Data processing method and device, equipment, storage medium and program product

Abstract

The invention provides a data processing method and device, equipment, a storage medium and a program product, and the method comprises the steps: receiving a data processing request, and determining an object key of a request object in the data processing request, and a data operation instruction of the request object on a target data component; according to an object key in the data processing request and a device key of the data processing device, generating an access credential of the request object, the data processing device providing a data operation function of the target data component; based on the access credential of the request object, performing permission verification of the target data component on the request object to obtain permission verification information of the request object; and under the condition that the permission verification information indicates that the permission verification is passed, responding to a data operation instruction in the data processing request, and performing corresponding data operation processing on the target data component. According to the embodiment of the invention, the security of the key information is improved, the non-credit access behavior caused by the leakage of the key information is effectively reduced, and the data security is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular, to a data processing method, apparatus, device, storage medium, and program product. Background Art

[0002] With the development of Internet applications, application systems are increasingly deployed on servers in different regions. The geographical locations to which these application systems belong are independent and are connected together using a network. When a user uses an application system to perform data operations such as adding, modifying, deleting, and querying data on different devices, it is necessary to perform permission verification on different users to ensure data security.

[0003] In the related art, user passwords are usually used to verify user permissions. However, the device storing the user password is vulnerable to attacks, resulting in the leakage of user passwords. The user permission verification is not secure, leading to insufficient data security. Summary of the Invention

[0004] The present invention provides a data processing method, apparatus, device, storage medium, and program product to solve the problem in the related art that user passwords are easily leaked, the user permission verification is not secure, resulting in insufficient data security.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, including:

[0006] Receiving a data processing request, and determining an object key of a request object in the data processing request, and a data operation instruction of the request object for a target data component;

[0007] Generating an access credential for the request object according to the object key in the data processing request and a device key of a data processing device, where the data processing device provides a data operation function for the target data component;

[0008] Performing permission verification on the request object for the target data component based on the access credential of the request object to obtain permission verification information of the request object;

[0009] In the case where the permission verification information is permission verification passed, in response to the data operation instruction in the data processing request, performing corresponding data operation processing on the target data component.

[0010] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0011] A receiving module, configured to receive a data processing request;

[0012] A determining module, configured to determine an object key of a request object in the data processing request, and a data operation instruction of the request object for a target data component;

[0013] A generation module, configured to generate an access credential for a requested object according to an object key in a data processing request and a device key of a data processing device, where the data processing device provides a data operation function for a target data component;

[0014] An authentication module, configured to perform permission authentication on the requested object for the target data component based on the access credential of the requested object to obtain permission authentication information of the requested object;

[0015] A processing module, configured to, when the permission authentication information indicates that the permission authentication is passed, perform corresponding data operation processing on the target data component in response to a data operation instruction in the data processing request.

[0016] In a third aspect, an embodiment of the present application provides a data processing system, which includes at least one data processing device, and the data processing device is configured to execute the steps of the above data processing method to perform corresponding data operation processing on a target data component in response to a data processing request of a requested object.

[0017] In a fourth aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the steps of the above data processing method are implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of the above data processing method are implemented.

[0019] In a sixth aspect, an embodiment of the present application provides a computer program product, and when the computer program is run, the above data processing method is executed.

[0020] In one solution provided by the above data processing method, apparatus, device, storage medium, and program product, a data processing request is received, and an object key of a request object in the data processing request, as well as a data operation instruction of the request object for a target data component, are determined; an access credential of the request object is generated according to the object key in the data processing request and the device key of the data processing device, and the data processing device provides a data operation function for the target data component; based on the access credential of the request object, permission verification of the request object is performed to obtain permission verification information of the request object; in the case where the permission verification information indicates that the permission verification is passed, in response to the data operation instruction in the data processing request, corresponding data operation processing is performed on the target data component. In this embodiment, by having different devices hold different key information, the true and complete authentication information of the request object is not retained in any plaintext or ciphertext form, improving the security of the key information; when the request object requests data operation, an access credential is generated according to the key information of different devices, and permission verification is performed based on this access credential, improving the security of permission verification. In the case of multi-device collaborative work, no party can rely on its own incomplete key information to achieve data access, nor can it solely rely on the keys of both parties to access data, effectively reducing unauthorized access behaviors caused by key information leakage and ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings based on these drawings without creative efforts.

[0022] Figure 1 is a schematic structural diagram of a data processing system according to an embodiment of the present invention;

[0023] Figure 2 is another schematic structural diagram of a data processing system according to an embodiment of the present invention;

[0024] Figure 3 is a schematic flowchart of a data processing method according to an embodiment of the present invention;

[0025] Figure 4 is a schematic diagram of the generation process of an access credential according to an embodiment of the present invention;

[0026] Figure 5 is Figure 3 a schematic signaling interaction diagram for implementing step S10 in

[0027] Figure 6It is a schematic diagram of interaction information in the process of processing a data query request in an embodiment of the present invention;

[0028] Figure 7 It is another schematic diagram of interaction information in the process of processing a data query request in an embodiment of the present invention;

[0029] Figure 8 It is Figure 3 A schematic diagram of an implementation process of step S20 in;

[0030] Figure 9 It is Figure 3 A schematic diagram of an implementation process of step S30 in;

[0031] Figure 10 It is a data processing framework diagram in the data query process in an embodiment of the present invention;

[0032] Figure 11 It is Figure 1 A schematic diagram of the structure of a data processing device in;

[0033] Figure 12 It is a schematic diagram of the structure of a computer device in an embodiment of the present invention. Detailed implementation manners

[0034] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0035] It should be understood that when used in the specification and the appended claims of the present invention, the term "comprising" indicates the presence of the described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or their combinations. It should also be understood that the term " / and" as used in the specification and the appended claims of the present invention refers to any combination and all possible combinations of one or more of the related listed items, and includes these combinations.

[0036] In addition, in the description of the specification and the appended claims of the present invention, the terms "first", "second", "third", etc. are only used for distinguishing descriptions, and cannot be understood as indicating or implying relative importance.

[0037] Reference to "an embodiment" or "some embodiments" etc. described in the specification of the present invention means that a specific feature, structure, or characteristic described in connection with that embodiment is included in one or more embodiments of the present invention. Thus, statements such as "in one embodiment", "in some embodiments", "in other some embodiments", "in still other embodiments" etc. that appear in different places in this specification are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized. The terms "comprising", "including", "having" and their variants all mean "including but not limited to", unless otherwise specifically emphasized.

[0038] It should be understood that the magnitudes of the sequence numbers of the steps in the following embodiments do not imply the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0039] In order to illustrate the technical solution of the present invention, specific embodiments will be used for illustration below.

