Micro-service file security processing method, system, medium and equipment

Abstract

The invention discloses a micro-service file security processing method, system, medium and equipment, and the method comprises the steps: receiving a file operation request initiated by a client, verifying the user permission of the client, generating an access token after the user permission verification is passed, and returning the access token to the client; and the first back-end service analyzes and verifies the access token used by the client, executes file operation after the verification of the access token is passed, and returns a unique file identification code corresponding to the executed file to the second back-end service. Through the scheme, the security of information and file operation contained in the token can be improved.

Description

Technical Field

[0001] The present invention relates to the field of file processing, and in particular to a method, system, storage medium and electronic device for securely processing microservice files. Background Art

[0002] The file confidentiality requirements in areas such as electronic bidding and tendering are relatively high. The existing microservice system cannot effectively solve the security issues of file information, data leakage and file access when uploading, accessing / operating files.

[0003] For example, the Chinese invention patent with application publication number CN111198848A discloses a distributed file access method, system, server and storage medium. The scheme proposes a file-reliant token to ensure the security of file access. However, there is still a risk of leakage when information such as file path and user ID is transmitted over the network.

[0004] Another example is the Chinese invention patent with application publication number CN115996141A, which discloses a file access authentication method, device, equipment and storage medium. The solution proposes to generate a service authorization code by requesting other services and send it to the file service for permission verification and return a file access token, which is used by the requesting party to access the file. However, since the token acquisition method involves data network transmission, there is still a possibility of leakage, and the file access verification rules are single and the security level is not enough. Summary of the invention

[0005] In view of the above problems, the present invention provides a method, system, storage medium and electronic device for secure processing of microservice files, which solves the problem of weak security of existing file operation access.

[0006] To achieve the above objectives, in a first aspect, the present application provides a method for securely processing microservice files, the method comprising the following steps:

[0007] Receive a file operation request initiated by a client, verify the user authority of the client, and generate an access token and return it to the client after the user authority verification passes. The access token is generated based on business information and user information of the current client;

[0008] The access token is generated by the second backend service, and the access token is generated according to the business information and the user information of the current client, including:

[0009] Generate a first access token field and a second access token field, and concatenate the first access token field and the second access token field according to a specified delimiter to obtain the access token;

[0010] Generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies;

[0011] Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file;

[0012] The second access token field is decompressed using the decompression algorithm in the first access token field, and asymmetrically encrypted using the encryption and decryption algorithm in the first access token field;

[0013] When the client uses the access token to perform file operations, the first back-end service parses and verifies the access token used by the client, executes the file operation after the access token verification is passed, and returns the unique file identification code corresponding to the executed file to the second back-end service, so that the second back-end service maps and stores the file identification code with the business information.

[0014] Further, using the encryption and decryption algorithm in the first access token field to perform asymmetric encryption includes:

[0015] Receive the public key sent by the key management module, and encrypt the information in the second access token field using the encryption and decryption algorithm and the public key;

[0016] The first backend service parses and verifies the access token used by the client, including:

[0017] The first backend service receives the private key sent by the key management module, and uses the private key and the encryption and decryption algorithm to decrypt the information in the second access token field;

[0018] The unique identifier of the decrypted user information, the unique code of the business information, the file security level and the effective operation time range of the file are verified one by one.

[0019] Furthermore, the method further comprises:

[0020] After the user authority verification is passed, an access restriction condition is generated and returned to the client, wherein the access restriction condition includes a file type and a file size, and the access restriction condition is determined according to the business information;

[0021] When it is detected that the file operated by the client does not meet the access restriction condition, a prompt message is issued.

[0022] Further, the file token type includes a file operation type and a file source type, the file operation type includes file upload and file download, the file source type includes an external source and an internal source, and the file token verification strategy includes multiple groups of verification strategies corresponding to different file security levels;

[0023] The different file token types correspond to different file token verification strategies, including:

[0024] The file security level is determined according to the file operation type and the file source type, and the file token verification strategy is determined according to the determined file security level.

