Desktop cloud file export control method and device

Abstract

The invention discloses a file export control method and device for desktop cloud, and relates to the field of computers.The method comprises the steps that in response to an uploading request for a first file, the first file is encrypted to obtain a second file; segmenting the second file to obtain a plurality of third files and a random storage directory corresponding to each third file; respectively storing the third file in a corresponding storage position in a storage server corresponding to the desktop cloud according to the respective corresponding random storage directory; wherein the third file is used for responding to an export request aiming at the first file to be exported to local electronic equipment from the storage server.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for controlling file export of a desktop cloud. Background Art

[0002] Currently, during the export process of desktop cloud files, file data may be intercepted, resulting in low file security.

[0003] Therefore, there is an urgent need for a technical solution that can improve file security during the desktop cloud file export process. Summary of the invention

[0004] In view of the above problems, the present application provides a method and device for controlling file export of a desktop cloud to achieve the purpose of improving file security. The specific scheme is as follows:

[0005] A first aspect of the present application provides a file export control method for a desktop cloud, the method comprising:

[0006] In response to an upload request for a first file, encrypting the first file to obtain a second file;

[0007] Splitting the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files;

[0008] The third files are stored in the corresponding storage locations of the storage servers corresponding to the desktop cloud according to the random storage directories corresponding to the third files;

[0009] The third file is used to be exported from the storage server to a local electronic device in response to an export request for the first file.

[0010] In a possible implementation, segmenting the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files includes:

[0011] According to the generated random number, the second file is divided to obtain a plurality of third files, and the number of the third files is consistent with the random number;

[0012] Generate a corresponding random string for each of the third files respectively;

[0013] A random storage directory is created for the corresponding third file according to the random character string, and the random character string is used as the file name of the third file in the random storage directory.

[0014] In a possible implementation, the method further includes:

[0015] Recording the file attributes corresponding to the first file into a database;

[0016] The file attributes include at least: the random storage directory of each of the third files corresponding to the first file and the export code corresponding to the first file, and the export code is used to uniquely identify the first file.

[0017] In a possible implementation, before encrypting the first file to obtain the second file, the method further includes:

[0018] Obtaining a file type corresponding to the first file;

[0019] According to the file type, obtaining the approval rule corresponding to the first file;

[0020] According to the approval rules, sending an approval request to the approval device to obtain the approval result fed back by the approval device according to the approval rules;

[0021] When the approval result indicates that the first file is allowed to be uploaded, a derived code is generated for the first file, where the derived code is used to uniquely identify the first file.

[0022] In a possible implementation, the file type includes: any one of a source code type, a document type, and an installation package type;

[0023] Among them, different file types correspond to different approval rules.

[0024] In a possible implementation, before obtaining the file type corresponding to the first file, the method further includes:

[0025] Calculating a current check code corresponding to the first file;

[0026] Compare the current verification code with the verification code carried in the upload request to obtain a comparison result;

[0027] If the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, executing: obtaining a file type corresponding to the first file;

[0028] If the comparison result indicates that the current verification code is inconsistent with the verification code carried in the upload request, a prompt message is sent to the uploading device corresponding to the upload request, and the prompt message is used to prompt the first file to be uploaded again.

[0029] A second aspect of the present application provides a file export control method for a desktop cloud, the method comprising:

[0030] In response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file is obtained; there are multiple third files, and the third files are obtained by encrypting and splitting the first file;

[0031] Reading each of the third files from the storage server corresponding to the desktop cloud according to the random storage directory;

[0032] Merging the third file to obtain a second file;

[0033] The second file is transmitted to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

[0034] In a possible implementation, obtaining a random storage directory corresponding to each third file corresponding to the first file includes:

[0035] According to the export code in the export request, a random storage directory corresponding to the export code is queried in a database to obtain a random storage directory corresponding to each third file corresponding to the first file.

[0036] A third aspect of the present application provides a file export control device for a desktop cloud, the device comprising:

[0037] a file encryption unit, configured to encrypt the first file in response to an upload request for the first file to obtain a second file;

[0038] A file segmentation unit, configured to segment the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files;

[0039] A file storage unit, used to store the third files in the corresponding storage locations of the storage server corresponding to the desktop cloud according to the random storage directories corresponding to the third files;

[0040] The third file is used to be exported from the storage server to a local electronic device in response to an export request for the first file.

[0041] A fourth aspect of the present application provides a file export control device for a desktop cloud, the device comprising:

[0042] A directory obtaining unit, configured to obtain, in response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file; the third files are multiple, and the third files are obtained by encrypting and splitting the first file;

[0043] A file reading unit, configured to read each of the third files from a storage server corresponding to the desktop cloud according to the random storage directory;

[0044] A file merging unit, used for merging the third file to obtain a second file;

[0045] The file transmission unit is used to transmit the second file to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

[0046] In a fifth aspect, the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the file export control method of the desktop cloud of the first aspect, the second aspect, or any implementation of the first aspect or the second aspect.

