Data access method and device executed by client program, equipment and medium

Abstract

The invention provides a data access method and device executed by a client program, equipment and a medium, and relates to the technical field of computers, in particular to the technical fields of remote access, data security and the like. According to the implementation scheme, first feature information is acquired; sending the first feature information to a data management platform; in response to the received first identity credential sent by the data management platform and in response to the received data access request of the data access subject, generating a second identity credential based on the first identity credential and the data access request; sending the second identity credential to a permission verification module of the file system; and authorizing the data access main body to execute data access corresponding to the data access request in response to a received verification result of access permission verification passing fed back by the permission verification module.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, in particular to technical fields such as big data, remote access, and data security, and specifically to a data access method, device, electronic device, computer-readable storage medium, and computer program product executed by a client program. Background Art

[0002] Distributed file storage systems have become a basic component of enterprise big data production environment systems. As a national basic strategic resource, big data has attracted increasing attention for data security issues. Enterprise production applications must ensure data security and avoid data leakage. Building a data security system is one of the basic requirements for enterprise data production, and the access control solution of the big data file storage system is one of the key paths of the data security system.

[0003] The methods described in this section are not necessarily methods that have been previously conceived or employed. Unless otherwise indicated, it should not be assumed that any method described in this section is considered to be prior art simply because it is included in this section. Similarly, unless otherwise indicated, the issues mentioned in this section should not be considered to have been recognized in any prior art. Summary of the invention

[0004] The present disclosure provides a data access method, device, electronic device, computer-readable storage medium and computer program product executed by a client program.

[0005] According to one aspect of the present disclosure, there is provided a data access method executed by a client program, comprising: obtaining first characteristic information, the first characteristic information comprising the subject characteristic of the current data access subject; sending the first characteristic information to a data management platform, the data management platform being used to perform identity authentication based on the first characteristic information and generate a first identity credential after the identity authentication passes, the first identity credential comprising the first characteristic information and a credential validity period; in response to receiving the first identity credential sent by the data management platform, and in response to receiving a data access request from the data access subject, generating a second identity credential based on the first identity credential and the data access request, the second identity credential comprising the first characteristic information, a credential validity period, a target resource to be accessed, and a data access operation type; sending the second identity credential to a permission verification module of the file system, the permission verification module being used to perform access permission verification based on the second identity credential; and in response to receiving a verification result of the access permission verification passing from the permission verification module, authorizing the data access subject to perform data access corresponding to the data access request.

[0006] According to another aspect of the present disclosure, a data access device executed by a client program is provided, comprising: a first acquisition unit, configured to acquire first characteristic information, the first characteristic information including the subject characteristic of the current data access subject; a first sending unit, configured to send the first characteristic information to a data management platform, the data management platform is used to perform identity authentication based on the first characteristic information and generate a first identity credential after the identity authentication is passed, the first identity credential including the first characteristic information and a credential validity period; a first generating unit, configured to generate a second identity credential based on the first identity credential and the data access request in response to receiving the first identity credential sent by the data management platform and in response to receiving a data access request of the data access subject, the second identity credential including the first characteristic information, a credential validity period, a target resource to be accessed, and a data access operation type; a second sending unit, configured to send the second identity credential to a permission verification module of the file system, the permission verification module being used to perform access permission verification based on the second identity credential; and an authorization unit, configured to authorize the data access subject to perform data access corresponding to the data access request in response to receiving a verification result of the access permission verification passed fed back by the permission verification module.

[0007] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data access method executed by a client program of the present disclosure.

[0008] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the data access method executed by a client program of the present disclosure.

[0009] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the computer program implements the data access method performed by the client program of the present disclosure.

[0010] According to one or more embodiments of the present disclosure, the risk of identity credential leakage can be effectively reduced and the security of data access can be improved.

[0011] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0013] Figure 1 A schematic diagram showing an exemplary system in which the various methods described herein may be implemented according to an embodiment of the present disclosure;

[0014] Figure 2 A flowchart of a data access method executed by a client program according to an embodiment of the present disclosure is shown;

[0015] Figure 3 A schematic diagram showing a data access system according to an exemplary embodiment of the present disclosure is shown;

[0016] Figure 4 A flowchart of obtaining a first identity credential according to an exemplary embodiment of the present disclosure is shown;

[0017] Figure 5 A flowchart showing data access in a data warehouse application scenario in the related art is shown;

[0018] Figure 6 A flowchart of data access in a data warehouse application scenario according to an embodiment of the present disclosure is shown;

[0019] Figure 7 A structural block diagram of a data access device 700 executed by a client program according to an embodiment of the present disclosure is shown;

[0020] Figure 8 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0021] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0022] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, temporal relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0023] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0024] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0025] Figure 1 FIG. 1 is a schematic diagram of an exemplary system 100 in which various methods and apparatuses described herein may be implemented according to an embodiment of the present disclosure. Figure 1 , the system 100 includes one or more client devices 101, 102, 103, 104, 105, and 106, a server 120, and one or more communication networks 110 coupling the one or more client devices to the server 120. The client devices 101, 102, 103, 104, 105, and 106 may be configured to execute one or more applications.

