File processing method and device, storage medium, electronic equipment and program product

Abstract

The invention relates to a file processing method and device, a storage medium, electronic equipment and a program product. The file storage node responds to a received file obtaining instruction sent by the terminal, and the type of the file obtaining instruction is analyzed through the service process; determining to-be-desensitized file data from a first file stored on a file storage node based on the type of the file acquisition instruction, the first file being a file indicated by the file acquisition instruction; and loading the first plug-in on the file storage node through the service process, desensitizing the to-be-desensitized file data, and sending the desensitized data to the terminal. Thus, remote automatic desensitization processing of the to-be-desensitized file data can be realized on the file storage node through the service process, manual desensitization processing is not needed, the situation that the non-desensitized file data is downloaded to a local terminal or other hosts is avoided, and the safety of the file data is improved.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet information technology, and in particular, to a file processing method, device, storage medium, electronic device and program product. Background Art

[0002] In the process of building and operating Internet information systems (such as social media platforms, e-commerce websites, financial service websites, enterprise information systems, etc.), the construction, startup and initialization of the system often rely on many related configuration files, and business data files are constantly generated during the operation of the system. These files are usually stored in a dedicated FSS (FileStorage Server) cluster, where the FSS cluster includes multiple nodes, including servers (or "file storage servers") and file storage nodes.

[0003] In the daily operation and maintenance of the system, when upgrades or failures occur, R&D personnel need to obtain relevant files from the FSS cluster for modification in order to achieve system maintenance or troubleshooting. Since files stored on the FSS cluster may contain sensitive information, they need to be desensitized before being provided to R&D personnel. Summary of the invention

[0004] The purpose of the present disclosure is to provide a file processing method, device, storage medium, electronic device and program product.

[0005] In a first aspect, the present disclosure provides a file processing method, which is applied to a file storage node in a data center, and the method comprises: In response to receiving the file acquisition instruction sent by the terminal, parsing the type of the file acquisition instruction through the service process on the file storage node; Based on the type of the file acquisition instruction, determine the file data to be desensitized from a first file stored on the file storage node, where the first file is the file indicated by the file acquisition instruction; The first plug-in on the file storage node is loaded through a service process, the file data to be desensitized is desensitized, and the desensitized data is sent to the terminal.

[0006] In a second aspect, the present disclosure provides a file processing device, which is applied to a file storage node in a data center, and the device includes: A type determination module, configured to, in response to receiving a file acquisition instruction sent by a terminal, parse the type of the file acquisition instruction through a service process on the file storage node; A module for determining data to be desensitized, used to determine the file data to be desensitized from a first file stored on the file storage node based on the type of the file acquisition instruction, where the first file is the file indicated by the file acquisition instruction; The desensitization processing module is used to load the first plug-in on the file storage node through a service process, perform desensitization processing on the file data to be desensitized, and send the desensitized data to the terminal.

[0007] In a third aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect of the present disclosure.

[0008] In a fourth aspect, the present disclosure provides an electronic device, including: a memory having a computer program stored thereon; A processor is used to execute the computer program in the memory to implement the steps of the method described in the first aspect of the present disclosure.

[0009] In a fifth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect of the present disclosure.

[0010] Through the above technical solution, the file storage node of the data center responds to receiving the file acquisition instruction sent by the terminal, and parses the type of the file acquisition instruction through the service process on the file storage node, determines the file data to be desensitized from the first file stored on the file storage node based on the type, and loads the first plug-in on the file storage node through the service process, desensitizes the file data to be desensitized, and then sends the desensitized data to the terminal. In this way, through the service process on the file storage node, remote automatic desensitization processing of the file data to be desensitized can be implemented on the file storage node, without manual desensitization processing, and avoiding downloading un-desensitized file data to the local terminal or other unauthorized hosts, and there is no need to transmit the file data to be desensitized to the server, thereby improving the security of the file data while making full use of the computing power of the file storage node, saving the resource overhead of the server, and improving the efficiency of file processing.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings: Figure 1The figure is a flowchart of a file processing method according to an exemplary embodiment.

[0013] Figure 2 is based on Figure 1 The illustrated embodiment shows a flow chart of a file processing method.

[0014] Figure 3 is based on Figure 1 The illustrated embodiment shows a flow chart of a file processing method.

[0015] Figure 4 The invention is a block diagram of a file processing device according to an exemplary embodiment.

[0016] Figure 5 is based on Figure 4 The illustrated embodiment shows a block diagram of a file processing device.

[0017] Figure 6 is based on Figure 4 The illustrated embodiment shows a block diagram of a file processing device.

[0018] Figure 7 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0019] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0020] The present disclosure is mainly applied to the scenario of accessing the relevant files (such as configuration files or business data files) of the Internet information system stored in the data center. The data center can be composed of multiple nodes in the FSS cluster, including multiple file storage nodes and at least one file storage server (which can be referred to as a "server" or "server node"). The FSS cluster can be understood as a distributed file storage system. In the FSS cluster, the file storage node is used to store files (that is, the file storage node is the node that actually stores the file data). As a server node, the file storage server can provide data management, access control, data distribution and other functions for the files stored in each file storage node. In the actual application scenario, the relevant files of the Internet information system can generally be classified and stored according to: business line-subsystem-application-type-date, and the ability to upload and download files can be provided to the outside. For example, the FTP / SFTP file transfer protocol can be used to upload and download files.

