Access authorization method, device and equipment based on point-to-point content distribution network

Abstract

The invention provides an access authorization method, device and equipment based on a point-to-point content distribution network, relates to the technical field of scientific data sharing, and aims to solve the authority control problem of scientific data access under a point-to-point content distribution network architecture. The method comprises the following steps: an identification layer obtains data use rules of each scientific data center according to a user identity identifier and a data identifier of accessed target data; the rule layer converts the data use rule of each data center into a standardized use rule according to a data pragmatic markup language specification, and digitally signs the standardized use rule to obtain an access authorization proof file, and the access authorization proof file is used for representing the access authority of an authorized user to the target data; and the verification layer verifies the access authorization proof file in the data transmission process, and downloads the target data from the point-to-point content distribution network under the condition that the verification is passed.

Description

Technical Field

[0001] This application relates to the technical field of scientific data sharing, and in particular to an access authorization method, device, and equipment based on a peer-to-peer content delivery network. Background Art

[0002] A peer-to-peer content delivery network (PCDN) uses the storage and bandwidth resources of edge nodes to build a decentralized content delivery service, significantly reducing the load on the central server and improving the transmission efficiency of large-scale high-bandwidth content. In the scenario of scientific data scheduling, scientific data usually has characteristics such as large individual volume, wide user distribution, and concentrated access time. The traditional centralized distribution mode faces problems such as high cross-regional transmission latency and a sharp increase in backbone network bandwidth costs. Through adjacent node caching and dynamic data exchange path optimization, PCDN can effectively relieve the pressure on the source server and improve the user download experience, becoming a potential solution for scientific data distribution.

[0003] However, scientific data involves sensitive information such as national security and business secrets, and needs to follow strict hierarchical and classified access control principles, requiring dynamic permission determination based on multi-dimensional attributes such as user identity, affiliated institution, research project, and data usage. Existing PCDNs are mainly oriented to public content distribution scenarios, and their security mechanisms only support basic data integrity verification, lacking fine-grained access control capabilities and unable to meet the requirements of scientific data centers for the security control of the entire data life cycle. Moreover, the permission rules of different scientific data centers have high heterogeneity and dynamics, further making it difficult for existing PCDNs to adapt to the real-time authorization requirements of complex policies.

[0004] Therefore, how to implement a dynamic access authorization mechanism that matches the security rules of scientific data centers under the PCDN architecture to ensure the controllability and compliance of the data flow process has become the core challenge for the application of PCDN technology in sensitive scientific data distribution. Summary of the Invention

[0005] In view of the above problems, embodiments of this application provide an access authorization method, device, and equipment based on a peer-to-peer content delivery network to overcome or at least partially solve the above problems.

[0006] In the first aspect of the embodiments of this application, an access authorization method based on a peer-to-peer content delivery network is disclosed. The method is applied to an access authorization system, and the access authorization system includes an identification layer, a rule layer, and a verification layer. The method includes: The identification layer obtains the data usage rules of each scientific data center according to the user identity identification in the access request and the data identification of the target data to be accessed. The data usage rules represent multi-dimensional constraint conditions for data access in the scientific data center. The multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions; The rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and digitally signs the standardized usage rules to obtain an access authorization certificate file, which is used to represent the access permission of the authorized user to the target data; The verification layer verifies the access authorization certificate file during data transmission, and downloads the target data from the peer-to-peer content distribution network in the case of successful verification. Each node in the peer-to-peer content distribution network caches the data of the scientific data center.

[0007] Optionally, the rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, including: The rule layer constructs a hierarchical structured format for describing the standardized usage rules according to the data pragmatics markup language specification, and defines the field mapping relationship between the data usage rules and the hierarchical structured format; wherein, the hierarchical structured format includes a basic permission format for describing the operation type, an environment constraint format for describing the access environment, and an extended policy format for describing the data usage information; The rule layer identifies the fields of the data usage rules, and converts the data usage rules of each data center into standardized usage rules according to the field mapping relationship.

