Access Log Analysis Method, Device, Equipment and Medium for Privacy Data in Decentralized Storage

Abstract

The present application discloses a method, device, equipment and medium for analyzing access logs of decentralized stored privacy data, and the present application belongs to the field of data privacy protection technology. The method includes: obtaining a partitioning rule and using multiple different storage nodes for storage; receiving an access request for privacy data from an access terminal and identifying an authorization tag; if there is no authorization tag, denying access, generating a first type of access log, and generating a first prompt message; if there is an authorization tag, generating a second type of access log and identifying whether the target storage node of the access request matches the partitioning rule; if it matches, adding a first suffix and allowing access; if it does not match, adding a second suffix and prohibiting access; and generating a second prompt message when the second type of access log with the second suffix is identified. This technical solution can perform access control on privacy data, thereby improving the security of decentralized data storage.

Description

Technical Field

[0001] The present application belongs to the field of data privacy protection technology, and specifically relates to a method, apparatus, device, and medium for analyzing access logs of decentralized stored privacy data. Background Art

[0002] During data storage, decentralized storage methods can be used to ensure data privacy and security. For example, current personal privacy protection strategies can disperse data storage across different nodes to increase the difficulty of illegal access. However, for some data storage, such as home surveillance video data, although existing decentralized data storage solutions are used to disperse surveillance video data and reduce the risk of illegal access, if an illegal terminal impersonates a legitimate terminal to access even any storage node, private data will be leaked, thus failing to effectively protect private data.

[0003] Therefore, how to adopt a decentralized storage strategy to protect private data and avoid illegal access is a technical problem that needs to be solved urgently in this field. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide a method, apparatus, device, and medium for analyzing access logs of private data stored in decentralized storage, aiming to address data security risks and other issues inherent in conventional decentralized data storage. This solution generates access logs for access requests to private data and identifies whether the access requests are secure based on the access logs, thereby controlling access to the private data and improving the security of decentralized data storage.

[0005] In a first aspect, an embodiment of the present application provides a method for analyzing access logs of decentralized stored private data, the method comprising:

[0006] The method is executed by a data management server connected to a storage node; the method includes:

[0007] Obtaining a partitioning rule for the private data from a storage planning server, and using a plurality of different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating the private data allocated to the storage node;

[0008] receiving an access request for private data from an access terminal, and identifying whether the access request includes an authorization tag issued by a storage planning server;

[0009] If the authorization tag is not present, access is denied, and a first type of access log of the access request is generated, and when the first type of access log is identified, a first prompt message is generated;

[0010] If there is an authorization tag, a second type of access log is generated, and whether the target storage node of the access request matches the partition rule is identified;

[0011] If a match is found, the first suffix is added to the second type of access log and access is allowed;

[0012] If there is no match, a second suffix is added to the second type access log and access is prohibited; and when a second type access log with the second suffix is identified, a second prompt message is generated.

[0013] Furthermore, identifying whether the target storage node of the access request matches the partitioning rule includes:

[0014] When identifying that there are multiple target storage nodes in the authorization tag of the access request, determining that the target storage nodes match the partitioning rule;

[0015] When the authorization tag of the access request identifies that the target storage node is one, it is determined that the node does not match the partitioning rule.

[0016] Furthermore, when identifying that there are multiple target storage nodes in the authorization tag of the access request, determining that the target storage nodes match the partitioning rule includes:

[0017] When there are multiple target storage nodes in the authorization tag identifying the access request and the switching times of the multiple target storage nodes correspond to the division rule, it is determined that the nodes match the division rule.

[0018] Furthermore, the authorization tag includes at least two target storage nodes and the switching time between the target storage nodes.

[0019] Furthermore, the partitioning rules for the privacy data are obtained from the storage planning server, including:

[0020] At the start of each monitoring cycle, the division rules for the privacy data in the current monitoring cycle are obtained from the storage planning server.

[0021] Furthermore, the division rule of each monitoring period is generated at the start time of the monitoring period.

[0022] Furthermore, the method further comprises:

[0023] When it is identified that the same access terminal issues multiple access requests for private data and generates second prompt information, the access terminal is added to a blacklist.