[0021] In the daily operation and maintenance of Internet information systems, upgrades and maintenance may be involved or failures may occur. R&D personnel can feedback the basic information of files that need to be modified or extracted (business line-subsystem-application-type-date, etc.) to the operation and maintenance personnel according to the situation. The operation and maintenance personnel remotely access the corresponding file storage node in the FSS cluster through the jump server, retrieve the target file based on the basic information of the file, preview it and confirm that it is correct, and then download it to the local terminal through FTP / SFTP. Then, the file is desensitized on the local terminal (the file often contains sensitive information and cannot be directly provided to the R&D personnel) and then provided to the R&D personnel for problem troubleshooting. If the files involved need to be modified, the R&D personnel will modify the local files and hand them over to the operation and maintenance personnel, who will then manually perform desensitization and recovery processing on the files (if the files are desensitized, the desensitized data needs to be restored) and merge them into the original files, and finally upload them to the file storage server through FTP / SFTP, thus completing a business closed loop.

[0022] In the access method for files stored on the FSS cluster provided in the related art, the file information to be obtained requires communication between developers and operation and maintenance personnel. This process may be repeatedly confirmed many times, thereby increasing the communication cost and thus causing the time cost of the entire process to be longer. In addition, in the case of high concurrency of multiple tasks, the limited number of operation and maintenance personnel and the low efficiency of manual processing will lead to a backlog of tasks, making it impossible to respond quickly to file access requests. In addition, the operation and maintenance personnel remotely log in to the FSS server to browse the directory, find files, preview the file content, and download it to the local via FTP / SFTP. If there is sensitive information that needs to be manually desensitized, the entire process needs to be manually processed, and the corresponding processing efficiency is low. The uneven level of ability of the operation and maintenance personnel leads to additional system risks. In addition, the un-desensitized files are downloaded to the local terminal of the operation and maintenance personnel for desensitization, and the files cannot be deleted in time and cannot be monitored. If the files involve sensitive information, there is a risk of sensitive information leakage.

[0023] Another related art provides a remote desensitization processing method, which is usually performed on a server, and the desensitization processing of all requested files is performed on the server, and the concurrency of file processing is low, resulting in low processing efficiency. In addition, the un-desensitized files are transferred from the storage device to the server for desensitization processing, and the un-desensitized files also have the security risk of being illegally accessed.

[0024] In order to solve the above problems, the present invention provides a file processing method, device, storage medium, electronic device and program product. The specific implementation of the present invention is described in detail below with reference to the accompanying drawings.

[0025] Figure 1It is a flowchart of a file processing method according to an exemplary embodiment. The method can be applied to a file storage node in a data center. The file storage node may include a node for file storage in an FSS cluster.

[0026] First, the method of determining the file storage node is explained.

[0027] In the present disclosure, the file storage node is a file storage node that stores the first file, determined by the terminal from multiple file storage nodes in a data center according to the first file and storage node information; the terminal refers to a user terminal, the first file is a file that the user currently wants to access and obtained by the terminal, the storage node information is sent to the terminal by a server communicating with the terminal, and the storage node information includes file information stored in each file storage node in at least one file storage node. The server here may include a server node in a data center, and the server node manages and maintains multiple file storage nodes in the data center.

[0028] In an actual application scenario, in response to receiving a user request message sent by a terminal, the server parses the user request message to obtain the user's access permission information, and the user request message is used to request file access to files stored on at least one file storage node in the data center; the server sends the storage node information to the terminal based on the access permission information.

[0029] For example, users can remotely access files stored on the FSS cluster through the RFS (Remote File Access System) deployed on the terminal. RFS can provide a UI interface on the user terminal that is open to users for remote file access operations. Users can use this UI interface to browse directories, filter files, preview file contents, filter file contents, customize desensitization capabilities through plug-ins, download desensitized files, upload files, and merge files for remote files stored on a file storage node in the FSS cluster. In this way, R&D personnel can filter, browse, and download specified files on the UI interface provided by RFS. The entire processing flow is simple for users to operate, reduces the cost of manual offline communication, and supports multiple users to operate at the same time, avoiding the problem of manual node blocking.

[0030] In response to the user logging into the RFS, the terminal may generate a user request message, which may include the user's identification information (such as a user account). The terminal sends the user request message to the server, and the server parses the user request message to obtain the user's identification information. The server may then determine the user's access permission information based on the user's identification information. It is understandable that different access permission information may access different files, and the server may determine the storage node information corresponding to the user's access permission information based on a preset correspondence. For example, if the user's access permission information indicates that the user's access permission is an administrator's permission, the storage node information may include the file information stored by all file storage nodes in the data center. If the user's access permission information indicates that the user's access permission is an ordinary user's permission, the storage node information may include the file information stored by at least one file storage node designated in the data center.

[0031] After the terminal determines the first file that the user wants to access based on the user's trigger operation, it can determine the file storage node storing the first file by querying the storage node information based on the first file. In this way, after the terminal generates a file acquisition instruction, it can send the file acquisition instruction to the determined file storage node.

[0032] like Figure 1 As shown, the method comprises the following steps: In step S101, in response to receiving a file acquisition instruction sent by a terminal, the type of the file acquisition instruction is parsed by a service process on a file storage node.

[0033] The file acquisition instruction may carry information such as the file name of the first file that the user wants to access, the file storage path, and the file access method. The first file may, for example, include a configuration file and / or a business data file of an Internet information system stored on a file storage node in the FSS cluster. In actual application scenarios, the user may select the first file that the user wants to access based on actual business needs (such as system upgrades or troubleshooting), and the file storage node is the file storage node that stores the first file.