[0008] Optionally, defining the field mapping relationship between the data usage rules and the hierarchical structured format includes: Mapping the validity period field in the data usage rules to the time string field in the environment constraint format; Mapping the operation type field in the data usage rules to the permission enumeration format field in the basic permission format. The permission enumeration format field represents the operation permission type, and the operation permission type includes read operation and write operation; Mapping the access times field in the data usage rules to the integer times field in the extended policy format; Saving the additional information in the data usage rules to the additional information field in the extended policy format.

[0009] Optionally, the data usage rules further include preset conversion rules; the method further includes: For fields in the data usage rules that cannot be recognized by the rule layer, the unrecognized fields are converted into standardized usage rules according to the preset conversion rules.

[0010] Optionally, the verification layer verifies the access authorization certificate file during data transmission, and downloads the target data from the peer-to-peer content distribution network when the verification is passed, including: The verification layer verifies the access authorization certificate file received by the seed node in the peer-to-peer content distribution network; wherein, the seed node is a node storing the target data, and the verification includes verifying the timeliness of the access authorization certificate file, the validity of the digital signature of the access authorization certificate file, and the consistency between the data usage rules in the access authorization certificate file and the current operation permissions; When the verification is passed, the verification layer regards the seed node as a trusted node and downloads the shards of the target data from the trusted node.

[0011] Optionally, the method further includes: When the verification fails, the verification layer performs target operations, and the target operations include: terminating the connection, security alert, and automatic repair attempt operation.

[0012] Optionally, the method further includes: The verification layer records the verification results of the timeliness, the validity, and the consistency, as well as the data transmission status of downloading the target data shards from the trusted node in the log, and the log is used for data access analysis.

[0013] In the second aspect of the embodiments of the present application, an access authorization device based on a peer-to-peer content distribution network is disclosed, and the device includes: A rule acquisition module, configured to acquire the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the target data to be accessed, where the data usage rules represent multi-dimensional constraint conditions for data access in the scientific data center, and the multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions; A rule conversion module, configured to convert the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and perform digital signature on the standardized usage rules to obtain an access authorization certificate file, where the access authorization certificate file is used to represent the access permission of the authorized user to the target data; The permission verification module is used to verify the access authorization proof file during data transmission, and download the target data from the peer-to-peer content distribution network when the verification is passed. Each node in the peer-to-peer content distribution network caches the data of the scientific data center.

[0014] In the third aspect of the embodiments of the present application, an electronic device is disclosed, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the steps of the access authorization method based on the peer-to-peer content distribution network described in the first aspect of the embodiments of the present application are implemented.

[0015] In the fourth aspect of the embodiments of the present application, a computer-readable storage medium is disclosed, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access authorization method based on the peer-to-peer content distribution network described in the first aspect of the embodiments of the present application are implemented.

[0016] In the fifth aspect of the embodiments of the present application, a computer program product is disclosed, including a computer program. When the computer program is executed by a processor, the steps of the access authorization method based on the peer-to-peer content distribution network described in the first aspect of the embodiments of the present application are implemented.

[0017] The embodiments of the present application include the following advantages: In the embodiments of the present application, the identification layer obtains the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the target data to be accessed, and realizes the verification of the binding relationship between the user identity and the target data to be accessed, so as to ensure that the requestor has the access qualification; moreover, by accessing through the user identity identifier and the data identifier, the naming conflicts of different scientific data centers are eliminated, providing an accurate entity positioning ability for subsequent rule parsing and verification. The rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, so as to ensure the accurate execution of various data usage rules in the peer-to-peer content distribution network environment and the interoperability of data usage rules between different scientific data centers; and by digitally signing the standardized usage rules, an access authorization proof file is obtained to ensure that the access authorization proof file cannot be tampered with and has non-repudiation during data transmission. The verification layer verifies the access authorization proof file during data transmission, and downloads the target data from the peer-to-peer content distribution network when the verification is passed, seamlessly embedding the authorization verification process into all links of data transmission, and ensuring that each operation undergoes strict permission checks. In this way, a dynamic access authorization mechanism matching the security rules of the scientific data center is realized under the peer-to-peer content distribution network architecture, ensuring the controllability and compliance of the scientific data circulation process. Description of the Drawings

[0018] To more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings required for the description of the embodiments of the present application will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can also be obtained based on these drawings.

