Data access method, device and equipment and readable storage medium

Abstract

The embodiment of the invention provides a data access method and device, equipment and a readable storage medium. The method comprises the following steps: in response to a demand for processing a data resource generated in a target application, sending a data access authorization request for the data resource to a plurality of clients of the target application, the plurality of clients being associated with the data resource. And respectively receiving authorization information for the data access authorization request from at least one client in the plurality of clients. And obtaining at least one access credential corresponding to the at least one client based on the authorization information. And accessing target data associated with the at least one client in the data resource by using the at least one access credential to process the target data. Through the process, the data security is enhanced, and unauthorized data resource access and leakage risks are avoided, so that the data security is improved.

Description

Technical Field

[0001] Example embodiments of the present disclosure generally relate to the field of computers, and more particularly, to data access methods, devices, apparatuses, and readable storage media. Background Art

[0002] As the importance of data security becomes increasingly prominent, improving data security has become a topic that urgently needs attention. In particular, in the process of data interaction between user terminals and the cloud, how to ensure the security of data generated by user terminals is an issue that needs to be solved urgently. Summary of the invention

[0003] In a first aspect of the present disclosure, a data access method is provided. The method may be applicable to a user end of a data resource, and includes: in response to a demand for processing a data resource generated in a target application, sending a data access authorization request for the data resource to multiple clients of the target application, wherein the multiple clients are associated with the data resource. Authorization information for the data access authorization request is received from at least one of the multiple clients. Based on the authorization information, at least one access credential corresponding to the at least one client is obtained. Using the at least one access credential, target data associated with the at least one client in the data resource is accessed to process the target data.

[0004] In a second aspect of the present disclosure, a data access method is provided. The method is applied to a client of a target application, and includes: in response to a credential management service passing verification, sending an access credential for data access to the credential management service. Using a processing credential corresponding to the access credential, processing the target data generated by the client in the target application. Storing the processed target data in a data storage side. Receive a data access authorization request from a user end of a data resource, the data resource including the target data. In response to an affirmative indication of the data access authorization request, generate authorization information for the data access authorization request. Send the authorization information to the user end of the data resource.

[0005] In a third aspect of the present disclosure, a data access method is provided, the method being applied to a credential management service, comprising: sending an attestation report to multiple clients of a target application, the attestation report indicating the credibility of an environment in which access credentials are stored. Receiving multiple access credentials corresponding to the multiple clients respectively from the multiple clients, the access credentials in the multiple access credentials being used to access data associated with the corresponding clients. In response to receiving an access credential request for at least one of the multiple clients from a user end of a data resource, sending the access credential corresponding to the at least one client to the user end of the data resource.

[0006] In a fourth aspect of the present disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit. When the instructions are executed by the at least one processing unit, the electronic device executes the method of the first aspect.

[0007] In a fifth aspect of the present disclosure, a computer-readable storage medium is provided, wherein a computer program is stored on the medium, and when the computer program is executed by a processor, the method of the first aspect is implemented.

[0008] It should be understood that the content described in this section is not intended to limit the key features or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram showing an example environment in which embodiments of the present disclosure can be implemented;

[0011] Figure 2 A block diagram illustrating a data access process according to some embodiments of the present disclosure;

[0012] Figure 3 A schematic diagram showing a principle of a data access process according to some embodiments of the present disclosure;

[0013] Figure 4 A block diagram showing a data access process according to other embodiments of the present disclosure;

[0014] Figure 5 A schematic diagram showing an interactive interface according to some embodiments of the present disclosure is shown;

[0015] Figure 6 A block diagram showing a data access process according to other embodiments of the present disclosure;

[0016] Figure 7 A schematic structural block diagram of a data access device according to some embodiments of the present disclosure is shown;

[0017] Figure 8 A schematic structural block diagram of a data access device according to some other embodiments of the present disclosure is shown;

[0018] Fig. 9A schematic structural block diagram showing a data access device according to some other embodiments of the present disclosure; and

[0019] Fig.10 A block diagram of an electronic device in which one or more embodiments of the present disclosure may be implemented is shown. DETAILED DESCRIPTION

[0020] The embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0021] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0022] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0023] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0024] It is understandable that before using the technical solutions disclosed in each embodiment of the present disclosure, the types, scope of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals, enterprises, and groups.

[0025] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly prompt the relevant user that the operation requested to be performed will require obtaining and using the information of the relevant user, so that the relevant user can independently choose whether to provide information to software or hardware such as an electronic device, application, server or storage medium that executes the operation of the technical solution of the present disclosure based on the prompt message.

[0026] As an optional but non-limiting implementation, in response to receiving an active request from a relevant user, a prompt message is sent to the relevant user, for example, in the form of a pop-up window, in which the prompt message may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide information to the electronic device.

[0027] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0028] Figure 1 1 is a schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented. Figure 1 As shown, example environment 100 may include a client 120 of a user 140 and a host device 110 in a cloud environment.

[0029] like Figure 1 As shown, the host device 110 may be deployed with a trusted execution environment 115. In the trusted execution environment 115, a computing engine 112 may be run. Trusted Execution Environment (TEE) is a hardware-based security technology that constructs a secure computing environment isolated from the outside by dividing the secure part and the non-secure part. The secure computing environment can ensure the confidentiality and integrity of the data and code loaded inside the trusted execution environment 115. The trusted execution environment 115 is isolated from the ordinary environment, has a higher security level, and is suitable for processing sensitive data therein. The computing engine can provide confidential cloud computing services (Confidential Cloud Computing, CCC) running in the trusted execution environment 115. The confidential cloud computing services provided by the computing engine are intended to protect the user's data security.