[0040] It should be understood that when a user uses an application system to perform data operations such as adding, modifying, deleting, and querying data on different devices, different users need to be authenticated for their permissions to ensure data security. For example, in the scenario of using an application service to perform point-to-point database access to different devices in a local area network, different organizational departments use different databases for data storage, and users in this organizational department or other organizational departments can access these different databases through the application service. To ensure data security, it is required that the access party and the service provider of the database authenticate the access users, and only the users who pass the authentication can perform operations such as querying, deleting, adding, or modifying data on the database.

[0041] In related technologies, user passwords are usually used to authenticate user permissions. However, the device storing the user password is vulnerable to attacks and the user password may be leaked, resulting in insecure user permission authentication and insufficient data security. For example, the user password is stored by a centralized component (such as the server of an application system) for user identity information and password. When this centralized component is attacked by a third party, the user identity information and password are easily intercepted or leaked, and the third party can use the user identity information and password to bypass the trusted parties and directly invade the database, causing data security problems.

[0042] In view of this problem, the present application provides a data processing method, apparatus, device, storage medium, and program product. The data processing device providing data operation functions receives a data processing request, determines the object key of the request object in the data processing request, and the data operation instruction of the request object for the target data component; then generates an access credential for the request object according to the object key in the data processing request and the device key of the data processing device; based on the access credential of the request object, performs permission verification on the request object for the target data component to obtain the permission verification information of the request object; and in the case where the permission verification information is verified through, in response to the data operation instruction in the data processing request, performs corresponding data operation processing on the target data component, effectively reducing unauthorized access behaviors caused by the leakage of key information and ensuring data security.

[0043] The data processing method provided by the embodiments of the present invention can be applied in a data processing system as Figure 1 shown. The data processing system includes a data processing device and a terminal device. The data processing device can communicate with the terminal device through a network.

[0044] Among them, the data processing system can be a data service platform, and the data processing device can be the server of the data service platform. The data service platform can include one or more data components, and the data component can be various databases, various data software, etc. The data processing device can provide data operation functions for one or more data components; for example, provide functions such as data query, addition, deletion, or modification of the data component.

[0045] Specifically, in the actual application process, the user uses the terminal device to log in to the data processing system (i.e., the data service platform) to which the data processing device belongs, and sends a data processing request for the target data component through the terminal device. Among them, the data processing request can include the identity key information of the request object, that is, the object key, and the data operation instruction of the request object for the target data component. The request object is used to represent the user or the user account of the user.

[0046] The data processing device of the data processing system receives the data processing request, determines the object key of the request object in the data processing request, and the data operation instruction of the request object for the target data component. Then, the data processing device generates an access credential for the request object according to the object key in the data processing request and the device key of the data processing device; based on the access credential of the request object, performs permission verification on the request object for the target data component to obtain the permission verification information of the request object; and in the case where the permission verification information is verified through, in response to the data operation instruction in the data processing request, performs corresponding data operation processing on the target data component.

[0047] For example, if the target data component is Database A and the data operation instruction is a data query instruction, then data query processing is performed on Database A in response to this data query instruction.

[0048] In this embodiment, different devices hold different key information, so that the true and complete authentication information of the request object is not retained in any cleartext or ciphertext form, improving the security of the key information; when the request object requests data operations, access credentials are generated according to the key information of different devices to perform permission verification based on the access credentials, improving the security of permission verification. In the case of multi-device collaborative work, no party can rely on its own incomplete key information to achieve data access, nor can it solely rely on the keys of both parties for data access, effectively reducing unauthorized access behaviors caused by key information leakage and ensuring data security.

[0049] In one embodiment, as Figure 2 shown, the above data processing system further includes a data service device, that is, the data processing system includes a data service device, a data processing device, and a terminal device. Among them, the data service device can communicate with the data processing device and the terminal device through a network. Among them, the data service device can be a master device that manages one or more data processing devices, that is, a Master device; the data processing device is a slave device that responds to the call of the data service device, that is, a Slave device.

[0050] The data service device and the data processing device can be computer devices deployed in different organizational departments. The data service device can be a server of a data service platform. The data service device provides an application service interface for users to call the data service platform. Users can log in to the data service platform through the terminal device and call this application service interface to send data operation instructions or data processing requests. The data service platform is provided with one or more data components; the data processing device is a host device of a certain organizational department and is used to perform operations such as data query, addition, deletion, or modification on one or more data components. The data service device realizes the data processing functions of each data component by calling the data processing device.

[0051] For example, the data service platform can be the United Query Service, and the data service device is the server of the unified query service platform, that is, the Application Entry Server used by users to access the unified query service platform. The multiple data processing devices can be the host devices of different organizational departments, providing data operation functions for the data components of the corresponding organizational departments. That is, the data processing device is the ApplicationTargetServer that actually executes data processing operations. As the entry point for data processing requests, the data service device interacts with users using the platform. As the entry server, the data service device is responsible for generating part of the user's identity key information (i.e., the object key), processing data processing requests (such as query requests) from users, and forwarding the requests to the corresponding target servers. As the recipient when the user initiates a request, the target server is responsible for generating the other part of the user's local identity key information (i.e., the device key), combining various parts of the key to obtain an access credential, and performing permission authentication; after the permission authentication passes, it responds to the data processing request and performs corresponding data processing.

[0052] Specifically, in the actual application process, the user uses a terminal device to log in to the data processing system to which the data processing device belongs, and sends a data operation instruction for the target data component through the terminal device. After receiving the data operation instruction, the data service device sends a data processing request for the request object corresponding to the data operation instruction to the data processing device. Among them, the request object is used to represent the user or the user's account. The data operation instruction may include the identity information of the request object, such as the object name (i.e., the user name) and the object identifier.

[0053] After receiving the data processing request, the data processing device determines the object key of the request object in the data processing request and the data operation instruction of the request object for the target data component, then generates an access credential for the request object, and based on the access credential of the request object, performs permission verification on the request object for the target data component to obtain the permission verification information of the request object; when the permission verification information indicates that the permission verification has passed, in response to the data operation instruction in the data processing request, it performs corresponding data operation processing on the target data component. By having different devices hold different key information, the security of the key information is improved; an access credential is generated based on the key information of different devices to perform permission verification based on this access credential, improving the security of permission verification, effectively reducing unauthorized access behaviors caused by key information leakage, and ensuring data security.

[0054] Among them, the terminal device includes but is not limited to various personal computers, laptop computers, smart phones, tablet computers, and portable wearable devices. The data processing device can be various electronic devices or terminal devices with data processing functions. The data service device can be a server, and the server can be implemented by an independent server or a server cluster composed of multiple servers.

[0055] In one embodiment, as Figure 3 shown, a data processing method is provided. Taking the data processing device in Figure 1 as an example for illustration, the method includes the following steps:

[0056] S10: The data processing device receives a data processing request, and determines the object key of the request object in the data processing request, as well as the data operation instruction of the request object for the target data component.