[0019] Figure 1 It is a schematic diagram of an access authorization system provided by an embodiment of the present application; Figure 2 It is a flowchart of the steps of an access authorization method based on a peer-to-peer content distribution network provided by an embodiment of the present application; Figure 3 It is a schematic diagram of the structure of an access authorization device based on a peer-to-peer content distribution network provided by an embodiment of the present application; Figure 4 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0020] To make the above objects, features, and advantages of the present application more obvious and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts belong to the scope of protection of the present application.

[0021] The permission rules of different scientific data centers are highly heterogeneous and dynamic, which makes it difficult for existing PCDN to adapt to the real-time authorization requirements of complex policies. Specifically, 1) There are many scientific data centers, and there is heterogeneity among them. Therefore, scientific data centers in different fields adopt differentiated technical architectures and storage solutions. This difference in the underlying architecture leads to different data access interfaces and permission management methods, which makes data sharing and content distribution across data centers face obstacles and it is difficult to establish a unified transmission and permission control mechanism. 2) The use rules of scientific data are complex and diverse, and this diversity is specifically manifested in the complexity and dynamism of the permission control dimension. The restrictions on data access in different data centers not only involve basic read and write permissions, but also include constraints in time, space, and purpose. There may be dependencies or conflicts between these rules, forming a multi-dimensional policy space, and a flexible coordination mechanism needs to be established to ensure the accuracy and consistency of rule execution. 3) There is also obvious diversity in the expression of data usage rules. Different data centers use different languages ​​and formats to describe data usage policies, and these expressions have significant differences in grammatical structure and semantic expression. To achieve cross-system rule conversion and unified description, it is necessary to perform differentiated adaptation according to the rule description characteristics of different scientific data centers, so as to realize semantic mapping from heterogeneous to homogeneous.

[0022] Therefore, in the process of applying peer-to-peer content distribution networks to data distribution in scientific data centers, a prerequisite problem that needs to be solved is that the data usage rules of different scientific data centers are highly heterogeneous and dynamic.

[0023] In order to overcome the limitations of related technologies, the embodiment of the present application provides an access authorization method based on a peer-to-peer content distribution network. The method uses digital signature technology to enable each node in the peer-to-peer content distribution network to independently complete user authority verification through access authorization certificate files, thereby effectively reducing the dependence on centralized authority services and realizing distributed authorization management in a true sense. Secondly, the access authorization certificate file has a strong dynamic authority adaptation capability. According to the data pragmatics markup language specification, the data usage rules of each data center are converted into standardized usage rules, thereby ensuring that various data usage rules are accurately executed in the peer-to-peer content distribution network environment. This method not only retains the original authority management characteristics of each scientific data center, but also realizes the interoperability of permissions across scientific data centers. Finally, according to the access authorization certificate file, the target data is downloaded from the peer-to-peer content distribution network, so that the node can verify the validity of the access authorization certificate file in real time, so as to seamlessly embed the authorization verification process into each link of data transmission, and ensure that each operation is subject to strict authority checks. In this way, the method can adapt to the stringent performance requirements of large-scale scientific data distribution and provide strong support for efficient data sharing.

[0024] The access authorization method based on the peer-to-peer content distribution network provided by the embodiments of the present application is applied to an access authorization system, such as Figure 1 shown. The access authorization system includes an identification layer, a rule layer, and a verification layer. When a requester accesses scientific data in the peer-to-peer content distribution network, the access authorization system executes the access authorization method based on the peer-to-peer content distribution network to verify the permissions of the requester, so as to ensure the controllability and compliance of the scientific data circulation process.

[0025] Referring to Figure 2 shown Figure 2 is the flowchart of the steps of an access authorization method based on the peer-to-peer content distribution network provided by the embodiments of the present application. As Figure 2 shown, an access authorization method based on the peer-to-peer content distribution network provided by the embodiments of the present application may include steps S210 to S230: Step S210: The identification layer obtains the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the target data to be accessed. The data usage rules represent the multi-dimensional constraint conditions for data access in the scientific data center. The multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions.