[0030] The credential management service may be executed in the trusted execution environment 115. The credential management service may be executed independently of the host device 110. The credential management service may be a trusted key management service (TKS). The credential management service may be a security service running in the trusted execution environment 115, aiming to provide hardware-protected access credential management and proxy services for users.

[0031] By using the credential management service, the access credential obtained from the client 120 can be stored in the access credential management database 114. In addition, the host device 110 can store the data resources generated in the target application obtained from the client 120 in the data storage side 116. It is not difficult to understand that the above data resources are data resources generated in the target application that are obtained with the permission and authorization of the user 140. Exemplarily, the data resources may include geographic location data, click behavior data, and the like.

[0032] In some embodiments, the host device 110 communicates with the client 120 to access and analyze data. The client 120 can be any type of mobile terminal, fixed terminal or portable terminal, including a mobile phone, a desktop computer, a laptop computer, a notebook computer, a netbook computer, a tablet computer, a media computer, a multimedia tablet, a personal communication system (PCS) device, a personal navigation device, a personal digital assistant (PDA), an audio / video player, a digital camera / camcorder, a positioning device, a television receiver, a radio broadcast receiver, an e-book device, a gaming device, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. In some embodiments, the client 120 can also support any type of interface for the user (such as a "wearable" circuit, etc.).

[0033] The host device 110 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, and big data and artificial intelligence platforms. The host device 110 may include, for example, a computing system / server, such as a mainframe, an edge computing node, a computing device in a cloud environment, and the like. The host device 110 may provide a backend service for data management for the client 120. An example of the host device 110 is a host machine of a cloud vendor.

[0034] A communication connection may be established between the host device 110 and the client 120. The communication connection may be established in a wired manner or a wireless manner. The communication connection may include, but is not limited to, a Bluetooth connection, a mobile network connection, a universal serial bus connection, a wireless fidelity connection, etc., and the embodiments of the present disclosure are not limited in this respect.

[0035] It should be understood that the structure and function of each element in the environment 100 are described only for exemplary purposes, and do not imply any limitation on the scope of the present disclosure. In other words, the structure, function, quantity and link relationship of the elements in the environment 100 can be changed according to actual needs. The present disclosure is not limited in this respect.

[0036] At present, there are many security risks in the interaction between the client and the host device in the cloud. For example, on the user side, the user has no perception of whether the data is encrypted during transmission, the use of the data, and the calculation process. As a result, the data is spied on, used without authorization, or even shared without the user's knowledge, posing the risk of personal information leakage.

[0037] In an embodiment of the present disclosure, an improved scheme for data access is provided. In the scheme, a user end of a data resource sends a data access authorization request for a data resource to multiple clients of a target application in response to a demand for processing data resources generated in a target application, and the multiple clients are associated with the data resource. Authorization information for the data access authorization request is received from at least one of the multiple clients. Based on the authorization information, at least one access credential corresponding to the at least one client is obtained. Using the at least one access credential, target data associated with the at least one client in the data resource is accessed to process the target data.

[0038] Through the above process, the data resource user sends a data access authorization request to multiple clients, which is a point-to-point request, which can prevent man-in-the-middle attacks. The data resource user receives the authorization information fed back by at least one client in response to the data access authorization request, and the acquired data includes the data resources generated in the target application running on the client, thereby satisfying the requirement that the acquisition of user data is completed with the user's authorization. Through these improvement measures, data security can be significantly enhanced, and the risk of unauthorized access and leakage of data resources can be avoided, thereby solving data security issues.

[0039] Some example embodiments of the present disclosure will be described in detail below with reference to the examples of the accompanying drawings. It should be understood that the interfaces shown in the accompanying drawings are merely examples, and various interface designs may actually exist. The various graphical elements in the interface may have different arrangements and different visual representations, one or more of which may be omitted or replaced, and one or more other elements may also exist. The embodiments of the present disclosure are not limited in this respect.

[0040] Figure 2 A block diagram of a data access process 200 according to some embodiments of the present disclosure is shown. The data access process can be implemented in a host device 110, which can be used as a user of data resources. Figure 1 To describe Figure 2 The task processing process is shown.

[0041] In block 201, the host device 110 sends a data access authorization request for the data resource to multiple clients of the target application in response to a demand for processing the data resource generated in the target application, and the multiple clients are associated with the data resource. Exemplarily, on the host device 110 side, scenarios such as data access tasks and data analysis tasks performed by the computing engine 112 can be used, and the computing engine 112 performing the data access task or the data analysis task can be used as a trigger instruction for generating and sending the data access authorization request.

[0042] Figure 3 FIG. 3 is a schematic diagram of a data access process 300 according to some embodiments of the present disclosure. Figure 3 As shown, for example, the host device 110 executes the POI recommendation task through the computing engine 112 , which may trigger the sending of a data resource access request at step 302 . Figure 3 As shown, although the data storage side 116 and the computing engine 112 are shown on one host device 110, in an actual scenario, the data storage side 116 and the computing engine 112 may be distributed on different host devices 110. In addition, there may be multiple host devices 110.

[0043] For the task of the computing engine 112 , the host device 110 may determine at least one client 120 based on multi-dimensional factors such as relevance, quality, and credibility of data resources. The host device 110 sends the generated data access authorization request to the determined at least one client 120 .

