Access log analysis method and device for privacy data of decentralized storage, equipment and medium

Abstract

The invention discloses an access log analysis method and device for privacy data of decentralized storage, equipment and a medium, and belongs to the technical field of data privacy protection. The method comprises the following steps: acquiring a division rule, and storing by adopting a plurality of different storage nodes; receiving a private data access request sent by an access terminal, and identifying the authorization tag; if not, refusing access, generating a first type of access log, and generating first prompt information; if the access request has the authorization label, generating a second type of access log, and identifying whether a target storage node of the access request is matched with the division rule; if yes, a first suffix is added, and access is allowed; if not, a second suffix is added, and access is forbidden; and when the second type of access log with the second suffix is identified, second prompt information is generated. According to the technical scheme, access control of private data can be carried out, so that the security of data decentralized storage is improved.

Description

Technical Field

[0001] The present application belongs to the technical field of data privacy protection, and specifically relates to a method, device, equipment and medium for analyzing access logs of decentralized stored privacy data. Background Art

[0002] In the process of data storage, in order to ensure the privacy and security of data, a decentralized storage method can be used. For example, the current personal privacy protection strategy can store it in different nodes in a decentralized manner to increase the difficulty of illegal access to data. However, for the storage of some data, such as surveillance video data at home, although the existing decentralized data storage solution is used to store surveillance video data in a decentralized manner to reduce the risk of illegal access, once an illegal terminal impersonates a legitimate terminal to access it, even if it accesses any storage node, it will cause the leakage of private data, and thus the protection effect of private data cannot be achieved.

[0003] Therefore, how to adopt a decentralized storage strategy to protect privacy data and avoid illegal access is a technical problem that needs to be solved urgently in this field. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a method, device, equipment and medium for analyzing access logs of private data stored in a decentralized manner, with the purpose of solving the problems of data security risks in conventional decentralized storage of data. The solution generates corresponding access logs for access requests to private data, and identifies whether the access request is a secure access request based on the access log, so as to control access to private data, thereby improving the security of decentralized data storage.

[0005] In a first aspect, an embodiment of the present application provides a method for analyzing access logs of decentralized stored private data, the method comprising: The method is executed by a data management server, and the data management server is connected to a storage node; the method comprises: Obtaining a partitioning rule for the privacy data from a storage planning server, and using a plurality of different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating the privacy data allocated to the storage node; receiving an access request for private data from an access terminal, and identifying whether the access request includes an authorization tag issued by a storage planning server; If there is no authorization tag, deny access, generate a first type of access log for the access request, and generate a first prompt message when the first type of access log is identified; If there is an authorization label, generate a second type of access log and identify whether the target storage node of the access request matches the partitioning rule; If it matches, add a first suffix to the second type of access log and allow access; If it does not match, add a second suffix to the second type of access log and prohibit access; and when a second type of access log with a second suffix is recognized, generate a second prompt message.

[0006] Further, identifying whether the target storage node of the access request matches the partitioning rule includes: When there are multiple target storage nodes in the authorization label of the access request, it is determined to match the partitioning rule; When there is one target storage node in the authorization label of the access request, it is determined not to match the partitioning rule.

[0007] Further, when there are multiple target storage nodes in the authorization label of the access request, determining to match the partitioning rule includes: When there are multiple target storage nodes in the authorization label of the access request and the switching time of the multiple target storage nodes corresponds to the partitioning rule, it is determined to match the partitioning rule.

[0008] Further, the authorization label includes at least two target storage nodes and the switching moments between the target storage nodes.

[0009] Further, obtaining the partitioning rule for private data from the storage planning server includes: At the start moment of each monitoring period, obtain the partitioning rule for private data in the current monitoring period from the storage planning server.

[0010] Further, the partitioning rule for each monitoring period is generated at the start moment of the monitoring period.

[0011] Further, the method further includes: In the case where it is recognized that multiple access requests for private data sent by the same access terminal all generate second prompt messages, add the access terminal to the blacklist.