[0026] In an embodiment of the present disclosure, the server 120 may run one or more services or software applications that enable the data access method of the present disclosure to be executed.

[0027] In some embodiments, server 120 may also provide other services or software applications, which may include non-virtualized environments and virtualized environments. In some embodiments, these services may be provided as web-based services or cloud services, such as provided to users of client devices 101, 102, 103, 104, 105, and / or 106 under a software as a service (SaaS) model.

[0028] exist Figure 1In the configuration shown, the server 120 may include one or more components that implement the functions performed by the server 120. These components may include software components, hardware components, or a combination thereof that can be executed by one or more processors. Users operating client devices 101, 102, 103, 104, 105, and / or 106 may in turn utilize one or more client applications to interact with the server 120 to utilize the services provided by these components. It should be understood that a variety of different system configurations are possible, which may differ from the system 100. Therefore, Figure 1 is one example of a system for implementing the various methods described herein and is not intended to be limiting.

[0029] A user may initiate data access using client devices 101, 102, 103, 104, 105, and / or 106. The client device may provide an interface that enables a user of the client device to interact with the client device. The client device may also output information to the user via the interface. Figure 1 Only six client devices are depicted, but one skilled in the art will appreciate that the present disclosure may support any number of client devices.

[0030] Client devices 101, 102, 103, 104, 105 and / or 106 may include various types of computer devices, such as portable handheld devices, general-purpose computers (such as personal computers and laptop computers), workstation computers, wearable devices, smart screen devices, self-service terminal devices, service robots, game systems, thin clients, various messaging devices, sensors or other sensing devices, etc. These computer devices may run various types and versions of software applications and operating systems, such as MICROSOFT Windows, APPLE iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as GOOGLE Chrome OS); or include various mobile operating systems, such as MICROSOFT Windows Mobile OS, iOS, Windows Phone, Android. Portable handheld devices may include cellular phones, smart phones, tablet computers, personal digital assistants (PDAs), etc. Wearable devices may include head-mounted displays (such as smart glasses) and other devices. Game systems may include various handheld game devices, Internet-enabled game devices, etc. Client devices are capable of executing various different applications, such as various Internet-related applications, communication applications (such as email applications), short message service (SMS) applications, and may use various communication protocols.

[0031] The network 110 may be any type of network known to those skilled in the art that may support data communications using any of a variety of available protocols, including but not limited to TCP / IP, SNA, IPX, etc. By way of example only, the one or more networks 110 may be a local area network (LAN), an Ethernet-based network, a token ring, a wide area network (WAN), the Internet, a virtual network, a virtual private network (VPN), an intranet, an extranet, a blockchain network, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., Bluetooth, WIFI), and / or any combination of these and / or other networks.

[0032] Server 120 may include one or more general purpose computers, dedicated server computers (e.g., PC (personal computer) servers, UNIX servers, mid-range servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and / or combination. Server 120 may include one or more virtual machines running virtual operating systems, or other computing architectures involving virtualization (e.g., one or more flexible pools of logical storage devices that may be virtualized to maintain a server's virtual storage device). In various embodiments, server 120 may run one or more services or software applications that provide the functionality described below.

[0033] The computing units in the server 120 may run one or more operating systems including any of the above operating systems and any commercially available server operating systems. The server 120 may also run any of a variety of additional server applications and / or middle-tier applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, etc.

[0034] In some implementations, server 120 may include one or more applications to analyze and consolidate data feeds and / or event updates received from users of client devices 101, 102, 103, 104, 105, and / or 106. Server 120 may also include one or more applications to display data feeds and / or real-time events via one or more display devices of client devices 101, 102, 103, 104, 105, and / or 106.

[0035] In some embodiments, the server 120 may be a server of a distributed system, or a server combined with a blockchain. The server 120 may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. A cloud server is a host product in a cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0036] The system 100 may also include one or more databases 130. In some embodiments, these databases may be used to store data and other information. For example, one or more of the databases 130 may be used to store information such as audio files and video files. The databases 130 may reside in various locations. For example, the database used by the server 120 may be local to the server 120, or may be remote from the server 120 and may communicate with the server 120 via a network-based or dedicated connection. The databases 130 may be of different types. In some embodiments, the databases used by the server 120 may be, for example, relational databases. One or more of these databases may store, update, and retrieve data to and from the databases in response to commands.

[0037] In some embodiments, one or more of the databases 130 may also be used by applications to store application data. The databases used by the applications may be different types of databases, such as a key-value store, an object store, or a conventional store backed by a file system.