[0044] In block 202 , the host device 110 receives authorization information for a data access authorization request from at least one of the plurality of clients. The authorization information may be sent from the client 120 to the host device 110 as feedback of the data access authorization request.

[0045] The client 120 receives the data access authorization request, and the user 140 can authorize the data access authorization request or refuse to authorize the data access authorization request. If the user 140 refuses to authorize the data access authorization request, the entire process ends. Figure 3 As shown, if the user 140 agrees to authorize the data access authorization request, the client 120 generates authorization information and sends it to the host device 110.

[0046] Generally speaking, the authorization information may at least include the access token of the client 120 (or user 140), and the access token may indicate the identification information of the client. In addition, the authorization information may also include additional information such as the authorized use scope, the authorized use purpose, and the authorized use period of the authorized data resource. Exemplarily, the authorized use scope of the data resource may indicate the category of the data resource generated in the target application. The authorized use period may be 1 day, 1 hour, etc. The authorized use purpose may be to authorize only the host device 110 to perform a certain data computing task or to perform a certain data analysis task.

[0047] In block 203, the host device 110 obtains at least one access credential corresponding to at least one client based on the authorization information. Figure 3 As shown, after receiving the authorization information, the host device 110 can use the credential management service to obtain the access credential of the data resource from the access credential management database 114 in step 304-1. In addition, the host device 110 can also obtain the data resource from the data storage side 116 in step 304-2.

[0048] Exemplarily, the access credential of the data resource may be uploaded by the client 120 to the access credential management database 114 in step 301-1. In addition, the client 120 may process the data resource generated in the target application by processing the credential and then upload it to the data storage side 116 in step 301-2. Exemplarily, processing the data resource by processing the credential may include encrypting the data resource by processing the credential. Corresponding to the processing credential is the access credential uploaded to the access credential management database 114. Exemplarily, the encrypted data resource may be decrypted using the access credential.

[0049] On the one hand, the host device 110 can obtain the access credentials of the data resource from the access credential management database 114 , and on the other hand, can obtain the data resource after the access credentials are processed from the data storage side 116 .

[0050] In block 204, the host device 110 uses the at least one access credential to access the target data associated with the at least one client in the data resource to process the target data. Based on the decrypted data resource, the computing engine 112 can perform corresponding computing and processing tasks. Using the at least one access credential, the execution process of accessing the target data associated with the at least one client can be completed in the trusted execution environment 115, ensuring that the data remains secure during the processing process and preventing data leakage and abuse.

[0051] Through the above process, the host device 110 ensures the legitimacy of data resource access through the feedback of authorization information, and prevents unauthorized access to data resources. At the same time, through the mechanism of access credentials, the security of data during transmission and use is guaranteed to prevent data leakage and tampering.

[0052] The above is an overview of the overall process of the host device 110. Next, obtaining access credentials for data resources and obtaining data resources are introduced in detail. First, the process of obtaining access credentials for data resources is introduced. In some embodiments, the host device 110 determines an access token of at least one client based on the authorization information. An access credential request for the data resource is sent to a credential management service, and the access credential request includes at least an access token. At least one access credential corresponding to at least one client is received from the credential management service.

[0053] The host device 110 first determines the access token of the client 120 based on the authorization information fed back by the client 120. The access token may indicate the identification information of the client 120. In the access credential management database 114, the credential management service configures each access credential entry to consist of a unique identification information and a corresponding access credential. The identification information may be a unique identification of the client. The access credential may be used to decrypt data resources.

[0054] The host device 110 sends an access credential request for a data resource to a credential management service that manages access credentials for data resources, and the access credential request includes at least an access token. Based on a structured storage method, the credential management service can quickly and accurately retrieve the corresponding access credential from the access credential management database 114 according to the identification information. Thus, the host device 110 can receive the access credential from the credential management service. The credential management service can be a security service running in a trusted execution environment.

[0055] The access credential request may also include a security report indicating the trustworthiness of the trusted execution environment 115 used to process the data resource. The host device 110 sends an access credential request for the data resource to the credential management service, and the access credential request may include both the access token and the security report. The security report is used to prove that the trusted execution environment 115 of the computing engine 112 used to process the data resource is secure and trustworthy and meets the predetermined security standards.

[0056] Exemplarily, the security report may include the operating system version of the host device 110 where the computing engine 112 is located. In the case where the computing engine 112 is running in a virtual machine, the version and configuration of the virtual machine software are reported. In addition, the security report may also include the code version of a specific application or software running in the computing engine 112. The operating system version may indicate the security and update status of the system environment. The version of the virtual machine software may indicate the security of the virtualized environment. The code version of a specific application or software may indicate that the application or software has not been tampered with and is running in the expected state.

[0057] The credential management service can perform verification on the security report. If it is determined that the verification is passed, the host device 110 is allowed to receive the access credential for the data resource. By setting the security report in the access credential request, the security of the computing engine 112 can be proved. For example, by verifying the version and ensuring that the system components and software have applied the latest security patches, the risk of malicious software or unsafe software being used in the data request process can be reduced.

[0058] The acquisition of access credentials for data resources is described above. Next, the acquisition of data resources is described. In some embodiments, the host device 110 acquires data resources from the data storage side 116, wherein the data resources are stored in the data storage side 116 by the provider based on the received attestation report, and the attestation report indicates the credibility of the environment storing the data resources.

[0059] The data resource is authorized by the client 120 and stored in the data storage side 116. The authorization by the client 120 may include performing a verification on the certification report sent by the host device 110 and obtaining a conclusion that the verification has passed.