[0024] In a second aspect, an embodiment of the present application provides an access log analysis device for decentralized private data storage, wherein the device is configured on a data management server connected to a storage node; the device includes:

[0025] A data storage module is configured to obtain a partitioning rule for private data from a storage planning server and, based on the partitioning rule, use multiple different storage nodes for storage; wherein the partitioning rule includes a time period for generating private data allocated to the storage node;

[0026] An authorization tag identification module is used to receive an access request for private data from an access terminal and identify whether the access request includes an authorization tag issued by a storage planning server;

[0027] a first type access log generating module, configured to deny access if the access request does not have an authorization tag, generate a first type access log for the access request, and generate a first prompt message when a first type access log is identified;

[0028] A second type access log generating module, configured to generate a second type access log if there is an authorization tag, and identify whether a target storage node of the access request matches the partitioning rule;

[0029] a first suffix adding module, configured to add the first suffix to the second type access log and allow access if a match is found;

[0030] The second suffix adding module is used to add a second suffix to the second type access log and prohibit access if there is no match; and generate a second prompt message when identifying the second type access log with the second suffix.

[0031] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0032] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0033] In a fifth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0034] The technical solution provided by the embodiment of the present application obtains privacy data partitioning rules from a storage planning server, adopts multiple storage nodes for storage according to the rules, identifies whether an authorization tag is included when receiving an access request, denies access to requests without authorization tags and generates a first type of access log and prompt information, generates a second type of access log for requests with authorization tags and determines whether the target storage node matches the partitioning rules. If a match is made, a first suffix is added to allow access; if a match is made, a second suffix is added to prohibit access and a prompt information is generated. This technical solution solves the problem of protecting privacy data under a decentralized storage strategy, avoids illegal access, reduces the risk of privacy data leakage through strict review and corresponding processing of access requests, achieves effective protection of privacy data, and provides reliable guarantees for the secure storage and access of privacy data in decentralized storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flowchart of the method for analyzing access logs of decentralized stored private data provided in Example 1 of the present application;

[0036] Figure 2 This is a flowchart of the method for analyzing access logs of decentralized stored private data provided in Example 2 of the present application;

[0037] Figure 3 This is a schematic diagram of the structure of the access log analysis device for decentralized storage of private data provided in Example 3 of the present application;

[0038] Figure 4 This is a schematic diagram of the structure of the electronic device provided in Example 4 of the present application. DETAILED DESCRIPTION

[0039] To further clarify the objectives, technical solutions, and advantages of this application, specific embodiments of the present application are described in further detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are intended only to illustrate this application and are not intended to limit it. It should also be noted that, for ease of description, the drawings only illustrate portions relevant to this application, not all of them. Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts depict the various operations (or steps) as sequential processes, many of the operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process may terminate upon completion of its operations, but may also include additional steps not shown in the accompanying drawings. The process may correspond to a method, function, procedure, subroutine, subprogram, and the like.

[0040] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field are within the scope of protection of this application.

[0041] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of this application can be implemented in an order other than that illustrated or described herein, and that the objects distinguished by "first," "second," and the like are generally of the same type, and do not limit the number of objects; for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects connected are in an "or" relationship.

[0042] The following, in conjunction with the accompanying drawings, describes in detail the access log analysis method, device, equipment and medium for decentralized storage of private data provided by the embodiments of the present application through specific embodiments and their application scenarios.

[0043] Example 1

[0044] Figure 1 This is a flow chart of the method for analyzing access logs of decentralized stored privacy data provided in Example 1 of this application. The method is executed by a data management server, which is connected to a storage node; Figure 1 As shown, the specific steps include:

[0045] S101, obtaining a partitioning rule for private data from a storage planning server, and using multiple different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating private data allocated to the storage nodes;

[0046] First, this application is applicable to scenarios where decentralized storage of private data requires access control. Based on the above usage scenarios, it can be understood that the execution entity of this application can be a data management server, which is connected to the storage nodes to perform write control and / or data access control on each storage node.

[0047] The storage planning server is responsible for developing private data storage plans. It maintains information about how private data should be stored, such as which storage nodes should be assigned to continuous private data, such as video surveillance data from a user's home, and how long private data should be stored. Specifically, it can control storage time from 0-5 seconds to the first storage node, from 5.01-10 seconds to the second storage node, and from 10.01-15 seconds to the third storage node, and so on. It can also shuffle storage nodes to improve data security.

[0048] Privacy data refers to data that contains personal privacy information or sensitive information, such as personal identity information, surveillance video data, etc.

[0049] Partitioning rules are detailed guidelines developed by the storage planning server for how to allocate private data to different storage nodes. These rules include assigning storage nodes to the time periods during which private data is generated. For example, surveillance video data generated during a certain period should be stored on a specific storage node. This helps ensure orderly data storage and management.