[0038] Figure 1 The system 100 may be configured and operated in various ways to enable the application of various methods and apparatuses described in the present disclosure.

[0039] According to the embodiments of the present disclosure, Figure 2 As shown, a data access method executed by a client program is provided, including: step S201, obtaining first characteristic information, the first characteristic information including the subject characteristics of the current data access subject; step S202, sending the first characteristic information to a data management platform, the data management platform is used to perform identity authentication based on the first characteristic information and generate a first identity credential after the identity authentication is passed, the first identity credential including the first characteristic information and a credential validity period; step S203, in response to receiving the first identity credential sent by the data management platform, and in response to receiving a data access request from the data access subject, generating a second identity credential based on the first identity credential and the data access request, the second identity credential including the first characteristic information, a credential validity period, a target resource to be accessed, and a data access operation type; step S204, sending the second identity credential to a permission verification module of the file system, the permission verification module being used to perform access permission verification based on the second identity credential; and step S205, in response to receiving a verification result of the access permission verification passed fed back by the permission verification module, authorizing the data access subject to perform data access corresponding to the data access request.

[0040] Therefore, by sending the first characteristic information to the data management platform, and obtaining the first identity credential dynamically generated by the data management platform after the identity authentication is passed, and when receiving a data access request, dynamically generating a second identity credential based on the data access request, access permission verification is performed. Since the identity credential is dynamically generated based on the first characteristic information and the data access request, the risk of identity credential leakage can be effectively reduced and the security of data access can be improved.

[0041] In some embodiments, the client program may be an access management application deployed on a terminal device or a cluster, such as a Spark client program, a Hadoop client program, etc. The data access subject may access data to the file system through the client program.

[0042] In some embodiments, obtaining the first characteristic information may be in response to the startup of the above-mentioned client program, or in response to a data access subject initiating a data access request, and the current first characteristic information is collected.

[0043] In some embodiments, the first characteristic information may include subject characteristics of the data access subject, such as a user account and password.

[0044] After obtaining the first characteristic information, the first characteristic information can be sent to the data management platform. The data management platform can store a preset permission policy, that is, the access control permission policy of the data access subject to the resources in the file system. The permission policy can be described based on the access control list (Access Control List policy, ACL) permission policy model. In some embodiments, the permission policy can also be described by permission policy models such as role-based access control (Role-Based Access Control, RBAC) and attribute-based permission verification (Attribute-Based Access Control, ABAC), which is not limited here.

[0045] In some embodiments, after receiving the first characteristic information sent by the client program, the data management platform can authenticate the identity of the data access subject by matching it with the permission policy preset in the data management platform; in response to the identity authentication being passed, the data management platform can generate a first identity credential based on the first characteristic information, and send it to the client program, wherein the first identity credential includes the first characteristic information and the validity period of the credential.

[0046] In response to the client program receiving a data access request, it can first determine the target resource in the file system that the data access subject wants to access (such as data in a storage area in the file system or a file stored in the file system) and the data access operation type (for example, it may include data reading, data writing, data modification or data deletion operations) based on the information in the data access request, and generate a second identity credential based on the above information and the first identity credential and send it to the permission verification module of the file system.

[0047] In some embodiments, the file system of the present disclosure may be a distributed file system or a file storage system deployed on a server, which is not limited here.

[0048] In some embodiments, a preset permission policy is stored in the permission verification module of the file system, and the permission verification module can be used for identity authentication and permission verification for file system access.

[0049] In some embodiments, the preset authority policy stored in the authority verification module can be obtained by synchronizing the preset authority policy in the data management system. In some embodiments, the authority verification module can synchronize the preset authority policy every preset time interval to update and maintain the preset authority policy in real time.

[0050] In some embodiments, the permission verification module may also be used to record data access records.

[0051] In some embodiments, the preset permission policy may record the correspondence between the subject characteristics of the data access subject, the target resource, and the data access operation type. In some embodiments, the preset permission policy may also record the validity period of the permission, and in response to exceeding the validity period, the permission policy is automatically deleted.

[0052] In some embodiments, after receiving the second identity credential, the permission verification module may first check the validity period of the second identity credential, and only if the second identity credential is still valid, match the preset permission policy based on the various information in the second identity credential, thereby determining whether the current data access subject has the permission to perform the target data access operation on the target resource.

[0053] In some embodiments, in response to determining that the current data access subject has the authority to perform target data access operations on the target resource, the authority verification module can send a corresponding verification result to the client program; in response to receiving the above verification result, the client software can authorize the data access subject to perform the target data access operation on the target resource on the file system through the client software.

