Access method and device, electronic equipment and storage medium

Abstract

The invention provides an access method and device, electronic equipment and a storage medium. According to the specific implementation scheme, the method is applied to an intermediate server, and receives a first access request from a first client; performing signature verification on the first access request based on a first key pair agreed by the first client and the intermediate server; under the condition that the signature verification of the first access request succeeds, determining the access permission of the first client based on the first key pair, and performing signature encryption on request access content in the first access request based on a second key pair agreed by the intermediate server and the object storage server to obtain a second access request; sending a second access request to an object storage server; under the condition that first access response data responding to the request access content from the object storage server is received, filtering the first access response data based on the access permission of the first client to obtain second access response data; and sending the second access response data to the first client.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, in particular to the field of object storage and information security. The present disclosure specifically relates to an access method, device, electronic device and storage medium. Background Art

[0002] The cloud platform can provide object storage services. As a basic service of the public cloud, it is deployed to ensure that it can be directly accessed by designated legitimate users as much as possible in any network environment. Whether the legitimate user is at work, at home, or even around the world, they can access the object storage function of the public cloud.

[0003] For the object storage function provided to an enterprise in the cloud platform, the enterprise's software developers must know the access password of the object storage system and write the password into the software that uses the object storage. At the same time, the enterprise will also deploy some third-party software on the cloud platform. These third-party software also use the object storage service. Therefore, the enterprise needs to inform the service provider of the third-party software of the access password of the object storage and let them write it into the software.

[0004] Once these software are officially put into operation, they are usually run 24 / 7. Even a short interruption will affect the business. Therefore, the object storage password is generally not changed. However, for people who know the object storage password, as long as they can connect to the Internet, they can access the data in the object storage. This is a huge security risk for the information security of the enterprise. Summary of the invention

[0005] The present disclosure provides an access method, device, electronic device and storage medium, which can solve the above problems.

[0006] According to one aspect of the present disclosure, there is provided an access method, which is applied to an intermediate server and includes:

[0007] receiving a first access request from a first client;

[0008] Performing signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server;

[0009] If the signature verification of the first access request succeeds, the access rights of the first client are determined based on the first key pair, and the requested access content in the first access request is signed and encrypted based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request;

[0010] Sending the second access request to the object storage server;

[0011] Upon receiving first access response data from the object storage server in response to the requested access content, filtering the first access response data based on the access rights of the first client to obtain second access response data;

[0012] The second access response data is sent to the first client.

[0013] According to another aspect of the present disclosure, there is provided an access device, applied to an intermediate server, comprising:

[0014] An access request receiving module, configured to receive a first access request from a first client;

[0015] A signature verification module, configured to perform signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server;

[0016] a signature encryption module, configured to determine the access rights of the first client based on the first key pair when the signature verification of the first access request succeeds, and to sign and encrypt the requested access content in the first access request based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request;

[0017] An access request sending module, configured to send the second access request to the object storage server;

[0018] a data filtering module configured to filter the first access response data based on the access rights of the first client to obtain second access response data when receiving first access response data from the object storage server in response to the requested access content;

[0019] A data sending module is used to send the second access response data to the first client.

[0020] According to another aspect of the present disclosure, there is provided an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor;

[0021] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any access method in the embodiments of the present disclosure.

[0022] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any access method in the embodiments of the present disclosure.

[0023] According to the technology disclosed in the present invention, when the intermediate server receives a first access request from a first client, it performs a signature verification on the first access request based on the first key pair agreed upon by the first client and the intermediate server, and in the case where the signature verification of the first access request succeeds, it determines the access rights of the first client based on the first key pair, and based on the second key pair agreed upon by the intermediate server and the object storage server, it performs a signature encryption on the requested access content in the first access request to obtain a second access request, and then sends the second access request to the object storage server. In this way, the access security of the object storage server can be ensured. Furthermore, in the case where the first access response data is received from the object storage server in response to the requested access content, the first access response data is filtered and processed based on the access rights of the first client to obtain the second access response data, and the second access response data is sent to the first client. In this way, the data security of the object storage server can be further ensured, and the complexity of permission management can be reduced.