[0057] In the actual application process, the user uses the terminal device to log in to the data processing system (i.e., the data service platform) to which the data processing device belongs, and sends a data processing request for the target data component through the terminal device. Alternatively, the user uses the terminal device to log in to the data processing system to which the data processing device belongs, and sends a data operation instruction for the target data component through the terminal device; after the data service device receives the data operation instruction, it sends a data processing request for the request object corresponding to the data operation instruction to the data processing device. Among them, the data processing request may include the identity key information of the request object, that is, the object key, and the data operation instruction of the request object for the target data component. The request object is used to represent the user or the user account of the user.

[0058] The data processing device receives the data processing request from the data service device or the terminal device, and performs data parsing processing on the data processing request to determine the object key of the request object in the data processing request, as well as the data operation instruction of the request object for the target data component.

[0059] Among them, the object key (User Secret Key) is the key information pre-generated by the data service device for the request object. The user sends a registration request to the data service device through the terminal device; in response to the registration request, the data service device creates an account for the user, and generates the unique identification information and key information of the account, obtaining the object identification and object key of the object (i.e., the created user account); binds and stores the object identification and object key of the object to the object mapping relationship data for subsequent invocation. For example, the object identification and object key in the object mapping relationship data can be called to apply for permissions or perform data processing on the target data component. The object can be a permission application object that requests permissions for the target data component, or a request object that requests data processing on the target data component.

[0060] Among them, the object key generation process is as follows: obtain the date and time information when the registration request is received, generate a random number based on the date and time information when the registration request is received, the clock sequence, and the machine identification number to obtain random identification information, and use this random identification information as the key information of the object sending the registration request, that is, as the object key.

[0061] S20: Generate an access credential for the requested object based on the object key in the data processing request and the device key of the data processing device.

[0062] Among them, the data processing device provides data operation functions for the target data component, such as data query, data modification, data deletion, and data addition and other operation functions.

[0063] After receiving the data processing request, the data processing device obtains the local key information stored in the data processing device, that is, obtains the device key stored in the data processing device. This device key can be the unique key information generated according to the device's own parameters when the data processing device runs the target data component.

[0064] After obtaining the object key in the data processing request and the device key of the data processing device, the data processing device generates an access credential for the requested object to the target data component according to the object key in the data processing request and the device key of the data processing device. This access credential is the identity authentication information for the requested object to request access to the target data component.

[0065] For example, the object key in the data processing request and the device key of the data processing device can be directly concatenated into the access credential of the requested object; or after concatenating the object key and the device key, a certain encryption algorithm can be used to perform key calculation on the concatenated key information to obtain the access credential for the requested object to the target data component.

[0066] Such as Figure 4As shown in the figure, a schematic diagram of the access credential generation process for different request objects is shown. Among them, the request objects may include System User 1 and System User 2. The object key of System User 1 is Key A1, and the object key of System User 2 is Key A2. The data processing device (i.e., Slave Module 1) stores a device key, namely Key B. After the data processing device receives the data processing request of System User 1, it concatenates the key A1 of System User 1 in the data processing request and the key B in the data processing device to obtain User 1's password, that is, to obtain the access credential of the request object for the target data component, which is also the access credential of Data Component User 1. After the data processing device receives the data processing request of System User 2, it concatenates the key A2 of System User 2 in the data processing request and the key B in the data processing device to obtain User 2's password, that is, to obtain the access credential of the request object for the target data component, which is also the access credential of Data Component User 2.

[0067] S30: The data processing device performs permission verification on the request object for the target data component based on the access credential of the request object to obtain the permission verification information of the request object.

[0068] After generating the access credential of the request object, the data processing device performs permission verification on the request object for the target data component based on this access credential of the request object, that is, to verify whether the request object has the permission to access the target data component (such as a database), and obtains the permission verification information of this request object.

[0069] In this embodiment, even if part or all of the object key and the device key are leaked, without knowing the access credential generation algorithm, third-party users cannot bypass the data service device to access and operate on the data component, significantly improving the security, reliability, and anti-tampering ability of data access verification and enhancing data security.

[0070] S40: When the permission verification information is permission verification passed, the data processing device responds to the data operation instruction in the data processing request and performs corresponding data operation processing on the target data component.

[0071] When the permission verification information is permission verification failed, it means that the request object does not have the permission to access the target data component. This request object may be a legitimate object that has not been authorized. The data processing device does not need to respond to the data processing request and does not perform data operations on the target data component to protect the data security of the target data component. At the same time, the permission verification information of permission verification failed can also be pushed to the user's terminal device through the data service device so that the user can timely learn the request result and take corresponding measures.

[0072] When the permission verification information indicates that the permission verification is passed, it means that the requesting object has the permission to access the target data component. The requesting object is a legitimate object that has been authorized. The data processing device then responds to the data operation instruction in the data processing request and performs corresponding data operation processing on the target data component.

[0073] After performing the corresponding data operation processing on the target data component, the data processing device can also push the processing result information obtained from the data processing (through the data service device) to the user's terminal device.

[0074] For example, the data processing request can be a data query request, and the data operation instruction in the data processing request can be a data query instruction for a certain database by the requesting object. When the permission verification information of the requesting object indicates that the permission verification is passed, the data processing device responds to the data query instruction, performs data query processing on the database to be queried, obtains the target query data, and pushes the target query data (through the data service device) to the user's terminal device so that the user can perform operations such as browsing and analyzing the target query data.

[0075] In this embodiment, by different devices holding different key information, the true and complete authentication information of the requesting object is not retained in any plaintext or ciphertext form, improving the security of the key information; when the requesting object requests data operations, an access credential is generated based on the key information of different devices for permission verification, improving the security of permission verification. In the case of multi-device collaborative work, no party can rely on its own incomplete key information to achieve data access, nor can it solely rely on the keys of both parties for data access, effectively reducing unauthorized access behaviors caused by key information leakage and ensuring data security.

[0076] In one embodiment, as Figure 5 shown, in step S10, that is, the data processing device receives a data processing request and determines the object key of the requesting object in the data processing request and the data operation instruction of the requesting object for the target data component, which specifically includes the following steps:

[0077] S11: The terminal device sends the data operation instruction of the requesting object for the target data component to the data server device.

[0078] Among them, the data processing system further includes a data service device, which is used to respond to the data operation instruction of the requesting object for the target data component, obtain the object key of the requesting object in the data service device, and send a data processing request according to the object key and the data operation instruction.

[0079] The user logs in to the data processing system to which the data processing device belongs using a terminal device, enters a data operation instruction for a target data component in the application page provided by the data processing system, and the terminal device uses the user or the user's account as the request object and sends the data operation instruction of the request object for the target data component to the data server device.