[0054] Therefore, by sending the first characteristic information to the data management platform, and obtaining the first identity credential dynamically generated by the data management platform after the identity authentication is passed, and when receiving a data access request, dynamically generating a second identity credential based on the data access request, access permission verification is performed. Since the identity credential is dynamically generated based on the first characteristic information and the data access request, the risk of identity credential leakage can be effectively reduced and the security of data access can be improved.

[0055] In some embodiments, obtaining the first characteristic information may include: in response to the data access subject being a user, obtaining the user account information of the user as a subject characteristic; and in response to the data access subject being a first application, obtaining at least one of the following characteristic information of the first application: a program startup command, a program execution directory, and a program execution file as a subject characteristic.

[0056] In some embodiments, the data access subject can be divided into an entity account and a service account, wherein the entity account corresponds to a specific natural person (ie, a user); the service account corresponds to a specific business application process (ie, the first application), and the service account has a corresponding person in charge.

[0057] The method of collecting characteristic information is different for different types of subjects.

[0058] For subjects such as users, their subject characteristics are generally the natural person account that logs in to the current client program. We can rely on the operation and maintenance mechanism of the enterprise IT assets, such as the tool class provided in the operation and maintenance system that can obtain the identity credentials of the current login user, to obtain the user's user account information as the subject characteristic.

[0059] For the first application, one or more of the program startup command, program execution directory, and program execution file may be collected as its main feature. After the above information is collected, a hash calculation may be performed to obtain a corresponding feature value (such as an MD5 value) as the main feature of the first application.

[0060] Therefore, by obtaining different subject characteristics for identity authentication for different data access subjects, the authentication strategies for different subjects can be further refined, thereby improving the security of data access.

[0061] In some embodiments, the first characteristic information may also include operating environment characteristics of the client program.

[0062] In some embodiments, the preset permission policy may also include the operating environment characteristics of the client program to restrict a data access subject to perform a preset data access operation on a resource only through a client program on a terminal device or cluster.

[0063] Therefore, by further verifying the environment in which the data access subject performs data access, the security of data access can be further improved.

[0064] In some embodiments, obtaining the first characteristic information may also include: in response to the client program being deployed on the terminal device, obtaining environmental information of the terminal device as an operating environment characteristic; and in response to the client program being deployed on the cluster, obtaining environmental information of the cluster as an operating environment characteristic.

[0065] In some embodiments, the client program can be deployed on a terminal device or on a cluster, where the cluster can be a cloud-native cluster, such as a Kubernetes cluster.

[0066] In some embodiments, the environment information of the terminal device may include the IP address, host name and other environment information of the terminal device. In some embodiments, the environment information of the cluster (taking the Kubernetes cluster as an example) may include the cluster ID, namespace, service name and other environment information. It is understandable that the type and quantity of the above environment information can be determined based on actual needs and are not limited here.

[0067] Therefore, by obtaining different operating environment characteristics for different client program operating environments for identity authentication, the authentication strategy under different operating environments can be further refined, thereby improving the security of data access.

[0068] In some embodiments, the client program may include a first tool, the first feature information can be collected and obtained through the first tool and sent to the data management platform through the first tool, the code of the first tool includes at least one verification point, and the method may also include: determining whether the current code of each verification point in at least one verification point is the same as the initial code; and in response to determining that the current code of each verification point in at least one verification point is the same as the initial code, obtaining the first feature information based on the first tool.

[0069] Figure 3 A schematic diagram of a data access system according to an exemplary embodiment of the present disclosure is shown.

[0070] In some exemplary embodiments, see Figure 3The data access method executed by the client program may include: step S301, the client program obtains first feature information through a first tool, sends it to the data management platform for identity authentication, and after the authentication is passed, sends the first identity credential to the client program; step S302, the data management platform performs identity authentication based on the first feature information, including subject verification and environment verification; step S303, in response to receiving a data access request, the client program generates a second identity credential based on the first identity credential and related information in the data access request, and sends it to the permission verification module of the file system; step S304, the permission verification module performs access permission verification based on the cached permission policy; step S305, in response to the verification being passed, authorizing the data access subject to perform the data access operation corresponding to the data access request on the file system.

[0071] In some exemplary embodiments, for verification of subject characteristics, the data management platform may call an identity authentication system constructed by a business party and complete the verification of subject characteristics based on the identity authentication system.

[0072] In some exemplary embodiments, the verification of the operating environment characteristics of the terminal device can be carried out by comparing the environmental information of the terminal device (such as IP address, host name, etc.) with the characteristic values ​​pre-stored in the data management platform for verification; the verification of the operating environment characteristics of the Kubernetes cluster can be carried out by calling a third-party environment verification interface to first verify whether the collected operating environment characteristics are valid characteristics issued by the Kubernetes cluster, and then compare them with the characteristic values ​​pre-stored in the data management platform for verification.

[0073] In some exemplary embodiments, see Figure 3 ,The authority verification module obtains the authority policy stored on the data management platform once at a preset time interval to achieve timely update of the authority policy.