[0047] A sixth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0048] The memory is used to store computer programs;

[0049] The processor is used to execute the computer program so that the electronic device can implement the file export control method of the desktop cloud of the first aspect, the second aspect, or any implementation manner of the first aspect or the second aspect.

[0050] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the file export control method of the desktop cloud of the above-mentioned first aspect, second aspect, or any implementation of the first aspect or the second aspect.

[0051] By means of the above technical scheme, in a desktop cloud file export control method and device provided by the present application, in response to a file upload request, the file to be uploaded can be encrypted and split, so that the multiple split files are stored in corresponding storage locations in the storage server according to corresponding random storage directories, so that these files can be exported from the storage server to a local electronic device in response to the export request. In this process, the files are encrypted and are partial files that are split, so even if they are illegally intercepted, the original files cannot be restored, thereby improving file security. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0053] Figure 1 A flowchart of a method for controlling file export of a desktop cloud provided in an embodiment of the present application;

[0054] Figure 2 This is an architecture diagram of a desktop cloud and a local electronic device in an embodiment of the present application;

[0055] Figure 3 A partial flow chart of a method for controlling file export of a desktop cloud provided in an embodiment of the present application;

[0056] Figure 4 Another flow chart of a method for controlling file export of a desktop cloud provided in an embodiment of the present application;

[0057] Figure 5 Another flow chart of a method for controlling file export of a desktop cloud provided in an embodiment of the present application;

[0058] Figure 6 A flowchart of another desktop cloud file export control method provided in an embodiment of the present application.

[0059] Figure 7 A schematic diagram of the structure of a file export control device for a desktop cloud provided in an embodiment of the present application;

[0060] Figure 8 , Fig. 9 , Fig.10 Another structural schematic diagram of a file export control device for a desktop cloud provided in an embodiment of the present application;

[0061] Fig.11 A schematic diagram of the structure of another desktop cloud file export control device provided in an embodiment of the present application;

[0062] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0063] Fig.13 A deployment architecture diagram of the file export system implemented in an embodiment of the present application;

[0064] Fig.14 This is a flowchart of implementing file uploading in an embodiment of the present application;

[0065] Fig.15 This is a flowchart of implementing file uploading in an embodiment of the present application;

[0066] Fig.16 This is a schematic diagram of identifying the type of a PDF document in an embodiment of the present application;

[0067] Fig.17 This is an example diagram for identifying the source code type of C language in an embodiment of the present application;

[0068] Fig.18 The figure is a flowchart for implementing file export in an embodiment of the present application. DETAILED DESCRIPTION

[0069] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0070] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0071] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0072] Reference Figure 1 , is a flowchart of a file export control method for a desktop cloud provided in an embodiment of the present application. The method can be applied to a management server deployed on a desktop cloud, and the management server is used to manage the upload and export of files so that the uploaded files can be exported to a local electronic device, such as Figure 2 The technical solution in this embodiment is mainly used to improve the security of file uploading and exporting.

[0073] Specifically, the method in this embodiment may include the following steps:

[0074] Step 101: In response to an upload request for a first file, encrypt the first file to obtain a second file.

[0075] The upload request may be generated by the user accessing the export service page on the management server through a browser and performing corresponding operations. For example, the user fills out an upload application form on the export service page, which includes files to be uploaded, such as code files, image files, etc., and may also include verification codes corresponding to the files to be uploaded, such as verification codes based on the message digest algorithm MD5 (Message-Digest Algorithm 5). In response to the user's operation on the export service page, an upload request may be generated, which includes the file to be uploaded, namely the first file, and may also carry a verification code corresponding to the first file.

[0076] Specifically, in this embodiment, the encryption key may be used to encrypt the first file based on a corresponding encryption algorithm such as the Advanced Encryption Standard (AES) algorithm to obtain the second file. At the same time, the encryption key may be stored in a database in an encrypted manner.

[0077] Furthermore, in this embodiment, after obtaining the second file, the first file may be deleted to avoid leakage of the first file and ensure file security.

[0078] Step 102: split the second file to obtain a plurality of third files and a random storage directory corresponding to each third file.

[0079] In this embodiment, the second file may be segmented according to a specific number, and corresponding random storage directories may be generated for each of the multiple segmented third files.

[0080] Step 103: The third files are stored in the corresponding storage locations of the storage servers corresponding to the desktop cloud according to their corresponding random storage directories.

