A file processing method and device, electronic equipment and storage medium

Abstract

The application provides a file processing method and device, electronic equipment and storage medium, the method comprises the following steps: receiving the data request sent by the user based on the client, the data request carries the corresponding token, the token is pre-allocated to the corresponding user account; if it is determined that the identity authentication of the user is passed, the permission verification is carried out based on the token in the data request; if the verification is passed, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service. The application uses the token as the authentication mechanism to realize the identity authentication mechanism of the user, ensures that it is not tampered with in the transmission process, then, when the identity authentication of the user is passed, the permission verification is carried out based on the token in the data request, so that the initiator of the current data request and the corresponding permission are quickly identified, and the database or the session storage does not need to be queried again, so that the unauthorized access and data leakage are avoided.

Description

Technical Field

[0001] This invention relates to the field of cloud computing and data storage technology, and in particular to a file processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the explosive advancement of information technology, the wave of digital transformation has swept the globe, and businesses and individuals have seen unprecedented growth in their demand for file storage and convenient access.

[0003] To ensure the security of file access in storage services, users are often directly authenticated. After successful authentication, users are allowed to access the corresponding storage service. However, since user information is easily tampered with during the authentication process, data leaks can occur, and data in the storage service can be accessed without authorization. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a file processing method, apparatus, electronic device, and storage medium to solve the problems of data leakage in storage services and unauthorized access to data in storage services in the prior art.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of the present invention discloses a file processing method, the method comprising:

[0007] Receive data requests sent by users based on the client, the data requests carrying a corresponding token, the token being pre-allocated to the corresponding user account;

[0008] If the user's authentication is confirmed to be successful, permission verification is performed based on the token in the data request;

[0009] If the verification is successful, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

[0010] Optionally, the process of pre-allocating tokens to corresponding user accounts includes:

[0011] Based on the user's job function information and the business information they are responsible for, all users are grouped into permission groups to obtain multiple permission groups;

[0012] A fine-grained permission control model is constructed based on the aforementioned permission groups;

[0013] The corresponding token is obtained by encapsulating the permissions and role information of each user in the fine-grained permission control model.

[0014] The token is distributed to the user account corresponding to each user.

[0015] Optionally, all users can be grouped into permission groups based on their job functions and the business they are responsible for, resulting in multiple permission groups, including:

[0016] For each user, the role corresponding to the user is determined based on the user's functional information and the business information they are responsible for.

[0017] The users are grouped by their corresponding roles to obtain multiple permission groups.

[0018] Optionally, determining whether the user's authentication is successful includes:

[0019] The integrity and authenticity of the token carried in the data request are verified.

[0020] If the integrity verification and authenticity verification are successful, the user's identity verification is considered successful.

[0021] Optionally, permission verification based on the token in the data request includes:

[0022] Based on the permissions held in the token, determine whether the user has performed an access operation corresponding to the data request;

[0023] If so, determine whether there are other users currently accessing the service module to which the data request is to be accessed;

[0024] If such a user exists, and it is determined that the number of other users currently accessing the site is greater than a preset number, then it is determined whether the permission group level of the user is greater than the permission group level of other users.

[0025] If the value is greater than the data request, execute the operation corresponding to the data request to access the file in the corresponding service module of the storage service.

[0026] Optional, also includes:

[0027] Obtain the permission requirements and access information for the storage service;

[0028] A model of an Access Control List (ACL) is constructed based on the permission requirements and access information of the storage service.

[0029] Optional, also includes:

[0030] Record detailed information for each access operation to the storage service;

[0031] An audit log is constructed based on the detailed information of each access operation to the storage service.

[0032] A second aspect of the present invention discloses a document processing apparatus, the apparatus comprising:

[0033] A receiving unit is used to receive data requests sent by users based on clients, wherein the data requests carry a corresponding token, and the token is pre-allocated to the corresponding user account;

[0034] The verification unit is used to perform permission verification based on the token in the data request if it is determined that the user's identity verification is successful.

[0035] The access unit is used to determine, if the verification is successful, that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

[0036] A third aspect of the present invention discloses an electronic device for running a program, wherein the program executes a file processing method as shown in the first aspect of the present invention.