[0025] Furthermore, the first backend service parses and verifies the access token used by the client, including:

[0026] The first backend service verifies whether the unique identifier of the user information decrypted by the first backend service conforms to the preset identifier, verifies whether the unique code of the business information conforms to the preset code, and verifies whether the timestamp of the current operation file is within the valid operation time range of the file.

[0027] Further, the file operation includes a file reading operation, and the file is stored in a preset storage space in an encrypted form;

[0028] Executing the file operation after the access token is verified includes:

[0029] After the access token is verified, the encrypted file is obtained from the preset storage space according to the unique file identifier, and the encrypted file is decrypted using the decryption key and then returned to the client.

[0030] In a second aspect, the present application provides a system for secure processing of microservice files, the system comprising:

[0031] The gateway is used to receive file operation requests initiated by the client and verify the user permissions of the client;

[0032] A second backend service is connected to the gateway for generating an access token and returning it to the client after the user authority verification is passed, wherein the access token is generated according to the business information and the user information of the current client;

[0033] a first backend service, which is in communication with the gateway and is used for parsing and verifying the access token used by the client when the client uses the access token to perform a file operation, and performing the file operation after the access token is verified, and returning a unique file identification code corresponding to the executed file to the second backend service, so that the second backend service maps and stores the file identification code with the business information;

[0034] The access token is generated according to the business information and the user information of the current client, including:

[0035] Generate a first access token field and a second access token field, and concatenate the first access token field and the second access token field according to a specified delimiter to obtain the access token;

[0036] Generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies;

[0037] Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file;

[0038] The second access token field is decompressed using the decompression algorithm in the first access token field, and is asymmetrically encrypted using the encryption and decryption algorithm in the first access token field.

[0039] Furthermore, it also includes:

[0040] A key management module, used to send a private key to the first backend service, and send a public key to the second backend service;

[0041] The second backend service is further used to encrypt the information in the second access token field by using the encryption and decryption algorithm and the public key;

[0042] The first back-end service is also used to receive the private key sent by the key management module, use the private key and the encryption and decryption algorithm to decrypt the information in the second access token field, and verify the unique identifier of the decrypted user information, the unique code of the business information, the file security level and the valid operation time range of the file one by one.

[0043] In a third aspect, the present invention further provides a computer-readable storage medium storing computer program instructions, which implement the method described in the first aspect when executed by a processor.

[0044] In a fourth aspect, the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method described in the first aspect.

[0045] Different from the prior art, the above technical solution involves a method, system, medium and device for secure microservice file processing, the method comprising: receiving a file operation request initiated by a client, verifying the user authority of the client, generating an access token and returning it to the client after the user authority verification is passed, when the client uses the access token to perform a file operation, the first backend service parses and verifies the access token used by the client, and executes the file operation after the access token verification is passed, and returns the unique file identification code corresponding to the executed file to the second backend service. Through the above solution, the security of the information contained in the token and the file operation can be improved.

[0046] The above-mentioned records related to the content of the invention are only an overview of the technical solution of the present invention. In order to enable ordinary technicians in the field to more clearly understand the technical solution of the present invention, and then implement it according to the text of the specification and the contents recorded in the drawings, and in order to make the above-mentioned purpose and other purposes, features and advantages of the present invention easier to understand, the following is a description in combination with the specific implementation mode of the present invention and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings are only used to illustrate the principles, implementations, applications, features and effects of the specific embodiments of the present invention and other related contents, and shall not be considered as limiting the present invention.