[0012] In a second aspect, an embodiment of the present application provides an access log analysis device for private data in a decentralized storage. The device is configured in a data management server, and the data management server is connected to a storage node; the device includes: A data storage module, configured to obtain a partitioning rule for private data from a storage planning server, and store the data using multiple different storage nodes according to the partitioning rule; wherein, the partitioning rule includes the time period during which the private data assigned to the storage nodes is generated. An authorization label identification module, configured to receive an access request for private data sent by an access terminal, and identify whether the access request includes an authorization label sent by the storage planning server. A first type of access log generation module, configured to, if the authorization label is not present, deny the access, generate a first type of access log for the access request, and generate a first prompt message when a first type of access log is recognized. A second type of access log generation module, configured to, if the authorization label is present, generate a second type of access log, and identify whether the target storage node of the access request matches the partitioning rule. A first suffix addition module, configured to, if there is a match, add a first suffix to the second type of access log and allow the access. A second suffix addition module, configured to, if there is no match, add a second suffix to the second type of access log and prohibit the access; and generate a second prompt message when a second type of access log with the second suffix is recognized.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of the method described in the first aspect are implemented.

[0014] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0015] In a fifth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor, and the processor is configured to run a program or instruction to implement the method described in the first aspect.

[0016] The technical solution provided by the embodiments of this application obtains the privacy data partitioning rules from a storage planning server, stores them using multiple storage nodes according to the rules, identifies whether an authorization tag is included when receiving an access request, rejects access to those without an authorization tag and generates a first type of access log and a prompt message, generates a second type of access log for those with an authorization tag, and determines whether the target storage node matches the partitioning rules. If it matches, a first suffix is added to allow access; if it does not match, a second suffix is added to prohibit access and a prompt message is generated. This technical solution solves the problem of protecting privacy data under a decentralized storage strategy, avoids illegal access, reduces the risk of privacy data leakage through strict review and corresponding processing of access requests, realizes effective protection of privacy data, and provides a reliable guarantee for the secure storage and access of privacy data in decentralized storage. Brief Description of the Drawings

[0017] Figure 1 It is a flowchart showing the process of the access log analysis method for privacy data in decentralized storage provided by Embodiment 1 of this application; Figure 2 It is a flowchart showing the process of the access log analysis method for privacy data in decentralized storage provided by Embodiment 2 of this application; Figure 3 It is a structural diagram showing the structure of the access log analysis device for privacy data in decentralized storage provided by Embodiment 3 of this application; Figure 4 It is a structural diagram showing the structure of the electronic device provided by Embodiment 4 of this application. Detailed Embodiments

[0018] In order to make the objectives, technical solutions, and advantages of this application clearer, the following further describes the specific embodiments of this application in detail with reference to the drawings. It can be understood that the specific embodiments described herein are only for explaining this application and are not intended to limit this application. Additionally, it should be noted that for the sake of description, only parts related to this application are shown in the drawings rather than all the content. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operations are completed, but it can also have additional steps not included in the drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0019] In the following, in combination with the drawings in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly described. Obviously, the described embodiments are a part rather than all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art belong to the scope of protection of the present application.

[0020] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually of the same category, and do not limit the number of objects. For example, the first object can be one or multiple. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / " generally means an "or" relationship between the associated objects before and after.

[0021] In the following, in combination with the drawings, through specific embodiments and their application scenarios, the method, device, equipment and medium for analyzing access logs of privacy data in decentralized storage provided by the embodiments of the present application will be described in detail.

[0022] Embodiment 1 Figure 1 is a schematic flowchart of the method for analyzing access logs of privacy data in decentralized storage provided by Embodiment 1 of the present application. The method is executed by a data management server, and the data management server is connected to storage nodes; as Figure 1 shown, it specifically includes the following steps: S101, obtain the partitioning rule for privacy data from a storage planning server, and according to the partitioning rule, store it using multiple different storage nodes; wherein, the partitioning rule includes the time period during which the privacy data assigned to the storage nodes is generated. First, the present application is applicable to the scenario of access control of privacy data in decentralized storage. Based on the above usage scenario, it can be understood that the execution subject of the present application can be a data management server, and the data management server is connected to storage nodes to perform write control and / or data access control on each storage node.