[0060] The attestation report can indicate the trustworthiness of the environment in which data resources are stored. Exemplarily, the attestation report may include information such as hardware Trusted Computing Base (TCB), application metrics, application custom data, and hardware signatures. Application metrics generally refer to a set of values ​​obtained after measuring an application or its components in a trusted execution environment. These values ​​are used to verify the integrity and authenticity of the application and ensure that the application has not been tampered with. Application custom data generally refers to data defined by the application according to its own needs and included in the attestation report. This data can be application-specific configurations, identification information, or other content that helps to prove the security and trustworthiness of the application.

[0061] After the client 120 verifies the certification report, it can upload the access credentials to the access credential management database 114, and the credential management service is responsible for managing the access credentials. In addition, the client 120 encrypts part of the data resources using the processing credentials and uploads the data resources to the data storage side 116 in the host device 110. In other words, after the client 120 verifies the certification report, it can authorize the data resources generated by the target application in the client 120 to be processed and uploaded to the data storage side 116.

[0062] When the host device 110 sends a data access authorization request to the client 120 based on the task to be executed by the computing engine 112, the client 120 may authorize the access, that is, authorize the host device 110 to obtain all or part of the data resources stored in the data storage side 116.

[0063] Through the above process, the client 120 can safely upload data resources to the data storage side 160 and authorize the computing engine 112 of the host device 10 to access these data resources when needed, ensuring that the access and transmission process of data resources meets security requirements.

[0064] For the at least one client, the target data stored in the data storage side 160 is the data generated in the target application processed by the client using the processing credentials corresponding to the access credentials of the client and then transmitted to the data storage side 160 .

[0065] At the client 120, the processing of the data generated in the target application may include using the processing credentials to process the data generated in the target application and then transmitting it to the data storage side 116. The processing credentials may correspond to the access credentials uploaded by the client 120 to the access credential management database 114. Exemplarily, the credential management service may decrypt the data resource based on the access credentials of the data resource. The decryption may be performed in the trusted execution environment 115.

[0066] In the trusted execution environment 115, the host device 110 can also process data resources and data resource access credentials to achieve data security. Specifically, in response to meeting a preset condition, the target data and the target data access credentials are removed from the trusted execution environment, and the preset condition includes that the access to the target data ends or the authorized use period of the target data has expired.

[0067] Based on the obtained access credentials, the host device 110 can perform a decryption operation on the data resource in the trusted execution environment 115. The decryption process is completed in the trusted execution environment 115, which can ensure that the decrypted data resource is not exposed to any untrusted environment.

[0068] The decrypted data resources are in the trusted execution environment 115, and the host device 110 performs access to the data resources processed by the access credentials based on the data access tasks. These tasks may include data analysis, calculation, etc. Since these accesses are all performed in the trusted execution environment 115, the integrity and confidentiality of the data resources are effectively protected.

[0069] According to the predefined preset conditions, when the access to the data resource ends or the authorized use period of the data resource is reached, the host device 110 will remove the data resource and the corresponding access credentials in the trusted execution environment 115. The preset conditions can be set according to different security policies to ensure that the data resources and access credentials will not be retained for a long time. For example, the preset conditions can indicate that the data resources and the corresponding access credentials are removed after the data analysis task or the data access task is completed. Alternatively, the preset conditions can indicate that the data resources and the corresponding access credentials are removed after the authorized use period of the data resource is reached.

[0070] Through the above process, decryption and data access are performed in a trusted execution environment, reducing the risk of data resources (especially data resources that may involve sensitive information) being exposed in an untrusted environment. In addition, by presetting conditions, it is ensured that when access ends or the authorized use period expires, data resources and access credentials are safely removed to prevent unauthorized use of data resources. On the other hand, through transparent security authentication and strict data access processes, the data security level is improved.

[0071] The access to the data resource is performed based on the data access authorization request. The data access authorization request may be for a specified provider. The following describes the process of generating the data access authorization request. The host device 110 determines at least one data resource type corresponding to the data processing task based on the data processing task to be executed, and the data resource includes data of at least one data resource type. Based on the at least one data resource type, a data access authorization request is generated.

[0072] Data processing tasks may include various categories. For example, a data processing task may include analyzing the behavior data of newly registered users of a certain application program to optimize the user experience.

[0073] The host device 110 determines the data resource acquisition scope and data resource type corresponding to the data processing task based on the data processing task of the computing engine 112. The data resource acquisition scope may correspond to a client, such as a newly registered user (e.g., a user who has registered for no more than one month), a user in a certain region, and so on.

[0074] Based on the data resource acquisition scope and the data resource type, the host device 110 may generate a data access authorization request. Exemplarily, the data access authorization request may include the purpose, data type, and usage period corresponding to the data access task, etc. The purpose corresponding to the data access task may be content recommendation, improved function, etc. The data type may indicate different types of data resources. The usage period may be 1 day, 5 days, etc.

[0075] Through the above process, after receiving the data access authorization request through the client, the user can clearly know which data resources are accessed and used. That is, because the data access authorization request contains detailed information such as the purpose of the request, the scope of data resource acquisition, and the type of data resource, the user has a clearer understanding and control over the use of data.

[0076] The determination process of the data resource type involved in the generation process of the data access authorization request may include the following process: determining multiple data resource types corresponding to the data processing task. Determining at least one data resource type based on the degree of association between the data of the multiple data resource types and the multiple clients.

[0077] For a data processing task, it can usually correspond to multiple data resource types. For data of multiple data resource types, the level can be determined based on the degree of association with the client. For example, high-level data resources, medium-level data resources, and low-level data resources. The level division standard can be determined according to actual conditions.