[0037] A fourth aspect of the present invention discloses a storage medium comprising a stored program, wherein, when the program is executed, the device on which the storage medium is located executes a file processing method as shown in the first aspect of the present invention.

[0038] Based on the above embodiments of the present invention, a file processing method, apparatus, electronic device, and storage medium are provided. The method includes: receiving a data request sent by a user based on a client, the data request carrying a corresponding token, the token being pre-assigned to a corresponding user account; if the user's authentication is confirmed, performing permission verification based on the token in the data request; if the verification is successful, determining that the access operation corresponding to the data request can be executed to access files under the corresponding service module in the storage service. In this embodiment of the present invention, a fine-grained permission control model is constructed based on the role-based access control (RBAC) system to assign a corresponding token to each user; receiving a data request carrying a token sent by a client, using the token as an authentication mechanism to implement the user's authentication mechanism, ensuring that it is not tampered with during transmission, and providing a reliable user identity verification basis for each subsequent interaction; then, when the user's authentication is confirmed, permission verification is performed based on the token in the data request, thereby quickly identifying the initiator of the current data request and its corresponding permissions, without needing to query the database or session storage again, thus improving the efficiency and security of data access; if the verification is successful, determining that the access operation corresponding to the data request can be executed, and executing the operation corresponding to the data request to access the corresponding service module in the storage service. To prevent unauthorized access and data breaches. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0040] Figure 1 This is a schematic flowchart illustrating a file processing method according to an embodiment of the present invention;

[0041] Figure 2 This is a schematic flowchart illustrating another file processing method according to an embodiment of the present invention;

[0042] Figure 3 This is a flowchart illustrating another document processing method according to an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram of the file processing flow according to an embodiment of the present invention;

[0044] Figure 5 This is a schematic diagram of the file processing architecture shown in an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram of the structure of a document processing device according to an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0048] It should be noted that the descriptions involving "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0049] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0050] This invention presents a file access method based on cloud computing and data storage technology, creating a cloud data storage platform (i.e., storage service) that integrates a fine-grained permission management mechanism for enterprises and individual users of different sizes. It not only ensures the security and integrity of data but also improves the efficiency and flexibility of data access to meet the high standards required for managing massive amounts of data.

[0051] Specifically, the fine-grained access control system implemented in this invention further refines the permission division based on traditional access control, authorizing access according to permissions. It supports multi-dimensional and multi-level access control policies, including but not limited to user authentication, role assignment, access key management, and granular permission settings down to the file or folder level (such as read, write, delete, and share). This design allows administrators to flexibly configure the most appropriate access permissions for different users or teams according to actual needs, effectively preventing data leakage and ensuring the security of information assets.

[0052] Furthermore, this invention optimizes data transmission and storage efficiency by employing intelligent caching strategies, data compression technology, and parallel processing mechanisms, significantly reducing data read / write latency and ensuring service stability and response speed even under high-concurrency access environments. Simultaneously, leveraging MinIO's support for multi-cloud environments, users can easily achieve cross-cloud platform data migration and backup.

[0053] See Figure 1 This is a flowchart illustrating a file processing method according to an embodiment of the present invention. The method includes:

[0054] Step S101: Receive the data request sent by the client.

[0055] The data request carries a corresponding token, which is pre-assigned to the corresponding user account.

[0056] Optionally, the steps shown in this invention are implemented by a server connected to the client, and the server is used to determine whether the user can access the files under the storage service.

[0057] It should be noted that the process of pre-allocating tokens to corresponding user accounts includes:

[0058] Step S11: Group all users by their job function and the business they are responsible for, resulting in multiple permission groups;

[0059] It should be noted that the specific implementation process of step S11 includes the following steps:

[0060] Step S21: For each user, determine the role corresponding to the user based on the user's functional information and the business information they are responsible for.

[0061] In the specific implementation of step S21, firstly, for each company, the functional information uploaded by each user under the company, such as the scope of work they are responsible for, the information of the colleagues responsible for handover, and the information of the corresponding superiors or subordinates, is used to obtain the business information stored in the company's database, such as the handlers and responsible persons of the submitted business, and to summarize and process it in order to determine the role of each user.