[0023] The storage planning server is responsible for formulating the storage plan for privacy data. It has the planning information on how to store privacy data. For example, for continuous privacy data such as video surveillance data in a user's home, it should be allocated to which storage nodes, as well as the allocation of the storage time of privacy data. Specifically, it can control the storage of data from 0 to 5 seconds to the first storage node, from 5.01 to 10 seconds to the second storage node, from 10.01 to 15 seconds to the third storage node, and so on. It can also disorder the storage nodes to improve the security of data storage.

[0024] Privacy data is data that contains personal privacy information or sensitive information, such as personal identity information, surveillance video data, etc.

[0025] The partitioning rule is a detailed rule formulated by the storage planning server on how to reasonably allocate privacy data to different storage nodes. It includes the time period during which the privacy data allocated to the storage node is generated. For example, the surveillance video data generated during a certain period should be stored on a specific storage node, which helps to achieve the orderly storage and management of data.

[0026] The storage node is a device or server that actually stores privacy data. The storage node can receive the control instructions from the data management server and store the corresponding privacy data according to the partitioning rule. These storage nodes may be distributed in different geographical locations and are connected to the data management server through a network to jointly form a decentralized storage system.

[0027] In this solution, the data management server can obtain the partitioning rule of privacy data from the storage planning server through the network. For example, the data management server sends a request to obtain the rule to the storage planning server, and the storage planning server responds to the request and sends the partitioning rule to the data management server. The data management server receives and parses these rules. For example, by reading the field content, it can obtain the partitioning method of the time period and the storage node corresponding to each time period.

[0028] S102, receive the access request for privacy data sent by the access terminal, and identify whether the access request includes the authorization label sent by the storage planning server; if there is no authorization label, execute S103, if there is an authorization label, execute S104; The access terminal is a device used by the user to access privacy data, such as a computer, a mobile phone, and a tablet computer, etc. The user sends a request to access privacy data to the data management server through these devices.

[0029] An access request is an instruction sent by an access terminal to a data management server for obtaining private data. The request contains information related to the private data that the user wishes to access, such as the data type of the target private data, the total number of accesses, etc. For continuous private data such as surveillance videos, the access request includes the start time point and end time point of the access. For example, it is necessary to access the surveillance video from 8:00:00 to 8:05:00 in the morning.

[0030] An authorization label is an identifier issued by a storage planning server for verifying the legality of access, which can specifically be a string. The access terminal can send a request to the storage planning server in advance to obtain it.

[0031] S103, reject the access, generate a first type of access log for the access request, and when a first type of access log is recognized, generate a first prompt message; The first type of access log is a log generated by the data management server when the access request does not have an authorization label for recording the access request. The first type of access log can include information related to the access request, such as the identifier of the access terminal, the access time, and the data type requested for access, etc., for subsequent analysis and monitoring of illegal access behaviors.

[0032] The first prompt message is a message generated by the data management server when it recognizes a first type of access log for prompting relevant personnel. Managers can timely learn of the occurrence of illegal access behaviors through these prompt messages and thus take corresponding measures.

[0033] In this solution, when the data management server determines that the access request does not contain an authorization label, it will reject the access request to prevent the occurrence of illegal access behaviors. After rejecting the access request, the data management server will generate a first type of access log. After completing the recording, it will regularly or real-time check the log files in the system to find whether there is a first type of access log. When a first type of access log is recognized, the data management server will generate a first prompt message and send the prompt message to the manager to inform of the occurrence of illegal access behaviors.

[0034] S104, generate a second type of access log, and identify whether the target storage node of the access request matches the partitioning rule; if it matches, execute S105, if it does not match, execute S106; The second type of access log is a log generated by the data management server when the access request contains an authorization label for recording the access request.

[0035] The target storage node is the storage node specified in the access request for obtaining privacy data. The access terminal can parse the authorization label, such as reading certain field information. For example, if the read field information includes storage node 2 and storage node 6, then storage node 2 and storage node 6 are the obtained target nodes.

[0036] When the data management server determines that the access request contains an authorization label, it can generate a second type of access log. Record the relevant information of the access request, such as the identifier of the access terminal, the access time, the data type requested for access, etc. Among them, the identifier of the access terminal can be written in some bytes of the access request when the access terminal issues the access request for the data management server to read.