[0024] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0026] Figure 1 is a flow chart of an access method according to an embodiment of the present disclosure;

[0027] Figure 2 is a schematic diagram of interaction between an intermediate server, an application program, and an object storage system according to an embodiment of the present disclosure;

[0028] Figure 3 is a structural block diagram of an access device according to an embodiment of the present disclosure;

[0029] Figure 4 The present invention is a block diagram of an electronic device for an access method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0031] Figure 1 is a flowchart of an access method according to an embodiment of the present disclosure.

[0032] like Figure 1 As shown, the method can be applied to an intermediate server and includes the following steps:

[0033] S110, receiving a first access request from a first client;

[0034] S120, performing signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server;

[0035] S130, if the signature verification of the first access request succeeds, determine the access rights of the first client based on the first key pair, and sign and encrypt the requested access content in the first access request based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request;

[0036] S140, sending a second access request to the object storage server;

[0037] S150, when first access response data in response to the request for access to the content is received from the object storage server, filtering the first access response data based on the access rights of the first client to obtain second access response data;

[0038] S160: Send second access response data to the first client.

[0039] Exemplarily, when the first client accesses the object storage server, it needs to send a first access request to the intermediate server. For example, add the Authorization attribute in the HTTP request header and carry the correct verification information. For example, the structure of the request can be: Authorization:OBS AccessKeyID:signature. Among them, AccessKeyID represents the key, and can also represent the identity of the first client, and signature represents the signature information. Among them, the signature information includes the specific requested access content.

[0040] It is understandable that the key pair agreed upon by each client and the intermediate server is different, and each client has different permissions to access the object storage server. For example, the files that can be accessed are different, and the permissions that can be used to access the same file are different, such as read-only, read-write, or delete.

[0041] Exemplarily, the intermediate server may be provided with a permission library for storing key pairs agreed upon by each client and the intermediate server, and access rights associated with each key pair (ie, access rights of the corresponding client).

[0042] Exemplarily, based on the first key in the first access request, a first key pair agreed upon by the first client and the intermediate server is determined in the intermediate server. The first key pair includes a first key and a second key. The signature of the first access request can be verified using the second key and access parameters related to the first access request. The access parameters can be access date, access path, etc.

[0043] Exemplarily, when the signature verification of the first access request fails, the intermediate server returns an error message to the first client and intercepts the first access request, and does not send the request or a request after processing the request to the object storage server.

[0044] It is understandable that the intermediate server also stores the second key pair agreed upon by the intermediate service and the object storage server. After the signature verification of the first access request is successful, the intermediate server will use the key pair with the highest authority defined by the object storage server to sign and encrypt the user's original request, that is, the requested access content in the first access request, resend the request to the object storage server and receive the response result returned by the object storage server.

[0045] It can be understood that the key pair used by the first client when sending the request is manually set by the administrator in the permission library, with the purpose of blocking direct communication between the user, that is, the client, and the object storage. That is, the key pair used by the first client can only be verified at the intermediate server, and is illegal at the object storage server. Therefore, the intermediate server must use another set of key pairs (that is, the legal key pair issued by the object storage server) to make a request to the object storage server.

[0046] It is understandable that the key pair used by the intermediate server has the highest authority on the object storage server, and the purpose is to be able to fully request the data required by the user. When the first client initiates an access request to a folder, the intermediate server needs to have certain permissions to fully request all the file contents under the file, and then filter out the content that is not visible to the user based on the permissions of the first client, that is, the content that the first client does not have access rights to.

[0047] It is understandable that when the object storage server receives the request from the intermediate server, it will also perform permission verification on the intermediate server. If the verification is successful, it will complete the response and return the content requested by the intermediate server. The intermediate server will then perform a series of filtering and rewriting operations and return it to the user. If the verification is unsuccessful, the object storage server will return a failure message to the intermediate server, and the failure message will also be returned by the intermediate server to the first client.

[0048] Exemplarily, during filtering, buckets, folders, files, or file contents, etc., which the user has no right to access, are filtered out in the first access response data.

[0049] Exemplarily, the filtered results are sorted according to the format requested by the first client to obtain the second access response data, which is then returned to the first client.

[0050] According to the above implementation, when the intermediate server receives the first access request from the first client, it performs signature verification on the first access request based on the first key pair agreed upon by the first client and the intermediate server, and when the signature verification of the first access request succeeds, it determines the access rights of the first client based on the first key pair, and based on the second key pair agreed upon by the intermediate server and the object storage server, it performs signature encryption on the requested access content in the first access request to obtain a second access request, and then sends the second access request to the object storage server. In this way, the access security of the object storage server can be ensured. Furthermore, when the first access response data is received from the object storage server in response to the requested access content, the first access response data is filtered based on the access rights of the first client to obtain second access response data, and the second access response data is sent to the first client. In this way, the data security of the object storage server can be further ensured, and the complexity of permission management can be reduced.