[0062] In other words, there is a pre-set correspondence between a user's functional information, the business information they are responsible for, and their role. That is, based on the aggregated information, users with the same or similar functional information are assigned the same role.

[0063] It should be noted that roles not only define the basic operation permissions that users can perform, such as read, write, or delete permissions, or the permissions to operate on a certain function, but also precisely limit the scope of resource access, such as covering multi-level data access control from the entire bucket to a single object.

[0064] One role corresponds to one basic operation (create, delete, modify, query), or one role can be set to correspond to multiple basic operations.

[0065] A user can have one or more roles.

[0066] In this embodiment of the invention, users can indirectly inherit all permission sets bound to their roles, meaning there's no need to configure individual account permissions in a fine-grained manner, greatly simplifying the complexity of permission management. This approach allows users to quickly adapt to changing permission requirements in new roles when moving within an organization; they only need to adjust their role assignments based on their job functions and the business they are responsible for. This ensures both the efficiency of permission adjustments and the consistency and maintainability of the permission structure.

[0067] Step S22: Group the users according to their corresponding roles to obtain multiple permission groups;

[0068] In the specific implementation of step S22, users with the same role are grouped into the same permission group.

[0069] It should be noted that the permission groups correspond to levels S, A, B, C, D, and E, with the level of permissions decreasing from left to right. In other words, an S-level permission group has more permissions than an A-level permission group.

[0070] Users within the same permission group have the same level of permissions.

[0071] Step S12: Construct a fine-grained permission control model based on the permission group.

[0072] In this embodiment of the invention, to achieve a more granular division of permissions, role configurations can be further refined. For example, specific roles in each permission group can be configured to only perform read operations within a designated bucket, or another role can be allowed to have complete control over an object within a specific time frame. This application of on-demand allocation and the principle of least privilege ensures that users can only access the resources necessary for their work, effectively reducing potential security risks and the probability of accidental operations.

[0073] It should be noted that the role-based access control (RBAC) system is used to build a fine-grained access control model.

[0074] Among them, the fine-grained access control model provides a flexible and secure access management framework for complex organizational structures and ever-changing business scenarios.

[0075] To ensure the deployment trend of multi-cloud and hybrid cloud in enterprises, this invention makes full use of MinIO, the cross-platform capability of storage service, enabling users to migrate and synchronize data between different cloud environments or local data centers, while maintaining the consistency and scalability of permission policies.

[0076] Step S13: Encapsulate the corresponding token by using the permission and role information of each user in the fine-grained permission control model.

[0077] In the specific implementation step S13, the permissions and role information corresponding to each user in the fine-grained permission control model, as well as the user's unique identifier, are encapsulated to obtain the corresponding token, and the correspondence between the token and the user account is constructed.

[0078] Optionally, the user enters their account for accessing the storage service through the client. The server obtains the account and determines whether there is information corresponding to the account. If there is, the server determines that the account has successfully logged in and obtains a token matching the user's account and sends it to the client.

[0079] The token encapsulates all necessary permission information, including the user's unique identifier, role information, and other necessary permission details.

[0080] The token is a JSON Web Token (JWT), a modern and secure authentication mechanism. This token is signed with a public key using a preset encryption algorithm to ensure that its content is not tampered with during transmission, providing a reliable user identity verification basis for every subsequent interaction.

[0081] It should be noted that the preset encryption algorithm is set by technical personnel according to the actual situation, such as a symmetric encryption algorithm or an asymmetric encryption algorithm.

[0082] JWT tokens are used for mutual trust and collaboration between services. Since the token contains all the necessary permission information of the user, the storage service can make access control decisions based on the token to achieve fine-grained permission verification without additional permission synchronization or sharing of session context, thereby maintaining the independence and autonomy of microservices.

[0083] Furthermore, by adopting JWT as the core authentication mechanism, not only is the security level of user authentication enhanced, but the resource access process is also optimized. This ensures that user permissions are managed accurately, efficiently, and in a distributed manner every time they interact with the MinIO service, perfectly meeting the needs of modern cloud-native and distributed applications.

[0084] Step S14: Send the token to the user account corresponding to each user.