[0037] The data management server can identify whether the target storage node of the access request matches the partitioning rule. Specifically, according to the corresponding relationship between privacy data and storage nodes in the partitioning rule, it can check whether the target storage node is the node where the privacy data requested for access should be stored. For example, it can compare whether the two are the same. If they match, the access request is considered reasonable; if they do not match, there is a problem. For example, the access terminal generates an authorization label and a target storage node by imitation. However, since it does not know the specific planning method of the storage planning server, the generated authorization label and target storage node can be identified as incorrect, thereby avoiding the acquisition of privacy data by illegal access terminals and protecting privacy security.

[0038] S105, Add a first suffix to the second type of access log and allow access; The first suffix is a special mark added to the second type of access log to indicate that the access request matches the partitioning rule and access is allowed. By adding the first suffix, the log can be classified and marked, facilitating subsequent management and auditing of legal and rule-compliant access behaviors.

[0039] After the data management server determines that the target storage node matches the partitioning rule, it will add a first suffix to the second type of access log, such as adding a suffix of "-0".

[0040] S106, Add a second suffix to the second type of access log and prohibit access; and when identifying the second type of access log with the second suffix, generate a second prompt message.

[0041] The second suffix is a special mark added to the second type of access log to indicate that the access request does not match the partitioning rule and access is prohibited. Corresponding to the first suffix, by adding the second suffix, illegal access behaviors are marked, facilitating subsequent analysis and management.

[0042] The second prompt message can be information used to prompt management personnel generated when the data management server identifies second-type access logs with a second suffix. Management personnel can learn from these prompt messages that there are access behaviors that do not conform to the rules, so as to take corresponding measures.

[0043] When the data management server determines that the target storage node does not match the partitioning rule, it will add a second suffix to the second-type access log, such as adding a suffix of "-1".

[0044] After adding the second suffix to the second-type access log, the data management server will prohibit the access terminal from accessing the private data. The data management server will regularly or in real time check the second-type access logs in the system to find out whether there are log records with the second suffix. Through the analysis and judgment of the logs, it is determined whether there are access behaviors that do not conform to the rules. When the data management server identifies a second-type access log with the second suffix, it will generate a second prompt message.

[0045] In this solution, after obtaining the access log, it is possible to obtain the access log at regular intervals or in real time, and analyze it to determine whether there is an access terminal attempting to maliciously access private data.

[0046] The technical solution provided in this embodiment realizes the reasonable storage of private data by obtaining the partitioning rule from the storage planning server, ensuring that the data is dispersed and stored in different nodes and managed in an orderly manner. In terms of access control, the authorization label of the access request is strictly checked, effectively preventing illegal access without an authorization label, and by generating the first-type access log and the first prompt message, it is convenient to monitor and manage illegal access behaviors. For access requests containing an authorization label, it is further determined whether the target storage node matches the partitioning rule. When it matches, access is allowed and a first suffix is added to the second-type access log. When it does not match, access is prohibited and a second suffix is added to the second-type access log, and at the same time a second prompt message is generated. This detailed access control mechanism ensures that only legal and compliant access can obtain private data, greatly improving the security and reliability of private data storage and access. By recording the access logs and generating prompt messages, it also provides effective management and monitoring means for relevant personnel such as system administrators, and can timely discover and handle illegal or non-compliant access behaviors, thereby better protecting the security of private data.

[0047] In one embodiment, optionally, obtaining the partitioning rule for private data from the storage planning server includes: At the start moment of each monitoring period, obtain the partitioning rule for private data in the current monitoring period from the storage planning server.

[0048] The partitioning rule is a specific rule generated by the storage planning server for the storage allocation of privacy data. It details how privacy data is stored on different storage nodes. Specifically, it includes the time period during which the privacy data assigned to each storage node is generated. For example, within a certain monitoring period, a specific storage node should store the privacy data generated during a specific time period.

[0049] The monitoring period can be one day, or one hour or one minute, etc.

[0050] The start time is the time point at which each monitoring period begins. At this time point, the data management server triggers an operation to obtain the partitioning rule from the storage planning server. The selection of this time point is usually pre-set. For example, if the monitoring period is set to one day, the start time may be zero o'clock every day.