[0074] In some embodiments, the first tool may be a software development kit (SDK) in a client program, which is used to provide the first characteristic information of the mobile phone and to perform data transmission with the data management platform.

[0075] In some embodiments, one or more verification points can be set in the code of the first tool, and before collecting the first characteristic information, the current code of the above-mentioned verification points can be compared with the initial code to see if they are consistent. If they are consistent, it is determined that the code of the first tool has not been tampered with and is safe and reliable. Subsequently, the first characteristic information is collected. At this time, the collected first characteristic information is also reliable.

[0076] Therefore, by verifying the code of the first tool before applying the first tool to collect the first feature information, the first tool can be prevented from being tampered with. The first feature information is collected based on the verified first tool, which can further improve the credibility of the first feature information and thereby improve the security of data access.

[0077] In some embodiments, the code of the first tool may be obtained by obfuscating the original code of the first tool.

[0078] Therefore, by performing code obfuscation on the original code of the first tool based on preset obfuscation rules, the risk of the first tool being tampered with is further reduced, the credibility of the first tool information is further improved, and the security of data access is further improved.

[0079] In some embodiments, based on the code obfuscation of the code of the first tool, at least one verification point can be further set, so as to further reduce the risk of the first tool being tampered with and enhance the credibility of the first tool information.

[0080] In some embodiments, sending the first characteristic information to the data management platform may include: encrypting the first characteristic information using a shared key between the first tool and the data management platform to obtain a first ciphertext; and sending the first ciphertext to the data management platform; and wherein the data management platform may also be used to decrypt the first ciphertext based on the shared key to obtain the first characteristic information.

[0081] Therefore, by encrypting and transmitting the first characteristic information, the risk of the first characteristic information being stolen or tampered with during transmission can be further reduced, thereby improving the security of data access.

[0082] In some embodiments, the first identity credential may be encrypted by the data management platform based on a shared key and sent to the first tool, and the method may further include: in response to receiving the encrypted first identity credential sent by the data management platform, decrypting based on the shared key to obtain the first identity credential.

[0083] Therefore, by encrypting and transmitting the first identity credential, the risk of the first identity credential being stolen or tampered with during transmission can be further reduced, thereby improving the security of data access.

[0084] In some embodiments, the shared key may be obtained through negotiation between the first tool and the data management platform based on the Diffie-Hellman protocol. In some embodiments, the generation of the shared key may also be achieved based on the RSA public key encryption algorithm, the elliptic curve Diffie-Hellman protocol, etc., without limitation herein.

[0085] In some embodiments, the shared key can be obtained by exchanging the respective public keys of the first tool and the data management platform, and calculated based on the received public key of the other party and the private key of the first tool and the data management platform, and the public key can be encrypted based on the key provided by the third-party trusted platform during the exchange process.

[0086] In some exemplary embodiments, the acquisition of the shared key may include: the first tool generates a set of asymmetric keys (private key a, public key A), and the data management platform generates a set of asymmetric keys (private key b, public key B). Based on the third-party trusted platform, a set of asymmetric keys is generated for the first tool and the data management platform respectively (private key c, public key C corresponding to the first tool, and private key d, public key D corresponding to the data management platform).

[0087] The first tool encrypts the public key A based on the private key c and sends the ciphertext to the data management platform; the data management platform decrypts the ciphertext based on the public key C stored in the third-party trusted platform to obtain the public key A, and then calculates the public key A and the private key b based on the Diffie-Hellman protocol to obtain the shared key.

[0088] Similarly, the data management platform encrypts the public key B based on the private key d and sends the ciphertext to the first tool; the first tool decrypts the ciphertext based on the public key D stored in the third-party trusted platform to obtain the public key B, and then calculates the public key B and the private key a based on the Diffie-Hellman protocol to obtain the shared key.

[0089] Therefore, in the process of obtaining the shared key, by encrypting the public key exchanged between the first tool and the data management platform, the risk of the public key being stolen or tampered with during transmission can be further reduced, thereby improving the security of the shared key and further improving the security of data access.

[0090] In some embodiments, the private key a held by the first tool can be written into the original code of the first tool, and then the entire original code can be obfuscated, thereby further reducing the risk of leakage of the private key a.

[0091] Figure 4 A flow chart of obtaining a first identity credential according to an exemplary embodiment of the present disclosure is shown.

[0092] In some embodiments, see Figure 4, obtaining the first identity credential may include: step S401, the first tool and the data management platform negotiate to obtain a shared key, wherein the shared key can be obtained based on any of the methods described above; step S402, in response to the code of the first tool passing the anti-tampering verification, collecting the current subject characteristics and environmental characteristics through the first tool, and encrypting them based on the shared key to obtain a first ciphertext; step S403, sending the first ciphertext to the data management platform to obtain the first identity credential; step S404, the data management platform decrypts the first ciphertext through the shared key, obtains the subject characteristics and environmental characteristics, and verifies them; step S405, in response to the verification passing, generating the first identity credential based on the subject characteristics and environmental characteristics, and feeding back to the first tool.