[0080] Among them, there are two ways to obtain the data operation instruction. The first way to obtain the data operation instruction can be: there are predefined data operation instructions in the application page provided by the data processing system, such as the predefined data query statement; the data operation instruction includes the instruction identification information for the request object to perform a preset operation (such as a query operation) on the target data component. The user selects the data operation instruction to be executed in the application page provided by the data processing system through the terminal device, and the terminal device sends the instruction identification information and object information (including object identification) characterizing the data operation instruction of the target data component to the data service device, that is, the data operation instruction of the request object for the target data component is sent to the data server device.

[0081] The second way to obtain the data operation instruction can be: the user determines the target data component for which a data operation is requested in the application page provided by the data processing system through the terminal device and enters a data operation instruction (such as a data query instruction) for the target data component. The terminal device sends the unique identification of the target data component, the data operation instruction, and object information (including object identification) to the data service device, that is, the data operation instruction of the request object for the target data component is sent to the data server device.

[0082] S12: The data service device responds to the data operation instruction of the request object for the target data component, obtains the object key of the request object in the data service device, and sends a data processing request according to the object key and the data operation instruction.

[0083] The data service device receives the data operation instruction of the request object for the target data component, and the data operation instruction carries the object identification of the request object, that is, the unique identification information of the request object; then, the data service device obtains the object key corresponding to the object identification of the request object from the data stored in the data service device, that is, obtains the object key of the request object. Among them, the object key is the key information pre-generated and stored by the data service device for the request object.

[0084] After obtaining the object key of the request object, the data service device generates a data processing request for the request object according to the data operation instruction of the request object for the target data component, the object key (and object identification) of the request object, and sends the data processing request to the data processing device corresponding to the target data component.

[0085] Among them, the data service device obtains the data component data stored in advance. The data component data stores the data processing devices corresponding to different data components and the device access addresses of these data processing devices. The device access address is the access address of the data processing device corresponding to the data component, such as the Internet Protocol address, that is, the IP (Internet Protocol) address. Then, the data service device searches for the device access address corresponding to the target data component identifier in the preset data component data according to the target data component identifier carried in the data operation instruction of the target data component, and obtains the device access address of the data processing device corresponding to the target data component. After generating the data processing request of the request object, the data processing request of the request object is sent to the data processing device based on the device access address.

[0086] S13: The data processing device receives the data processing request from the data service device.

[0087] The data processing device receives the data processing request from the data service device. That is, the data processing request is generated by the data service device according to the data operation instruction of the request object and the object key. The object key is the key information pre-generated and stored by the data service device for the request object.

[0088] S14: The data processing device extracts data from the data processing request to obtain the object key of the request object and the data operation instruction for the target data component.

[0089] After receiving the data processing request from the data service device, the data processing device extracts data from the data processing request to obtain the object key, object identifier of the request object, and the data operation instruction for the target data component.

[0090] Taking the data operation instruction as a data query instruction as an example, as Figure 6 and Figure 7 shown, it shows the data processing process during the response of each device to the data processing request when different data query instruction acquisition methods are adopted. The data component can be one or more of Database 1, Database 2, and Database 3.

[0091] Among them, as Figure 6 shown, it shows the device data processing process diagram when the first instruction acquisition method is adopted. Specifically, the user selects the data query instruction to be executed in the application page provided by the data processing system through the terminal device, such as Figure 6As shown in the figure, the terminal device sends the instruction identification information (i.e., instruction ID) and object information (including object identification) of the data query instruction characterizing the target data component to the data service device. The data service device parses the instruction identification information to obtain the data query instruction of the request object for the target data component, obtains the object key in the data processing device according to the object identification in the object information, and obtains the device access address of the data processing device corresponding to the target data component.

[0092] Among them, as Figure 7 shown in the figure, it shows the device data processing process diagram when the second instruction acquisition method is adopted. Specifically, the user selects the target data component for which the data query operation is requested in the application page provided by the data processing system through the terminal device and inputs the data query instruction for the target data component. As Figure 7 shown in the figure, the terminal device sends the identification information (i.e., component identification), data query instruction and object information (including object identification) characterizing the target data component to the data service device. The data service device receives the data query instruction of the request object for the target data component, obtains the object key corresponding to the object identification in the data processing device according to the object identification in the object information, and obtains the device access address of the data processing device corresponding to the target data component identification.

[0093] After the data service device obtains the object key of the request object and the device access address, as Figure 6 and 7 shown in the figure, the data service device sends the data processing request including the data query instruction, object identification and object key to the data processing device based on the device access address. The data processing device parses the data processing request to obtain the data query instruction for the target data component, the object identification of the request object and the object key. Then, the data processing device performs information digest calculation based on the object key and its own device key to generate the access credential of the request object; performs permission verification based on the access credential of the request object and the object identification, and after the permission verification passes, responds to the data query instruction to query the data of the data component.

[0094] In this embodiment, the terminal device sends a data operation instruction for the target data component to the data server device for the request object; the data service device responds to the data operation instruction for the target data component of the request object, obtains the object key of the request object in the data service device, and sends a data processing request according to the object key and the data operation instruction; the data processing device receives the data processing request from the data service device, and performs data extraction on the data processing request to obtain the object key of the request object and the data operation instruction for the target data component. Compared with directly receiving the data processing request of the terminal device, this solution adds the data service device to generate and forward requests. The object keys are uniformly managed by the data service device, simplifying the key distribution and update process and avoiding potential security risks caused by the terminal device directly managing the keys. In addition, as an intermediate layer, the data service device can filter and verify the requests of the terminal device to ensure that the terminal device can only access data within a specific range, prevent the terminal device from directly communicating with the data processing device, increase the isolation of access permissions, prevent unauthorized requests from directly accessing the data processing device, and avoid the leakage of sensitive data. At the same time, it can reduce the situation of invalid requests being sent to the data processing device, optimize the resource utilization rate of the data processing device, and improve the security, reliability, and scalability of the system.

[0095] In one embodiment, as Figure 8 shown, in step S20, that is, the data processing device generates an access credential for the request object according to the object key in the data processing request and the device key in the data service device, which specifically includes the following steps:

[0096] S21: The data processing device splices the object key in the data processing request and the device key of the data processing device to obtain combined key information.

[0097] After extracting the object key in the data processing request, the data processing device obtains the device key of the data processing device, and splices the object key in the data processing request and the device key of the data processing device to obtain combined key information.

[0098] S22: The data processing device performs an information digest calculation on the combined key information to obtain the access credential for the request object.

[0099] The data processing device uses a preset key algorithm to perform an information digest calculation on the combined key information to obtain the access credential for the request object. The preset key algorithm can be a one-way irreversible encryption algorithm such as the MD5 algorithm or the hash algorithm.

[0100] For example, the object key and the device key of the data processing device can be directly concatenated to obtain combined key information, and then the MD5 algorithm or the hash algorithm is used to calculate the information digest of the combined key information to obtain the access credential for the requested object.