[0051] In this technical solution, obtaining the partitioning rule for privacy data in the current monitoring period from the storage planning server at the start time of each monitoring period enables the data management server to timely understand the latest storage plan. In this way, it is ensured that the storage of privacy data on different storage nodes is carried out according to the latest and reasonable rules, improving the orderliness and security of data storage. Timely obtaining the partitioning rule also facilitates the dynamic management of data storage, and flexibly adjusts the storage allocation of data according to the characteristics and requirements of different monitoring periods.

[0052] In one embodiment, optionally, the partitioning rule for each monitoring period is generated at the start time of the monitoring period.

[0053] This technical solution stipulates that the partitioning rule in each monitoring period is generated at the start time of the monitoring period, which can ensure the timeliness and pertinence of the partitioning rule. The data management server obtains the newly generated partitioning rule at the start of each monitoring period and performs storage operations on privacy data accordingly, making data storage more orderly and improving the security of data storage. Moreover, regenerating each period can prevent the rule from being cracked and improve the security of privacy data.

[0054] In one embodiment, optionally, the method further includes: In the case where it is recognized that multiple access requests for privacy data sent by the same access terminal all generate a second prompt message, the access terminal is included in the blacklist.

[0055] The blacklist refers to a list maintained by the data management server, which records the relevant information of the access terminals prohibited from accessing privacy data. Once an access terminal is included in the blacklist, the terminal can no longer access the privacy data in the system. It is a measure to strengthen the protection of privacy data and restricts the access rights of access terminals that may pose risks.

[0056] The data management server analyzes multiple privacy data access requests sent by the access terminal to determine whether the second prompt information is generated for each of them. It checks the log records corresponding to each access request to see if there is a second suffix. When it is determined that the second prompt information is generated for multiple privacy data access requests sent by the same access terminal, the relevant information of the access terminal, such as the device identifier, IP address, etc., is added to the blacklist.

[0057] In this technical solution, by adding the access terminal to the blacklist when it is recognized that multiple privacy data access requests sent by the same access terminal all generate the second prompt information, the security of privacy data is effectively improved. It can timely detect those access terminals that frequently exhibit non-compliant access behaviors, restrict these terminals that may have malicious access or operational errors resulting in multiple violations, prevent them from continuing to attempt to access privacy data, and reduce the risk of privacy data being illegally obtained or leaked. The blacklist mechanism also acts as a deterrent to potential illegal access behaviors, further ensuring the secure and stable operation of the privacy data storage and access system, and ensuring better protection of the privacy data of legitimate users.

[0058] Embodiment 2 Figure 2 It is a schematic flowchart of the method for analyzing the access log of privacy data in decentralized storage provided by the second embodiment of this application. This solution makes a better improvement to the above embodiment. The specific improvement is: identifying whether the target storage node of the access request matches the partitioning rule, including: when it is identified that there are multiple target storage nodes in the authorization label of the access request, it is determined that it matches the partitioning rule; when it is identified that there is one target storage node in the authorization label of the access request, it is determined that it does not match the partitioning rule. As Figure 2 shown, it specifically includes the following steps: S201, obtain the partitioning rule for privacy data from the storage planning server, and store it using multiple different storage nodes according to the partitioning rule; wherein, the partitioning rule includes the time period during which the privacy data assigned to the storage node is generated; S202, receive the privacy data access request sent by the access terminal, and identify whether the access request includes the authorization label sent by the storage planning server; if there is no authorization label, execute S203, if there is an authorization label, execute S204; S203, reject the access, generate the first type of access log for the access request, and generate the first prompt information when it is recognized that there is the first type of access log; S204. Generate the second type of access log. When the target storage nodes in the authorization label for identifying the access request are multiple, it is determined that they match the partitioning rule, and S205 is executed; when the target storage node in the authorization label for identifying the access request is one, it is determined that they do not match the partitioning rule, and S206 is executed. Among them, the data management server analyzes the authorization label of the access request to view the information of the target storage node therein. Specifically, according to the number of target storage nodes identified in the authorization label, the data management server makes a judgment on whether it matches the partitioning rule. When multiple target storage nodes are identified in the authorization label, it is determined that the target storage nodes of the access request match the partitioning rule; when one target storage node is identified, it is determined that it does not match the partitioning rule.