[0051] In one implementation, the first access request includes a first key and first signature information, wherein the first signature information is information obtained by the first client using a second key to sign and encrypt the requested access content, and the second key pair includes the first key and the second key.

[0052] Alternatively, the first signature information is information obtained by the first client using the second key and access parameters related to the first access request to sign and encrypt the requested access content.

[0053] It can be understood that the access parameters include access date, access path, etc.

[0054] It can be understood that the first client concatenates the requested access content and the access parameters, and then uses the second key to encrypt the concatenated content, and the obtained encrypted text is the above-mentioned first signature information.

[0055] According to the above implementation, the access security between the first client and the intermediate server can be improved.

[0056] In one embodiment, the above-mentioned signature verification of the first data access request based on the first key pair agreed upon by the first client and the intermediate server includes: in a case where a key identical to the first key in the first data access request is stored in the intermediate server, based on the first key, searching the intermediate server for a second key paired with the first key; based on the second key and access parameters related to the first data access request, signing and encrypting the requested access content in the first signature information to obtain second signature information; and in a case where the first signature information is identical to the second signature information, determining that the signature verification of the first access request is successful.

[0057] Exemplarily, the intermediate server extracts the AccessKeyID, i.e., the AK value, from the Authorization header of the first access request, and searches the self-built permission library for the AK value. If it does not exist, an error message is returned to the first client and the request is intercepted. If it does exist, the current user's access rights (read-only, read-write, read-write-delete) to each directory and file in the object storage service are queried, as well as the key paired with this AK value in the permission library, i.e., SK, for subsequent signature verification.

[0058] Exemplarily, the intermediate server uses the AK-SK key pair queried in the permission library and some parameters carried in the HTTP request sent by the user (such as date, access path, etc.), according to the predefined signature calculation method (based on the signature method defined by the object storage server, to concatenate the above parameters and encrypt them in the specified encryption method, and finally generate an encrypted text, re-sign the user's request, and generate a new signature. The regenerated signature is compared with the signature in the request header. If they are inconsistent, an error message is returned to the first client and the request is intercepted; if they are consistent, it means that the signature verification is passed.

[0059] According to the above implementation, the access request from the client can be accurately verified to ensure access security.

[0060] In one embodiment, the second key pair includes a third key and a fourth key. Based on the second key pair agreed upon by the intermediate server and the object storage server, the requested access content in the first access request is signed and encrypted to obtain a second access request, including: based on the third key, the requested access content in the first access request is signed and encrypted to obtain third signature information; based on the fourth key and the third signature information, the second access request is determined.

[0061] Exemplarily, the current access date, access path and other information may be combined with the requested access content, and the combined content may be signed and encrypted using a third key to obtain third signature information.

[0062] Exemplarily, the fourth key and the third signature information are encapsulated and packaged to obtain a second access request.

[0063] Exemplarily, the user uses the ak-sk key pair defined in the permission library to send a request to the intermediate server. When the authentication is passed, the intermediate server uses the highest-authority AK-SK key pair defined by the object storage server to sign and encrypt the user's original request URL, i.e. the above-mentioned request access content, and resends the request to the object storage server and receives the response result returned by the object storage server.

[0064] According to the above implementation, the security of data transmission between the intermediate server and the object storage server can be guaranteed.

[0065] In one embodiment, sending the second access request to the object storage server includes: sending the second access request to the object storage server when the access rights of the first client include rights to access at least part of the requested access content.

[0066] Exemplarily, if the access content requested is the AA folder, and the access permission of the first client is only the 2024-01 folder under the AA folder, a second access request may be sent to the object storage server.

[0067] It is understandable that if the access rights of the first client do not include any rights to access the content requested in the first access request, the second access request is not sent to the object storage server, and access denial information may be returned to the first client.

[0068] Exemplarily, if the access request is to an AA folder, and the access permission of the first client is to a BB folder, which has no intersection with the AA folder, the second access request is not sent to the object storage server, and access denial information may be returned to the first client.