[0026] Specifically, the access request is an access request initiated by a requester (such as a user terminal, other scientific data centers, etc.) to access scientific data in the peer-to-peer content distribution network. The access request includes a user identity identifier and the data identifier of the target data to be accessed. Among them, the user identity identifier associates the user identity with the permission subject, and the user identity identifier adopts a composite structure, integrating the institutional identifier of the scientific data center and the user characteristic value. The data identifier adopts the digital network standard coding specification, including the type prefix and hash suffix of the scientific data digital object (i.e., the target data to be accessed), ensuring that each target data has a unique traceable identity identifier in the peer-to-peer content distribution network.

[0027] The identification layer can determine the user identity identifier and the data identifier from the access request, and obtain the data usage rules from each scientific data center according to the user identity identifier and the data identifier. Among them, the data usage rules of each scientific data center are different. Specifically, the data usage rules represent the multi-dimensional constraint conditions for data access in the scientific data center, and the data usage rules can reflect the scientific data processing process in the scientific data center. Among them, the operation type constraint conditions include basic operation types such as read operation and write operation, the access environment constraint conditions include context conditions such as validity period and IP, and the data usage information constraint conditions include advanced controls such as supporting data encryption and access times.

[0028] In some embodiments, the security policies and access control requirements of the scientific data center are taken into consideration. When the identification layer obtains the data usage rules of each scientific data center, it needs to send the authenticated identity credentials to the scientific data center and adjust the request parameters according to the authorization of different scientific data centers to obtain the data usage rules that match the identity of the user (requester).

[0029] Step S220: The rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and digitally signs the standardized usage rules to obtain an access authorization certificate file, which is used to represent the authorized user's access rights to the target data.

[0030] In the embodiment of the present application, Data Pragmatics Markup Language (DPML) is a markup language for scenario-based use of scientific data. Data Pragmatics Markup Language describes the role and relationship of data in a specific context through a hypergraph model. Therefore, the rule layer parses the data usage rules of the data center (for example, access validity period, IP range), and converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, so that the knowledge of the scientific data processing flow implicit in the data usage rules (for example, how data is reused, the dependencies between algorithms) can be mapped in the standardized usage rules for display expression. Among them, standardized usage rules can be understood as rules described by structured data pragmatics markup language.

[0031] It is understandable that standardized usage rules also include multi-dimensional constraints, including operation type constraints (e.g., read operations, write operations, etc.), access environment constraints (e.g., validity period, IP range, etc.) and data usage information constraints (e.g., access frequency, number of visits, etc.).

[0032] After converting the data usage rules of each data center into standardized usage rules, the rule layer can use an asymmetric encryption algorithm to digitally sign the standardized usage rules and generate a tamper-proof access authorization certificate file to ensure that the access authorization certificate file cannot be tampered with and has non-repudiation during data transmission.

[0033] Step S230: The verification layer verifies the access authorization certificate file during the data transmission process, and downloads the target data from the peer-to-peer content distribution network if the verification is successful. Each node in the peer-to-peer content distribution network caches the data of the scientific data center.

[0034] During the data transmission process, the access authorization certificate file can be embedded into the extension field of the BitTorrent protocol (BitTorrent is a file sharing protocol based on a peer-to-peer content distribution network), and a data download request is sent to the peer-to-peer content distribution network to obtain the target data for access.

[0035] Specifically, the requester can send a data download request carrying the access authorization certificate file to the peer-to-peer content distribution network, so that the rules layer can verify the validity of the access authorization certificate file according to the preset public key (the preset public key can be the public key of the access authorization certificate file generator), and dynamically parse the constraint conditions in the standardized usage rules to ensure that the data distribution process is both efficient and secure. Finally, the nodes that pass the verification provide the target data to the requester.