[0093] Therefore, by improving the security of each step in obtaining the first identity credential, the accuracy of identity authentication and the credibility and security of the first identity credential can be improved, thereby improving the security of data access.

[0094] In some embodiments, a target data warehouse may be deployed in the file system. In response to the target resource to be accessed in the data access request being the target data warehouse, the method may further include: in response to receiving a data access request from a data access subject, sending first characteristic information to the target data warehouse to perform identity authentication based on the permission data table in the target data warehouse; and in response to receiving a notification of identity authentication passing from the target data warehouse, sending the first characteristic information to the data management platform to obtain a first identity credential, wherein the first identity credential also includes an association relationship between the first resource and the underlying resources of the file system.

[0095] Figure 5 A flow chart of data access in a data warehouse application scenario in the related art is shown. Figure 6 A flow chart of data access in a data warehouse application scenario according to an embodiment of the present disclosure is shown.

[0096] In the data warehouse application scenario, since the data warehouse (such as HBase database, Hive database, etc.) is deployed on the upper layer of the distributed file system, when a user requests to access data in the data warehouse (such as accessing a data table in the data warehouse), the client program needs to first send the first feature information to the data warehouse and perform identity authentication based on the permission data table pre-stored in the data warehouse. After the first feature information passes the identity authentication of the data warehouse, it is necessary to configure the data access subject with the permission to operate the underlying file system.

[0097] In related technologies, such as Figure 5As shown, the user account can be replaced with an account with greater authority so that the user can operate the underlying file storage system when accessing the data warehouse. This solution will make the data access subject have too much authority, which is not conducive to data security. Another solution is to further verify the authority of the underlying file system to determine whether the data access subject has the authority to operate the underlying file storage system. This solution requires maintaining two layers of authority policies for the data warehouse and the underlying file system. This means that when the authority of one layer expires, the corresponding authority policy in the other layer needs to be deleted at the same time, which greatly reduces the maintenance and management efficiency.

[0098] According to an exemplary embodiment of the present disclosure, Figure 6 As shown, after passing the identity authentication of the data warehouse, a temporary first identity credential can be obtained at the data management platform. At the same time, the association between the first resource to be accessed and the underlying resources of the file system is declared in the first identity credential, so that after passing the identity authentication of the data warehouse, the permission to access the underlying file system resources corresponding to the first resource can be directly obtained, ensuring accurate authorization of the data access subject while reducing the difficulty of permission management and improving the efficiency of permission management.

[0099] In some embodiments, Figure 7 As shown, a data access device 700 executed by a client program is provided, and the device 700 includes: a first acquisition unit 710, configured to acquire first feature information, the first feature information including the subject feature of the current data access subject; a first sending unit 720, configured to send the first feature information to a data management platform, the data management platform is used to perform identity authentication based on the first feature information and generate a first identity credential after the identity authentication is passed, the first identity credential including the first feature information and a credential validity period; a first generating unit 730, configured to generate a second identity credential based on the first identity credential and the data access request in response to receiving the first identity credential sent by the data management platform and in response to receiving a data access request of the data access subject, the second identity credential including the first feature information, the credential validity period, the target resource to be accessed, and the data access operation type; a second sending unit 740, configured to send the second identity credential to a permission verification module of the file system, the permission verification module is used to perform access permission verification based on the second identity credential; and an authorization unit 750, configured to authorize the data access subject to perform data access corresponding to the data access request in response to receiving a verification result of the access permission verification passed fed back by the permission verification module.

[0100] The operations and effects performed by units 710 to 750 in the data access device 700 executed by the client program are similar to steps S201 to S205 in the data access method executed by the client program of the present disclosure, and are not described in detail here.

[0101] In some embodiments, the client program may include a first tool, the first feature information can be collected and obtained through the first tool and sent to the data management platform through the first tool, the code of the first tool includes at least one verification point, and the device may also include: a first determination unit, configured to determine whether the current code of each verification point in at least one verification point is the same as the initial code; and a third acquisition unit, configured to acquire the first feature information based on the first tool in response to determining that the current code of each verification point in at least one verification point is the same as the initial code.

[0102] In some embodiments, the code of the first tool may be obtained by obfuscating the original code of the first tool.

[0103] In some embodiments, the first sending unit may include: a first encryption subunit, configured to encrypt the first characteristic information using a shared key between the first tool and the data management platform to obtain a first ciphertext; and a first sending subunit, configured to send the first ciphertext to the data management platform; and wherein the data management platform can also be used to decrypt the first ciphertext based on the shared key to obtain the first characteristic information.