[0081] The third file is used to export from the storage server to a local electronic device in response to an export request for the first file. Specifically, in this embodiment, in response to an export request for the first file, a random storage directory corresponding to each third file corresponding to the first file can be obtained first, and then, according to the random storage directory, each third file can be read from the storage server corresponding to the desktop cloud, and then the third files can be merged, and then the obtained second file can be transmitted to the local electronic device, so that the local electronic device can decrypt the second file to obtain the first file.

[0082] By means of the above technical scheme, in a file export control method for a desktop cloud provided by the present application, in response to a file upload request, the file to be uploaded can be encrypted and split, so that the multiple split files are stored in corresponding storage locations in the storage server according to corresponding random storage directories, so that these files can be exported from the storage server to a local electronic device in response to the export request. In this process, the files are encrypted and are partial files that are split, so even if they are illegally intercepted, the original files cannot be restored, thereby improving file security.

[0083] In one implementation, in this embodiment, the file attribute corresponding to the first file may also be recorded in a database.

[0084] The file attributes of the first file include at least: a random storage directory of each third file corresponding to the first file and a derived code corresponding to the first file, where the derived code is used to uniquely characterize the first file.

[0085] It should be noted that the export code corresponding to the first file can be generated before the first file is encrypted.

[0086] Specifically, in this embodiment, the export code can be generated according to the name of the upload requester corresponding to the first file, the upload application time, the file name of the first file, etc. For example, in this embodiment, the name of the upload requester, the upload application time, and the file name of the first file are used as input parameters, and the underlying interface provided by the operating system of the management server is called to access the random number source, and the generated random number is used as the export code. The export code is recorded in the database.

[0087] Based on this, the export request for the first file can carry an export code, and the export code is used to represent the need to export the first file. Based on this, the random storage directory corresponding to each third file corresponding to the first file can be queried in the database according to the export code in the export request, and then each third file can be read according to these random storage directories, and then the third files are merged to obtain the second file, and after transmitting it to the local electronic device, the electronic device can query the encryption key corresponding to the first file in the database, and based on this, the electronic device can decrypt the second file according to the decryption key corresponding to the queried encryption key to obtain the first file.

[0088] In one implementation, the segmentation of the second file in step 102 to obtain a plurality of third files and a random storage directory corresponding to each third file can be implemented in the following manner: Figure 3 middle:

[0089] Step 301: split the second file according to the generated random number to obtain a plurality of third files.

[0090] The number of the third file is consistent with the random number.

[0091] For example, in this embodiment, a random number N of 3 to 9 digits may be generated by a random algorithm, and then the second file may be divided according to the random number N to obtain N third files.

[0092] Specifically, in this embodiment, the file segmentation size can be determined according to the file size of the second file and the random number N; for example, the file size of the second file is divided by the random number N to obtain the file segmentation size; then, according to the file segmentation size, multiple third files of corresponding sizes are segmented from the second file.

[0093] Step 302: Generate a corresponding random character string for each third file respectively.

[0094] The number of random character strings is consistent with the number of third files, and there is a one-to-one correspondence between the random character strings and the third files.

[0095] For example, in this embodiment, an open source cryptographic toolkit such as openssl may be called to generate N 8-bit random strings, such as string1, string2, ..., stringN, each of which corresponds to a third file.

[0096] Step 303: Create a random storage directory for the corresponding third file according to the random character string.

[0097] The random character string is used as the file name of the third file in the random storage directory.

[0098] Specifically, in this embodiment, corresponding random storage directories can be created according to random character strings, such as / opt / data / string1, / opt / data / string2, ..., / opt / data / stringN, each of which corresponds to a third file. The random storage directory contains a random character string, and the random character string is used as the file name of the corresponding third file. That is to say, the third file no longer uses the original file name of the first file, thereby avoiding the file being intercepted according to the file name, thereby improving file security.

[0099] In one implementation, before encrypting the first file in step 101 to obtain the second file, the method in this embodiment may further include the following processing: Figure 4 As shown in:

[0100] Step 104: Obtain the file type corresponding to the first file.

[0101] The file type may include any one of a source code type, a document type, and an installation package type. In this embodiment, after decompressing the first file, the first file may be scanned to obtain the file type of the first file, and then the file type of the first file may be recorded in the database.

[0102] Step 105: Obtain the approval rules corresponding to the first file according to the file type.

[0103] Different file types correspond to different approval rules. Each file type corresponds to a set of approval rules. For example, the source code type corresponds to the approval rules of the source code; the document type corresponds to the approval rules of the document; and the installation package type corresponds to the approval rules of the installation package.

[0104] Step 106: According to the approval rules, send the approval request to the approval device to obtain the approval result fed back by the approval device according to the approval rules.