[0036] Adopting the technical solution implemented in this application, the identification layer obtains the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the target data for access, realizes the verification of the binding relationship between the user identity and the target data for access, and ensures that the request subject has the access qualification; moreover, by accessing through the user identity identifier and the data identifier, the naming conflicts of different scientific data centers are eliminated, providing an accurate entity positioning ability for subsequent rule parsing and verification. The rules layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, so as to ensure the accurate execution of various data usage rules in the peer-to-peer content distribution network environment and the interoperability of data usage rules between different scientific data centers; and by digitally signing the standardized usage rules, an access authorization certificate file is obtained to ensure that the access authorization certificate file cannot be tampered with and has non-repudiation during the data transmission process. The verification layer verifies the access authorization certificate file during the data transmission process, and downloads the target data from the peer-to-peer content distribution network when the verification passes, seamlessly embedding the authorization verification process into all links of the data transmission to ensure that each operation undergoes strict permission checks. In this way, a dynamic access authorization mechanism matching the security rules of the scientific data center is realized under the peer-to-peer content distribution network architecture, ensuring the controllability and compliance of the scientific data circulation process.

[0037] Combined with the above embodiments, in one implementation manner, the embodiments of this application also provide an access authorization method based on a peer-to-peer content distribution network. In this method, for the "the rules layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification" in step S220 above, it can specifically include sub-steps S220-1 to step S220-2: Step S220-1: The rule layer constructs a hierarchical structured format for describing standardized usage rules according to the data pragmatics markup language specification, and defines a field mapping relationship between the data usage rules and the hierarchical structured format; wherein, the hierarchical structured format includes a basic permission format for describing the operation type, an environment constraint format for describing the access environment, and an extended policy format for describing the data usage information.

[0038] Step S220-2: The rule layer identifies the fields of the data usage rules, and converts the data usage rules of each data center into standardized usage rules according to the field mapping relationship.

[0039] In the embodiments of the present application, according to the pragmatics relationship modeling ability of the data pragmatics markup language, the field mapping relationship between the data usage rules and the hierarchical structured format is defined through the hypergraph theory. Then, through field mapping and semantic parsing, the data usage rules of the scientific data center are unified into standardized usage rules described in a hierarchical structured format, so as to retain the complete semantics of the original policy (data usage rules).

[0040] Specifically, the basic permission format can ensure the certainty of permission definition through enumerated values; the environment constraint format can adopt structured fields (for example, time window fields and network condition fields) to support context-based dynamic permission calculation; the extended policy format can allow each scientific data center to inject domain-specific control logic through pluggable custom rule fields (interfaces).

[0041] In some embodiments, defining the field mapping relationship between the data usage rules and the hierarchical structured format includes: Item A-1: Map the validity period field in the data usage rules to the time string field in the environment constraint format. For example, map the validity period field (such as expiration Date) to the time string field in ISO 8601 format.

[0042] Item A-2: Map the operation type field in the data usage rules to the permission enumeration format field in the basic permission format, where the permission enumeration format field represents the operation permission type, and the operation permission types include read operation and write operation. For example, map the read field (read Only) to the unified permission enumeration format read field.

[0043] Item A-3: Map the access times field in the data usage rules to the integer times field in the extended policy format. Among them, the access times field can be understood as the maximum allowed access times field.

[0044] Item A-4: Save the additional information in the data usage rule to the additional information field in the extended policy format. The additional information may include information such as supporting data encryption and access frequency.

[0045] Adopting the technical solution of the embodiment of the present application, fully considering the mapping requirements of the data usage rule and the pragmatic relationship of DPML, constructing a hierarchical structured format, ensuring that the standardized usage rule is both machine-readable and can accurately reflect the original permission semantics, thereby ensuring the accurate execution of various data usage rules in the peer-to-peer content distribution network environment and the interoperability of data usage rules between different scientific data centers.

[0046] Combined with the above embodiments, in one implementation, the embodiment of the present application further provides an access authorization method based on a peer-to-peer content distribution network. In this method, the data usage rule further includes a preset conversion rule.

[0047] Specifically, the method further includes the following steps: For the fields in the data usage rule that cannot be recognized by the rule layer, convert the unrecognized fields into a standardized usage rule according to the preset conversion rule.

[0048] In the embodiment of the present application, strict type checking and semantic verification are performed during the conversion of the data usage rule. The recognized fields are mapped to the format specified by the hierarchical structured format according to the field mapping relationship; for the unrecognized fields (which cannot be directly mapped), the unrecognized fields are converted into a standardized usage rule by using the preset conversion rule.

