upload is successful;

[0196] The sending module 1003 is further used to store the file identifier and index information corresponding to the second file in correspondence, and return the upload result to the user terminal.

[0197] Optionally, the device further comprises:

[0198] The sending module 1003 is further configured to send an upload failure message to the user terminal if the file security level stored corresponding to the control identifier is not obtained.

[0199] Optionally, the device further comprises:

[0200] The sending module 1003 is further configured to forward the access failure information to the user terminal in response to receiving the access failure information sent by the file management server.

[0201] The file access device provided in this embodiment can execute the technical solution of the corresponding method embodiment. Its implementation principle and technical effect are similar to those of the corresponding method embodiment, and will not be described in detail here.

[0202] The embodiment of the present application also provides a file management server. Fig.13 is a schematic diagram showing the structure of a file management server according to an exemplary embodiment. Fig.13 As shown, the file management server 1100 includes: a processor 1101, and a memory 1102 and a transceiver 1103 respectively connected to the processor 1101 for communication.

[0203] The memory 1102 stores computer-executable instructions; the transceiver 1103 is used to send and receive data with the client server; the processor 1101 executes the computer-executable instructions stored in the memory 1102 to implement the file access method provided in this application.

[0204] In the embodiment of the present application, the memory 1102, the transceiver 1103 and the processor 1101 are connected via a bus. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0205] The embodiment of the present application also provides a client server. Fig.14 is a schematic diagram showing a structure of a client server according to an exemplary embodiment. Fig.14 As shown, the client server 1200 includes: a processor 1201, and a memory 1202 and a transceiver 1203 which are respectively communicatively connected to the processor 1201.

[0206] The memory 1202 stores computer-executable instructions; the transceiver 1203 is used to send and receive data with the file management server and the user terminal respectively; the processor 1201 executes the computer-executable instructions stored in the memory 1202 to implement the file access method provided in this application.

[0207] In this embodiment of the present application, the memory 1202, the transceiver 1203 and the processor 1201 are connected via a bus.

[0208] The components, their connections and relationships, and their functions shown herein are merely examples and are not intended to limit the implementation of the present application described and / or required herein. The various components are interconnected using different buses and may be mounted on a common motherboard or in other ways as desired.

[0209] In an exemplary embodiment, a computer-readable storage medium is also provided, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the file access method provided by the present application.

[0210] In an exemplary embodiment, a computer program product is also provided, including computer-executable instructions. When the computer-executable instructions in the computer program product are executed by a processor, they are used to implement the file access method provided by the present application.

[0211] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0212] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0213] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0214] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0215] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. Unless otherwise specified, the processor may be any appropriate hardware processor, such as a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a digital signal processor (DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor or other electronic components. Unless otherwise specified, the memory may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a USB flash drive, random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), enhanced dynamic random access memory (EDRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), resistive random access memory (RRAM), high-bandwidth memory HBM (High-BandwidthMemory), hybrid memory cube HMC (Hybrid Memory Cube), magnetic storage, flash memory, magnetic disk, optical disk, mobile hard disk or disk, etc.

[0216] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present application.

[0217] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0218] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0219] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A file access method, characterized in that: Applicable to file management servers, including: Receiving a first access request sent by a client server, wherein the first access request carries index information corresponding to a first file; Obtaining a file security level stored corresponding to the index information; Based on the authentication policy corresponding to the file security level, authenticating the first access request to obtain an authentication result, wherein the authentication result indicates whether the authentication is passed or not; If the authentication result indicates that the authentication is successful, the file storage address stored corresponding to the index information is obtained, the first file is read from the storage space indicated by the file storage address, and the first file is returned.

2. The method according to claim 1, characterized in that The authenticating the first access request based on the authentication policy corresponding to the file security level to obtain an authentication result includes: In the case where the file security level is personal level, if the first access request also carries a requester account and the requester account is the same as the uploader account corresponding to the first file, then the authentication result is determined to be authentication passed; if the first access request does not carry the requester account, or the first access request also carries the requester account but the requester account is different from the uploader account, then the authentication result is determined to be authentication failed; In the case where the file security level is the platform level, if the first access request does not carry the requester account, determining the authentication result as authentication failure; if the first access request also carries the requester account, authenticating the first access request based on the type of the platform level to obtain the authentication result; When the file security level is the public level, the authentication result is determined to be authentication passed.

3. The method according to claim 1, characterized in that The platform level belongs to an access type or an authorization type, and the authenticating the first access request based on the type to which the platform level belongs to obtain the authentication result includes: In a case where the platform level belongs to the access type, determining that the authentication result is authentication passed; In the case where the platform level belongs to the authorization type, if the first client identifier carried by the first access request is the same as the second client identifier corresponding to the first file, the authentication result is determined to be authentication passed, the first client identifier is the identifier corresponding to the client server, and the second client identifier is the identifier corresponding to the client server that uploaded the first file; if the first client identifier carried by the first access request is different from the second client identifier, the authentication result is determined to be authentication failed.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: If the authentication result indicates that the authentication fails, access failure information is returned to the client server.