[0101] In this embodiment, the data processing device concatenates the object key in the data processing request and the device key of the data processing device to obtain combined key information; calculates the information digest of the combined key information to obtain the access credential for the requested object. Through the combined calculation of the object key and the device key, the complexity of the access credential is increased, avoiding the security risk caused by the leakage of a single key. Through the dual authentication of the object key and the device key of the requested object, the reliability of the identity authentication is improved; the access credential generated by the information digest calculation is irreversible, effectively preventing the key from being directly restored and enhancing the data protection intensity. This solution obtains the access credential through dual-key joint verification and information digest calculation for permission verification. Even if part or all of the object key and the device key are leaked, without knowing the digest algorithm and the key trimming method, a third-party user cannot bypass the data service device to access and operate on the data component, significantly enhancing the security, reliability, and anti-tampering ability of data access verification and improving data security.

[0102] In one embodiment, the data processing device can perform trimming processing (or salting processing) on at least one of the object key and the device key of the requested object to obtain the trimmed (or salted) object key and / or device key, and then concatenate the trimmed (or salted) object key and / or device key to obtain combined key information. Among them, the trimming processing is to delete some characters in the object key or the device key; the salting processing is to add a preset string or a random string to the object key or the device key.

[0103] For example, the object key of the requested object can be trimmed (or salted), and the trimmed (or salted) object key is concatenated with the device key of the data processing device to obtain combined key information. Or, the device key of the data processing device can be trimmed (or salted), and the trimmed (or salted) device key is concatenated with the object key of the requested object to obtain combined key information. It is also possible to trim (or salt) the object key of the requested object and trim (or salt) the device key of the data processing device, and then concatenate the trimmed (or salted) object key with the trimmed (or salted) device key to obtain combined key information.

[0104] In this embodiment, at least one of the object key and the device key of the request object is subjected to cropping processing or salting processing, and then the combined key information is spliced to generate an access credential. This solution improves the randomness, unpredictability, and anti-attack ability of the key through cropping or salting processing, and can effectively enhance the security and accuracy of data access control and authentication.

[0105] In one embodiment, before step S10, that is, before the data processing device receives a data processing request, the method further specifically includes the following steps:

[0106] S01: The data processing device receives a permission application request from a permission application object for a target data component, and the permission application request includes the object key of the permission application object.

[0107] The user inputs a permission application request for a target data component by the object through a terminal device, and the terminal device sends the permission application request for the target data component by the permission application object to the data processing device, where the permission application request carries the object key of the permission application object.

[0108] Alternatively, the user inputs a permission application request for a target data component by the object through a terminal device, and the terminal device sends the permission application request for the target data component by the permission application object to the data service device. After receiving the permission application request from the permission application object, the data service device obtains the object key of the permission application object from the stored data in the data service device, and then sends the object key and the permission application request of the permission application object to the data processing device.

[0109] The data processing device receives the permission application request for the target data component from the permission application object from the data service device, where the permission application request includes the object key of the permission application object. The generation process of the object key is as described above and will not be elaborated here.

[0110] S02: In response to the permission application request, the data processing device creates an authorized account for the target data component for the permission application object, and obtains the object account information of the permission application object.

[0111] In response to the permission application request of the permission application object, the data processing device creates an authorized account for the target data component for the permission application object, and obtains the object account information of the permission application object.

[0112] Among them, since the data processing system can operate across departments and users in different organizational departments have different permissions for different data components, to ensure the security of account information and data information. In this embodiment, in response to a permission application request, the data processing device uses a preset account (such as an administrator account) of the data component to create an authorized account for the permission application object of the data component, and configures object permission information for the permission application object to obtain the object account information of the permission application object. The object account information includes the object account (and object identifier) of the permission application object, and the object permission information of the permission application object.

[0113] S03: The data processing device generates authentication information for the permission application object according to the object key of the permission application object and the device key of the data processing device.

[0114] After the data processing device creates the object account information of the permission application object, it obtains the key information generated locally by the data processing device, that is, obtains the device key of the data processing device. Among them, the device key is the key information generated when the data processing device first executes the data processing function of the data component. The device key is generated according to the device information when the data processing device first runs the data processing function of the data component. The device information includes the system time, device name (or device identifier), and Internet protocol address of the device bit when the data processing device first runs the data processing function of the data component, that is, the device IP address.

[0115] The generation process of the device key of the data processing device is as follows: Enable the data processing function of the pre-configured data component, and detect whether there is a key file with a preset name in the target file of the data processing device, such as checking whether there is a file named local_key in the directory resources / of the data processing device; if it exists, it is determined that the device key has been generated; if it does not exist, string splicing is performed based on the current system time, device name (or device identifier), and device IP address, and a preset key algorithm, such as the Message-Digest algorithm 5 (MD5), is used to perform key calculation on the spliced string to obtain the device key of the data processing device, and the device key is stored in the file resources / local_key in the data processing device, that is, the process of generating and storing the device key locally is completed.

[0116] After obtaining the device key of the data processing device, the data processing device generates authentication information for the permission application object according to the object key of the permission application object and the device key of the data processing device. Among them, the authentication information is used to verify the access credentials of the request object to perform permission verification of the target data component for the request object.

[0117] Among them, the object key of the permission application object and the device key of the data processing device can be concatenated to obtain combined key information, and then the combined key information is subjected to information digest calculation to obtain the authentication information of the permission application object. By generating the authentication information of the object through two key information with different sources, the security of the authentication information is improved, and the accuracy of subsequent request object permission verification is also improved.

[0118] S04: The data processing device binds and stores the authentication information of the permission application object and the object account information to the authorized account data of the target data component.

[0119] After obtaining the authentication information of the permission application object and the object account information, the data processing device binds and stores the authentication information of the permission application object and the object account information to the authorized account data of the target data component for subsequent invocation.

[0120] Taking the data component as a MySQL database as an example, the object permission information and authentication information of the permission application object can be stored in the authorized account data in the following way: GRANT SELECT ON <database> . <username>'@'<host_ip>'identified by' <password>'with grant option。

[0121] Among them, database is the name of the database; table is the name of the table in the database; username represents the newly created username, that is, the object account of the object for which the permission is applied; host_ip refers to the IP address of the terminal device allowed to access the database; password represents the authentication information of the object for which the permission is applied. In other embodiments, the storage methods of the object permission information and the authentication information may also be other methods, which will not be elaborated here.