[0049] Combined with the above embodiments, in one implementation, the embodiment of the present application further provides an access authorization method based on a peer-to-peer content distribution network. In this method, "the verification layer verifies the access authorization certificate file during the data transmission process and downloads the target data from the peer-to-peer content distribution network when the verification is passed" in step S230 above may specifically include sub-steps S230-1 to step S230-2: Step S230-1: The verification layer verifies the access authorization certificate file received by the seed node in the peer-to-peer content distribution network; where the seed node is the node storing the target data, and the verification includes verifying the timeliness of the access authorization certificate file, the validity of the digital signature of the access authorization certificate file, and the consistency between the data usage rule in the access authorization certificate file and the current operation permission.

[0050] Step S230-2: When the verification is passed, the verification layer regards the seed node as a trusted node and downloads the shards of the target data from the trusted node.

[0051] Among them, passing the verification means that the access authorization certificate file is valid, the digital signature of the access authorization certificate file is valid, and the data usage rules in the access authorization certificate file are consistent with the current operation permissions.

[0052] In the embodiments of the present application, the verification layer verifies the access authorization certificate file and embeds it in the handshake phase of the peer-to-peer (P2P) protocol stack. The communication between nodes extends a dedicated access authorization certificate file exchange process. When data is transmitted, the requesting party sends the access authorization certificate file to the seed node in the peer-to-peer content distribution network, so that the verification layer verifies the access authorization certificate file.

[0053] In the case of passing the verification, the seed node is regarded as a trusted node, and there can be multiple trusted nodes. Download the shards of the target data from different trusted nodes, and finally obtain the target data. In this way, by seamlessly embedding the authorization verification process into all links of data transmission, it is ensured that each operation undergoes strict permission checks.

[0054] Adopting the technical solution of the embodiments of the present application fully considers the balance between performance and security during data transmission, provides strict permission control for accessing scientific data in the peer-to-peer content distribution network, and at the same time ensures good transmission efficiency.

[0055] Combined with the above embodiments, in one implementation manner, the embodiments of the present application further provide an access authorization method based on a peer-to-peer content distribution network. The method further includes the following steps: when the verification fails, the verification layer performs a target operation, and the target operation includes: terminating the connection, security alert, and automatic repair attempt operation.

[0056] Among them, failing the verification includes at least one of the following: passing the verification means that the access authorization certificate file is invalid, the digital signature of the access authorization certificate file is invalid, and the data usage rules in the access authorization certificate file are inconsistent with the current operation permissions.

[0057] In the embodiments of the present application, in order to ensure the robustness of the data access process, when the verification fails, the target operation is triggered. In some embodiments, abnormal events will be classified and recorded (that is, the reasons for failing the verification), and responses will be made according to preset policies to ensure that the system can still maintain a safe state when facing various abnormal situations.

[0058] Combined with the above embodiments, in one implementation manner, the embodiments of the present application further provide an access authorization method based on a peer-to-peer content distribution network. The method further includes the following steps: the verification layer records the verification result, the basis for permission decision-making, and the data transmission status of downloading the shards of the target data from the trusted node in the log, and the log is used for data access analysis.

[0059] In the embodiments of the present application, during the data transmission process, the verification layer records information such as the verification result, the basis for permission decision-making, and the data transmission status of the shards of the target data downloaded from the trusted node in the log, so that subsequent data access analysis can be performed based on the records in the log, and the log provides data support for real-time data monitoring.

[0060] The embodiments of the present application also provide an access authorization device based on a peer-to-peer content distribution network. Refer to Figure 3 as shown in Figure 3 FIG. 8 is a schematic structural diagram of an access authorization device based on a peer-to-peer content distribution network provided by the embodiments of the present application. The device includes: A rule acquisition module 310, configured to acquire the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the target data to be accessed. The data usage rules represent multi-dimensional constraint conditions for data access in the scientific data center. The multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions; A rule conversion module 320, configured to convert the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and perform a digital signature on the standardized usage rules to obtain an access authorization certificate file, where the access authorization certificate file is used to represent the access permission of the authorized user to the target data; A permission verification module 330, configured to verify the access authorization certificate file during the data transmission process, and download the target data from the peer-to-peer content distribution network when the verification is passed. Each node in the peer-to-peer content distribution network caches the data of the scientific data center.