[0034] The type of the file acquisition instruction can represent the user's file acquisition needs. For example, the file acquisition instruction may include three types: file preview instruction, file download instruction, and file filtering and download instruction. As the name implies, the file preview instruction can represent that the user currently needs to preview the first file, and only part of the file content of the first file can be transmitted to the user for preview. The file download instruction represents that the user needs to download the entire first file, and the file filtering and download instruction represents that the file content of the first file needs to be filtered, and then the file data that meets the filtering conditions is sent to the user terminal.

[0035] In a possible implementation of this step, after the service process parses the file acquisition instruction, it obtains a field value representing the type, and determines the type of the file acquisition instruction based on the field value.

[0036] In actual application scenarios, the user can enter the file information of the first file that the user wants to access in the UI interface of RFS on the terminal, and the file information includes, for example, the file name, the storage path of the file, or the access method of the file. In response to the user's triggering operation on the UI interface of RFS, the terminal generates the file acquisition instruction, and then sends the file acquisition instruction to the file storage node by calling the target interface of the service process. The target interface here refers to the interface corresponding to the type of the current file acquisition instruction among the multiple interfaces provided by the service process.

[0037] The service process provides multiple interfaces to the outside world, among which the interface to be called when the terminal transmits the file acquisition instruction is different for different types. In response to obtaining the file acquisition instruction initiated by the user, the terminal determines the target interface to be called based on the type of the instruction, and sends the file acquisition instruction to the service process deployed on the file storage node by calling the target interface. Therefore, the RFS system deployed on the terminal can access the file storage node through the interface capabilities provided by the service process, thereby realizing the imperceptible integration between systems conveniently and safely.

[0038] In addition, as a root process residing in the background of the file storage node, the service process can realize the basic ability to control the host machine (i.e., the file storage node where the service process is deployed) by executing shell, python and other scripts. For example, the service process may include a server probe Agent. Agent is a background process running on the file storage node, which is used to provide command execution capabilities to the outside world. In the present disclosure, Agent has the following functions: automatic registration and heartbeat reporting capabilities, file system browsing capabilities of the host machine (i.e., the file storage node where the Agent is deployed) (which can be achieved by calling Osquery capabilities, where Osquery is a detection framework suitable for a variety of operating systems, and can use SQL-like statements to query system information), real-time local desensitization processing of files, file screening of data in files according to conditions, desensitization recovery processing of files, and file merging, etc.

[0039] It should be noted that, before executing step S101, the service process on the file storage node may also receive a file retrieval instruction sent by the terminal, and the file retrieval instruction includes a file query parameter input by the user. The service process performs a file search according to the file query parameter, obtains a file list corresponding to the first file, and sends the file list to the terminal, so that the user triggers the file acquisition instruction according to the file list at the terminal.

[0040] For example, the user can enter the file access parameters of the first file that he wants to access on the UI interface of RFS. The file access parameters may include the category information of the first file. The category information may include, for example, the business line, subsystem, application name, data category of the file (such as configuration class, general business data, sensitive business data, etc.), data date and file name corresponding to the first file. The terminal can assemble the file access parameters into the file retrieval instruction and send it to the file storage node. For example, the file retrieval instruction may be in the following form: / home / finance / * / ${SUBSYSTEM} / ${APPNAME} / ${DATE} / *${FILENAME}*. After obtaining the file retrieval instruction, the service process asynchronously executes the file retrieval instruction and determines the file list. During the execution of the instruction, the file retrieval instruction can be parsed to obtain the file query parameters so as to perform file retrieval based on the file query parameters. In one possible implementation, for each file, the service process can generate a file directory structure corresponding to the file according to the hierarchical structure of business line identifier-subsystem identifier-application identifier-file data category identifier-data log-file name, and store the file in the file directory of the file storage node. In this way, the service process can retrieve the file list corresponding to the first file after traversing the file directory based on the parsed file query parameters.

[0041] Among them, the file list may include a data file corresponding to the first file and a data description file corresponding to the first file (the file suffix may be, for example, *.info), where the data file refers to a file storing the original data of the first file, and the data description file refers to a file storing each change information of the data file, and the change information may include, for example, file size, change time, changer, change content coordinates (such as row number, column number), and other information.

[0042] In the present disclosure, after the RFS on the terminal obtains the file list, the file basic information of each file in the file list can be displayed to the user on the UI interface of the RFS on the terminal according to the storage directory. The displayed file basic information may include, for example: file name, file size, last modification time of the file, text version information, and most recent modification user, wherein the above-mentioned file basic information can be obtained by parsing the data description file corresponding to the first file.

[0043] For example, the user can select the first file he needs from the displayed file list, and then further select the access method to the first file, which access method may include file preview, file download, or download after filtering according to conditions, wherein file download means directly downloading the entire file, and download after filtering according to conditions means that the user can enter the file content filtering conditions, and then filter the first file according to the file content filtering conditions, and then download the filtered file. In this way, the terminal can generate different file acquisition instructions based on the different trigger operations of the user on the file list. In other words, the file acquisition instruction may include a file preview instruction, a file download instruction, or a file filtering and download instruction.

[0044] It should also be noted that in order to further improve the data security of files stored on the file storage node, in another possible implementation of the present disclosure, the file storage node can, in response to receiving the file acquisition instruction, perform security authentication on the file acquisition instruction according to a preset security authentication strategy; and after the authentication is passed, execute step S101.