[0069] Exemplarily, if the access request is for upload permission to the AA folder, and the first client has only read-only permission to the AA folder but not upload permission, the second access request will not be sent to the object storage server, and access denial information may be returned to the first client.

[0070] According to the above implementation, the authority management can be simplified while protecting information security. It is not necessary to process the request content, but only the access response data returned by the intermediate server needs to be processed accordingly.

[0071] In one embodiment, based on the access rights of the first client, the first access response data is filtered to obtain the second access response data, including: based on the access rights of the first client, determining, in the first access response data, first sub-data with access rights and second sub-data without access rights; extracting the first sub-data from the first access response data; and determining the second access response data based on the first sub-data.

[0072] It is understandable that the access response result or data returned by the object storage server is usually an XML document, including information such as buckets, folders, files and their paths. The intermediate server parses the returned XML document, extracts the data therein, and makes a judgment based on the user's operating permissions for the path. If the permissions are insufficient, all files under the path are filtered out. After the filtering is completed, the intermediate server reassembles the remaining data into an XML document that complies with the user's permissions, encapsulates the reassembled XML document into an HTTP response message, and returns it to the first client.

[0073] For example, if the user only has access rights to the / AA / 2024-01 folder, when he accesses all the contents under the AA folder, the intermediate server will first request the object storage for the specific contents under the AA folder (i.e., the 2024-01 folder and the 2024-04 folder). Then the intermediate server will detect that the user only has permission to the 2024-01 folder, and will filter out the contents of the other folder, retaining only the contents of one folder and returning it to the user.

[0074] For example, the first client has the permission / testflex / AA / 2024-01 / , and the access path of the first access request is / testflex / AA / . There are two folders 2024-01 and 2024-04 under the current path, and the access response data returned by the diagonal storage server is AA / 2024-01, AA / 2024-04. The filtering process can be as follows:

[0075] 1. First, split the access path according to the / symbol: `testflex``AA`, level = 3, the level is the length of the array after segmentation - 1 (remove the empty path in the first layer, the current file being accessed is test, so keep the last empty path)

[0076] 2. Obtain user permissions and split: `testflex``AA``2024-01`

[0077] 3. Get the prefix, which is the location of the third level in the permission path. The first is an empty path, and the second is a bucket. The data in the obtained object list does not contain the bucket name. The prefix is: AA / 2024-01 / .

[0078] 4. Search the permission map based on the prefix and add any results to the result list.

[0079] 5. Assemble the result list into an XML document, obtain an HTTP response message, and return it to the first client.

[0080] It can be understood that the above filtering process can be to filter the buckets first, then filter the documents, and finally filter the folders to obtain the final result.

[0081] According to the above implementation, the intermediate server sends the filtered results to the first client, and the user of the first client can only see and operate the resources within the scope of his authority.

[0082] Figure 2 It is a schematic diagram of the interaction between the intermediate server, application program, and object storage system according to an embodiment of the present disclosure.

[0083] like Figure 2 As shown in the figure, the application uses the AWS S3 protocol and our custom key system to send a request to the intermediate server, which decrypts and verifies the received data; then uses the object storage key system and the AWS S3 protocol encryption method to reconstruct the data packet and forward it to the object storage. Conversely, the data packet sent by the object storage also needs to be decrypted and reconstructed by the intermediate server and sent to the application.

[0084] The system is implemented based on a three-layer architecture between the application, the intermediate server and the object storage server (OBS server). As the intermediate forwarding layer, the intermediate server is not only responsible for data forwarding, but also undertakes the functions of permission verification and data modification.

[0085] 1. Communication between the application and the intermediate server:

[0086] (1) Use encryption mechanisms to ensure the security of communications.

[0087] (2) The application uses the AK / SK provided by the intermediate server for authentication and data transmission.

[0088] 2. Communication between the intermediate server and the object storage server:

[0089] (1) Communicate with the target server after secondary encryption to ensure the security of data during transmission.

[0090] (2) The intermediate server acts as a proxy, responsible for forwarding user requests to the object storage server and filtering and modifying the server response before returning it to the application.

[0091] 2. Permission Control

[0092] This system has built a permission management background to be used in conjunction with the intermediate server, with an independent user and permission system, which realizes fine-grained control of object storage server resources.

[0093] 1. User rights management:

[0094] (1) The user does not use the key pair assigned by the object storage server, but the system assigns a set of AK / SK that belongs only to the intermediate server.