[0105] Specifically, in this embodiment, the approval rules are added to the approval request, and the approval request is sent to the approval device, which is an electronic device used by the approver; after receiving the approval request, the approval device provides the approval rules to the approver, who then approves the approval request with reference to the approval rules and sets the approval result; the approval device feeds back the approval result to the management server in this embodiment. It can be seen that in this embodiment, by providing the approval rules to the approval device, the accuracy and efficiency of the approver's approval of the document can be improved.

[0106] The approval result may indicate whether the first file is allowed to be uploaded.

[0107] Step 107: Determine whether the approval result indicates that the first file upload is allowed. If the approval result indicates that the first file upload is allowed, execute step 108; if the approval result indicates that the first file upload is not allowed, output a prompt message to prompt the upload requester to re-upload the file.

[0108] Step 108: Generate a derived code for the first file, where the derived code is used to uniquely identify the first file, and then execute step 101.

[0109] Specifically, in step 108, the export code may be generated according to the name of the upload requester corresponding to the first file, the upload application time, the file name of the first file, and the like.

[0110] For example, in this embodiment, the name of the upload requester, the upload application time, and the file name of the first file are used as input parameters, and the underlying interface provided by the operating system of the management server is called to access the random number source, and the generated random number is used as the export code, and the export code is then recorded in the database.

[0111] In one implementation, before obtaining the file type corresponding to the first file in step 104, the present embodiment may further include the following steps: Figure 5 As shown in:

[0112] Step 109: Calculate the current verification code corresponding to the first file.

[0113] Specifically, in this embodiment, the check code calculation may be performed on the first file according to MD5 to obtain the current check code.

[0114] Step 110: Compare the current verification code with the verification code carried in the upload request to obtain a comparison result.

[0115] Step 111: Determine whether the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request. If the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, execute step 104; if the comparison result indicates that the current verification code is inconsistent with the verification code carried in the upload request, execute step 112.

[0116] If the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, it means that there is no error in uploading the first file, and then step 104 is executed to obtain the file type corresponding to the first file.

[0117] Step 112: Send a prompt message to the uploading device corresponding to the upload request, where the prompt message is used to prompt the user to re-upload the first file.

[0118] It should be noted that if the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, the current verification code or the verification code carried in the upload request can be recorded in the database. Based on this, the database can contain the name of the upload requester corresponding to the first file, the unit or department to which the upload requester belongs, the upload application time, the file name of the first file, the verification code corresponding to the first file, the export code of the first file, the file type of the first file, the encryption key and decryption key corresponding to the first file, and the random storage directory of each third file corresponding to the first file.

[0119] refer to Figure 6 , is a flowchart of a method for controlling file export of a desktop cloud provided in an embodiment of the present application. The method can be applied to a management server deployed on a desktop cloud. The management server is used to manage the upload and export of files so that the uploaded files can be exported to a local electronic device, such as Figure 2 The technical solution in this embodiment is mainly used to improve the security of file uploading and exporting.

[0120] Specifically, the method in this embodiment may include the following steps:

[0121] Step 601: In response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file is obtained.

[0122] There are multiple third files, and the third files are obtained by encrypting and splitting the first files. The specific method of obtaining the third files can refer to the above embodiments and will not be described in detail here.

[0123] Specifically, in step 601, the random storage directory corresponding to the export code can be queried in the database according to the export code in the export request to obtain the random storage directory corresponding to each third file corresponding to the first file, such as / opt / data / string1, / opt / data / string2, ..., / opt / data / stringN.

[0124] Step 602: Read each third file from the storage server corresponding to the desktop cloud according to the random storage directory.

[0125] The storage server is a server assigned to the unit or department to which the upload requester belongs, and the storage server is used to provide storage services for all persons in the unit or department.

[0126] Step 603: Merge the third file to obtain the second file.

[0127] In this embodiment, each third file can be merged to obtain the second file according to the association relationship between the random strings representing the file names of the third files contained in the random storage directory corresponding to each third file, such as the association relationship from 1 to N between string1, string2, ..., stringN.

[0128] Step 604: The second file is transmitted to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

[0129] Specifically, the electronic device may query the encryption key corresponding to the export code in the export request from the database, and then use the queried encryption key to decrypt the second file to obtain the first file, that is, the original file.

[0130] By means of the above technical solution, in a file export control method of a desktop cloud provided by the present application, in response to a file upload request, the file to be uploaded can be encrypted and split, so that the split multiple files are stored in the corresponding storage locations in the storage server according to the corresponding random storage directories. In this way, these files can be exported from the storage server to the local electronic device in response to the export request, and when a user needs to export these files to the local electronic device, each file can be read according to the random storage directory and then merged, and then transmitted to the local electronic device and decrypted. Therefore, even if it is intercepted during the export process, the original file will not be restored, thereby improving security.

[0131] A method for controlling the export of files in a desktop cloud provided in an embodiment of the present application is described above. A device for executing the method for controlling the export of files in a desktop cloud is described below.