[0122] In this embodiment, a permission application request from an object for which permission is applied for a target data component is received. The permission application request includes the object key of the object for which permission is applied. In response to the permission application request, an authorization account for the target data component is created for the object for which permission is applied, and the object account information of the object for which permission is applied is obtained. According to the object key of the object for which permission is applied and the device key of the data processing device, the authentication information of the object for which permission is applied is generated. The authentication information of the object for which permission is applied and the object account information are bound and stored in the authorization account data of the target data component. The authentication information is used to verify the access credentials of the request object to perform permission verification on the target data component for the request object. By jointly generating the authentication information through the object key and the device key, the security of the authentication information is improved. Taking this as the basis for object permission authentication can ensure the authenticity of the subsequent object's identity and prevent forgery or tampering. In addition, by dynamically creating an authorization account through the permission application request, the instant allocation of permissions for different data components is realized, adapting to the needs of multi-user concurrent access. Binding the authentication information to the authorization account data avoids directly exposing sensitive credentials and further enhances data access security.

[0123] In one embodiment, as Figure 9 shown, in step S30, that is, the data processing device performs permission verification on the request object for the target data component based on the access credentials of the request object, and obtains the permission verification information of the request object, which specifically includes the following steps:

[0124] S31: The data processing device searches for the authentication information of the request object in the authorization account data of the target data component.

[0125] Among them, the data processing request further includes the object key and the object identifier of the request object. After obtaining the data processing request, the data processing device obtains the authorization account data stored in the data processing device. Among them, the authorization account data includes the object account information and the authentication information of at least one object authorized by the target data component. The object account information includes the object account, the object identifier, and the object key of the object, as well as the object permission information of the authorized object. The object account information of the object is bound and associated with the authentication information for storage.

[0126] After obtaining the authorized account data of the target data component, the data processing device searches for the authentication information of the request object in the authorized account data of the target data component. Among them, the data processing device performs data matching on the authorized account data according to the object identifier of the request object in the data processing request, and determines the authentication information corresponding to the matched object identifier as the authentication information of the request object.

[0127] S32: The data processing device performs a consistency check on the access credential and authentication information of the request object to obtain the permission verification information.

[0128] After obtaining the authentication information of the request object, the data processing device performs a consistency check on the access credential and authentication information of the request object to obtain the permission verification information.

[0129] That is, the data processing device determines the information consistency between the access credential and authentication information of the request object, and the information consistency can be represented by similarity; if the similarity between the access credential and authentication information of the request object is greater than or equal to the threshold, it indicates that the access credential and authentication information of the request object are consistent, and the permission verification information is determined to be permission verification passed. If the similarity between the access credential and authentication information of the request object is less than the threshold, it indicates that the access credential and authentication information of the request object are inconsistent, and the permission verification information is determined to be permission verification failed.

[0130] In this embodiment, by searching for the authentication information of the request object in the authorized account data of the target data component, the account data includes the object account information and authentication information of at least one object authorized by the target data component; performing a consistency check on the access credential and authentication information of the request object to obtain the permission verification information. By performing a consistency check on the access credential of the request object and the stored authentication information, only legal objects can access the target data component, ensuring the authenticity and legality of the access credential, preventing unauthorized access, and enhancing data security.

[0131] In one embodiment, in step S32, that is, the data processing device performs a consistency check on the access credential and authentication information of the request object to obtain the permission verification information, which specifically includes the following steps:

[0132] S321: The data processing device performs a consistency check on the access credential and authentication information of the request object to obtain the credential verification information.

[0133] After searching for the authentication information of the request object in the authorized account data of the target data component, the data processing device performs a consistency check on the access credential and authentication information of the request object to obtain the credential verification information.

[0134] Among them, the data processing device determines the information consistency between the access credential of the requested object and the authentication information, and the information consistency can be represented by similarity. If the similarity between the access credential of the requested object and the authentication information is greater than or equal to the threshold, it indicates that the access credential and the authentication information of the requested object are consistent, and the credential verification information is determined to pass the consistency verification. If the similarity between the access credential of the requested object and the authentication information is less than the threshold, it indicates that the access credential and the authentication information of the requested object are inconsistent, and the credential verification information is determined to fail the consistency verification.

[0135] S322: The data processing device searches for the object permission information of the requested object in the authorized account data of the target data component, and determines the data access permission of the requested object based on the object permission information.

[0136] It should be noted that different objects (users) have different data access permissions for different data components, and different objects also have different data access permissions for the same data component. For example, a certain object has the query permission for data component A, but does not have the management permissions for data component A, such as modification, addition, and deletion. Another object has the query permission for data component B, as well as the permissions for modification, addition, and deletion of data component B.

[0137] Therefore, the data processing device also needs to determine the data access permission of the requested object for the target data component according to the object permission information of the requested object, so as to perform permission verification on the requested object according to the data access permission and improve the accuracy of permission verification.

[0138] Among them, the data processing device performs data matching on the authorized account data according to the object identifier of the requested object in the data processing request, and determines the object permission information corresponding to the matched object identifier as the object permission information of the requested object. Then, the data processing device determines the data access permission of the requested object for the target data component according to the object permission information of the requested object.

[0139] S323: When the credential verification information passes the consistency verification and the data access permission is the operation permission corresponding to the data operation instruction, the data processing device determines that the permission verification information passes the permission verification.

[0140] After obtaining the credential verification information and the data access permission of the requested object, when the credential verification information passes the consistency verification and the data access permission is the operation permission corresponding to the data operation instruction, it indicates that the key information of the requested object is correct, and for the target data component, the requested object has the operation permission corresponding to the data operation instruction it requests. The data processing device determines that the permission verification information passes the permission verification.

[0141] For example, if the data processing request of the request object is a query request, and the data operation instruction is a query instruction for the target data component, when the voucher verification information passes the consistency verification, the data processing device determines that the request object has the data query permission for the target data component according to the object permission information of the request object, indicating that the request object is a legal object authorized, and its operation on the target data component does not exceed its permission, then the data processing device determines that the permission verification information passes the permission verification.

[0142] S324: When the voucher verification information fails the consistency verification, or the data access permission does not have the operation permission corresponding to the data operation instruction, the data processing device determines that the permission verification information fails the permission verification.

[0143] When the voucher verification information fails the consistency verification, it indicates that the key information of the request object is incorrect, the data processing request may be attacked and tampered with, and the identity of the request object is suspicious with potential security risks. Then the data processing device determines that the permission verification information fails the permission verification.

[0144] Or, when the voucher verification information fails the consistency verification, but the data access permission of the request object does not have the operation permission corresponding to the data operation instruction, it means that the request object is a legal object authorized, but its operation on the target data component exceeds its permission. Then the data processing device determines that the permission verification information fails the permission verification.

[0145] For example, when the voucher verification information passes the consistency verification, it is determined that the data access permission of the request object has the data query permission for the target data component, but the request object does not have the permissions such as data modification, addition, and deletion for the target data component; if the data processing request of the request object is one or more of the data modification request, data addition request, and data deletion request, and its data operation instruction for the target data component is one or more of the data modification instruction, data addition instruction, and data deletion instruction, then it is determined that the data access permission of the request object does not have the operation permission corresponding to the data operation instruction. At this time, the data processing device determines that the permission verification information fails the permission verification.