[0061] In an optional embodiment, the rule conversion module includes: A mapping relationship definition module, configured to construct a hierarchical structured format for describing the standardized usage rules according to the data pragmatics markup language specification, and define a field mapping relationship between the data usage rules and the hierarchical structured format; wherein, the hierarchical structured format includes a basic permission format for describing the operation type, an environment constraint format for describing the access environment, and an extended policy format for describing the data usage information; A field mapping module, configured to identify the fields of the data usage rules, and convert the data usage rules of each data center into standardized usage rules according to the field mapping relationship.

[0062] In an optional embodiment, the mapping relationship definition module includes: The first definition sub-module is used to map the validity period field in the data usage rule to the time string field in the environment constraint format; The second definition sub-module is used to map the operation type field in the data usage rule to the permission enumeration format field in the basic permission format. The permission enumeration format field represents the operation permission type, and the operation permission type includes read operation and write operation; The third definition sub-module is used to map the access times field in the data usage rule to the integer times field in the extended policy format; The fourth definition sub-module is used to save the additional information in the data usage rule to the additional information field in the extended policy format.

[0063] In an alternative embodiment, the data usage rule further includes a preset conversion rule; the mapping relationship definition module is further used to convert the unrecognized field in the data usage rule into a standardized usage rule according to the preset conversion rule for the unrecognized field in the data usage rule.

[0064] In an alternative embodiment, the permission verification module includes: The permission verification module is used for the verification layer to verify the access authorization proof file received by the seed node in the peer-to-peer content distribution network; wherein, the seed node is a node storing the target data, and the verification includes verifying the timeliness of the access authorization proof file, the validity of the digital signature of the access authorization proof file, and the consistency between the data usage rule in the access authorization proof file and the current operation permission; The data shard download module is used for the verification layer to use the seed node as a trusted node and download the shards of the target data from the trusted node when the verification is passed.

[0065] In an alternative embodiment, the device further includes: The operation execution module is used to execute a target operation when the verification fails. The target operation includes: terminating the connection, security alert, and automatic repair attempt operation.

[0066] In an alternative embodiment, the device further includes: The log recording module is used to record the verification result, the basis for the permission decision, and the data transmission status of downloading the shards of the target data from the trusted node in the log. The log is used for data access analysis.

[0067] The embodiments of the present application further provide an electronic device. Refer to Figure 4 , Figure 4 is a schematic structural diagram of an electronic device provided by the embodiments of the present application. AsFigure 4 As shown in Figure 4 , the electronic device 400 includes a memory 410 and a processor 420. The memory 410 and the processor 420 are communicatively connected via a bus. A computer program is stored in the memory 410, and this computer program can run on the processor 420, thereby implementing the steps of the access authorization method based on the peer-to-peer content distribution network described in the embodiments of the present application.

[0068] The embodiments of the present application also provide a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the access authorization method based on the peer-to-peer content distribution network described in the embodiments of the present application are implemented.

[0069] The embodiments of the present application also provide a computer program product, including a computer program. When the computer program is executed by a processor, the steps of the access authorization method based on the peer-to-peer content distribution network described in the embodiments of the present application are implemented.

[0070] The various embodiments in this specification are all described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other.

[0071] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods and devices according to the embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, as well as the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing terminal devices generate a device for implementing the functions specified in Figure 1 one or more of the flows and / or Figure 1 blocks.

[0072] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including an instruction device, and the instruction device implements the functions specified in Figure 1 one or more of the flows and / or Figure 1 blocks.

[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 steps of the functions specified in one block or multiple blocks.

[0074] Although the preferred embodiments of the embodiments of the present application have been described, those skilled in the art can make additional changes and modifications once they learn the basic creative concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0075] Finally, it should also be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising the element.

[0076] The above has introduced in detail a method, device and equipment for access authorization based on a peer-to-peer content distribution network provided by the present application. Specific examples are used in this article to elaborate on the principle and implementation manner of the present application. The description of the above embodiments is only used to help understand the method and its core idea of the present application; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present application.