[0132] See also Figure 7 , is a structural diagram of a file export control device for a desktop cloud provided in an embodiment of the present application. The device can be deployed on a management server deployed on the desktop cloud. The management server is used to manage the upload and export of files so that the uploaded files can be exported to a local electronic device, such as Figure 2 The technical solution in this embodiment is mainly used to improve the security of file uploading and exporting.

[0133] Specifically, the device in this embodiment may include the following units:

[0134] A file encryption unit 701, configured to encrypt a first file in response to an upload request for the first file to obtain a second file;

[0135] A file segmentation unit 702 is used to segment the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files;

[0136] The file storage unit 703 is used to store the third files in the corresponding storage locations of the storage server corresponding to the desktop cloud according to the random storage directories corresponding to the third files;

[0137] The third file is used to be exported from the storage server to a local electronic device in response to an export request for the first file.

[0138] By means of the above technical scheme, in a file export control device of a desktop cloud provided by the present application, in response to a file upload request, the file to be uploaded can be encrypted and split, so that the multiple split files are stored in corresponding storage locations in the storage server according to corresponding random storage directories, so that these files can be exported from the storage server to a local electronic device in response to the export request. In this process, the files are encrypted and are partial files that are split, so even if they are illegally intercepted, the original files cannot be restored, thereby improving file security.

[0139] In one implementation, the file segmentation unit 702 is specifically used to: segment the second file according to the generated random number to obtain multiple third files, and the number of the third files is consistent with the random number; generate a corresponding random string for each of the third files; and create a random storage directory for the corresponding third file based on the random string, and the random storage directory uses the random string as the file name of the third file.

[0140] In one implementation, the device in this embodiment may further include the following units: Figure 8 As shown in:

[0141] An information recording unit 704, configured to record the file attributes corresponding to the first file into a database;

[0142] The file attributes include at least: the random storage directory of each of the third files corresponding to the first file and the export code corresponding to the first file, and the export code is used to uniquely identify the first file.

[0143] In one implementation, the device in this embodiment may further include the following units: Fig. 9 As shown in:

[0144] The approval processing unit 705 is used to obtain the file type corresponding to the first file before the file encryption unit 701 encrypts the first file to obtain the second file; obtain the approval rule corresponding to the first file according to the file type; send an approval request to the approval device according to the approval rule to obtain the approval result fed back by the approval device according to the approval rule; if the approval result indicates that the first file is allowed to be uploaded, generate an export code for the first file, and the export code is used to uniquely identify the first file.

[0145] The file type includes: any one of a source code type, a document type, and an installation package type; different file types correspond to different approval rules.

[0146] In one implementation, the device in this embodiment may further include the following units: Fig.10 As shown in:

[0147] The file verification unit 706 is used to calculate the current verification code corresponding to the first file before the approval processing unit 705 obtains the file type corresponding to the first file; compare the current verification code with the verification code carried in the upload request to obtain a comparison result; if the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, execute the following: obtain the file type corresponding to the first file; if the comparison result indicates that the current verification code is inconsistent with the verification code carried in the upload request, send a prompt message to the upload device corresponding to the upload request, and the prompt message is used to prompt the re-upload of the first file.

[0148] It should be noted that the specific implementation method of each unit in this embodiment can refer to the corresponding content in the previous text and will not be described in detail here.

[0149] refer to Fig.11 , is a structural diagram of a file export control device for a desktop cloud provided in an embodiment of the present application. The device can be deployed on a management server deployed on the desktop cloud. The management server is used to manage the upload and export of files so that the uploaded files can be exported to a local electronic device, such as Figure 2 The technical solution in this embodiment is mainly used to improve the security of file uploading and exporting.

[0150] Specifically, the device in this embodiment may include the following units:

[0151] The directory obtaining unit 1101 is used to obtain, in response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file; there are multiple third files, and the third files are obtained by encrypting and splitting the first file;

[0152] The file reading unit 1102 is used to read each of the third files from the storage server corresponding to the desktop cloud according to the random storage directory;

[0153] A file merging unit 1103, configured to merge the third file to obtain a second file;

[0154] The file transmission unit 1104 is used to transmit the second file to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

[0155] By means of the above technical solution, in a file export control device for a desktop cloud provided by the present application, in response to a file upload request, the file to be uploaded can be encrypted and segmented, so that the multiple segmented files are stored in the corresponding storage locations in the storage server according to the corresponding random storage directories. In this way, these files can be exported from the storage server to a local electronic device in response to the export request, and when a user needs to export these files to a local electronic device, each file can be read according to the random storage directory and then merged, and then transmitted to the local electronic device and decrypted. Therefore, even if it is intercepted during the export process, the original file will not be restored, thereby improving security.