[0048] In the drawings of the specification:

[0049] Figure 1 A flowchart of a method for securely processing microservice files according to a first exemplary embodiment of the present invention;

[0050] Figure 2 A flowchart of a method for securely processing microservice files according to a second exemplary embodiment of the present invention;

[0051] Figure 3 A schematic diagram of modules of a system for secure processing of microservice files according to a first exemplary embodiment of the present invention;

[0052] Figure 4 A schematic diagram of a module of a system for secure processing of microservice files according to a second exemplary embodiment of the present invention;

[0053] Figure 5 A flowchart of a method for securely processing microservice files according to a third exemplary embodiment of the present invention;

[0054] Figure 6 A timing diagram of a method for securely processing microservice files according to a first exemplary embodiment of the present invention;

[0055] Figure 7A timing diagram of a method for securely processing microservice files according to a second exemplary embodiment of the present invention;

[0056] Figure 8 A schematic diagram of an electronic device according to an exemplary embodiment of the present invention.

[0057] The reference numerals in the above drawings are described as follows:

[0058] 100. Gateway;

[0059] 101. First backend service;

[0060] 102. Second backend service;

[0061] 103. Key management module;

[0062] 1. Electronic equipment;

[0063] 11. Memory;

[0064] 12. Processor. DETAILED DESCRIPTION

[0065] In order to explain in detail the possible application scenarios, technical principles, specific schemes that can be implemented, and the purposes and effects of the present invention, the following is a detailed description in combination with the specific embodiments listed and the accompanying drawings. The embodiments described herein are only used to more clearly illustrate the technical solutions of the present invention, and are therefore only used as examples, and cannot be used to limit the scope of protection of the present invention.

[0066] Reference to "embodiment" herein means that the specific features, structures or characteristics described in conjunction with the embodiment may be included in at least one embodiment of the present invention. The word "embodiment" appearing in various places in the specification does not necessarily refer to the same embodiment, nor does it particularly limit its independence or association with other embodiments. In principle, in the present invention, as long as there is no technical contradiction or conflict, the various technical features mentioned in each embodiment can be combined in any way to form a corresponding implementable technical solution.

[0067] Unless otherwise defined, the technical terms used herein have the same meanings as those generally understood by those skilled in the art to which the present invention belongs; the use of relevant terms herein is only for describing specific embodiments and is not intended to limit the present invention.

[0068] In the description of the present invention, the term "and / or" is an expression used to describe the logical relationship between objects, indicating that three relationships may exist, for example, A and / or B, which means: A exists, B exists, and A and B exist at the same time. In addition, the character " / " in this article generally indicates that the objects before and after are in a logical relationship of "or".

[0069] In the present invention, terms such as "first" and "second" are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship of quantity, priority or sequence between these entities or operations.

[0070] Without further restrictions, in the present invention, the words "include", "comprises", "has" or other similar open-ended expressions used in sentences are intended to cover non-exclusive inclusion. These expressions do not exclude the presence of additional elements in the process, method or product including the elements, so that the process, method or product including a series of elements may include not only those limited elements, but also other elements not explicitly listed, or also include elements inherent to such process, method or product.

[0071] Similar to the understanding in the Examination Guidelines, in the present invention, expressions such as "greater than", "less than", "exceed" and the like are understood to exclude the number itself; expressions such as "above", "below", "within" and the like are understood to include the number itself. In addition, in the description of the embodiments of the present invention, the meaning of "multiple" is more than two (including two), and similar expressions related to "multiple" are also understood in this way, such as "multiple groups", "multiple times", etc., unless otherwise clearly and specifically limited.

[0072] like Figure 1 As shown, in a first aspect, the present application provides a method for securely processing microservice files, the method comprising the following steps:

[0073] First, step S101 is performed to receive a file operation request initiated by a client, verify the user authority of the client, and generate an access token and return it to the client after the user authority verification passes;

[0074] Then enter step S102. When the client uses the access token to perform file operations, the first back-end service parses and verifies the access token used by the client, and executes the file operation after the access token verification is passed, and returns the unique file identification code corresponding to the executed file to the second back-end service, so that the second back-end service maps and stores the file identification code with the business information.

[0075] In step S101, the access token is generated according to the service information and the user information of the current client. In this application, the service information refers to the type of service being executed, and the user information of the current client can be a user account or other information that can identify the current client.