[0050] Storage nodes are devices or servers used to store private data. They receive control instructions from the data management server and store the corresponding private data according to the partitioning rules. These storage nodes may be distributed in different geographical locations and connected to the data management server via a network, forming a decentralized storage system.

[0051] In this solution, the data management server can obtain the privacy data partitioning rules from the storage planning server over the network. For example, the data management server sends a request to the storage planning server to obtain the rules. The storage planning server responds and sends the partitioning rules to the data management server. The data management server receives and parses these rules. For example, by reading the field content, it can obtain the time period division method and the storage node corresponding to each time period.

[0052] S102, receiving an access request for private data from an access terminal, and identifying whether the access request includes an authorization tag issued by a storage planning server; if the authorization tag is not included, executing S103; if the authorization tag is included, executing S104;

[0053] Access terminals are devices used by users to access private data, such as computers, mobile phones, and tablets. Users use these devices to send requests to the data management server to access private data.

[0054] An access request is an instruction sent by an access terminal to a data management server to retrieve private data. This request contains information about the private data the user wishes to access, such as the target data type and the total number of requests. For continuous private data such as surveillance videos, the access request includes the start and end times of the access. For example, if you need to access surveillance videos from 8:00:00 AM to 8:05:00 AM, the request may contain the start and end times of the access.

[0055] The authorization tag is issued by the storage planning server and is used to verify the legitimacy of the access. Specifically, it can be a string. The access terminal can send a request to the storage planning server in advance to obtain it.

[0056] S103, denying access, generating a first type of access log for the access request, and generating a first prompt message when identifying a first type of access log;

[0057] Type 1 access logs are generated by the data management server to record access requests when the access request lacks an authorization tag. Type 1 access logs can include relevant information about the access request, such as the access terminal identifier, access time, and the type of data requested, for subsequent analysis and monitoring of unauthorized access.

[0058] The first prompt information is information generated when the data management server identifies a first type of access log and is used to prompt relevant personnel. Through these prompt information, the management personnel can promptly learn that illegal access behavior has occurred and take corresponding measures.

[0059] In this solution, if the data management server determines that an access request does not contain an authorization tag, it will deny the access request to prevent unauthorized access. After denying the access request, the data management server will generate a first-type access log. After completing the record, the server will periodically or in real time check the system's log files for any such logs. If a first-type access log is detected, the data management server will generate a first notification message and send it to the administrator, notifying them of the unauthorized access.

[0060] S104, generating a second type of access log, and identifying whether the target storage node of the access request matches the partitioning rule; if so, executing S105; if not, executing S106;

[0061] The second type of access log is a log generated by the data management server to record an access request when the access request includes an authorization tag.

[0062] The target storage node is the storage node specified in the access request for obtaining private data. The access terminal can parse the authorization tag and read certain field information. For example, if the read field information includes storage node 2 and storage node 6, storage node 2 and storage node 6 are the target nodes obtained by reading.

[0063] When the data management server determines that an access request contains an authorization tag, it can generate a second type of access log. This log records information related to the access request, such as the access terminal's identifier, access time, and the type of data being requested. The access terminal's identifier can be written into a portion of the access request's bytes when the access terminal issues the request, allowing the data management server to read it.

[0064] The data management server can identify whether the target storage node of the access request matches the division rule. Specifically, based on the correspondence between private data and storage nodes in the division rule, it can check whether the target storage node is the node where the private data requested for access should be stored. For example, the two can be compared to see if they are consistent. If they match, the access request is considered reasonable; if they do not match, it is considered that there is a problem. For example, the access terminal generates its own authorization tag and target storage node through imitation, but because it does not know the specific planning method of the storage planning server, the authorization tag and target storage node generated by itself can be identified as wrong, thereby preventing illegal access terminals from obtaining private data and protecting privacy security.

[0065] S105, adding the first suffix to the second type of access log and allowing access;

[0066] The first suffix is a special tag added to the second type of access log to indicate that the access request matches the classification rules and is allowed. By adding the first suffix, the logs can be categorized and marked, making it easier to manage and audit legal and rule-compliant access behaviors.

[0067] After determining that the target storage node matches the partitioning rule, the data management server adds a first suffix, such as a suffix of "-0", to the second type of access log.

[0068] S106: Add a second suffix to the second type of access log and prohibit access; and generate second prompt information when the second type of access log with the second suffix is identified.