[0059] Since the monitoring data will be divided by time period and stored in different storage nodes after generation, and the access requests for video data are often based on a relatively long time period, or no time period is selected, that is, all monitoring videos within the monitoring period are obtained. In such a case, it is impossible for the target storage node to be only one. Therefore, it is possible to determine whether it matches the partitioning rule according to the number of target storage nodes.

[0060] S205. Add a first suffix to the second type of access log and allow access. S206. Add a second suffix to the second type of access log and prohibit access; and when a second type of access log with a second suffix is identified, generate a second prompt message.

[0061] The technical solution provided in this embodiment can effectively regulate the access behavior of privacy data by making a matching judgment on the target storage node of the access request and the partitioning rule, and determining whether they match according to the number of target storage nodes in the authorization label. This mechanism can prevent a single illegal target storage node from being accessed, reducing the risk of privacy data leakage caused by incorrect or illegal access. When the target storage nodes are multiple, it is determined that they match the partitioning rule, ensuring that data access is based on a reasonable storage plan, meeting the requirements of decentralized storage, and improving the security and orderliness of privacy data storage and access. At the same time, this simple and clear matching judgment method also improves the processing efficiency of the data management server, enabling it to quickly respond to access requests and ensuring the stable operation of the system.

[0062] Based on the above technical solutions, optionally, when the target storage nodes in the authorization label for identifying the access request are multiple, it is determined that they match the partitioning rule, including: When there are multiple target storage nodes in the authorization label for identifying the access request, and the switching times of the multiple target storage nodes correspond to the partitioning rule, it is determined that they match the partitioning rule.

[0063] This solution has been further optimized by considering the switching time. For example, there are switching time points between multiple target storage nodes. This is because privacy data in different time periods may be stored on different nodes, so there will be a situation where access switches from one storage node to another. The partitioning rule can include the switching time arrangement between these storage nodes.

[0064] The data management server parses and analyzes the authorization label in the access request, and extracts information such as the number of target storage nodes and the switching time. When it is recognized that there are multiple target storage nodes in the authorization label of the access request, and the switching times of these target storage nodes are consistent with the partitioning rule, a determination that they match the partitioning rule is made.

[0065] In this technical solution, by considering the number of target storage nodes and the switching time when determining whether the access request matches the partitioning rule, the security and accuracy of privacy data access can be greatly improved. From a security perspective, this mechanism can effectively prevent illegal access behavior. Because only when the number of target storage nodes and the switching time of the access request strictly conform to the partitioning rule will it be recognized as a match, which increases the difficulty for illegal accessors to bypass the rule to obtain privacy data. In terms of accuracy, it ensures that the access request can be carried out according to a reasonable storage plan, enabling users to access the privacy data stored on the corresponding node at the correct time, and avoiding problems such as data acquisition failure or data inconsistency caused by incorrect access. This fine-grained matching judgment mechanism helps to maintain the stability of the decentralized storage system and better protect the security of privacy data.

[0066] Based on the above technical solutions, optionally, the authorization label includes at least two target storage nodes and the switching moments between the target storage nodes.

[0067] In this solution, the authorization label can carry at least two target storage nodes and the switching moments between the target storage nodes.

[0068] In this technical solution, the setting of multiple target storage nodes can achieve the decentralized storage of private data, increasing the difficulty of illegal data acquisition and improving data security. Moreover, the clear switching moment enables the data management server to process access requests according to predetermined rules, ensuring that access requests can access the private data stored on the corresponding target storage nodes at the correct time. This design avoids the risks of access failure or data leakage caused by time errors or incorrect target storage nodes. Such an accurate control mechanism effectively guarantees the secure access of private data.