[0045] The preset security authentication policy may include at least one of the following: the IP address of the terminal is a preset IP address (the preset IP address may be an IP address in the whitelist corresponding to the service process); the time difference between the sending time corresponding to the file acquisition instruction and the current time is less than or equal to the preset time difference threshold. When it is determined that the IP address of the terminal is the preset IP address, and / or the time difference between the sending time corresponding to the file acquisition instruction and the current time is less than or equal to the preset time difference threshold, the current file acquisition request can be considered to be valid and safe, and the subsequent file processing steps can be executed.

[0046] In step S102, based on the type of the file acquisition instruction, the file data to be desensitized is determined from a first file stored on the file storage node, where the first file is the file indicated by the file acquisition instruction.

[0047] In order to avoid the leakage of sensitive information in file data and improve data security, the present disclosure needs to perform desensitization processing on the file data of the first file before sending it to the user terminal. Among them, desensitizing the first file refers to performing data masking (also known as data bleaching, data de-hiding or data deformation) on part or all of the file data in the first file. As described above, the file acquisition instruction includes a file preview instruction, a file download instruction or a file screening and download instruction. It can be understood that the type of the file acquisition instruction is different, and the file data to be desensitized is also different.

[0048] In this step, the file storage node can determine the file data to be desensitized from the first file based on the type of file acquisition instruction through the service process.

[0049] In step S103, the first plug-in on the file storage node is loaded through the service process, the file data to be desensitized is desensitized, and the desensitized data is sent to the terminal.

[0050] The first plug-in is a plug-in for performing desensitization processing on input file data.

[0051] In the process of executing this step, the service process can use any of the two desensitization methods to desensitize the file data to be desensitized. Among these two desensitization methods, one is to desensitize the data in the system default method, and the other is to desensitize the data based on the desensitization method set by the user. If the user sets the target desensitization method, the file acquisition instruction can also include an indication message of the target desensitization method.

[0052] The preset default desensitization method may be, for example, a regularized matching method. In this method, the first plug-in may use a regular expression to perform regular matching on the desensitized file data to obtain matching sensitive text; for each character in the sensitive text, the character is replaced with a preset character to obtain desensitized data.

[0053] For example, the sensitive text may be a text including information such as a password, a mobile phone number, an ID number, an email address, etc. The preset character may be any character (such as "*", "X" or "-") pre-set to hide sensitive information. In this way, for each character in the sensitive text, the character may be replaced with the preset character to obtain the desensitized data. Before and after the desensitization process, the number of characters remains unchanged.

[0054] The target desensitization method selected by the user may be, for example, a word segmentation method. In this method, the first plug-in may use a preset word segmenter to perform word segmentation on the file data to be desensitized, and obtain multiple word segmentation results; for each word segmentation result, when the word segmentation result is identified as a sensitive word according to a preset sensitive keyword, the character corresponding to the word segmentation result is replaced with a preset character to obtain the desensitized data.

[0055] The preset word segmenter can be a pre-trained deep learning model. In this desensitization method, the preset sensitive keyword can be pre-set as a word library of sensitive words, so that for each word segmentation result, it can be identified whether the word segmentation result is a sensitive word according to the word library of the sensitive word. In addition, in the process of replacing each character in the sensitive text with the preset character, the character replacement is also performed for each character separately, so that the number of characters remains unchanged before and after the desensitization process.

[0056] Based on the above method, the file storage node can load the first plug-in through the service process, and perform desensitization processing on the file data to be desensitized based on the first plug-in to obtain desensitized data.

[0057] It should be noted that the file of the desensitized data can be called a desensitized file (the suffix name can be, for example, *.dm). The file storage node in the present disclosure can also be provided with a corresponding desensitization description file (the suffix name can be, for example, *.dm.info) for each desensitized file. The desensitization description file is used to save the position information (such as line number) of the characters that have been desensitized in the corresponding desensitized file in the original file (i.e., the first file). Therefore, the file processing method provided in the present disclosure can also include: recording the position information of the characters that have been replaced in the file data to be desensitized to the corresponding desensitization description file. The desensitization description file can be used for subsequent desensitization and restoration of the desensitized data. For example, when the desensitization and restoration of the desensitized data are performed, the characters that have been desensitized can be located based on the corresponding desensitization description file.

[0058] In addition, the service process in the present disclosure also supports expansion through plug-ins. For example, the user can modify the first plug-in to be loaded by the Agent to add new preset sensitive words, or add a new data desensitization method by modifying the first plug-in.

[0059] Therefore, the file processing method provided by the present disclosure may also include: in response to receiving the plug-in function extension instruction sent by the terminal, modifying the desensitization policy of the first plug-in to a target desensitization policy, where the target desensitization policy is the desensitization policy indicated by the plug-in function extension instruction. For example, the target desensitization policy may include preset sensitive words and / or new data desensitization methods added by the user through the UI interface of the RFS.

[0060] By adopting the above method, through the service process on the file storage node, remote automatic desensitization processing of desensitized file data can be realized on the file storage node, without the need for manual desensitization processing, and avoiding downloading un-desensitized file data to the local terminal or other unauthorized hosts, thereby improving file data security while also improving file processing efficiency.