[0076] The access token is generated by the second backend service. The access token is generated according to the business information and the user information of the current client, including: generating a first access token field and a second access token field, splicing the first access token field and the second access token field according to a specified delimiter, and combining them to obtain the access token.

[0077] Preferably, generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies;

[0078] Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file;

[0079] The second access token field is decompressed using the decompression algorithm in the first access token field, and is asymmetrically encrypted using the encryption and decryption algorithm in the first access token field.

[0080] The above scheme proposes a microservice file security access method based on the encryption and decryption technology scheme and the resource access control technology of the verification token. By setting the format of the access token and encrypting and storing it, the security and efficiency of file access can be improved.

[0081] In some embodiments, Figure 2 As shown, using the encryption and decryption algorithm in the first access token field to perform asymmetric encryption includes:

[0082] Step S201: the second backend service receives the public key sent by the key management module, and uses the encryption and decryption algorithm and the public key to encrypt the information in the second access token field;

[0083] The first backend service parses and verifies the access token used by the client, including:

[0084] Step S202: The first back-end service receives the private key sent by the key management module, uses the private key and the encryption and decryption algorithm to decrypt the information in the second access token field, and verifies the unique identifier of the decrypted user information, the unique code of the business information, the file security level, and the valid operation time range of the file one by one.

[0085] In this way, the security of file operations can be effectively improved through asymmetric encryption.

[0086] In some embodiments, the method further comprises:

[0087] After the user authority verification is passed, an access restriction condition is generated and returned to the client, wherein the access restriction condition includes a file type and a file size, and the access restriction condition is determined according to the business information;

[0088] When it is detected that the file operated by the client does not meet the access restriction condition, a prompt message is issued.

[0089] Preferably, the prompt information may be a sound prompt, a light prompt, a vibration prompt, or a text or graphic prompt on a display interface of a display device, etc. The prompt information may be used to prompt when the file uploaded by the user does not meet the access restriction conditions, and refuse to execute the corresponding file operation instruction, thereby improving the security of file access.

[0090] In some embodiments, the file token type includes a file operation type and a file source type, the file operation type includes file upload and file download, the file source type includes an external source and an internal source, and the file token verification strategy includes multiple groups of verification strategies corresponding to different file security levels;

[0091] The different file token types correspond to different file token verification strategies, including:

[0092] The file security level is determined according to the file operation type and the file source type, and the file token verification strategy is determined according to the determined file security level.

[0093] In this embodiment, there are multiple file token verification strategies. When different file security levels are involved, the content and quantity to be verified will be different. The higher the file security level, the more content and quantity need to be verified. Preferably, an independent set can be configured for each file security level, and each set stores multiple file token verification strategies corresponding to each file security level. When it is necessary to determine the file token verification strategy, a file token verification strategy is randomly selected from the set corresponding to the current file security level, thereby further improving the randomness and security of file access. The random method can first sequentially number each file token verification strategy in the set, and then trigger the selected sequence number through a random number, or perform a hash operation on the current timestamp, and normalize the hash operation value to the range of (0, N+1), and then round down the selected file token verification strategy sequence number, where N is the number of strategies included in the current set.

[0094] In some embodiments, the first backend service parses and verifies the access token used by the client, including: checking whether the unique identifier of the user information decrypted by the first backend service conforms to the preset identifier, checking whether the unique code of the business information conforms to the preset code, and checking whether the timestamp of the current operation file is within the valid operation time range of the file. In this way, multiple verifications are used to help improve the security of access tokens and file access.

[0095] In some embodiments, the file operation includes a file reading operation, and the file is stored in a preset storage space in an encrypted form; performing the file operation after the access token verification passes includes: obtaining the encrypted file from the preset storage space according to the file unique identifier after the access token verification passes, decrypting the encrypted file using a decryption key, and returning it to the client. The decryption key may include a private key issued by a key management module, and may also include other information required for decryption such as a digital certificate.