[0156] In one implementation, the directory obtaining unit 1101 is specifically used to: according to the export code in the export request, query the random storage directory corresponding to the export code in the database to obtain the random storage directory corresponding to each third file corresponding to the first file.

[0157] The present application also provides an electronic device, namely the management server mentioned above, such as Fig.12 As shown in , it includes at least one processor 1201 and a memory 1202 connected to the processor 1201, wherein:

[0158] The memory is used to store computer programs;

[0159] The processor is used to execute the computer program so that the electronic device can implement the desktop cloud file export control method described in any of the above embodiments.

[0160] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any desktop cloud file export control method provided in the embodiment of the present application.

[0161] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any desktop cloud file export control method provided in an embodiment of the present application.

[0162] The following is an example of the technical solution of this application:

[0163] In the desktop cloud system, all data is stored on the cloud server, and no data is saved on the user's local device (i.e., the local electronic device mentioned above). When a user needs to export data, he must apply to the system administrator for permission to export data. After reviewing and confirming the user's request, the administrator will open the corresponding export permission for them, allowing the user to operate and export the required data by themselves.

[0164] In view of this, this application mainly solves the problem of security and controllability of desktop cloud data export process, and ensures data security from being leaked during the export process and file storage process.

[0165] First of all, this application is committed to proposing an innovative method to introduce an additional approval link in the data export process. The purpose of this link is to further strengthen the security of data and ensure that data leakage and abuse can be effectively prevented during the data export process. An approval link is added during the data export process to ensure that only authorized personnel can perform data export operations.

[0166] In addition, in order to further improve the security of data export, this application uses random sharding technology to process the exported data (i.e., files). By dividing the data into multiple random fragments, even if the data is intercepted during transmission, it is difficult for attackers to obtain complete data information. This sharding technology can effectively improve the security of data and prevent data from being illegally obtained during transmission.

[0167] Moreover, in order to further enhance the security of data, this application adopts a random path saving method. This means that the exported data will be saved on multiple randomly generated paths instead of fixed paths. In this way, even if an attacker can obtain part of the data, it is difficult to trace the complete data path, thereby further improving the security of the data.

[0168] Finally, in order to ensure the security of data during the export process, this application encrypts the exported data. By adopting advanced encryption algorithms, even if the data is intercepted during transmission, the attacker cannot decipher the data content. This encryption method can effectively prevent the data from being illegally obtained and interpreted during transmission, thereby ensuring the security of the data.

[0169] In summary, this application proposes a comprehensive method to comprehensively enhance the security of data export by adding approval links, adopting random sharding technology, random path storage, and encryption processing. These measures can effectively prevent data leakage and abuse, and ensure the security and integrity of data during the export process.

[0170] The file export system implemented in this application consists of three parts: an export service (ExportService) for users to apply for export, a file server (i.e., storage server) from department 1 to department M, and a file export client (exportClient). The file server is determined according to the number of departments, and the deployment architecture is as follows: Fig.13 as shown in .

[0171] Specific business processes such as Fig.14 As shown in . In this process, the uploading user first submits an upload application through the export client. Subsequently, the export service scans the received uploaded file (i.e., the first file) to identify the file type. The approval leader makes an approval decision based on the approval rules corresponding to the file type. If the approval is passed, the export service will perform security processing on the uploaded file, such as encryption and segmentation, and then store it in the corresponding file storage server. Finally, the processed file (i.e., the third file) is exported through the export client.

[0172] Among them, the approval leaders are composed of leaders of departments at all levels, and the levels can be specified according to the organizational structure. For example, the approval level can be 2 levels, the first-level approver is the superior leader of the current export applicant, the second-level approver is the leader of the previous level, and so on. Approver can only view the data under his own organization, and data between different departments cannot be viewed by each other. The file server where the export data is stored is independently deployed between departments and isolated from each other.

[0173] The specific file upload process is as follows Fig.15 As shown in the following:

[0174] Step 1501: The user needs to access the export page through a browser and fill out an application form, which includes the export file content (such as code file, image ISO file), upload the file A to be exported (i.e., the first file, file A is compressed) and the MD5 value of the file.

[0175] It should be noted that in this embodiment, the files to be exported are packaged into one file.

[0176] Step 1502: After receiving the upload application, the export service (ExportService) will perform MD5 verification on the uploaded file to confirm whether the MD5 value of the file uploaded by the user is consistent with the MD5 value filled in by the user. If not, the user is notified to resubmit. At the same time, in this embodiment, the name of the exporter, the upload application time, the file name, the MD5 value and the department name can be recorded in the database. Among them, the user's department and the exporter have been set when the system is initialized.

[0177] Step 1503: The export service will perform a detailed scan on the decompressed file, focus on examining the file type, and record the file type identified after the file decompression operation, specifically: save the file type in the database.