[0078] The data resource type can be determined by performing screening on multiple data resource types. For example, only high-level data resources can be retained. In other words, data access authorization requests are generated only for high-level data resources. Alternatively, high-level data resources and medium-level data resources can be retained, thereby generating data access authorization requests for high-level data resources and medium-level data resources. Through the above process, data resource types are screened and access requests are generated only for important data. Frequent data request notifications are avoided, reducing interference with users.

[0079] Figure 4 Schematic diagram of a data access process 400 according to some embodiments of the present disclosure is shown. The data access process can be implemented on the client 120 of the target application. Figure 1 To describe Figure 4 The data access process is shown.

[0080] like Figure 4 As shown, in block 401 , in response to the credential management service passing the authentication, an access credential for data access is sent to the credential management service.

[0081] The credential management service can send a certification report to the client 120. The certification report can be sent by the credential management service or by the electronic device 110. The certification report can prove the security of the host device 110. Exemplarily, the certification report may include hardware trusted computing base information (TCB), application measurement values, application custom data, hardware signature and other information. Application measurement values ​​generally refer to a set of values ​​obtained after measuring an application or its components in a trusted execution environment. These values ​​are used to verify the integrity and authenticity of the application and ensure that the application has not been tampered with. Application custom data generally refers to data defined by the application according to its own needs and included in the certification report. These data can be application-specific configurations, identification information or other content that helps to prove the security and credibility of the application. User 140 confirms the certification report, which can indicate that the credential management service has passed the verification. As a result, access credentials for data access can be sent to the credential management service.

[0082] In block 402 , the client 120 processes target data generated by the client in a target application using processing credentials corresponding to the access credentials.

[0083] The client 120 can upload the data resources generated in the target application to the cloud from time to time. The uploaded data resources can be processed using the processing credentials. For example, the access credentials can be used to encrypt the specified data resources to obtain the target data.

[0084] In block 403 , the client 120 may store the processed target data to the data storage side 116 by uploading the target data to the electronic device 110 .

[0085] In block 404, the client 120 receives a data access authorization request from a user of a data resource, the data resource including target data. On the host device 110 side, scenarios such as data access tasks and data analysis tasks performed by the computing engine 112 can be used, and the computing engine 112 performs data access tasks or data analysis tasks, etc., which can be sent to the client 120 as a trigger instruction for generating and sending a data access authorization request. The client 120 can thus receive a data access authorization request from a user of a data resource.

[0086] At block 405 , the client 120 generates authorization information for the data access authorization request in response to the affirmative indication of data access authorization. Figure 5A schematic diagram of an interactive interface 500 between a client 120 and a host device 110 according to some embodiments of the present disclosure is shown. Referring to interface 501, the client 120 receives a data access authorization request. In response to a user's "click details" instruction, data usage details as shown in interface 502 may be displayed. Exemplarily, the data usage details may include, for example, the scope of use, the period of use, and the purpose of use of the data. In response to a positive indication, authorization information may be generated. For example, the positive indication may be that the user 140 clicks "Authorize" in interface 502.

[0087] The authorization information may correspond to the data usage details, that is, the authorization information may indicate, for example, the applicable scope, the usage period, and the purpose of use of the data. Based on the authorization information, the client 120 may also save an authorization record. Referring to interface 503, the authorization record may correspond to the authorization information. That is, the authorization record may also include the authorized use scope, the authorized use period, and the authorized use purpose of the data, etc.

[0088] For example, the authorized use scope of the data resource may indicate the category of the data resource generated in the target application. The authorized use period may be 1 day, 1 hour, etc. The authorized use purpose may be to authorize only the host device 110 to perform a certain data computing task or a certain data analysis task.

[0089] In block 406, the client 120 sends the authorization information to the end user of the data resource. The client 120 sends the authorization information to the end user of the data resource so that the end user of the data resource can obtain the corresponding data resource. Through the above process, the authorization information makes the data access process more transparent. By defining the authorized use scope and authorized use period in detail, it ensures that the user's data is always controlled during use to prevent data abuse or unauthorized access. The user can clearly know which data is accessed and used in the time range, thereby improving the protection level of data resources.

[0090] In some implementations, the credential management service is authenticated by: receiving an attestation report from the credential management service, the attestation report indicating the trustworthiness of an environment in which the access credentials are stored. Authenticating the credential management service based on the attestation report.

[0091] The attestation report may be sent by the credential management service. The attestation report may include hardware trusted computing basic information, application metrics, application custom data, hardware signatures, etc. The attestation may be verified by the target program in the client 120.

[0092] In some embodiments, the authorization information includes an access token of the client. In addition, the authorization information indicates at least one of the following: the scope of authorized use of the target data, the purpose of authorized use, and the period of authorized use.

[0093] The authorization information includes the access token of the client, and the access token may indicate the identification information of the client 120. Based on the identification information, the credential management service configures each access credential entry to consist of a unique identification information and a corresponding access credential. In addition, the authorization information may also correspond to the data usage details, that is, the authorization information may indicate, for example, the applicable scope, usage period, and purpose of use of the data, etc.

[0094] Figure 6 A schematic diagram of a data access process 600 according to some embodiments of the present disclosure is shown. The data access process can be implemented in a credential management service. Figure 1 To describe Figure 6 The data access process is shown.

[0095] In block 601 , a credential management service sends an attestation report to a plurality of clients of a target application, the attestation report indicating the trustworthiness of an environment storing access credentials.