[0146] In this embodiment, the access credentials and authentication information of the request object are subjected to consistency verification to obtain credential verification information; the object permission information of the request object is searched in the authorized account data of the target data component, and the data access permission of the request object is determined based on the object permission information; when the credential verification information passes the consistency verification and the data access permission has the operation permission corresponding to the data operation instruction, it is determined that the permission verification information passes the permission verification; when the credential verification information fails the consistency verification or the data access permission does not have the operation permission corresponding to the data operation instruction, it is determined that the permission verification information fails the permission verification. Through the consistency verification of the access credentials, it is ensured that the identity of the request object is true and reliable, preventing illegal objects from impersonating identities to access data, and restricting the data operation scope of the object in combination with the object permission information to prevent authorized objects from performing unauthorized data operations beyond their authority. This solution ensures the security, reliability, and controllability of the data access process through the dual guarantees of identity verification and permission verification.

[0147] In a specific embodiment, taking the data component as a database, the data processing request as a data query request, and the data operation instruction as a data query instruction as an example, the data processing operations of the data service device, the data processing device, and the terminal device in the data processing method provided in this embodiment are described. As Figure 10 shown, a data processing framework diagram of the data processing system implementing the data processing method in this embodiment is shown.

[0148] As Figure 10 shown, a system entry for the user to call the relevant data functions of the data processing system (i.e., the unified data processing platform) is provided on the terminal device, and the function call of the system entry is implemented through the system user management module. The data service device is used to distribute user requests to the data processing devices corresponding to the databases. Each data processing device manages one or more databases correspondingly. For example, data processing device 1 manages database 1, database 2, and database 3...; data processing device 2 manages database 4. Each data processing device performs key initialization when running the relevant functions for the first time to generate and store the device key of the data processing device.

[0149] In practical applications, the user (i.e., the requesting object) inputs a registration request through a terminal device. The system user management module in the terminal device calls the data service device to enable the data service device to respond to the registration request and perform system user configuration to obtain the system account information of the user; generate a system key for the user to generate an object key for the user, and store the object key, system account information, and user information (such as the user device) to save the data of the user mapping relationship (i.e., the object mapping relationship data). Then, the user requests authorization permissions for one or more databases from the data service device through the terminal device, that is, the terminal device sends a permission application request to the data service device. The data service device sends the permission application request and the object key of the user to the data processing device corresponding to the database requesting the permission. After receiving the permission application request and the object key of the user, the data processing device creates a database user for the user, obtains the object account information of the user, and stores it.

[0150] During the data query process, the user inputs a data query instruction for one or more target databases through the terminal device, so that the system user management module in the terminal device calls the data service device to perform data query. Among them, the terminal device sends the data query instruction to the data service device. After receiving the data query instruction of the user for the target database, the data service device obtains the object key of the user, assembles the object key and the data query instruction into a data query request, and distributes the request to the corresponding data processing devices, such as distributing it to data processing device 1 and data processing device 2. After receiving the data query request, data processing device 1 and data processing device 2 generate an access credential for the user to the target database based on the object key and their own device keys, and perform database permission verification on the user based on the access credential. After the permission verification passes, data processing device 1 and data processing device 2 push the data query instruction of the user to the corresponding target database to execute the data query instruction to obtain the returned target query data.

[0151] In this embodiment, by having different devices hold different key information, the true and complete authentication information of the user is not retained in any plaintext or ciphertext form, improving the security of the key information; when the user requests data query, an access credential is generated based on the key information of different devices to perform permission verification based on the access credential, improving the security of the permission verification. In the case of multi-device collaborative work, no party can rely on its own incomplete key information to achieve data access, nor can it rely solely on the keys of both parties for data access, effectively reducing unauthorized access behaviors caused by key information leakage and ensuring data security.

[0152] It should be understood that the sequence numbers of the steps in the above embodiments do not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0153] In one embodiment, a data processing device is provided, which corresponds one-to-one with the data processing method in the above embodiment. As Figure 11 shown, the data processing device includes a receiving module 111, a determining module 112, a generating module 113, a verifying module 114, and a processing module 115. The detailed descriptions of each functional module are as follows:

[0154] The receiving module 111 is used to receive a data processing request;

[0155] The determining module 112 is used to determine the object key of the requested object in the data processing request, and the data operation instruction of the requested object on the target data component;

[0156] The generating module 113 is used to generate an access credential for the requested object according to the object key in the data processing request and the device key of the data processing device, and the data processing device provides the data operation function of the target data component;

[0157] The verifying module 114 is used to perform permission verification on the requested object for the target data component based on the access credential of the requested object to obtain the permission verification information of the requested object;

[0158] The processing module 115 is used to perform corresponding data operation processing on the target data component in response to the data operation instruction in the data processing request when the permission verification information is verified through.

[0159] In one embodiment, the receiving module 111 is specifically used to receive a data processing request from a data service device; the data service device is used to respond to the data operation instruction of the requested object on the target data component, obtain the object key of the requested object in the data service device, and send a data processing request according to the object key and the data operation instruction;

[0160] The determining module 112 is specifically used to extract data from the data processing request to obtain the object key of the requested object and the data operation instruction on the target data component.

[0161] In one embodiment, the data processing device further includes a creating module 116 and a storing module 117;

[0162] Among them, the receiving module 111 is further used to receive a permission application request from a permission application object for the target data component before receiving the data processing request, and the permission application request includes the object key of the permission application object;

[0163] A creation module 116, configured to create an authorized account of a target data component for a permission application object in response to a permission application request, so as to obtain object account information of the permission application object;

[0164] A generation module 113 is further configured to generate authentication information of the permission application object according to an object key of the permission application object and a device key of the data processing device, where the authentication information is used to verify an access credential of the request object, so as to perform permission verification on the request object for the target data component;

[0165] A storage module 117 is configured to bind and store the authentication information and the object account information of the permission application object to the authorized account data of the target data component.

[0166] In one embodiment, a verification module 114 is specifically configured to search for the authentication information of the request object in the authorized account data of the target data component, where the account data includes object account information and authentication information of at least one object authorized by the target data component; perform consistency verification on the access credential and the authentication information of the request object to obtain permission verification information.

[0167] In one embodiment, the verification module 114 is further specifically configured to perform consistency verification on the access credential and the authentication information of the request object to obtain credential verification information; search for object permission information of the request object in the authorized account data of the target data component, and determine the data access permission of the request object based on the object permission information; when the credential verification information passes the consistency verification and the data access permission has the operation permission corresponding to the data operation instruction, determine that the permission verification information passes the permission verification; when the credential verification information fails the consistency verification or the data access permission does not have the operation permission corresponding to the data operation instruction, determine that the permission verification information fails the permission verification.