[0095] (2) All users have no permissions by default and must be assigned permissions through the permissions management interface.

[0096] (3) Permissions can be defined for buckets, folders, and files, and support three permission levels: read-only, read-write (non-deletable), and delete.

[0097] 2. Permission verification:

[0098] (1) When the application initiates a request, the intermediate server first decrypts the request data and verifies whether the user's AK exists and the signature is correct.

[0099] (2) Query the permission table based on the target resource (bucket, folder, file) and operation type (read, write, delete) requested by the user.

[0100] (3) If the user has the corresponding authority, the process continues; otherwise, the message "Insufficient authority" is returned.

[0101] 3. Filter rewrite

[0102] When the user passes the authentication, the intermediate server will filter the data obtained from the object storage server according to the user's permissions.

[0103] 1. Data Request:

[0104] (1) The intermediate server re-signs the user request using its own AK / SK and sends the request to the object storage server.

[0105] (2) The request will be made with the highest authority so that all content that the user may need can be obtained.

[0106] 2. Data filtering:

[0107] (1) After receiving the response from the object storage server, the intermediate server will filter the data according to the user's permissions.

[0108] (2) The filtering process will remove buckets, folders, files, or file contents that the user does not have access to.

[0109] (3) The filtered results will be organized according to the format requested by the user and prepared to be returned to the user.

[0110] If the user only has access rights to the / AA / 2024-01 folder, when he accesses all the contents under the AA folder, the intermediate server will first request the object storage for the specific contents under the AA folder (i.e., the 2024-01 folder and the 2024-04 folder). Then the intermediate server will detect that the user only has permissions for the 2024-01 folder, and will filter out the contents of the other folder, retaining only the contents of one folder and returning it to the user.

[0111] 3. Result return: The intermediate server sends the filtered results to the application, and the user can only see and operate the resources within his or her permission scope.

[0112] The above implementation has the following effects:

[0113] 1. Fine-grained permission control: Through the intermediate server, users can implement more refined permission control on the resources on the remote object storage server. Not only can the read and write permissions at the bucket level be controlled, but permission management can also be further refined to the folder and file level. This fine-grained permission control meets the flexibility of different users' access requirements for different resources and improves the security of the system.

[0114] 2. Enhanced data security: Data needs to be encrypted and signed when communicating between the application and the proxy host, and between the proxy host and the object storage server. This double encryption mechanism ensures the security of data during transmission and effectively prevents the risk of data leakage and tampering.

[0115] 3. Simplified permission management: We have established our own user and permission system, so that developers or third-party program deployers do not need to directly manage the AK / SK of the object storage server. Even if the AK / SK issued by the intermediate server is leaked, the object storage server cannot be directly accessed, which greatly simplifies the complexity of permission management and reduces security risks.

[0116] Figure 3 It is a structural block diagram of an access device according to an embodiment of the present disclosure.

[0117] like Figure 3 As shown, the access device can be applied to an intermediate server, including:

[0118] The access request receiving module 310 is used to receive a first access request from a first client;

[0119] A signature verification module 320, configured to perform signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server;

[0120] The signature encryption module 330 is used to determine the access rights of the first client based on the first key pair when the signature verification of the first access request succeeds, and to sign and encrypt the requested access content in the first access request based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request;

[0121] An access request sending module 340, configured to send the second access request to the object storage server;

[0122] The data filtering module 350 is configured to filter the first access response data based on the access rights of the first client to obtain second access response data when receiving the first access response data from the object storage server in response to the requested access content;

[0123] The data sending module 360 ​​is configured to send the second access response data to the first client.

[0124] In one implementation, the first access request includes a first key and first signature information, wherein the first signature information is information obtained by the first client using a second key to sign and encrypt the requested access content, and the second key pair includes the first key and the second key.

[0125] In one implementation, the signature verification module 320 includes:

[0126] a key searching unit, configured to search the intermediate server for the second key paired with the first key based on the first key, if a key identical to the first key in the first data access request is stored in the intermediate server;

[0127] A first signature encryption unit is used to sign and encrypt the access request content in the first signature information based on the second key and the access parameter related to the first data access request to obtain second signature information;

[0128] A verification success determination unit is used to determine that the signature verification of the first access request is successful when the first signature information is the same as the second signature information.