[0096] In short, in order to improve the security of file storage and access, each file is stored in the preset storage space according to the file security level partition. Files in different file security level partitions are operated through different access tokens, and the access token corresponding to each security level has and can only access files in the corresponding security level partition, thereby further improving the security of file access. The amount and type of information required for decryption contained in the decryption key can be determined according to the file partition level to be accessed. The higher the file partition level, the more amount and type of information required for decryption contained in the decryption key.

[0097] like Figure 3 As shown, in a second aspect, the present application provides a system for secure processing of microservice files, the system comprising:

[0098] The gateway 100 is used to receive a file operation request initiated by a client and verify the user authority of the client;

[0099] A second backend service 102 is connected to the gateway for generating an access token and returning it to the client after the user authority verification is passed. The access token is generated according to the business information and the user information of the current client;

[0100] The first backend service 101 is connected to the gateway for communication, and is used for parsing and verifying the access token used by the client when the client uses the access token to perform a file operation, and performing the file operation after the access token is verified, and returning a unique file identification code corresponding to the executed file to the second backend service, so that the second backend service maps and stores the file identification code with the business information;

[0101] The access token is generated according to the business information and the user information of the current client, including:

[0102] Generate a first access token field and a second access token field, and concatenate the first access token field and the second access token field according to a specified delimiter to obtain the access token;

[0103] Generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies;

[0104] Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file;

[0105] The second access token field is decompressed using the decompression algorithm in the first access token field, and is asymmetrically encrypted using the encryption and decryption algorithm in the first access token field.

[0106] In some embodiments, the system further comprises:

[0107] The key management module 103 is used to send the private key to the first backend service and send the public key to the second backend service;

[0108] The second backend service is further used to encrypt the information in the second access token field by using the encryption and decryption algorithm and the public key;

[0109] The first back-end service is also used to receive the private key sent by the key management module, use the private key and the encryption and decryption algorithm to decrypt the information in the second access token field, and verify the unique identifier of the decrypted user information, the unique code of the business information, the file security level and the valid operation time range of the file one by one.

[0110] like Figure 4 As shown, in this application, the system for microservice file security processing includes an authentication module, a key management module, a file access token management module, a file access token authentication module, a file storage module, a file information management module and a file encryption and decryption module. Figure 4 These seven modules are explained separately:

[0111] (1) Authentication module

[0112] The authentication module mainly authenticates the user identity based on resource access control technology. The authentication methods include but are not limited to using jwt technology to generate tokens and verify tokens. In addition, a custom authentication function is added to verify user roles and permissions to access server resources.

[0113] (2) Key Management Module

[0114] The key management module mainly provides the encryption and decryption functions of the file access token. Specifically, the key management module sends the private key in the asymmetric key to the first backend service (file service) and the public key to the second backend service (non-file service).

[0115] (3) File access token management module

[0116] The file access token management module is mainly responsible for the parameter rule setting and verification of the file access token. The file access token consists of two parts.

[0117] The first part is the file access token policy parameters, which mainly include:

[0118] File token type: It can further include operation type (upload, download, etc.) and file access source type (internal, external, etc.). Different file token types will trigger different security verification strategies.

[0119] File token verification policy: This policy is used together with the file token type to determine the file access verification policy.

[0120] Decompression strategy: Set whether the second part of the file access token is decompressed and the corresponding decompression algorithm. The decompression algorithm includes but is not limited to GZiP, ZIP, etc.

[0121] Encryption and decryption strategy: Set the asymmetric encryption and decryption algorithm for the second part of the file access token. The encryption and decryption algorithms include but are not limited to SM2, RSA, etc.

[0122] The file access token policy parameters in the first part are symmetrically encrypted using a preset key or encrypted using Base64.

[0123] The second part is the file access token verification parameters, including: file unique identifier, token owner user identifier, permission verification policy expression, file security level, valid time range, current timestamp, etc.

[0124] The second part is compressed using the decompression algorithm set in the first part, and then asymmetric encryption is performed using the public key distributed by the key management module using the algorithm set in the first part.