[0061] In addition, the present disclosure performs remote desensitization processing on the file data that the user wants to access locally on the file storage node based on the service process. Compared with completing the desensitization processing operation on the file data on the server, it avoids transmitting the file data to be desensitized to the server, and improves data security (the reason is that if the un-desensitized file data to be desensitized is transmitted to the server, the file data to be desensitized also has the security risk of being illegally accessed). In addition, if the desensitization processing operation is performed on the server side, the server usually needs to receive desensitization processing requests from multiple user terminals at the same time. The present disclosure performs remote desensitization processing on the file data that the user wants to access locally on the file storage node based on the service process. Compared with completing the desensitization processing operation on the file data on the server, each desensitization processing request is dispersed to the corresponding file storage node for desensitization processing, so that the computing power of each file storage node can be fully utilized, the concurrency performance and processing efficiency of file processing can be improved, and the resource occupation of the server can be saved at the same time.

[0062] It should also be noted that the data center in the present disclosure can be an FSS cluster. In actual application scenarios, the FSS cluster usually needs to horizontally expand the file storage nodes as the business develops. The method provided by the present disclosure only needs to deploy the target process (such as the Agent plug-in) on the newly added file storage node to achieve rapid expansion, thereby simplifying the management difficulty of the entire file system.

[0063] Figure 2 is based on Figure 1 The embodiment shown is a flowchart of a file processing method, such as Figure 2 As shown, step S102 includes the following sub-steps: In step S1021, based on the type of the file acquisition instruction, the file acquisition instruction is parsed to obtain instruction parameters.

[0064] In this step, the service process parses the file acquisition instruction based on the type of the file acquisition instruction to obtain instruction parameters. As described above, the file acquisition instruction includes three types: file preview instruction, file download instruction, or file screening and download instruction. It can be understood that the type of the file acquisition instruction is different, and the instruction parameters obtained by parsing the file acquisition instruction are also different. In the case where the type of the file acquisition instruction is file preview, the instruction parameters include the file path and file preview parameters of the first file; the file preview parameters represent the number of previewable contents in the first file; in the case where the type of the file acquisition instruction is file download, the instruction parameters include the file path of the first file. In the case where the type of the file acquisition instruction is file screening and downloading, the instruction parameters include the file path of the first file and the file screening conditions set by the user.

[0065] In step S1022, the file data to be desensitized is obtained from the first file according to the instruction parameters.

[0066] In one implementation, if the user selects file preview, the type of the file acquisition instruction is file preview. When the type of the file acquisition instruction is file preview, the instruction parameters include the file path of the first file and file preview parameters. The file preview parameters represent the number of previewable contents in the first file. The number of previewable contents can be, for example, the number of rows of file data in the first file, and the number of previewable contents can be set by the user or can be a system default value. The present disclosure does not limit this.

[0067] In this way, in this step, when the type of file acquisition instruction is file preview, the service process on the file storage node can read the file data to be desensitized from the first file under the file path by executing the first preset instruction, and the file data to be desensitized is the file data corresponding to the file preview parameter.

[0068] The first preset instruction refers to a preset instruction for reading part of the data in the file. For example, the first preset instruction may be a head instruction.

[0069] For example, in response to a file preview instruction triggered by a user, the RFS deployed on the terminal sends the file preview instruction to the Agent deployed on the corresponding file storage node through the instruction sending channel. After obtaining the file preview instruction, the Agent can read the first N lines (i.e., the number of preview contents) of the first file as the file data to be desensitized by executing the head instruction.

[0070] In another implementation, if the user chooses to directly download the first file, the type of the file acquisition instruction is file download. In the case where the type of the file acquisition instruction is file download, the instruction parameter includes the file path of the first file.

[0071] In this way, in this step, if the file acquisition instruction is the file download instruction, the service process on the file storage node can read the first file under the file path by executing the second preset instruction, and use the file data of the first file as the file data to be desensitized.

[0072] The second preset instruction refers to an instruction for reading the entire original file corresponding to the first file. For example, the original file of the first file can be read in a file stream manner.

[0073] For example, in response to a file download instruction triggered by a user, the RFS deployed on the terminal sends the file download instruction to the Agent of the corresponding file storage node through the instruction channel. After receiving the instruction, the Agent reads the original file of the first file through the file stream and uses the entire original file as the file data to be desensitized.

[0074] In another implementation, if the user chooses to filter and download by condition, the type of the file acquisition instruction is file filtering and download, and the instruction parameters include the file path of the first file and the file filtering condition set by the user. The file filtering condition can be, for example, a data row containing a preset key field (set by the user).

[0075] In this way, in this step, if the type of the file acquisition instruction is to download after file filtering, the service process on the file storage node can read the first file under the file path by executing the second preset instruction, and obtain the file data to be desensitized after filtering the first file according to the file filtering conditions.

[0076] For example, in response to a file filtering and downloading instruction triggered by a user, the RFS deployed on the terminal sends the file filtering and downloading instruction to the Agent of the corresponding file storage node through the instruction channel. After obtaining the instruction, the Agent reads the original file of the first file by means of a file stream, and then filters the data in the original file according to the file filtering condition, and then determines the target data row that meets the file filtering condition, and then determines the file data to be desensitized based on the target data row. For example, the file data corresponding to the target data row can be directly used as the file data to be desensitized, or the first / last N rows of data adjacent to the target data row position can be used together with the file data corresponding to the target data row as the file data to be desensitized.

[0077] That is to say, the Agent deployed on the file storage node can support remote screening and processing of the first file, so that only part of the data required by the user can be downloaded through FTP / SFTP, thereby improving the file download efficiency, saving the network bandwidth occupied by the processing flow, and reducing the resource overhead during the file download process.