[0096] The attestation report may indicate the trustworthiness of the environment in which the credential management service stores data resources. For example, the attestation report may include hardware trusted computing basic information, application metrics, application custom data, hardware signatures, and other information. The credential management service may send the attestation report to multiple clients 120 of the target application to prove its trustworthiness.

[0097] In block 602 , the credential management service receives a plurality of access credentials respectively corresponding to the plurality of clients 120 from the plurality of clients 120 , the access credentials in the plurality of access credentials being used to access data associated with the corresponding client 120 .

[0098] After the client 120 verifies the certification report, it can upload the access credential to the access credential management database 114, which is managed by the credential management service. The credential management service configures each access credential entry to consist of a unique identification information and a corresponding access credential. The identification information can be a unique identification of the client 120, and the identification information can correspond to the access token of the client 120. The access credential can be used to access data associated with the corresponding client 120.

[0099] In block 603 , the credential management service sends access credentials corresponding to at least one client to the user of the data resource in response to receiving an access credential request for at least one client among the plurality of clients from the user of the data resource.

[0100] The host device 110, as a user of data resources, responds to the demand for data resources generated in the target application and sends a data access authorization request for the data resources to the multiple clients 120 of the target application. After obtaining the authorization information of at least one client among the multiple clients for the data access authorization request, the access token of the at least one client can be determined based on the authorization information. Based on the access token of the at least one client, the host device 110 can send an access credential request for the data resources to the credential management service.

[0101] The credential management service sends the access credential corresponding to at least one client to the user of the data resource in response to the access credential request.

[0102] The access credential request may include at least an access token. The credential management service verifies the access credential request based on the access token of the at least one client in response to the access credential request including at least one access token of the client. In response to the access credential request passing the verification, the access credential of the at least one client is sent to the user of the data resource.

[0103] As mentioned above, the credential management service configures each access credential entry to consist of a unique identification information and a corresponding access credential, and the access token can indicate the identification information of the client. Based on this, the credential management service can quickly and accurately retrieve the corresponding access credential according to the identification information in the access credential management database 114 based on a structured storage method. The access credential of at least one client is sent to the user end of the data resource.

[0104] The access credential request may also include a security report indicating the trustworthiness of the trusted execution environment 115 used to process the data resource. The credential management service sends the access credential of at least one client to the user of the data resource in response to the security report in the access credential request being verified, and the security report indicating the trustworthiness of the environment used to process the data resource.

[0105] For access credentials, each access credential corresponds to a processing credential. That is, a processing credential and an access credential can form a credential pair. At the client 120, the target data generated in the target application can be processed based on the processing credential. Exemplarily, the processing can include encryption processing. The processed target data is stored in the data storage side 116.

[0106] The host device 110 sends an access credential request for the data resource to the credential management service, and the access credential request may include both an access token and a security report. The credential management service may determine the corresponding client 120 based on the access token and obtain the corresponding access credential. The security report is used to prove that the trusted execution environment 115 of the computing engine 112 used to process the data resource is secure and reliable and meets the predetermined security standards. The credential management service may perform verification on the security report, and if it is determined that the verification is passed, the access credential of the data resource is sent to the host device 110.

[0107] Figure 7 A schematic structural block diagram of a data access apparatus 700 according to some embodiments of the present disclosure is shown. The apparatus 700 may be implemented in or included in a host device 110, for example. Each module / component in the apparatus 700 may be implemented by hardware, software, firmware, or any combination thereof.

[0108] As shown in the figure, the device 700 includes a data access authorization request sending module 701, which is configured to send a data access authorization request for a data resource to multiple clients of a target application in response to a demand for processing data resources generated in a target application, and the multiple clients are associated with the data resource. A data acquisition module 702 is configured to receive authorization information for the data access authorization request from at least one of the multiple clients. An access credential acquisition module 703 is configured to acquire at least one access credential corresponding to at least one client based on the authorization information. A data access module 704 is configured to access target data associated with at least one client in the data resource to process the target data.

[0109] In some embodiments, the data acquisition module 702 may be specifically configured to: determine an access token of at least one client based on the authorization information, send an access credential request for a data resource to a credential management service, the access credential request at least including the access token, and receive at least one access credential corresponding to the at least one client from the credential management service.

[0110] In some implementations, the access credential request also includes a security report indicating the trustworthiness of an environment for processing data resources.

[0111] In some embodiments, the data acquisition module 702 can also be configured to acquire target data from the data storage side, wherein the target data is stored in the data storage side by at least one client based on a received certification report, and the certification report indicates the credibility of the environment storing the data resource.

[0112] In some embodiments, for at least one of the clients, the target data stored in the data storage side is the data generated in the target application processed by the client using processing credentials corresponding to the access credentials of the client and then transmitted to the data storage side.

[0113] In some embodiments, accessing data resources with access credentials is performed in a trusted execution environment, based on which a data removal module is also included. The data removal module is configured to remove the target data and the access credentials to the target data from the trusted execution environment in response to satisfying a preset condition, wherein the preset condition includes that access to the target data ends or the authorized use period of the target data has expired.

[0114] In some implementations, the data access authorization request sending module 701 may be specifically configured to: determine at least one data resource type corresponding to the data processing task based on the data processing task to be executed, the data resource including data of at least one data resource type, and generate a data access authorization request based on the at least one data resource type.

[0115] In some implementations, the data access authorization request sending module 701 may be specifically configured to: determine multiple data resource types corresponding to the data processing task, and determine at least one data resource type based on the degree of association between data of the multiple data resource types and multiple clients.