[0168] In one embodiment, the generation module 113 is specifically configured to splice the object key in the data processing request and the device key of the data processing device to obtain combined key information; perform information digest calculation on the combined key information to obtain the access credential of the request object.

[0169] It should be noted that, for the information interaction, execution process, etc. between the above-mentioned device / unit, since it is based on the same concept as the method embodiment of the present application, for its specific functions and the technical effects brought, please refer to the method embodiment part for details, and will not be elaborated here.

[0170] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the above-mentioned division of each functional unit and module is used as an example. In actual applications, the above-mentioned functions can be allocated to different functional units and modules according to needs, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction and do not limit the protection scope of this application. The specific working process of the units and modules in the above system can refer to the corresponding process in the foregoing method embodiments and will not be elaborated herein.

[0171] The embodiment of this application also provides a computer device, as Figure 12 shown. The computer device 12 includes: at least one processor 121, a memory 122, and a computer program 123 stored in the memory 122 and executable on the at least one processor 121. When the processor 121 executes the computer program 123, it implements the steps in any of the foregoing method embodiments, or when the processor 121 executes the computer program 123, it implements the functions of each module / unit in the foregoing device embodiments.

[0172] Exemplarily, the computer program 123 can be divided into one or more modules / units. The one or more modules / units are stored in the memory 122 and executed by the processor 121 to complete this application. The one or more modules / units can be a series of computer program instruction segments capable of completing specific functions, and these instruction segments are used to describe the execution process of the computer program 123 in the computer device 12.

[0173] Those skilled in the art can understand that Figure 12 this is only an example of the computer device and does not constitute a limitation on the computer device. It may include more or fewer components than shown in the figure, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0174] The above-mentioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0175] The memory can be an internal storage unit of the computer device, such as the hard disk or memory of the computer device. The memory can also be an external storage device of the computer device, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. equipped on the computer device. Further, the memory can also include both the internal storage unit and the external storage device of the computer device.

[0176] An embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0177] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can execute the steps in the above-mentioned various method embodiments.

[0178] When the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, to implement all or part of the processes in the above method embodiments of this application, a computer program can be used to instruct relevant hardware to complete. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate forms, etc. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the photographing device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal, and software distribution medium. For example, USB flash drive, mobile hard disk, magnetic disk or optical disc, etc. In some jurisdictions, according to legislation and patent practice, the computer-readable medium cannot be electrical carrier signal and telecommunication signal.

[0179] In the above embodiments, the descriptions of the various embodiments have their own emphases. For the parts not detailed or recorded in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0180] Those of ordinary skill in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of this application.

[0181] In the embodiments provided in this application, it should be understood that the disclosed device / equipment and method can be implemented in other ways. For example, the device / equipment embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in an electrical, mechanical or other form.

[0182] The unit described as a separating component may or may not be physically separated. The component shown as a unit may or may not be a physical unit, that is, it may be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0183] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the protection scope of the present application.< / password> < / username> to' It should be noted that "to'" in the original seems to be an incorrect or incomplete expression. Maybe there is a typo. If this is a crucial part for the patent text understanding, it might need further clarification. < / database>

Claims

1. A data processing method, characterized in that Including: Receiving a data processing request, determining an object key of a request object in the data processing request, and a data operation instruction of the request object for a target data component; Generating an access credential for the request object according to the object key in the data processing request and a device key of a data processing device, where the data processing device provides a data operation function for the target data component; Performing permission verification on the request object for the target data component based on the access credential of the request object to obtain permission verification information of the request object; When the permission verification information indicates that the permission verification is passed, in response to the data operation instruction in the data processing request, performing corresponding data operation processing on the target data component.

2. The data processing method according to claim 1, wherein The receiving the data processing request, determining the object key of the request object in the data processing request, and the data operation instruction of the request object for the target data component includes: Receiving a data processing request from a data service device; the data service device is configured to respond to the data operation instruction of the request object for the target data component, obtain the object key of the request object in the data service device, and send the data processing request according to the object key and the data operation instruction; Performing data extraction on the data processing request to obtain the object key of the request object and the data operation instruction for the target data component.

3. The data processing method according to claim 1, wherein Before receiving the data processing request, the method further includes: Receiving a permission application request of a permission application object for the target data component, where the permission application request includes an object key of the permission application object; In response to the permission application request, creating an authorized account for the permission application object for the target data component to obtain object account information of the permission application object; Generating authentication information for the permission application object according to the object key of the permission application object and the device key of the data processing device, where the authentication information is used to verify the access credential of the request object so as to perform permission verification on the request object for the target data component; Binding and storing the authentication information of the permission application object and the object account information to authorized account data of the target data component.

4. The data processing method according to claim 1, characterized in that The performing permission verification on the request object for the target data component based on the access credential of the request object to obtain the permission verification information of the request object includes: Searching for the authentication information of the request object in the authorized account data of the target data component, where the account data includes object account information and authentication information of at least one object authorized by the target data component; Performing consistency verification on the access credential of the request object and the authentication information to obtain the permission verification information.

5. The data processing method according to claim 4, wherein The performing consistency verification on the access credential of the request object and the authentication information to obtain the permission verification information includes: Performing consistency verification on the access credential of the request object and the authentication information to obtain credential verification information; Search for the object permission information of the request object in the authorized account data of the target data component, and determine the data access permission of the request object based on the object permission information; When the voucher verification information passes the consistency verification and the data access permission has the operation permission corresponding to the data operation instruction, determine that the permission verification information passes the permission verification; When the voucher verification information fails the consistency verification or the data access permission does not have the operation permission corresponding to the data operation instruction, determine that the permission verification information fails the permission verification.

6. The data processing method according to any one of claims 1-5, characterized in that, The generating the access voucher of the request object according to the object key in the data processing request and the device key of the data service device includes: Perform splicing processing on the object key in the data processing request and the device key of the data processing device to obtain combined key information; Perform information digest calculation on the combined key information to obtain the access voucher of the request object.

7. A data processing device, characterized in that, Includes: A receiving module, configured to receive a data processing request; A determining module, configured to determine the object key of the request object in the data processing request and the data operation instruction of the request object for the target data component; A generating module, configured to generate an access voucher of the request object according to the object key in the data processing request and the device key of the data processing device, where the data processing device provides the data operation function of the target data component; A verifying module, configured to perform permission verification of the target data component on the request object based on the access voucher of the request object to obtain the permission verification information of the request object; A processing module, configured to, when the permission verification information passes the permission verification, respond to the data operation instruction in the data processing request and perform corresponding data operation processing on the target data component.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, the steps of the data processing method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that, When the computer program is run, the data processing method according to any one of claims 1 to 6 is executed.

Images