[0125] The first part and the second part are concatenated according to the specified delimiter to form the final file access token.

[0126] (4) File access token authentication module

[0127] The file access token authentication module is used to parse and authenticate the access token. For example, Figure 5 As shown, the authentication method is as follows:

[0128] The access token can be split into two parts according to the separator. For the first part, the file access token authentication module uses the preset key to perform symmetric decryption. For the second part, the file access token authentication module receives the public key distributed by the key management module, uses the algorithm set in the first part to asymmetric decrypt the second part, and then performs decompression, user matching authentication, time validity authentication, other permission rule matching authentication and other operations according to the decompression algorithm set in the first part.

[0129] (5) File storage module

[0130] The file storage module is used to store files. Corresponding to the file security level in the second part of the upload access token, the files will be stored in physical storage spaces with different security levels. A password is required to access the storage space with a high security level, and a key is also required to decrypt the file when using the access token to access the file.

[0131] (6) File Information Management Module

[0132] The file information management module is mainly used to record file information after the file is stored. File information includes the file's unique identifier, path, size, hash value, file security level, file encryption method, etc. The file's unique identifier is a UUID generated by a specified algorithm; the file encryption method is determined by the configuration, including but not limited to passwords, USB-KEY digital certificates, etc.

[0133] (7) File encryption and decryption module

[0134] The file encryption and decryption module is mainly used for encryption and decryption operations on files. The encryption and decryption algorithms include but are not limited to SM4, DES, etc. The file encryption and decryption module can encrypt files by generating a random string of specified length. The key encrypts the random string. The key source includes but is not limited to passwords, USB-KEY digital certificates, etc. The encrypted string is stored in a specified location of the encrypted file.

[0135] like Figure 6 As shown, the method involved in this application is further explained below in conjunction with the process of uploading files:

[0136] After receiving the request initiated by the client, the gateway authenticates the access_token (the authentication token obtained after logging in) and verifies the user's system resource permissions, and then enters the second backend service (non-file service) to verify the business permissions. The information and verification rules of the uploaded access token are set according to the user information and business information.

[0137] For example, the first part of the access token is set to the file token type as system internal upload, the file token verification policy is set to normal upload restriction verification, the decompression algorithm and encryption and decryption algorithm are set, and after the settings are completed, the first part is symmetrically encrypted.

[0138] The second part of the access token sets the current user's system unique identifier, upload business code, specific file security level, valid time range, and current timestamp. The second part is compressed using the decompression algorithm set in the first part, and the public key distributed by the key management module is asymmetrically encrypted using the algorithm set in the first part.

[0139] The first part and the second part are then concatenated according to the specified delimiter to form the final file access token, and the access token and the restrictions corresponding to the upload business code are returned. The restrictions include but are not limited to file type and size.

[0140] The client then uses the access token to upload files according to the upload restriction conditions. The gateway authenticates the access_token (the authentication token obtained after logging in) and verifies the user's system resource permissions, enters the first backend service (file service), parses the access token and verifies: verifies whether the current user's system unique identifier matches; performs the second step of verification according to the file token verification strategy, verifies whether the restrictions corresponding to the upload business code in the permission verification policy expression are met, such as whether the file size and file type match; verifies whether the current time is within the valid time range. Only after the verification is passed can the file be stored in the storage space with the specified security level, and returns the unique identifier of the file to the second backend service for storage associated with the business.

[0141] like Figure 7 As shown, the method involved in this application is further described below in conjunction with the file access process:

[0142] After receiving the request initiated by the client, the gateway authenticates the access_token (the authentication token obtained after logging in) and verifies the user's system resource permissions, enters the second backend service (non-file service) for business permission verification, and sets the information and verification rules for downloading the access token based on user information and business information.

[0143] The first part of the access token is set to file token type for internal system download, the file token verification strategy is high-security level file download restriction verification, the decompression algorithm and encryption and decryption algorithm are set, and after the settings are completed, the first part is symmetrically encrypted.