[0116] Figure 8 A schematic structural block diagram of a data access device 800 according to some embodiments of the present disclosure is shown. The device 800 may be implemented in or included in the client 120, for example. Each module / component in the device 800 may be implemented by hardware, software, firmware, or any combination thereof.

[0117] As shown in the figure, the device 800 includes an access credential sending module 801, which is configured to send access credentials for data access to the credential management service in response to the credential management service passing the verification. The data processing module 802 is configured to use the processing credentials corresponding to the access credentials to process the target data generated by the client in the target application. The data storage module 803 is configured to store the processed target data to the data storage side. The access request receiving module 804 is configured to receive a data access authorization request from the user end of the data resource, and the data resource includes the target data. The authorization information generating module 805 is configured to generate authorization information for the data access authorization request in response to an affirmative indication of the data access authorization request. The authorization information sending module 806 is configured to send the authorization information to the user end of the data resource.

[0118] In some embodiments, the credential sending module 801 may also be configured to receive an attestation report from the credential management service, the attestation report indicating the trustworthiness of the environment storing the access credential, and verify the credential management service based on the attestation report.

[0119] In some implementations, the authorization information includes an access token for the client.

[0120] In some implementations, the authorization information indicates at least one of an authorized use scope, an authorized use purpose, or an authorized use period of the data resource.

[0121] Fig. 9 A schematic structural block diagram of a data access device 900 according to some embodiments of the present disclosure is shown. The device 900 may be implemented in or included in a credential management service, for example. Each module / component in the device 900 may be implemented by hardware, software, firmware, or any combination thereof.

[0122] As shown in the figure, the apparatus 900 includes a certification report sending module 901, which is configured to send a certification report to multiple clients of the target application, and the certification report indicates the credibility of the environment storing the access credentials. An access credential receiving module 902 is configured to receive multiple access credentials corresponding to the multiple clients respectively from the multiple clients, and the access credentials in the multiple access credentials are used to access data associated with the corresponding clients. An access credential sending module 903 is configured to send the access credentials corresponding to the at least one client to the user end of the data resource in response to receiving an access credential request for at least one client among the multiple clients from the user end of the data resource.

[0123] In some implementations, an access credential corresponding to a client among multiple clients has a corresponding processing credential, and the corresponding processing credential is used by the client to process target data generated in a target application, and the processed target data is stored in a data storage side.

[0124] In some embodiments, the access credential sending module 903 may be specifically configured to: in response to the access credential request including at least one access token of a client, verify the access credential request based on the access token of the at least one client, and in response to the access credential request passing the verification, send the access credential of the at least one client to the user of the data resource.

[0125] In some embodiments, the access credential sending module 903 can be specifically configured to: in response to the security report in the access credential request being verified, send the access credentials of at least one client to the user end of the data resource, and the security report indicates the credibility of the environment used to process the data resource.

[0126] Fig.101 shows a block diagram of an electronic device 1000 in which one or more embodiments of the present disclosure may be implemented. It should be understood that Fig.10 The electronic device 1000 shown is merely exemplary and should not constitute any limitation on the functionality and scope of the embodiments described herein. Fig.10 The electronic device 1000 shown may include or be implemented as Figure 1 The host device 110, the client 120, the credential management service, Figure 7 The device 700, Figure 8 Device 800 or Fig. 9 Device 900.

[0127] like Fig.10 As shown, the electronic device 1000 is in the form of a general electronic device. The components of the electronic device 1000 may include, but are not limited to, one or more processors or processing units 1010, a memory 1020, a storage device 1030, one or more communication units 1040, one or more input devices 1050, and one or more output devices 1060. The processing unit 1010 may be an actual or virtual processor and is capable of performing various processes according to a program stored in the memory 1020. In a multi-processor system, multiple processing units execute computer executable instructions in parallel to improve the parallel processing capability of the electronic device 1000.

[0128] The electronic device 1000 typically includes a plurality of computer storage media. Such media may be any accessible media that is accessible to the electronic device 1000, including but not limited to volatile and non-volatile media, removable and non-removable media. The memory 1020 may be a volatile memory (e.g., a register, a cache, a random access memory (RAM)), a non-volatile memory (e.g., a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. The storage device 1030 may be a removable or non-removable medium, and may include a machine-readable medium, such as a flash drive, a disk, or any other medium, which may be capable of being used to store information and / or data and may be accessed within the electronic device 1000.

[0129] The electronic device 1000 may further include additional removable / non-removable, volatile / non-volatile storage media. Figure 8As shown in , a disk drive for reading or writing from a removable, non-volatile disk (e.g., a "floppy disk") and an optical drive for reading or writing from a removable, non-volatile optical disk may be provided. In these cases, each drive may be connected to the bus (not shown) by one or more data media interfaces. Memory 1020 may include a computer program product 1025 having one or more program modules that are configured to perform various methods or actions of various embodiments of the present disclosure.

[0130] The communication unit 1040 implements communication with other electronic devices through a communication medium. Additionally, the functions of the components of the electronic device 1000 can be implemented in a single computing cluster or multiple computing machines that can communicate through a communication connection. Therefore, the electronic device 1000 can operate in a networked environment using a logical connection with one or more other servers, a network personal computer (PC), or another network node.

[0131] The input device 1050 may be one or more input devices, such as a mouse, a keyboard, a tracking ball, etc. The output device 1060 may be one or more output devices, such as a display, a speaker, a printer, etc. The electronic device 1000 may also communicate with one or more external devices (not shown) through the communication unit 1040 as needed, such as a storage device, a display device, etc., communicate with one or more devices that allow a user to interact with the electronic device 1000, or communicate with any device that allows the electronic device 1000 to communicate with one or more other electronic devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface (not shown).