[0085] In the specific implementation of step S14, the token is sent to the user account corresponding to each user according to the correspondence between the token and the user account.

[0086] Optionally, the user triggers an access to the storage service through the client, which may include uploading files, downloading data, or performing other management operations. The client generates a data request based on the access to the storage service and sends the token as part of the data request header to the server along with the data request.

[0087] It should be noted that data requests can be HTTP requests, and storage services are the MinIO file system service.

[0088] In the specific implementation step S101, the server obtains the data request sent by the client, as well as the token it carries.

[0089] Step S102: Determine whether the user's authentication is successful. If the authentication is successful, proceed to step S103. If the authentication fails, output that the user is not allowed to access the storage service.

[0090] It should be noted that the specific implementation process of step S102 includes the following steps:

[0091] Step S31: Verify the integrity of the token carried in the data request. If the integrity verification passes, proceed to step S32. If the integrity verification fails, output that the user is not allowed to access the storage service.

[0092] In the specific implementation of step S31, the signature of the token is decrypted using the private key to determine whether the signature has been modified. If not, it indicates that the token has integrity, and step S32 is executed. If it has been modified, it indicates that the token does not have integrity, and the user is not allowed to access the storage service.

[0093] Optionally, it also includes: after executing step S31, obtaining the expiration date of the token, comparing it with the current date, determining whether the token has expired; if not, continuing to execute step S32; if so, outputting that the user is not allowed to access the storage service.

[0094] Step S32: Verify the authenticity of the token. If the verification passes, proceed to step S33. If the verification fails, output that the user is not allowed to access the storage service.

[0095] In the specific implementation of step S32, the unique identifier of the user in the token is compared with the identifier of the token corresponding to the user account stored on the server. If they match, the data contained in the token is verified to be permission and role information. If they do, the authenticity verification is passed, and step S33 is executed. If they do not match, or there is no permission and role information, the user is not allowed to access the storage service.

[0096] Step S33: Confirm that the user's identity verification has passed.

[0097] In this embodiment of the invention, the solution verifies the token to determine whether the sent data request has been tampered with. This allows for subsequent identification of the initiator of the current data request and its corresponding permission information via the token, eliminating the need to query the database or session storage again. This simplifies the frequent database queries or session management overhead of traditional authentication mechanisms, and the stateless design improves the system's scalability and response speed. Ultimately, this enhances the efficiency and security of data access.

[0098] Step S103: Perform permission verification based on the token in the data request. If the verification is successful, determine that the access operation corresponding to the data request can be executed, and proceed to step S104. If the verification fails, output information that the user is not allowed to access the storage service.

[0099] It should be noted that the specific implementation of step S103 includes the following steps:

[0100] Step S41: Determine whether the user has the permissions held in the token to perform the access operation corresponding to the data request. If so, proceed to step S42; otherwise, output that the user is not allowed to access the storage service.

[0101] In the specific implementation of step S41, it is determined whether there are permissions related to the operation corresponding to the data request in the token. If there are, step S42 is executed; if not, the user is not allowed to access the storage service.

[0102] Step S42: Determine whether there are other users accessing the service module corresponding to the data request. If there are, proceed to step S43; otherwise, proceed to step S104.

[0103] Since the operation corresponding to the data request refers to the operation performed on one or more service modules in the storage service, the operation corresponding to the data request can determine the one or more service modules that the operation needs to access. In the specific implementation of step S42, it is determined whether there are other users accessing the service module corresponding to the current data request. If there are, step S43 is executed; if not, step S104 is executed.

[0104] Optionally, each other user can trigger a corresponding data request via a mobile terminal to access the storage service.

[0105] Step S43: Determine whether the number of other users currently accessing the service module is greater than a preset number. If it is greater, it means that the access limit of the service module corresponding to the data request has been reached, and step S44 is executed. If not, it means that the service module corresponding to the data request can still be accessed, and step S104 is executed directly.

[0106] In the specific implementation of step S43, the number of users accessing the service module corresponding to the data request is used to determine whether the user can directly access the service module corresponding to the data request. When it is determined that the number of other users accessing the service module is greater than a preset number, it indicates that the access limit of the service module corresponding to the data request has been reached, and step S44 is executed. When it is determined that the number of other users accessing the service module is less than or equal to the preset number, it indicates that the service module corresponding to the data request can still be accessed, and step S104 is executed directly.