[0144] The second part of the access token sets the file unique identifier, the current user's system unique identifier, the permission verification policy expression, the effective time range, and the current timestamp. The second part is compressed using the decompression algorithm set in the first part, and the public key distributed by the key management module is asymmetrically encrypted using the algorithm set in the first part. Finally, the first and second parts are concatenated according to the specified delimiter to form the final file access token, and the access token is returned.

[0145] The client uses the access token to upload files according to the upload restriction conditions. The gateway authenticates the access_token (the authentication token obtained after logging in) and verifies the user's system resource permissions, enters the first backend service (file service), parses the access token and verifies it. The specific verification content is as follows:

[0146] Verify whether the current user's system unique identifier matches; perform the second step of verification based on the file token verification policy to verify whether the restriction conditions of the permission verification policy expression are met, such as IP rules, etc.; verify whether the current time is within the valid time range. Obtain file record information based on the file's unique identifier. Files in storage spaces with high security levels require encryption methods in file records to obtain keys for decryption processing.

[0147] In a third aspect, this embodiment further provides a computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described in the first aspect is implemented.

[0148] See also Figure 8 In a third aspect, this embodiment further provides an electronic device 1, comprising a memory 11 and a processor 12, wherein the memory 11 is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor 12 to implement the method described in the first aspect.

[0149] The electronic device 1 may be a tablet, a mobile phone, a laptop, a desktop computer, etc. The storage medium / memory 11 includes but is not limited to: RAM, ROM, a disk, a tape, an optical disk, a flash memory, a USB flash drive, a mobile hard disk, a memory card, a memory stick, a network server storage, a network cloud storage, etc. The processor 12 includes but is not limited to a CPU (central processing unit 12), a GPU (graphics processor 12), an MCU (microprocessor 12), etc.

[0150] The present invention discloses a method, system, medium and device for secure processing of microservice files. The method comprises: receiving a file operation request initiated by a client, verifying the user authority of the client, generating an access token and returning it to the client after the user authority verification passes, when the client uses the access token to perform a file operation, a first backend service parses and verifies the access token used by the client, executes the file operation after the access token verification passes, and returns a unique file identification code corresponding to the executed file to a second backend service.

[0151] Based on the resource access control technology of encryption and decryption algorithms and authentication tokens, the present invention customizes the file access token mechanism to ensure the security of file upload, download and operation, prevents the leakage of file information and file storage structure from being used for further analysis of security vulnerabilities of the server, and restricts legal and illegal users from arbitrarily uploading files and illegally accessing or operating system files.

[0152] Finally, it should be noted that although the above embodiments have been described in the specification and drawings of the present invention, the patent protection scope of the present invention cannot be limited thereby. All technical solutions generated by replacing or modifying equivalent structures or equivalent processes based on the essential concept of the present invention and using the contents recorded in the specification and drawings of the present invention, as well as directly or indirectly implementing the technical solutions of the above embodiments in other related technical fields, are included in the patent protection scope of the present invention.

Claims

1. A method for securely processing microservice files, characterized in that: The method comprises the following steps: Receive a file operation request initiated by a client, verify the user authority of the client, and generate an access token and return it to the client after the user authority verification passes. The access token is generated based on business information and user information of the current client; The access token is generated by the second backend service, and the access token is generated according to the business information and the user information of the current client, including: Generate a first access token field and a second access token field, and concatenate the first access token field and the second access token field according to a specified delimiter to obtain the access token; Generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies; Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file; The second access token field is decompressed using the decompression algorithm in the first access token field, and asymmetrically encrypted using the encryption and decryption algorithm in the first access token field; When the client uses the access token to perform file operations, the first back-end service parses and verifies the access token used by the client, executes the file operation after the access token verification is passed, and returns the unique file identification code corresponding to the executed file to the second back-end service, so that the second back-end service maps and stores the file identification code with the business information.