[0069] Embodiment III Figure 3 It is a schematic structural diagram of an access log analysis device for private data in decentralized storage provided by Embodiment III of the present application. The device is configured in a data management server, and the data management server is connected to storage nodes; as Figure 3 shown, the device includes: A data storage module 301, configured to obtain a partitioning rule for private data from a storage planning server, and store the data using multiple different storage nodes according to the partitioning rule; wherein, the partitioning rule includes the time period during which the private data assigned to the storage nodes is generated. An authorization label identification module 302, configured to receive an access request for private data sent by an access terminal, and identify whether the access request includes an authorization label sent by the storage planning server. A first type of access log generation module 303, configured to reject access if there is no authorization label, generate a first type of access log for the access request, and generate a first prompt message when a first type of access log is identified. A second type of access log generation module 304, configured to generate a second type of access log if there is an authorization label, and identify whether the target storage node of the access request matches the partitioning rule. A first suffix addition module 305, configured to add a first suffix to the second type of access log and allow access if it matches. A second suffix addition module 306, configured to add a second suffix to the second type of access log and prohibit access if it does not match; and generate a second prompt message when a second type of access log with a second suffix is identified.

[0070] In an embodiment of the present application, a data storage module is configured to obtain a partitioning rule for private data from a storage planning server, and store the private data using a plurality of different storage nodes according to the partitioning rule; wherein the partitioning rule includes a time period during which the private data assigned to the storage nodes is generated; an authorization label recognition module is configured to receive an access request for private data sent by an access terminal, and recognize whether the access request includes an authorization label sent by the storage planning server; a first type of access log generation module is configured to, if the authorization label is not present, reject the access, generate a first type of access log for the access request, and generate a first prompt message when it is recognized that the first type of access log is present; a second type of access log generation module is configured to, if the authorization label is present, generate a second type of access log, and recognize whether the target storage node of the access request matches the partitioning rule; a first suffix addition module is configured to, if there is a match, add a first suffix to the second type of access log and allow the access; a second suffix addition module is configured to, if there is no match, add a second suffix to the second type of access log and prohibit the access; and generate a second prompt message when it is recognized that the second type of access log with the second suffix is present. According to the above technical solution, corresponding access logs are generated for access requests for private data, and based on the access logs, it is recognized whether the access requests are secure access requests, so as to perform access control on private data, thereby improving the security of decentralized data storage.

[0071] The access log analysis device for private data in decentralized storage in an embodiment of the present application may be a device, or a component, an integrated circuit, or a chip in a terminal. The device may be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device may be a mobile phone, a tablet computer, a laptop computer, a handheld computer, a vehicle-mounted electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device may be a server, a Network Attached Storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc. The embodiments of the present application do not make specific limitations.

[0072] The access log analysis device for private data in decentralized storage in an embodiment of the present application may be a device with an operating system. The operating system may be an Android operating system, an IOS operating system, or other possible operating systems. The embodiments of the present application do not make specific limitations.

[0073] The access log analysis device for private data in decentralized storage provided by the embodiments of the present application can implement all the processes achieved in the above-mentioned Embodiments 1 to 4. To avoid repetition, details are not described herein again.

[0074] Embodiment 4 As Figure 4 shown, the embodiments of the present application further provide an electronic device 400, including a processor 401, a memory 402, and a program or instruction stored on the memory 402 and executable on the processor 401. When the program or instruction is executed by the processor 401, it implements all the processes of the above-mentioned embodiments of the access log analysis method for private data in decentralized storage and can achieve the same technical effects. To avoid repetition, details are not described herein again.

[0075] It should be noted that the electronic devices in the embodiments of the present application include the above-mentioned mobile electronic devices and non-mobile electronic devices.

[0076] Embodiment 5 The embodiments of the present application further provide a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, it implements all the processes of the above-mentioned embodiments of the access log analysis method for private data in decentralized storage and can achieve the same technical effects. To avoid repetition, details are not described herein again.

[0077] Wherein, the processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0078] Embodiment 6 The embodiments of the present application further provide a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement all the processes of the above-mentioned embodiments of the access log analysis method for private data in decentralized storage and can achieve the same technical effects. To avoid repetition, details are not described herein again.

[0079] It should be understood that the chip mentioned in the embodiments of the present application may also be referred to as a system-on-chip, system chip, chip system, or system-on-chip, etc.

[0080] It should be noted that in this document, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or apparatus comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or apparatus. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising such element. In addition, it should be pointed out that the scope of the methods and apparatuses in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in a reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0081] From the description of the above embodiments, those skilled in the art can clearly understand that the above-described example methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions for causing a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in various embodiments of the present application.