[0129] In one implementation, the second key pair includes a third key and a fourth key, and the signature encryption module 330 includes:

[0130] A second signature encryption unit is used to sign and encrypt the requested access content in the first access request based on the third key to obtain third signature information;

[0131] An access request generating unit is used to determine the second access request based on the fourth key and the third signature information.

[0132] In one implementation, the access request sending module is specifically configured to:

[0133] In a case where the access rights of the first client include the right to access at least part of the requested access content, the second access request is sent to the object storage server.

[0134] In one implementation, the data filtering module 350 includes:

[0135] an authority determination unit, configured to determine, based on the access authority of the first client, first sub-data having the access authority and second sub-data not having the access authority in the first access response data;

[0136] a data extraction unit, configured to extract the first sub-data from the first access response data;

[0137] The response data determining unit is configured to determine the second access response data based on the first sub-data.

[0138] For the description of specific functions and examples of each module and submodule of the device in the embodiment of the present disclosure, reference can be made to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0139] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0140] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0141] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0142] like Figure 4 As shown, the device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 404, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0143] A number of components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0144] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above, such as an access method. For example, in some embodiments, an access method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 400 via ROM 402 and / or communication unit 409. When the computer program is loaded into RAM 403 and executed by the computing unit 401, one or more steps of an access method described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to perform an access method in any other appropriate manner (e.g., by means of firmware).

[0145] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0147] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0150] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0151] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0152] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An access method, characterized in that: Applicable to intermediate servers, including: receiving a first access request from a first client; Performing signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server; If the signature verification of the first access request succeeds, the access rights of the first client are determined based on the first key pair, and the requested access content in the first access request is signed and encrypted based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request; Sending the second access request to the object storage server; Upon receiving first access response data from the object storage server in response to the requested access content, filtering the first access response data based on the access rights of the first client to obtain second access response data; The second access response data is sent to the first client.

2. The method according to claim 1, wherein: The first access request includes a first key and first signature information, wherein the first signature information is information obtained by the first client using a second key to sign and encrypt the requested access content, and the second key pair includes the first key and the second key.

3. The method according to claim 2, wherein: The performing signature verification on the first data access request based on the first key pair agreed upon by the first client and the intermediate server includes: In a case where a key identical to the first key in the first data access request is stored in the intermediate server, searching the intermediate server for the second key paired with the first key based on the first key; Based on the second key and the access parameters related to the first data access request, the access request content in the first signature information is signed and encrypted to obtain second signature information; When the first signature information is identical to the second signature information, it is determined that the signature verification of the first access request is successful.

4. The method according to claim 3, wherein: The second key pair includes a third key and a fourth key. The second key pair agreed upon by the intermediate server and the object storage server is used to sign and encrypt the access request content in the first access request to obtain a second access request, including: Based on the third key, sign and encrypt the access request content in the first access request to obtain third signature information; The second access request is determined based on the fourth key and the third signature information.

5. The method according to claim 1, wherein: Sending the second access request to the object storage server includes: In a case where the access rights of the first client include the right to access at least part of the requested access content, the second access request is sent to the object storage server.

6. The method according to claim 1, wherein: The filtering the first access response data based on the access permission of the first client to obtain the second access response data includes: Based on the access right of the first client, determining, in the first access response data, first sub-data with the access right and second sub-data without the access right; extracting the first sub-data from the first access response data; Based on the first sub-data, the second access response data is determined.

7. An access device, characterized in that: Applicable to intermediate servers, including: An access request receiving module, configured to receive a first access request from a first client; A signature verification module, configured to perform signature verification on the first access request based on a first key pair agreed upon by the first client and the intermediate server; a signature encryption module, configured to determine the access rights of the first client based on the first key pair when the signature verification of the first access request succeeds, and to sign and encrypt the requested access content in the first access request based on the second key pair agreed upon by the intermediate server and the object storage server to obtain a second access request; An access request sending module, configured to send the second access request to the object storage server; a data filtering module configured to filter the first access response data based on the access rights of the first client to obtain second access response data when receiving first access response data from the object storage server in response to the requested access content; A data sending module is used to send the second access response data to the first client.

8. The device according to claim 1, wherein: The access request sending module is specifically used for: In a case where the access rights of the first client include the right to access at least part of the requested access content, the second access request is sent to the object storage server.

9. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method described in any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-6.

Images