[0104] In some embodiments, the first identity credential may be encrypted by the data management platform based on a shared key and sent to the first tool, and the device may also include: a decryption unit, configured to decrypt based on the shared key in response to receiving the encrypted first identity credential sent by the data management platform to obtain the first identity credential.

[0105] In some embodiments, the shared key can be obtained by exchanging the respective public keys of the first tool and the data management platform, and calculated based on the received public key of the other party and the private key of the first tool and the data management platform, and the public key is encrypted based on the key provided by the third-party trusted platform during the exchange process.

[0106] In some embodiments, a target data warehouse is deployed in the file system. In response to the target resource to be accessed in the data access request being the target data warehouse, the device may also include: a third sending unit, configured to send first characteristic information to the target data warehouse in response to receiving a data access request from a data access subject, so as to perform identity authentication based on the permission data table in the target data warehouse; and a fourth sending unit, configured to send the first characteristic information to the data management platform in response to receiving a notification of identity authentication passing feedback from the target data warehouse, so as to obtain a first identity credential, wherein the first identity credential also includes an association relationship between the first resource and the underlying resources of the file system.

[0107] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0108] According to an embodiment of the present disclosure, an electronic device, a readable storage medium and a computer program product are also provided.

[0109] refer to Figure 8 , a block diagram of an electronic device 800 that can be used as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0110] like Figure 8 As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The computing unit 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0111] Multiple components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, an output unit 807, a storage unit 808, and a communication unit 809. The input unit 806 can be any type of device that can input information to the electronic device 800. The input unit 806 can receive input digital or character information and generate key signal input related to user settings and / or function control of the electronic device, and can include but is not limited to a mouse, a keyboard, a touch screen, a track pad, a track ball, a joystick, a microphone, and / or a remote controller. The output unit 807 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 808 can include but is not limited to a disk, an optical disk. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, an 802.11 device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0112] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as the data access method performed by the client program of the present disclosure. For example, in some embodiments, the data access method performed by the client program of the present disclosure may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the data access method performed by the client program of the present disclosure may be executed. Alternatively, in other embodiments, the computing unit 801 may be configured to execute the data access method executed by the client program of the present disclosure in any other appropriate manner (for example, by means of firmware).

[0113] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0115] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0117] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0118] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0119] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be performed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document is not limited here.

[0120] Although the embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it should be understood that the above-mentioned methods, systems and devices are merely exemplary embodiments or examples, and the scope of the present invention is not limited by these embodiments or examples, but only by the claims after authorization and their equivalent scope. Various elements in the embodiments or examples can be omitted or replaced by their equivalent elements. In addition, each step can be performed in an order different from that described in the present disclosure. Further, the various elements in the embodiments or examples can be combined in various ways. It is important that with the evolution of technology, many elements described herein can be replaced by equivalent elements that appear after the present disclosure.

Claims

1. A data access method executed by a client program, the method comprising: Acquire first characteristic information, where the first characteristic information includes subject characteristics of a current data access subject; Sending the first characteristic information to a data management platform, the data management platform is used to perform identity authentication based on the first characteristic information and generate a first identity credential after the identity authentication is passed, the first identity credential including the first characteristic information and a validity period of the credential; In response to receiving the first identity credential sent by the data management platform and in response to receiving a data access request from the data access subject, generating a second identity credential based on the first identity credential and the data access request, wherein the second identity credential includes the first feature information, the validity period of the credential, the target resource to be accessed, and the data access operation type; Sending the second identity credential to a permission verification module of the file system, the permission verification module being used to verify access rights based on the second identity credential; as well as In response to receiving a verification result of passing the access authority verification fed back by the authority verification module, the data access subject is authorized to execute the data access corresponding to the data access request.

2. The method according to claim 1, wherein: The client program includes a first tool, the first feature information is collected and obtained by the first tool and sent to the data management platform by the first tool, the code of the first tool includes at least one verification point, and the method further includes: determining whether a current code of each verification point of the at least one verification point is the same as an initial code; and In response to determining that the current code of each of the at least one verification point is the same as the initial code, the first feature information is acquired based on the first tool.

3. The method according to claim 2, wherein: The code of the first tool is obtained by obfuscating the original code of the first tool.

4. The method according to claim 2 or 3, wherein: The sending the first feature information to the data management platform includes: encrypting the first feature information using a shared key between the first tool and the data management platform to obtain a first ciphertext; and The first ciphertext is sent to the data management platform; and wherein, The data management platform is also used to decrypt the first ciphertext based on the shared key to obtain the first feature information.

5. The method according to claim 4, wherein: The first identity credential is encrypted by the data management platform based on the shared key and sent to the first tool, and the method further includes: In response to receiving the encrypted first identity credential sent by the data management platform, decryption is performed based on the shared key to obtain the first identity credential.