[0078] Through the service process on the file storage node, remote automatic desensitization of the file data to be desensitized is implemented on the file storage node, and then the file storage node can send the desensitized data to the terminal. After the desensitized data is sent to the terminal, the user can edit the desensitized data on the terminal based on actual business needs (such as system upgrades or troubleshooting).

[0079] In one implementation, RFS can provide an editor, and the user can open the editor in the UI interface provided by the terminal RFS to implement editing operations on the desensitized data, and the editing operations include but are not limited to modification, deletion, and addition. The editor can record the editing information of the user's editing operation on the desensitized data, and save the editing information in the header of the file (i.e., the header file), wherein the editing information represents the editing position corresponding to the editing operation in the second file, and the second file is the file after the user edits the desensitized data. Afterwards, the terminal can send the second file to the file storage node.

[0080] After receiving the second file, the file storage node may store the second file. It is understandable that before storing the second file in the file storage node, the file needs to be desensitized and restored.

[0081] Figure 3 is based on Figure 1 The embodiment shown is a flowchart of a file processing method, such as Figure 3 As shown, after executing step S103, the method further includes the following steps: In step S104, in response to receiving the second file sent by the terminal, the second plug-in on the file storage node is loaded through the service process, and the second file is desensitized and restored, wherein the second file is sent by the terminal to the file storage node based on the desensitized data, and the terminal edits the desensitized data to obtain the second file.

[0082] The second plug-in is a plug-in used to perform desensitization and restoration processing on input file data.

[0083] During the execution of this step, the second plug-in can obtain a desensitization description file, which is used to record the position of the desensitized characters in the second file in the first file; for each desensitized character in the second file, according to the position of the character in the first file, the second plug-in replaces the character with the character at that position in the first file.

[0084] Here, for each character that is desensitized in the second file, the target character before desensitization corresponding to the character can be determined from the first file according to the position information of the character recorded in the desensitization description file, and the character is replaced with the target character to complete the desensitization restoration processing of the second file.

[0085] After the service process in the present disclosure performs desensitizing and restoring processing on the second file, it can also merge the first file and the file that has been desensitized and restored according to the editing information. The editing information is used to record the editing position in the second file of the editing operation performed by the user on the desensitized data. The service process can merge the file data corresponding to the editing position in the file that has been desensitized and restored with the file data at other positions in the first file except the editing position. It can be understood that the difference between the merged file and the first file lies in the editing operation performed by the user on the first file, that is, the merged file is a file after the first file is modified based on the user's editing operation.

[0086] In addition, in the file storage node, for each original data file, the following files with the same name will be generated in the file directory of the original data file: data description file (*.info), desensitized file (*.dm) and desensitized description file (*.dm.info), wherein the data description file refers to a file that stores each change record of the data file, and the change record may include, for example, file size, change time, change person, change content coordinates (such as line number, column number) and other information. Therefore, after the second file edited by the user is stored in the file storage node, it is also necessary to update the data description file corresponding to the first file, so that the data description file can be used to record each file change operation of the first file, that is, the change time, user name (i.e. change person), change content coordinates and other information of the current user's editing operation on the first file are stored in the data description file, so that the historical change operation corresponding to the first file can be traced.

[0087] It is understandable that desensitized files and corresponding desensitizing description files are usually only used for desensitizing operations and desensitizing restoration operations of the current file access task. Therefore, after the current file access task is completed, the corresponding desensitized files and desensitizing description files can be automatically cleared to avoid memory usage.

[0088] In a possible implementation, the service process may delete a designated file when it is determined that the designated file meets a preset clearing condition, where the designated file includes a desensitized file and / or a desensitized description file.

[0089] The preset clearing condition may include: the time interval between the creation time of the designated file and the current time is greater than or equal to a preset time threshold; or a clearing instruction for the designated file sent by the user from the terminal is received.

[0090] The present disclosure provides two strategies for clearing the specified file. One is that the user can delete the specified files such as *.dm and *.dm.info through the UI interface provided by the RFS system. In this case, the file storage node can receive the user's clearing instruction for the specified file sent by the terminal. In another way, the Agent running on the file storage node can initiate a scheduled task to delete expired *.dm and *.dm.info files (for example, delete files older than the last week).

[0091] By adopting the above method, it is possible to realize online search, real-time desensitization preview, desensitized file download, desensitized file upload, remote desensitized file restoration and file merging for remote files stored on the file storage node of the data center. Among them, the network service of remote file download and upload can be provided by installing an FTP / SFTP server on each file storage node to provide FTP / SFTP service to the outside for downloading and uploading specified files.

[0092] The desensitization operation of the file involved in the file transfer method provided by the present disclosure and the desensitization restoration processing of the desensitized file can be automatically completed on the file storage node based on the service thread (i.e., Agent) deployed on the file storage node, which improves the file processing efficiency and avoids the risk caused by human errors. In addition, the entire processing process automatically matches the corresponding file storage node according to the user's query conditions to obtain the file, and automatically clears the corresponding temporary files after use, which reduces the time cost of offline communication and processing for users, thereby improving work efficiency.