[0107] It should be noted that the preset quantity is set based on multiple experiments, and this embodiment of the invention does not limit it.

[0108] Step S44: Determine whether the user's permission group level is greater than the permission group level of other users. If it is greater, proceed to step S104. If it is less than or equal to, directly enter the waiting queue.

[0109] In the specific implementation of step S44, the level of the user's permission group is compared with the level of each other user's permission group. If the level of any other user's permission group is lower than the user's permission group level, the user can directly access the service module corresponding to the data request after a preset time, and step S104 is executed. If the level of all other users' permission groups is higher than the user's permission group level, the user is controlled to directly enter the waiting queue.

[0110] Optionally, before executing step S44, the system further includes sorting other users according to the permission group level from highest to lowest, outputting a prompt message to the client of the other user with the lowest level to suspend access, so that the other user can prepare, and controlling the other user with the lowest level to enter a waiting state when the preset time arrives.

[0111] Step S104: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0112] In the specific implementation step S104, it is determined that the user can perform the operation corresponding to the data request to access the storage service, that is, the file in the file system service MinIO under the service module corresponding to the data request.

[0113] To ensure the security of stored data, enhance the flexibility of data access, simplify operation and maintenance, and improve cross-platform compatibility and scalability, this invention implements fine-grained access control strategies to achieve robust protection for files and objects in MinIO.

[0114] In this embodiment of the invention, a fine-grained permission control model is constructed based on the role-based access control (RBAC) system to assign a corresponding token to each user; a data request carrying a token is received from the client, and the token is used as an authentication mechanism to realize the user's identity verification mechanism; then, when the user's identity verification is successful, permission verification is performed based on the token in the data request. If the verification is successful, it is determined that the access operation corresponding to the data request can be executed, and the operation corresponding to the data request is executed to access the corresponding service module in the storage service.

[0115] Based on the flowchart of a file processing method shown in the above embodiments of the present invention, the present invention also shows a flowchart of another file processing method, such as... Figure 2 As shown, the method includes:

[0116] Step S201: Obtain the permission requirements and access information for the storage service.

[0117] It should be noted that storage services refer to platforms that provide users with file access and management.

[0118] Permission requirements refer to the permissions required for each service in the storage service. Access information includes user account, user role, permissions, access time, and the services accessed.

[0119] Step S202: Construct an Access Control List (ACL) model based on the permission requirements and access information of the storage service.

[0120] Specifically, the initial model is trained using the permission requirements and access information of the storage service to obtain the trained initial model, which is then used to analyze and generate a set of ACL rules for each user in the file access system, i.e., the storage service. In other words, each user has their own corresponding ACL rules in the storage service.

[0121] The initial model is an over-integration of advanced machine learning algorithms and big data analysis algorithms.

[0122] It should be noted that the goal is to build a model that can automatically analyze ACLs, aiming to achieve intelligent simplification and optimization of ACL rule sets. This allows for the rapid identification of user access patterns and permission requirements through the ACL rules of each user in the file access system, automatically identifying and eliminating redundant access control rules, thereby refining the permission allocation logic and ensuring that the permission checking process is executed efficiently and accurately.

[0123] The present invention not only reduces the system's latency during access authorization through the above-described method, but also further enhances data security and the smoothness of resource access.

[0124] Optionally, the Access Control List (ACL) model allows for real-time updates of access permission assignments, enabling rapid adjustments to role-specific permission configurations based on organizational changes or security policy adjustments. All changes take effect immediately without service interruption or system restart. This enhances system flexibility and responsiveness, ensuring enterprises can quickly adjust permissions in rapidly changing environments, reduce redundancy, and optimize permission allocation logic to address various security challenges or meet new business needs.

[0125] In addition, the Access Control List (ACL) model also has predictive analytics capabilities. It can be trained based on user token information, historical access data, and user behavior patterns to provide better permission optimization suggestions for the current user, thereby predicting and avoiding potential access control risks.