[0178] Among them, the file types mainly include: installation package types (such as rpm, deb, ISO, etc.), document types (such as doc, txt, pdf, etc.) and source code types (such as C language code, java code, etc.). In this embodiment, three approval rule groups are defined according to the file type, namely, the approval rule group for the installation package, the approval rule group for the source code, and the approval rule for the document type.

[0179] Specifically, in this embodiment, after obtaining the attribute of the object, that is, the file type, it is matched with the approval rule group. For example, in this embodiment, the object type, that is, the file type, can be obtained through the file command, such as Fig.16 As shown in the pdf document type, Fig.17 The C language source code types are shown in the figure.

[0180] Step 1504: Use the AES algorithm to encrypt file A to generate an encrypted file B. After the encryption is completed, the source file A will be completely deleted, and the encryption key will be saved in the database. The key storage is stored in an encrypted manner.

[0181] Step 1505: Generate a 3 to 9-digit random number N through a random algorithm, then use the dd command (a tool provided by the Linux system) to split the file B to generate files such as B1, B2 to BN. After the splitting is completed, the original file B is completely deleted.

[0182] The specific process is as follows:

[0183] (1) Call the random algorithm module random to generate the random number N;

[0184] (2) Calculate the size S of the split file and the size of each file s1 = S / N;

[0185] (3) Split by dd method, such as: dd if=O of=O1 bs=s1 count=1, that is, split file B according to the size of s1. Among them, N, O1~ON are saved in the database.

[0186] Step 1506: Generate N 8-bit strings by calling openssl (open source cryptographic toolkit), and use these strings to create N random storage directories, which are used to store the corresponding divided files, such as random1 / B1, random2 / B2 to randomN / BN.

[0187] The specific process is as follows:

[0188] (1) Generate N random strings by calling the openssl library (openssl rand -base64 32) string1, stringN;

[0189] (2) Use these strings to create N directories, namely / opt / data / string1 and / opt / data / stringN, to store the corresponding files.

[0190] The complete storage path is / opt / data / string1 / O1, / opt / data / string2 / O2, ..., / opt / data / stringN / ON.

[0191] Step 1507: The N files are respectively transferred to the file storage server of the user's department, and the relevant information of random1 / B1, random2 / B2 to randomN / BN is recorded in the database.

[0192] Specifically, N folders are transferred to the file storage server of the user's department respectively, and / opt / data / string1 / O1, / opt / data / string2 / O2, ..., / opt / data / stringN / ON are recorded in the database, and these path information (ie, random storage directories) are updated in the database in sequence.

[0193] Step 1508: Create a new approval node and notify the first-level approver (superior leader) for approval. The approval content includes the file name, export description and scan results. The first-level approver will make a decision based on the export application description filled in by the user and the automatic scan results.

[0194] Among them, after the first-level approver approves it, the approval flow is transferred to the second-level approver (a higher-level leader), and the second-level approver makes a decision based on the approval results of the first-level approver and the application content.

[0195] Step 1509: After the second-level approver approves the application, the process flows to the exporter node and notifies the corresponding export administrator. At the same time, a 16-digit export code (EScode) is generated in this embodiment.

[0196] The export code is based on the user login name (that is, the user name of the uploading user), application time, and export file name as input parameters. The underlying interface provided by the operating system is called to access the random number source to generate a random number, which is then updated to the database. This method has high unpredictability and security to prevent the export code from being predicted.

[0197] Step 1510: Each process node notifies the applicant, i.e. the exporting user, via email. The email content will contain the decryption key information (i.e. the decryption key that matches the encryption key) and the approval result.

[0198] The export process is as follows Fig.18 As shown in:

[0199] Step 1801: The operator, ie, the exporting user, logs in to the designated virtual machine allocated by the desktop cloud, starts the export tool, ie, the export client (ExportClient), and enters a designated export code (EScode).

[0200] Step 1802: After the export service (ExportService) receives the request from ExportClient, it returns the relevant information of the export request to the client according to EScode. The information mainly includes the applicant's name, the number of copies of the file, the file storage location, i.e., the random storage directory and other field information.

[0201] Step 1803: The export client requests slice files such as B1, B2 to BN from the export service according to the returned information (random storage directory of the file, number of file splits).

[0202] Step 1804: After the export service downloads the slice files to the export client, the export client merges the slice files B1, B2, ...BN to form a new file B. The slice files are completely deleted from the virtual machine where the export client is located.

[0203] Step 1805: export the new file B from the virtual machine to the terminal, i.e., the local electronic device;

[0204] Step 1806: The terminal decrypts file B according to the decryption key in the email to obtain file A.