[0082] The embodiments of the present application have been described above with reference to the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. Under the inspiration of the present application, those of ordinary skill in the art can also make many forms without departing from the purpose of the present application and the scope protected by the claims, and all of them belong to the protection scope of the present application.

[0083] The above is only the preferred embodiment of the present application and the technical principles applied. The present application is not limited to the specific embodiments described herein. Various obvious changes, re-adjustments and substitutions that can be made by those skilled in the art will not depart from the protection scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments. Without departing from the concept of the present application, it may also include more other equivalent embodiments, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for analyzing access logs of private data in decentralized storage, characterized in that, The method is executed by a data management server, which is connected to storage nodes; the method includes: Obtaining a partitioning rule for private data from a storage planning server, and storing it using multiple different storage nodes according to the partitioning rule; wherein, the partitioning rule includes the time period during which the private data assigned to the storage nodes is generated; Receiving an access request for private data sent by an access terminal, and identifying whether the access request includes an authorization label sent by the storage planning server; If there is no authorization label, access is denied, a first type of access log for the access request is generated, and a first prompt message is generated when a first type of access log is recognized; If there is an authorization label, a second type of access log is generated, and it is identified whether the target storage node of the access request matches the partitioning rule; If it matches, a first suffix is added to the second type of access log, and access is allowed; If it does not match, a second suffix is added to the second type of access log, and access is prohibited; and a second prompt message is generated when a second type of access log with a second suffix is recognized.

2. The method for analyzing access logs of private data in decentralized storage according to claim 1, wherein Identifying whether the target storage node of the access request matches the partitioning rule includes: When there are multiple target storage nodes in the authorization label of the access request, it is determined that it matches the partitioning rule; When there is one target storage node in the authorization label of the access request, it is determined that it does not match the partitioning rule.

3. The method for analyzing access logs of privacy data in decentralized storage according to claim 2, wherein When there are multiple target storage nodes in the authorization label of the access request, determining that it matches the partitioning rule includes: When there are multiple target storage nodes in the authorization label of the access request, and the switching times of the multiple target storage nodes correspond to the partitioning rule, it is determined that it matches the partitioning rule.

4. The method for analyzing access logs of privacy data in decentralized storage according to claim 3, wherein The authorization label includes at least two target storage nodes and the switching moments between the target storage nodes.

5. The method for analyzing access logs of private data in decentralized storage according to claim 1, wherein Obtaining a partitioning rule for private data from a storage planning server includes: At the start moment of each monitoring period, obtaining the partitioning rule for private data in the current monitoring period from the storage planning server.

6. The method for analyzing access logs of privacy data in decentralized storage according to claim 5, wherein The partitioning rule for each monitoring period is generated at the start moment of the monitoring period.

7. The method for analyzing access logs of privacy data in decentralized storage according to claim 1, wherein The method further includes: In the case where it is recognized that multiple access requests for private data sent by the same access terminal all generate second prompt messages, adding the access terminal to a blacklist.

8. An access log analysis device for privacy data in decentralized storage, characterized in that, The device is configured in a data management server, which is connected to storage nodes; the device includes: A data storage module, configured to obtain a partitioning rule for private data from a storage planning server, and store it using multiple different storage nodes according to the partitioning rule; wherein, the partitioning rule includes the time period during which the private data assigned to the storage nodes is generated; An authorization label identification module, configured to receive an access request for private data sent by an access terminal, and identify whether the access request includes an authorization label sent by the storage planning server; The first type of access log generation module is used to reject access if there is no authorization label, generate the first type of access log for the access request, and generate a first prompt message when the first type of access log is recognized; The second type of access log generation module is used to generate the second type of access log if there is an authorization label, and identify whether the target storage node of the access request matches the partitioning rule; The first suffix addition module is used to add a first suffix to the second type of access log and allow access if there is a match; The second suffix addition module is used to add a second suffix to the second type of access log and prohibit access if there is no match; and generate a second prompt message when the second type of access log with the second suffix is recognized.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor. When the program or instruction is executed by the processor, it implements the steps of the method for analyzing access logs of private data in decentralized storage as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, A program or instruction is stored on the readable storage medium. When the program or instruction is executed by the processor, it implements the steps of the method for analyzing access logs of private data in decentralized storage as described in any one of claims 1-7.

Images