[0069] The second suffix is a special tag added to the second type of access log to indicate that the access request does not match the classification rules and is therefore prohibited. Similar to the first suffix, the second suffix marks illegal access behavior for easier analysis and management.

[0070] The second prompt information can be information generated when the data management server identifies the second type of access log with the second suffix to prompt the administrator. The administrator can learn from the prompt information that there is an access behavior that does not comply with the rules so that he can take corresponding measures.

[0071] When the data management server determines that the target storage node does not match the partitioning rule, it will add a second suffix to the second type of access log, such as adding a suffix of "-1".

[0072] After adding the second suffix to the second type of access log, the data management server will prohibit the access terminal from accessing the private data. The data management server will periodically or in real time check the second type of access log in the system to check for any log records with the second suffix. By analyzing and judging the logs, it will determine whether any access behavior that does not comply with the rules has occurred. When a second type of access log with the second suffix is identified, the data management server will generate a second prompt message.

[0073] In this solution, after obtaining the access log, the access log can be obtained at regular intervals or in real time, and analyzed to determine whether there is an access terminal that wants to maliciously access private data.

[0074] The technical solution provided by this embodiment achieves reasonable storage of private data by obtaining partitioning rules from the storage planning server, ensuring that data is stored in different nodes and managed in an orderly manner. In terms of access control, the authorization tag is strictly checked for access requests, effectively preventing illegal access without authorization tags, and facilitating the monitoring and management of illegal access behaviors by generating a first type of access log and a first prompt message. For access requests containing authorization tags, it is further determined whether the target storage node matches the partitioning rules. If it matches, access is allowed and a first suffix is added to the second type of access log. If it does not match, access is prohibited and a second suffix is added to the second type of access log, and a second prompt message is generated. This meticulous access control mechanism ensures that only legal and rule-compliant access can obtain private data, greatly improving the security and reliability of private data storage and access. By recording access logs and generating prompt information, it also provides effective management and monitoring means for system administrators and other relevant personnel, who can promptly discover and handle illegal or rule-incompliant access behaviors, thereby better protecting the security of private data.

[0075] In one embodiment, optionally, obtaining a partitioning rule for private data from a storage planning server includes:

[0076] At the start of each monitoring cycle, the division rules for the privacy data in the current monitoring cycle are obtained from the storage planning server.

[0077] Partitioning rules are specific rules generated by the storage planning server for allocating private data storage. They specify how private data is stored on different storage nodes. Specifically, they specify the time period during which private data is generated, assigned to each storage node. For example, within a certain monitoring cycle, a storage node should store private data generated within a specific time period.

[0078] The monitoring period can be one day, one hour, one minute, etc.

[0079] The start time is the time at which each monitoring cycle begins. At this time, the data management server triggers the operation of obtaining the partitioning rules from the storage planning server. This time is usually pre-set. For example, if the monitoring cycle is set to one day, the start time may be midnight every day.

[0080] This technical solution obtains the private data partitioning rules for the current monitoring cycle from the storage planning server at the start of each monitoring cycle, enabling the data management server to promptly learn the latest storage plan. This ensures that private data is stored on different storage nodes according to the latest and most appropriate rules, improving the orderliness and security of data storage. Timely access to partitioning rules also facilitates dynamic data storage management, allowing for flexible adjustment of data storage allocation based on the characteristics and requirements of different monitoring cycles.

[0081] In one embodiment, optionally, the division rule of each monitoring period is generated at the start time of the monitoring period.

[0082] This technical solution specifies that the partitioning rules for each monitoring cycle are generated at the beginning of the monitoring cycle, ensuring the timeliness and relevance of the partitioning rules. The data management server obtains the most recently generated partitioning rules at the beginning of each monitoring cycle and stores private data accordingly, making data storage more organized and improving data security. Furthermore, regenerating the rules each cycle prevents the rules from being cracked, enhancing the security of private data.

[0083] In one embodiment, optionally, the method further includes:

[0084] When it is identified that the same access terminal issues multiple access requests for private data and generates second prompt information, the access terminal is added to a blacklist.

[0085] A blacklist is a list maintained by the data management server that records information about terminals that are prohibited from accessing private data. Once a terminal is blacklisted, it can no longer access private data in the system. This strengthens privacy protection by limiting the access rights of potentially risky terminals.

[0086] The data management server analyzes multiple private data access requests issued by the access terminal to determine whether each of them generates the second prompt message. It checks the log records corresponding to each access request to see if the second suffix exists. If it determines that multiple private data access requests issued by the same access terminal all generate the second prompt message, the server adds the relevant information of the access terminal, such as the device identifier and IP address, to a blacklist.