[0205] It can be seen that the technical solution of this application has the following advantages:

[0206] (1) This application implements refined control over user exported data and automatically scans files, providing export reviewers with effective decision-making and evaluation criteria, i.e., approval rules. For example, if a user applies to export a document that also includes source code files, automatic scanning can quickly reveal that the exported content is non-compliant;

[0207] (2) During the export process, this application encrypts and randomly splits the files and saves them in randomly distributed paths, thereby ensuring that even if the system is attacked, the data is difficult to steal.

[0208] (3) This application has designed an approval mechanism. When users apply to export data, they need to go through approval. Approval personnel can make decisions based on the detailed report and risk assessment results provided by this application. In addition, each step in the approval process will be recorded to form a complete audit log for subsequent tracking and responsibility attribution;

[0209] (4) In order to deal with internal threats, this application has designed a data isolation strategy. According to the user's role and authority, the exporter can be restricted to export only the data of the department he is responsible for, thereby effectively preventing internal personnel from exceeding their authority.

[0210] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0211] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0212] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0213] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for controlling file export of a desktop cloud, characterized in that: The method comprises: In response to an upload request for a first file, encrypting the first file to obtain a second file; Splitting the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files; The third files are stored in the corresponding storage locations of the storage servers corresponding to the desktop cloud according to the random storage directories corresponding to the third files; The third file is used to be exported from the storage server to a local electronic device in response to an export request for the first file.

2. The method according to claim 1, characterized in that: The second file is segmented to obtain a plurality of third files and a random storage directory corresponding to each of the third files, including: According to the generated random number, the second file is divided to obtain a plurality of third files, and the number of the third files is consistent with the random number; Generate a corresponding random string for each of the third files respectively; A random storage directory is created for the corresponding third file according to the random character string, and the random character string is used as the file name of the third file in the random storage directory.

3. The method according to claim 1, characterized in that The method further comprises: Recording the file attributes corresponding to the first file into a database; The file attributes include at least: the random storage directory of each of the third files corresponding to the first file and the export code corresponding to the first file, and the export code is used to uniquely identify the first file.

4. The method according to claim 1, characterized in that Before encrypting the first file to obtain the second file, the method further includes: Obtaining a file type corresponding to the first file; According to the file type, obtaining the approval rule corresponding to the first file; According to the approval rules, sending an approval request to the approval device to obtain the approval result fed back by the approval device according to the approval rules; When the approval result indicates that the first file is allowed to be uploaded, a derived code is generated for the first file, where the derived code is used to uniquely identify the first file.

5. The method according to claim 4, characterized in that The file type includes: any one of a source code type, a document type, and an installation package type; Among them, different file types correspond to different approval rules.

6. The method according to claim 4, characterized in that Before obtaining the file type corresponding to the first file, the method further includes: Calculating a current checksum corresponding to the first file; Compare the current verification code with the verification code carried in the upload request to obtain a comparison result; If the comparison result indicates that the current verification code is consistent with the verification code carried in the upload request, obtaining the file type corresponding to the first file is performed; If the comparison result indicates that the current verification code is inconsistent with the verification code carried in the upload request, a prompt message is sent to the uploading device corresponding to the upload request, and the prompt message is used to prompt the first file to be uploaded again.

7. A method for controlling file export of a desktop cloud, characterized in that: The method comprises: In response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file is obtained; there are multiple third files, and the third files are obtained by encrypting and splitting the first file; Reading each of the third files from the storage server corresponding to the desktop cloud according to the random storage directory; Merging the third files to obtain a second file; The second file is transmitted to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

8. The method according to claim 7, characterized in that Obtaining a random storage directory corresponding to each third file corresponding to the first file includes: According to the export code in the export request, a random storage directory corresponding to the export code is queried in a database to obtain a random storage directory corresponding to each third file corresponding to the first file.

9. A file export control device for a desktop cloud, characterized in that: The device comprises: a file encryption unit, configured to encrypt the first file in response to an upload request for the first file to obtain a second file; A file segmentation unit, configured to segment the second file to obtain a plurality of third files and a random storage directory corresponding to each of the third files; A file storage unit, used to store the third files in the corresponding storage locations of the storage server corresponding to the desktop cloud according to the random storage directories corresponding to the third files; The third file is used to be exported from the storage server to a local electronic device in response to an export request for the first file.

10. A file export control device for a desktop cloud, characterized in that: The device comprises: A directory obtaining unit, configured to obtain, in response to an export request for a first file, a random storage directory corresponding to each third file corresponding to the first file; the third files are multiple, and the third files are obtained by encrypting and splitting the first file; A file reading unit, configured to read each of the third files from a storage server corresponding to the desktop cloud according to the random storage directory; A file merging unit, used for merging the third file to obtain a second file; The file transmission unit is used to transmit the second file to a local electronic device, and the electronic device is used to decrypt the second file to obtain the first file.

Images