[0132] According to an exemplary implementation of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored, wherein the computer-executable instructions are executed by a processor to implement the method described above. According to an exemplary implementation of the present disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the method described above.

[0133] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices, equipment, and computer program products implemented according to the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0134] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0135] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0136] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple implementations of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some implementations as replacements, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be realized by a special hardware-based system that performs the function or action of the specification, or can be realized by a combination of special hardware and computer instructions.

[0137] The above descriptions of various implementations of the present disclosure are exemplary, non-exhaustive, and not limited to the disclosed implementations. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described implementations. The selection of terms used herein is intended to best explain the principles of the implementations, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the various implementations disclosed herein.

Claims

1. A data access method, the method being applied to a user end of a data resource, comprising: In response to a demand for a data resource generated in a processing target application, sending a data access authorization request for the data resource to a plurality of clients of the target application, the plurality of clients being associated with the data resource; Receiving authorization information for the data access authorization request from at least one of the plurality of clients; Based on the authorization information, obtaining at least one access credential corresponding to the at least one client; as well as The target data associated with the at least one client in the data resource is accessed by using the at least one access credential to process the target data.

2. The method according to claim 1, wherein obtaining at least one access credential corresponding to the at least one client comprises: Based on the authorization information, determining an access token for the at least one client; Sending an access credential request for the data resource to a credential management service, the access credential request including at least the access token; as well as At least one access credential respectively corresponding to the at least one client is received from the credential management service.

3. The method of claim 2, wherein the access credential request further comprises: A security report indicating the trustworthiness of an environment for processing the data resource.

4. The method according to claim 1, further comprising: The target data is acquired from a data storage side, wherein the target data is stored in the data storage side by the at least one client based on a received attestation report, wherein the attestation report indicates the credibility of an environment storing the data resource.

5. The method according to claim 4, wherein for a client among the at least one client, the target data stored in the data storage side is the data generated in the target application processed by the client using processing credentials corresponding to the access credentials of the client and then transmitted to the data storage side.

6. The method of claim 1, wherein accessing the target data associated with the at least one client in the data resource is performed within a trusted execution environment, and the method further comprises: In response to satisfying a preset condition, the target data and the access credential to the target data are removed from the trusted execution environment, wherein the preset condition includes that access to the target data ends or an authorized usage period of the target data has expired.

7. The method of claim 1, wherein the data access authorization request is determined by: Based on the data processing task to be executed, determining at least one data resource type corresponding to the data processing task, the data resource comprising data of the at least one data resource type; and Based on the at least one data resource type, the data access authorization request is generated.

8. The method according to claim 7, wherein determining at least one data resource type corresponding to the data processing task comprises: Determining a plurality of data resource types corresponding to the data processing task; as well as The at least one data resource type is determined based on the association degree between the data of the multiple data resource types and the multiple clients.

9. A data access method, applied to a client of a target application, comprising: In response to the credential management service passing the authentication, sending access credentials for data access to the credential management service; Using the processing credentials corresponding to the access credentials, processing the target data generated by the client in the target application; storing the processed target data in a data storage side; receiving a data access authorization request from a user of a data resource, wherein the data resource includes the target data; In response to an affirmative indication of the data access authorization request, generating authorization information for the data access authorization request; as well as The authorization information is sent to a user of the data resource.

10. The method of claim 9, wherein the credential management service is authenticated by: receiving an attestation report from the credential management service, the attestation report indicating the trustworthiness of an environment in which access credentials are stored; and The credential management service is authenticated based on the attestation report. The method of claim 9 , wherein the authorization information comprises an access token of the client.

12. The method according to claim 9, wherein the authorization information indicates at least one of the following: The scope of authorized use of the target data, Authorized purpose of use, Authorized use period.

13. A data access method, the method being applied to a credential management service, comprising: sending an attestation report to a plurality of clients of the target application, the attestation report indicating the trustworthiness of an environment storing access credentials; receiving, from the plurality of clients, a plurality of access credentials respectively corresponding to the plurality of clients, wherein the access credentials in the plurality of access credentials are used to access data associated with the corresponding client; as well as In response to receiving an access credential request for at least one of the plurality of clients from a user of the data resource, an access credential corresponding to the at least one client is sent to the user of the data resource.

14. The method according to claim 13, wherein the access credentials corresponding to the client among the multiple clients have corresponding processing credentials, and the corresponding processing credentials are used by the client to process the target data generated in the target application, and the processed target data is stored in the data storage side.

15. The method according to claim 13, wherein sending the access credentials corresponding to the at least one client to the user of the data resource comprises: In response to the access credential request including at least an access token of the at least one client, verifying the access credential request based on the access token of the at least one client; as well as In response to the access credential request being verified, the access credential of the at least one client is sent to a user of the data resource.

16. The method according to claim 13, wherein sending the access credentials corresponding to the at least one client to the user of the data resource comprises: In response to a security report in the access credential request being verified, the access credential of the at least one client is sent to a user of the data resource, the security report indicating the trustworthiness of an environment for processing the data resource.

17. An electronic device comprising: at least one processing unit; as well as At least one memory, the at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, the instructions when executed by the at least one processing unit cause the electronic device to perform the method according to any one of claims 1 to 16.

18. A computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the method according to any one of claims 1 to 16.

Images