[0126] This solution also incorporates a visual management interface, making even complex ACL structures clear at a glance, facilitating efficient management and auditing, and ensuring that the system's permission settings are always highly consistent with actual business needs, effectively supporting the organization's digital transformation and security compliance goals.

[0127] Optionally, the Access Control List (ACL) model can also intelligently optimize the ACL, supporting the setting of static access control rules, and also effectively controlling access based on dynamic rules and balancing principles.

[0128] Step S203: Receive the data request sent by the client.

[0129] It should be noted that the data request includes the user account information.

[0130] Step S204: Determine whether the user's authentication is successful. If the authentication is successful, proceed to step S205. If the authentication fails, output that the user is not allowed to access the storage service.

[0131] It should be noted that the specific implementation process of step S204 is the same as that of step S102 above, and they can be referred to each other.

[0132] Step S205: Determine the Access Control List (ACL) corresponding to the user account from the ACL model.

[0133] It should be noted that the data request includes the user account information.

[0134] In the specific implementation step S205, the model of the access control list (ACL) is traversed to determine the access control list (ACL) that matches the user account.

[0135] Step S206: Based on the data request and the access control list (ACL) corresponding to the user account, determine whether the operation corresponding to the data request can be executed. If yes, proceed to step S207; otherwise, output information that the user is not allowed to access the storage service.

[0136] In the specific implementation of step S206, it is determined whether the access control list (ACL) contains the permission to perform the access operation corresponding to the data request. If it does, step S207 is executed; otherwise, the user is not allowed to access the storage service.

[0137] Step S207: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0138] It should be noted that the specific implementation process of step S207 is the same as that of step S104 described above, and they can be referred to each other.

[0139] In this embodiment of the invention, the permission requirements and access information of the storage service are obtained to construct a model of the corresponding Access Control List (ACL); the ACL corresponding to the user account is determined from the ACL model; and the user is determined to have permission to perform the operation corresponding to the data request based on the ACL, thereby ensuring efficient execution of the permission check process and reducing access latency.

[0140] Optionally, based on the flowchart of a file processing method shown in the above embodiments of the present invention, combined with... Figure 1 See Figure 3 The method includes:

[0141] Step S301: Receive the data request sent by the client.

[0142] Step S302: Determine whether the user's authentication is successful. If the authentication is successful, proceed to step S303. If the authentication fails, output that the user is not allowed to access the storage service.

[0143] Step S303: Perform permission verification based on the token in the data request. If the verification is successful, determine that the access operation corresponding to the data request can be executed, and proceed to step S304. If the verification fails, output information that the user is not allowed to access the storage service.

[0144] Step S304: Execute the operation corresponding to the data request to access the file under the corresponding service module in the storage service.

[0145] Step S305: Record detailed information for each access operation of the storage service.

[0146] In the specific implementation of step S305, detailed information of each file access operation in the storage service is recorded, including operator authentication information, operation time, operation type (read / write / delete), target file, etc., to facilitate post-event review and compliance checks.

[0147] To build a comprehensive, granular audit trail system, it is necessary to record the message information of every file access operation.

[0148] It should be noted that the operator's identity authentication information, that is, the specific user or system process that performs the operation, and even the role group or department to which they belong, is used to trace individual responsibility and assess team behavior patterns.

[0149] Operation time, or operation timestamp accurate to the second, helps to reconstruct the event sequence and quickly locate the time window in which the problem occurred.

[0150] Operation types, which can distinguish between operations such as reading, modifying, adding content, or deleting files, are crucial for understanding data flow and change history, especially when it is necessary to trace back errors or investigate potential violations.

[0151] The target file, which is the complete path and attributes of the target file, specifically includes metadata such as filename, directory, file size, last modified time, as well as sensitivity tags or categories of the file, to help assess the potential scope and importance of each access.

[0152] Operation results and exception logs include details of routine operations, records of whether the operation was successful, and any error codes or exception information that occurred, facilitating troubleshooting and system optimization.

[0153] Record the details of access permission verification, including the specific permission check process before access, such as the verification basis, permission level, and whether the verification is passed, to ensure that each operation complies with the established security policy and compliance requirements.