6. The method according to claim 5, wherein: The shared key is obtained by exchanging respective public keys between the first tool and the data management platform, and is calculated based on the received public key of the other party and the private key of the party, and wherein the public key is encrypted based on the key provided by a third-party trusted platform during the exchange process.

7. The method according to any one of claims 1 to 6, wherein: A target data warehouse is deployed in the file system, and the target resource to be accessed in the data access request is a first resource in the target data warehouse. The method further includes: In response to receiving a data access request from the data access subject, sending the first characteristic information to the target data warehouse to perform identity authentication based on a permission data table in the target data warehouse; and In response to receiving a notification that identity authentication has passed from the target data warehouse, the first feature information is sent to the data management platform to obtain the first identity credential, wherein the first identity credential also includes an association relationship between the first resource and an underlying resource of the file system.

8. The method according to any one of claims 1 to 7, wherein: The obtaining of the first characteristic information comprises: In response to the data access subject being a user, obtaining user account information of the user as the subject feature; and In response to the data access subject being a first application, at least one of the following characteristic information of the first application is obtained: a program startup command, a program execution directory, and a program execution file, as the subject characteristic.

9. The method according to any one of claims 1 to 8, wherein: The first characteristic information also includes the operating environment characteristics of the client program.

10. The method according to claim 9, wherein: The obtaining of the first characteristic information further includes: In response to the client program being deployed on a terminal device, obtaining environment information of the terminal device as the operating environment feature; and In response to the client program being deployed on a cluster, environmental information of the cluster is obtained as the operating environment feature.

11. A data access device executed by a client program, the device comprising: A first acquisition unit is configured to acquire first characteristic information, wherein the first characteristic information includes subject characteristics of a current data access subject; A first sending unit is configured to send the first characteristic information to a data management platform, the data management platform is used to perform identity authentication based on the first characteristic information and generate a first identity credential after the identity authentication passes, the first identity credential including the first characteristic information and a validity period of the credential; a first generating unit, configured to generate a second identity credential based on the first identity credential and the data access request in response to receiving the first identity credential sent by the data management platform and receiving a data access request from the data access subject, wherein the second identity credential includes the first feature information, the validity period of the credential, the target resource to be accessed, and the data access operation type; A second sending unit is configured to send the second identity credential to a permission verification module of the file system, where the permission verification module is used to perform access permission verification based on the second identity credential; as well as The authorization unit is configured to, in response to receiving a verification result of the access authority verification being passed fed back by the authority verification module, authorize the data access subject to execute the data access corresponding to the data access request.

12. The device according to claim 11, wherein The client program includes a first tool, the first feature information is collected and obtained by the first tool and sent to the data management platform by the first tool, the code of the first tool includes at least one verification point, and the device further includes: A first determining unit configured to determine whether a current code of each verification point of the at least one verification point is the same as an initial code; and A third acquisition unit is configured to acquire the first feature information based on the first tool in response to determining that the current code of each of the at least one verification point is the same as the initial code.

13. The device according to claim 12, wherein: The code of the first tool is obtained by obfuscating the original code of the first tool.

14. The device according to claim 12 or 13, wherein: The first sending unit includes: A first encryption subunit is configured to encrypt the first feature information using a shared key between the first tool and the data management platform to obtain a first ciphertext; and A first sending subunit is configured to send the first ciphertext to the data management platform; and wherein, The data management platform is also used to decrypt the first ciphertext based on the shared key to obtain the first feature information.

15. The method according to claim 14, wherein: The first identity credential is encrypted by the data management platform based on the shared key and sent to the first tool, and the device further includes: The decryption unit is configured to, in response to receiving the encrypted first identity credential sent by the data management platform, decrypt based on the shared key to obtain the first identity credential.

16. The device according to claim 15, wherein: The shared key is obtained by exchanging respective public keys between the first tool and the data management platform, and is calculated based on the received public key of the other party and the private key of the party, and wherein the public key is encrypted based on the key provided by a third-party trusted platform during the exchange process.

17. The device according to any one of claims 11 to 16, wherein: A target data warehouse is deployed in the file system, and the target resource to be accessed in the data access request is the target data warehouse. The device further includes: A third sending unit is configured to send the first feature information to the target data warehouse in response to receiving the data access request of the data access subject, so as to perform identity authentication based on the authority data table in the target data warehouse; and The fourth sending unit is configured to send the first characteristic information to the data management platform in response to receiving a notification of identity authentication passing feedback from the target data warehouse, so as to obtain the first identity credential, wherein the first identity credential also includes an association relationship between the first resource and the underlying resources of the file system.

18. An electronic device, comprising: at least one processor; as well as a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 10.

19. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to make a computer execute the method according to any one of claims 1-10.

20. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images