Claims

1. An access authorization method based on a peer-to-peer content distribution network, characterized in that, Applied to an access authorization system, the access authorization system includes an identification layer, a rule layer, and a verification layer, and the method includes: The identification layer obtains the data usage rules of each scientific data center according to the user identity identification in the access request and the data identification of the target data to be accessed. The data usage rules represent the multi-dimensional constraint conditions for data access in the scientific data center. The multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions; The rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and digitally signs the standardized usage rules to obtain an access authorization certificate file, which is used to represent the access permission of the authorized user to the target data; The verification layer verifies the access authorization certificate file during data transmission, and downloads the target data from the peer-to-peer content distribution network in the case of successful verification. Each node in the peer-to-peer content distribution network caches the data of the scientific data center.

2. The method according to claim 1, characterized in that, The rule layer converts the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, including: The rule layer constructs a hierarchical structured format for describing standardized usage rules according to the data pragmatics markup language specification, and defines the field mapping relationship between the data usage rules and the hierarchical structured format; wherein, the hierarchical structured format includes a basic permission format for describing the operation type, an environment constraint format for describing the access environment, and an extended policy format for describing data usage information; The rule layer identifies the fields of the data usage rules, and converts the data usage rules of each data center into standardized usage rules according to the field mapping relationship.

3. The method according to claim 2, wherein Defining the field mapping relationship between the data usage rules and the hierarchical structured format includes: Mapping the validity period field in the data usage rules to the time string field in the environment constraint format; Mapping the operation type field in the data usage rules to the permission enumeration format field in the basic permission format. The permission enumeration format field represents the operation permission type, and the operation permission types include read operation and write operation; Mapping the access times field in the data usage rules to the integer times field in the extended policy format; Saving the additional information in the data usage rules to the additional information field in the extended policy format.

4. The method according to claim 2, wherein The data usage rules also include preset conversion rules; the method further includes: The rule layer converts the unrecognized fields in the data usage rules into standardized usage rules according to the preset conversion rules.

5. The method according to any one of claims 1-4, characterized in that The verification layer verifies according to the access authorization certificate file during data transmission, and downloads the target data from the peer-to-peer content distribution network in the case of successful verification, including: The verification layer verifies the access authorization proof file received by the seed nodes in the peer-to-peer content distribution network; wherein, the seed nodes are the nodes storing the target data, and the verification includes verifying the timeliness of the access authorization proof file, the validity of the digital signature of the access authorization proof file, and the consistency between the data usage rules in the access authorization proof file and the current operation permissions. When the verification is passed, the verification layer regards the seed nodes as trusted nodes and downloads the shards of the target data from the trusted nodes.

6. The method according to claim 5, wherein The method further includes: When the verification fails, the verification layer performs target operations, and the target operations include: terminating the connection, security alert, and automatic repair attempt operation.

7. The method according to claim 5, characterized in that, The method further includes: The verification layer records the verification result, the basis for the permission decision, and the data transmission status of downloading the shards of the target data from the trusted nodes in the log, and the log is used for data access analysis.

8. An access authorization device based on a peer-to-peer content distribution network, characterized in that, The device includes: A rule acquisition module, configured to obtain the data usage rules of each scientific data center according to the user identity identifier in the access request and the data identifier of the accessed target data, where the data usage rules represent the multi-dimensional constraint conditions for data access in the scientific data center, and the multi-dimensional constraint conditions include operation type constraint conditions, access environment constraint conditions, and data usage information constraint conditions. A rule conversion module, configured to convert the data usage rules of each data center into standardized usage rules according to the data pragmatics markup language specification, and perform digital signature on the standardized usage rules to obtain an access authorization proof file, where the access authorization proof file is used to represent the access permission of the authorized user to the target data. A permission verification module, configured to verify the access authorization proof file during the data transmission process, and download the target data from the peer-to-peer content distribution network when the verification is passed, and each node in the peer-to-peer content distribution network caches the data of the scientific data center.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the access authorization method based on the peer-to-peer content distribution network according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the access authorization method based on the peer-to-peer content distribution network according to any one of claims 1-7.

Images