[0154] Step S306: Construct a corresponding audit log based on the detailed information of each access operation to the storage service.

[0155] Optionally, audit logs are used to protect encrypted storage and access control, ensuring data integrity and privacy. Simultaneously, efficient log search, filtering, and analysis tools enable security administrators and compliance auditors to quickly locate critical events within large amounts of data, conducting post-event reviews, periodic audits, trend analysis, and compliance verification, effectively enhancing the organization's information security management capabilities and its ability to address regulatory compliance challenges.

[0156] Optionally, based on the processes of steps S301 to S306 above, an architectural flowchart can also be used for illustration, such as... Figure 4 As shown.

[0157] This invention employs the ELK log analysis system, namely the audit log, which records data within a reasonable and legal scope, including but not limited to operator authentication information, operation timestamps accurate to the second, detailed operation type identifiers, the complete path and attributes of the target file, operation results and exception records, and access permission verification details.

[0158] Figure 4 The proxy access data shown refers to the files under the corresponding service module in the storage service that the user's mobile terminal can access.

[0159] Optionally, the content shown above can also be accessed through... Figure 5 The architecture shown is explained.

[0160] The authentication mechanism is used to execute steps S301 and S302, the fine-grained access control model is used to execute step S303, the intelligent optimization of the access control list is used to execute steps S201 to S207, and the audit log is used to execute steps S305 and S306.

[0161] In this embodiment of the invention, a corresponding audit log is constructed by recording detailed information of each file access operation, so that subsequent review and compliance checks can be carried out quickly.

[0162] Based on the file processing method shown in the above embodiments of the present invention, correspondingly, the present invention provides a schematic diagram of the structure of a file processing device, as follows: Figure 6 The device includes:

[0163] The receiving unit 601 is used to receive a data request sent by a user based on a client, wherein the data request carries a corresponding token, and the token is pre-allocated to the corresponding user account;

[0164] Verification unit 602 is used to perform permission verification based on the token in the data request if it is determined that the user's identity verification is successful;

[0165] Access unit 603 is used to determine, if the verification is successful, that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

[0166] The specific principles and execution processes of each unit in the file processing device disclosed in the above embodiments of the present invention are the same as the corresponding contents in the file processing method provided in the above embodiments of the present invention. Please refer to the corresponding parts in the file processing method disclosed in the above embodiments of the present invention, and they will not be repeated here.

[0167] In this embodiment of the invention, a fine-grained permission control model is constructed based on the role-based access control (RBAC) system to assign a corresponding token to each user; a data request carrying a token is received from the client, and the token is used as an authentication mechanism to realize the user's identity verification mechanism; then, when the user's identity verification is successful, permission verification is performed based on the token in the data request. If the verification is successful, it is determined that the access operation corresponding to the data request can be executed, and the operation corresponding to the data request is executed to access the corresponding service module in the storage service.

[0168] Optionally, based on the file processing apparatus shown in the above embodiments of the present invention, the receiving unit 601 for the process of pre-allocating tokens to corresponding user accounts is specifically used for:

[0169] Based on the user's job function information and the business information they are responsible for, all users are grouped into permission groups to obtain multiple permission groups;

[0170] A fine-grained permission control model is constructed based on the aforementioned permission groups;

[0171] The corresponding token is obtained by encapsulating the permissions and role information of each user in the fine-grained permission control model.

[0172] The token is distributed to the user account corresponding to each user.

[0173] This involves grouping all users into permission groups based on their job functions and the business they are responsible for, resulting in multiple permission groups, including:

[0174] For each user, the role corresponding to the user is determined based on the user's functional information and the business information they are responsible for.

[0175] The users are grouped by their corresponding roles to obtain multiple permission groups.

[0176] Optionally, based on the file processing apparatus shown in the above embodiments of the present invention, the verification unit 602 for determining whether the user's authentication is successful is specifically used for:

[0177] The integrity and authenticity of the token carried in the data request are verified.

[0178] If the integrity verification and authenticity verification are successful, the user's identity verification is considered successful.