5. The method according to claim 1, characterized in that The method further comprises: Receiving a first upload request sent by the client server, the first upload request carrying a second file, a file security level corresponding to the second file, and an uploader account; Generate index information corresponding to the second file; storing the second file, and correspondingly storing the index information, the file security level, the uploader account and the file storage address corresponding to the second file; The index information is returned to the client server.

6. The method according to claim 5, characterized in that The first upload request also carries a cleanup period corresponding to the second file, and the method further includes: In the file cleaning record table, the file storage address, the cleaning cycle, the upload time and the cleaning status corresponding to the second file are stored correspondingly, and the cleaning status is uncleaned; Scanning the file cleaning record table regularly, if the time interval between the current time and the upload time is greater than or equal to the cleaning period, deleting the second file from the storage space indicated by the file storage address; The current time is determined as the cleaning time corresponding to the second file, and the cleaning time corresponding to the second file is added to the file cleaning record table, and the cleaning status is updated to cleaned.

7. A file access method, characterized in that: Applicable to client servers, including: receiving a second access request sent by a user terminal, where the second access request carries a file identifier corresponding to the first file; Obtaining index information stored corresponding to the file identifier; Sending a first access request to a file management server, the first access request carrying the index information, so that the file management server obtains a file security level stored corresponding to the index information, authenticates the second access request based on an authentication policy corresponding to the file security level to obtain an authentication result, and if the authentication result indicates that the authentication is passed, obtains a file storage address stored corresponding to the index information, reads the first file from a storage space indicated by the file storage address, and returns the first file; The first file is returned to the user terminal.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a second upload request triggered by an upload control and sent by the user terminal, wherein the second upload request carries a second file, an uploader account, and a control identifier corresponding to the upload control; If the file security level stored corresponding to the control identifier is obtained, a first upload request is sent to the file management server, the first upload request carries the second file, the uploader account and the file security level, so that the file management server generates index information corresponding to the second file and stores the second file, and stores the index information, the file security level, the uploader account and the file storage address corresponding to the second file, and returns the index information and the upload result, the upload result indicating that the upload is successful; The file identifier corresponding to the second file and the index information are stored correspondingly, and the upload result is returned to the user terminal.

9. The method according to claim 8, characterized in that The method further comprises: If the file security level stored corresponding to the control identifier is not obtained, an upload failure message is sent to the user terminal.

10. The method according to claim 7, characterized in that The method further comprises: In response to receiving the access failure information sent by the file management server, forwarding the access failure information to the user terminal.

11. A file access device, characterized in that: Set in a file management server, the device includes: A receiving module, configured to receive a first access request sent by a client server, wherein the first access request carries index information corresponding to a first file; An acquisition module, used to acquire the file security level stored corresponding to the index information; An authentication module, configured to authenticate the first access request based on an authentication policy corresponding to the file security level to obtain an authentication result, wherein the authentication result indicates whether the authentication is passed or not; The acquisition module is further configured to acquire a file storage address stored corresponding to the index information if the authentication result indicates that the authentication is successful, read the first file from the storage space indicated by the file storage address, and return the first file.

12. A file access device, characterized in that: Set in a client server, the device includes: A receiving module, configured to receive a second access request sent by a user terminal, wherein the second access request carries a file identifier corresponding to the first file; An acquisition module, used to acquire index information stored corresponding to the file identifier; a sending module, configured to send a first access request to a file management server, wherein the first access request carries the index information, so that the file management server obtains a file security level stored corresponding to the index information, authenticates the second access request based on an authentication policy corresponding to the file security level to obtain an authentication result, and if the authentication result indicates that the authentication is passed, obtains a file storage address stored corresponding to the index information, reads the first file from a storage space indicated by the file storage address, and returns the first file; The sending module is further used to return the first file to the user terminal.

13. A file management server, characterized in that: include: A processor and a memory and a transceiver communicatively connected to the processor; The memory stores computer-executable instructions; the transceiver is used to send and receive data with the client server; The processor executes the computer-executable instructions stored in the memory to implement the file access method according to any one of claims 1 to 6.

14. A client server, characterized in that: include: A processor and a memory and a transceiver communicatively connected to the processor; The memory stores computer-executable instructions; the transceiver is used to send and receive data with the file management server and the user terminal respectively; The processor executes the computer-executable instructions stored in the memory to implement the file access method according to any one of claims 7 to 10.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the file access method according to any one of claims 1 to 10.

Images