[0093] Figure 4 is a block diagram of a file processing device according to an exemplary embodiment. The device can be applied to a file storage node in a data center, such as Figure 4 As shown, the device comprises: A type determination module 401 is used for, in response to receiving a file acquisition instruction sent by a terminal, parsing the type of the file acquisition instruction through a service process on the file storage node; The module 402 for determining the data to be desensitized is used to determine the file data to be desensitized from the first file stored on the file storage node based on the type of the file acquisition instruction, where the first file is the file indicated by the file acquisition instruction; The desensitization processing module 403 is used to load the first plug-in on the file storage node through the service process, perform desensitization processing on the file data to be desensitized, and send the desensitized data to the terminal.

[0094] Optionally, the module 402 for determining the data to be desensitized is used to parse the file acquisition instruction based on the type of the file acquisition instruction to obtain instruction parameters; and obtain the file data to be desensitized from the first file according to the instruction parameters.

[0095] Optionally, when the type of the file acquisition instruction is file preview, the instruction parameter includes a file path and a file preview parameter of the first file; the file preview parameter represents the amount of previewable content in the first file; The module 402 for determining the data to be desensitized is used to read the file data to be desensitized from the first file under the file path by executing a first preset instruction, and the file data to be desensitized is the file data corresponding to the file preview parameter.

[0096] Optionally, when the type of the file acquisition instruction is file download, the instruction parameter includes the file path of the first file; The module 402 for determining the data to be desensitized is used to read the first file under the file path by executing a second preset instruction, and use the file data of the first file as the file data to be desensitized.

[0097] Optionally, when the type of the file acquisition instruction is file screening and downloading, the instruction parameters include the file path of the first file and the file screening condition set by the user; The module 402 for determining the data to be desensitized is used to read the first file under the file path by executing a second preset instruction, and obtain the file data to be desensitized after filtering the first file according to the file filtering condition.

[0098] Optionally, the first plug-in implements desensitization processing on the file data to be desensitized in the following manner: Regular expressions are used to perform regular matching on the file data to be desensitized to obtain matching sensitive text; for each character in the sensitive text, the character is replaced with a preset character to obtain the desensitized data; or, A preset word segmenter is used to perform word segmentation processing on the file data to be desensitized to obtain multiple word segmentation results; for each of the word segmentation results, when the word segmentation result is identified as a sensitive word according to a preset sensitive keyword, the characters corresponding to the word segmentation result are replaced with preset characters to obtain the desensitized data.

[0099] Optionally, Figure 5 is based on Figure 4 The block diagram of a file processing device shown in the embodiment shown in FIG. Figure 5 As shown, the device also includes: The function extension module 404 is used to modify the desensitization policy of the first plug-in to a target desensitization policy in response to receiving a plug-in function extension instruction sent by the terminal, and the target desensitization policy is the desensitization policy indicated by the plug-in function extension instruction.

[0100] Optionally, Figure 6 is based on Figure 4 The block diagram of a file processing device shown in the embodiment shown in FIG. Figure 6 As shown, the device also includes: The desensitizing and restoring module 405 is used to load the second plug-in on the file storage node through the service process in response to receiving the second file sent by the terminal, and perform desensitizing and restoring processing on the second file, wherein the second file is sent by the terminal to the file storage node based on the desensitized data, and the terminal edits the desensitized data to obtain the second file.

[0101] Optionally, the desensitizing and restoring module 405 is used to obtain a desensitizing description file, which is used to record the position of the desensitized characters in the second file in the first file; for each desensitized character in the second file, according to the position of the character in the first file, the second plug-in is used to replace the character with the character at the position in the first file.

[0102] Optionally, the type determination module 401 is used to, in response to receiving the file acquisition instruction, perform security authentication on the file acquisition instruction according to a preset security authentication policy; after the authentication is passed, parse the type of the file acquisition instruction through the service process on the file storage node; wherein the preset security authentication policy includes at least one of the following: the IP address of the terminal is a preset IP address; the time difference between the sending time corresponding to the file acquisition instruction and the current time is less than or equal to a preset time difference threshold.

[0103] Optionally, the file storage node is a file storage node that is determined by the terminal from a plurality of file storage nodes in the data center according to the first file and storage node information and stores the first file; The storage node information is sent to the terminal by a server communicating with the terminal, and the storage node information includes file information stored in each file storage node in at least one file storage node; In response to receiving a user request message sent by the terminal, the server parses the user request message to obtain access permission information of the user, wherein the user request message is used to request file access to files stored on at least one file storage node in the data center; the server sends the storage node information to the terminal according to the access permission information.

[0104] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0105] Figure 7 FIG. 1 is a block diagram of an electronic device according to an exemplary embodiment. Figure 7 As shown, the electronic device 700 may include: a processor 701 , a memory 702 . The electronic device 700 may also include one or more of a multimedia component 703 , an input / output (I / O) interface 704 , and a communication component 705 .

[0106] The processor 701 is used to control the overall operation of the electronic device 700 to complete all or part of the steps in the above-mentioned file transfer method. The memory 702 is used to store various types of data to support the operation of the electronic device 700. For example, these data may include instructions for any application or method used to operate on the electronic device 700, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. The multimedia component 703 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 702 or sent through the communication component 705. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 704 provides an interface between the processor 701 and other interface modules, and the above-mentioned other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 705 may include: Wi-Fi module, Bluetooth module, NFC module.

[0107] In an exemplary embodiment, the electronic device 700 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned file transfer method.

[0108] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned file transmission method are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 702 including program instructions, and the above-mentioned program instructions can be executed by the processor 701 of the electronic device 700 to complete the above-mentioned file transmission method.