2. The method for securely processing microservice files according to claim 1, characterized in that: Using the encryption and decryption algorithm in the first access token field to perform asymmetric encryption includes: The second backend service receives the public key sent by the key management module, and uses the encryption and decryption algorithm and the public key to encrypt the information in the second access token field; The first backend service parses and verifies the access token used by the client, including: The first back-end service receives the private key sent by the key management module, uses the private key and the encryption and decryption algorithm to decrypt the information in the second access token field, and verifies the unique identifier of the decrypted user information, the unique code of the business information, the file security level, and the valid operation time range of the file one by one.

3. The method for securely processing microservice files according to claim 1, characterized in that: The method further comprises: After the user authority verification is passed, an access restriction condition is generated and returned to the client, wherein the access restriction condition includes a file type and a file size, and the access restriction condition is determined according to the business information; When it is detected that the file operated by the client does not meet the access restriction condition, a prompt message is issued.

4. The method for securely processing microservice files according to claim 1, characterized in that: The file token type includes a file operation type and a file source type, the file operation type includes file upload and file download, the file source type includes an external source and an internal source, and the file token verification strategy includes multiple groups of verification strategies corresponding to different file security levels; The different file token types correspond to different file token verification strategies, including: The file security level is determined according to the file operation type and the file source type, and the file token verification strategy is determined according to the determined file security level.

5. The method for securely processing microservice files according to claim 1, characterized in that: The first backend service parsing and verifying the access token used by the client includes: The first backend service verifies whether the unique identifier of the user information decrypted by the first backend service conforms to the preset identifier, verifies whether the unique code of the business information conforms to the preset code, and verifies whether the timestamp of the current operation file is within the valid operation time range of the file.

6. The method for securely processing microservice files according to claim 1, characterized in that: The file operation includes a file reading operation, and the file is stored in a preset storage space in an encrypted form; Executing the file operation after the access token is verified includes: After the access token is verified, the encrypted file is obtained from the preset storage space according to the unique file identifier, and the encrypted file is decrypted using the decryption key and then returned to the client.

7. A system for secure processing of microservice files, characterized in that: The system comprises: The gateway is used to receive file operation requests initiated by the client and verify the user permissions of the client; A second backend service is connected to the gateway for generating an access token and returning it to the client after the user authority verification is passed, wherein the access token is generated according to the business information and the user information of the current client; a first backend service, which is in communication with the gateway and is used for parsing and verifying the access token used by the client when the client uses the access token to perform a file operation, and performing the file operation after the access token is verified, and returning a unique file identification code corresponding to the executed file to the second backend service, so that the second backend service maps and stores the file identification code with the business information; The access token is generated according to the business information and the user information of the current client, including: Generate a first access token field and a second access token field, and concatenate the first access token field and the second access token field according to a specified delimiter to obtain the access token; Generating the first access token field includes: setting a file token type, setting a file token verification strategy, setting a decompression algorithm, and setting an encryption and decryption algorithm, and different file token types correspond to different file token verification strategies; Generating the second access token field includes: setting a unique identifier for the user information, setting a unique code for the business information, setting a file security level, and setting a valid operation time range for the file; The second access token field is decompressed using the decompression algorithm in the first access token field, and is asymmetrically encrypted using the encryption and decryption algorithm in the first access token field.

8. The system for secure microservice file processing according to claim 7, characterized in that: Also includes: A key management module, used to send a private key to the first backend service, and send a public key to the second backend service; The second backend service is further used to encrypt the information in the second access token field by using the encryption and decryption algorithm and the public key; The first back-end service is also used to receive the private key sent by the key management module, use the private key and the encryption and decryption algorithm to decrypt the information in the second access token field, and verify the unique identifier of the decrypted user information, the unique code of the business information, the file security level and the valid operation time range of the file one by one.

9. A computer-readable storage medium storing computer program instructions, characterized in that: The computer program instructions implement the method according to any one of claims 1 to 8 when executed by a processor.

10. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement the method according to any one of claims 1 to 8.

Images