[0179] Optionally, in the file processing apparatus shown in the above embodiments of the present invention, the verification unit 602 for verifying permissions based on the token in the data request is specifically used for:

[0180] Based on the permissions held in the token, determine whether the user has performed an access operation corresponding to the data request;

[0181] If so, determine whether there are other users currently accessing the service module to which the data request is to be accessed;

[0182] If such a user exists, and it is determined that the number of other users currently accessing the site is greater than a preset number, then it is determined whether the permission group level of the user is greater than the permission group level of other users.

[0183] If the value is greater than the data request, execute the operation corresponding to the data request to access the file in the corresponding service module of the storage service.

[0184] Optionally, the document processing apparatus based on the above embodiments of the present invention further includes: a processing unit;

[0185] The processing unit is used to obtain the permission requirements and access information of the storage service;

[0186] A model of an Access Control List (ACL) is constructed based on the permission requirements and access information of the storage service.

[0187] Optionally, based on the file processing apparatus shown in the above embodiments of the present invention, the processing unit is further configured to record detailed information of each access operation of the storage service;

[0188] An audit log is constructed based on the detailed information of each access operation to the storage service.

[0189] This application provides an electronic device, which includes a processor and a memory. The memory contains program code and data for file processing, and the processor is used to call program instructions in the memory to execute steps as shown in the file processing method in the above embodiments.

[0190] This application provides a storage medium that includes a stored program, wherein the program controls the device where the storage medium is located to execute the file processing method shown in the above embodiments during runtime.

[0191] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0192] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0193] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A file processing method, characterized in that, The method includes: Receive data requests sent by users based on the client, the data requests carrying a corresponding token, the token being pre-allocated to the corresponding user account; If the user's authentication is successful, determine whether the user has the permissions to perform the access operation corresponding to the data request based on the token. If so, determine whether there are other users currently accessing the service module to which the data request is to be accessed; If such a user exists, and it is determined that the number of other users currently accessing the site is greater than a preset number, then it is determined whether the permission group level of the user is greater than the permission group level of other users. If the value is greater than the specified value, it is determined that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

2. The method according to claim 1, characterized in that, The process of pre-allocating tokens to corresponding user accounts includes: Based on the user's job function information and the business information they are responsible for, all users are grouped into permission groups to obtain multiple permission groups; A fine-grained permission control model is constructed based on the aforementioned permission groups; The corresponding token is obtained by encapsulating the permissions and role information of each user in the fine-grained permission control model. The token is distributed to the user account corresponding to each user.

3. The method according to claim 2, characterized in that, Based on users' job functions and the business they are responsible for, all users are grouped into permission groups, resulting in multiple permission groups, including: For each user, the role corresponding to the user is determined based on the user's functional information and the business information they are responsible for. The users are grouped by their corresponding roles to obtain multiple permission groups.

4. The method according to claim 1, characterized in that, Determining whether the user's authentication is successful includes: The integrity and authenticity of the token carried in the data request are verified. If the integrity verification and authenticity verification are successful, the user authentication is considered successful.

5. The method according to claim 1, characterized in that, Also includes: Obtain the permission requirements and access information for the storage service; A model of an Access Control List (ACL) is constructed based on the permission requirements and access information of the storage service.

6. The method according to claim 1, characterized in that, Also includes: Record detailed information for each access operation to the storage service; An audit log is constructed based on the detailed information of each access operation to the storage service.

7. A document processing device, characterized in that, The device includes: A receiving unit is used to receive data requests sent by users based on clients, wherein the data requests carry a corresponding token, and the token is pre-allocated to the corresponding user account; The verification unit is used to determine whether the user has performed an access operation corresponding to the data request based on the permissions held in the token if the user's authentication is successful; if so, to determine whether there are other users accessing the service module to be accessed by the data request; if so, and to determine that the number of other users accessing the service module is greater than a preset number, to determine whether the level of the permission group to which the user belongs is greater than the level of the permission group to which other users belong. An access unit is used to determine, if greater than 1, that the access operation corresponding to the data request can be executed to access the file under the corresponding service module in the storage service.

8. An electronic device, characterized in that, The electronic device is used to run a program, wherein the program executes the file processing method as described in any one of claims 1-6.

9. A storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to perform the file processing method as described in any one of claims 1-6.

Images