[0109] In yet another exemplary embodiment, a computer program product is provided. The computer program product includes a computer program executable by a programmable device. The computer program has a code portion for executing the above-mentioned file processing method when executed by the programmable device.

[0110] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0111] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0112] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A file processing method, characterized in that: Applied to a file storage node in a data center, the method comprises: In response to receiving the file acquisition instruction sent by the terminal, parsing the type of the file acquisition instruction through the service process on the file storage node; Based on the type of the file acquisition instruction, determine the file data to be desensitized from a first file stored on the file storage node, where the first file is the file indicated by the file acquisition instruction; The first plug-in on the file storage node is loaded through the service process, the file data to be desensitized is desensitized, and the desensitized data is sent to the terminal.

2. The method according to claim 1, characterized in that The determining, based on the type of the file acquisition instruction, the file data to be desensitized from the first file stored on the file storage node comprises: Based on the type of the file acquisition instruction, the file acquisition instruction is parsed to obtain instruction parameters; The file data to be desensitized is obtained from the first file according to the instruction parameters.

3. The method according to claim 2, characterized in that In the case where the type of the file acquisition instruction is file preview, the instruction parameters include the file path of the first file and a file preview parameter; the file preview parameter represents the amount of content that can be previewed in the first file; The acquiring the to-be-desensitized file data from the first file according to the instruction parameter comprises: By executing a first preset instruction, the file data to be desensitized is read from the first file under the file path, and the file data to be desensitized is the file data corresponding to the file preview parameter.

4. The method according to claim 2, characterized in that: In the case where the type of the file acquisition instruction is file download, the instruction parameter includes the file path of the first file; The acquiring the to-be-desensitized file data from the first file according to the instruction parameter comprises: By executing the second preset instruction, the first file under the file path is read, and the file data of the first file is used as the file data to be desensitized.

5. The method according to claim 2, characterized in that: In the case where the type of the file acquisition instruction is file screening and downloading, the instruction parameters include the file path of the first file and the file screening condition set by the user; The acquiring the to-be-desensitized file data from the first file according to the instruction parameter comprises: By executing the second preset instruction, the first file under the file path is read, and the first file is filtered according to the file filtering condition to obtain the file data to be desensitized.

6. The method according to claim 1, characterized in that The first plug-in performs desensitization processing on the file data to be desensitized in the following manner: Using regular expressions to perform regular matching on the file data to be desensitized to obtain matching sensitive text; For each character in the sensitive text, replace the character with a preset character to obtain the desensitized data; or, A preset word segmenter is used to perform word segmentation processing on the file data to be desensitized to obtain multiple word segmentation results; for each of the word segmentation results, when the word segmentation result is identified as a sensitive word according to a preset sensitive keyword, the characters corresponding to the word segmentation result are replaced with preset characters to obtain the desensitized data.

7. The method according to claim 1, characterized in that The method further comprises: In response to receiving the plug-in function extension instruction sent by the terminal, the desensitization policy of the first plug-in is modified to a target desensitization policy, where the target desensitization policy is the desensitization policy indicated by the plug-in function extension instruction.

8. The method according to claim 1, characterized in that The method further comprises: In response to receiving a second file sent by the terminal, the second plug-in on the file storage node is loaded through the service process to perform desensitizing and restoring processing on the second file, wherein the second file is sent by the terminal to the file storage node based on the desensitized data, and the terminal edits the desensitized data to obtain the second file.

9. The method according to claim 8, characterized in that In response to receiving the second file sent by the terminal, loading the second plug-in on the file storage node through the service process to perform desensitization and restoration processing on the second file includes: Obtain a desensitization description file, where the desensitization description file is used to record the positions of desensitized characters in the second file in the first file; For each desensitized character in the second file, according to the position of the character in the first file, the second plug-in replaces the character with the character at the position in the first file.

10. The method according to claim 1, characterized in that The method further comprises: In response to receiving the file acquisition instruction, performing security authentication on the file acquisition instruction according to a preset security authentication strategy; The type of parsing the file acquisition instruction by the service process on the file storage node includes: After the file acquisition instruction is authenticated, the type of the file acquisition instruction is parsed through the service process on the file storage node; The preset security authentication strategy includes at least one of the following: The IP address of the terminal is a preset IP address; The time difference between the sending time corresponding to the file acquisition instruction and the current time is less than or equal to a preset time difference threshold.

11. The method according to any one of claims 1 to 10, characterized in that: The file storage node is a file storage node that is determined by the terminal from a plurality of file storage nodes in the data center according to the first file and storage node information and stores the first file; The storage node information is sent to the terminal by a server communicating with the terminal, and the storage node information includes file information stored in each file storage node in at least one file storage node; In response to receiving a user request message sent by the terminal, the server parses the user request message to obtain access permission information of the user, wherein the user request message is used to request file access to files stored on at least one file storage node in the data center; the server sends the storage node information to the terminal according to the access permission information.

12. A file processing device, characterized in that: A file storage node applied to a data center, the device comprising: A type determination module, configured to, in response to receiving a file acquisition instruction sent by a terminal, parse the type of the file acquisition instruction through a service process on the file storage node; A module for determining data to be desensitized, used to determine the file data to be desensitized from a first file stored on the file storage node based on the type of the file acquisition instruction, where the first file is the file indicated by the file acquisition instruction; The desensitization processing module is used to load the first plug-in on the file storage node through a service process, perform desensitization processing on the file data to be desensitized, and send the desensitized data to the terminal.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 11 are implemented.

14. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 11.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images