[0087] This technical solution effectively improves the security of private data by blacklisting the access terminal when it identifies multiple private data access requests from the same terminal, each generating a second prompt message. This solution promptly identifies access terminals that frequently engage in non-compliant access behaviors and restricts these terminals, potentially due to malicious access or operational errors, to prevent further attempts to access private data, reducing the risk of illegal acquisition or leakage of private data. The blacklist mechanism also serves as a deterrent to potential illegal access, further ensuring the secure and stable operation of the private data storage and access system, and ensuring better protection of legitimate users' private data.

[0088] Example 2

[0089] Figure 2 This is a flow chart of the access log analysis method for decentralized storage of privacy data provided in Example 2 of this application. This solution makes a better improvement to the above embodiment, specifically: identifying whether the target storage node of the access request matches the partitioning rule, including: when the target storage node in the authorization tag of the access request is multiple, it is determined that it matches the partitioning rule; when the target storage node in the authorization tag of the access request is one, it is determined that it does not match the partitioning rule. Figure 2 As shown, the specific steps include:

[0090] S201, obtaining a partitioning rule for private data from a storage planning server, and using multiple different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating private data allocated to the storage nodes;

[0091] S202, receiving an access request for private data from an access terminal, and identifying whether the access request includes an authorization tag issued by a storage planning server; if the authorization tag is not included, executing S203; if the authorization tag is included, executing S204;

[0092] S203, denying access, generating a first type of access log for the access request, and generating a first prompt message when identifying a first type of access log;

[0093] S204: Generate a second type of access log. If multiple target storage nodes are identified in the authorization tag of the access request, determine that the access log matches the partitioning rule, and execute S205. If only one target storage node is identified in the authorization tag of the access request, determine that the access log does not match the partitioning rule, and execute S206.

[0094] The data management server analyzes the authorization tag in the access request and checks the target storage node information. Specifically, based on the number of target storage nodes identified in the authorization tag, the data management server determines whether the partitioning rule is matched. If multiple target storage nodes are identified in the authorization tag, the access request is deemed to have matched the partitioning rule. If only one target storage node is identified, the access request is deemed to have mismatched the partitioning rule.

[0095] Once generated, surveillance data is divided and stored in different storage nodes according to time periods. However, video data access requests are often based on a longer time period, or do not select a time period, meaning all surveillance videos within the monitoring period are retrieved. In such cases, it is unlikely that there will be only one target storage node. Therefore, the number of target storage nodes can be used to determine whether the partitioning rule is met.

[0096] S205, adding the first suffix to the second type of access log and allowing access;

[0097] S206: Add a second suffix to the second type of access log and prohibit access; and generate second prompt information when the second type of access log with the second suffix is identified.

[0098] The technical solution provided in this embodiment can effectively regulate the access behavior of private data by matching the target storage node of the access request with the partitioning rules and determining whether it matches based on the number of target storage nodes in the authorization tag. This mechanism can prevent a single illegal target storage node from being accessed, reducing the risk of private data leakage due to errors or illegal access. When there are multiple target storage nodes, it is determined to match the partitioning rules, ensuring that data access is based on a reasonable storage plan, meeting the requirements of decentralized storage, and improving the security and orderliness of private data storage and access. At the same time, this simple and clear matching judgment method also improves the processing efficiency of the data management server, can quickly respond to access requests, and ensure the stable operation of the system.

[0099] Based on the above technical solutions, optionally, when identifying that there are multiple target storage nodes in the authorization tag of the access request, determining that the target storage nodes match the partitioning rule includes:

[0100] When there are multiple target storage nodes in the authorization tag identifying the access request and the switching times of the multiple target storage nodes correspond to the division rule, it is determined that the nodes match the division rule.

[0101] This solution further optimizes switching time. For example, there are switching points between multiple target storage nodes. This is because private data from different time periods may be stored on different nodes, so access may switch from one storage node to another. The partitioning rules can include the switching time schedule between these storage nodes.

[0102] The data management server parses and analyzes the authorization tag in the access request, extracting information such as the number of target storage nodes and the switching time. If the authorization tag in the access request identifies multiple target storage nodes and the switching times of these target storage nodes are consistent with the partitioning rule, the server determines that the partitioning rule matches.

[0103] This technical solution can greatly improve the security and accuracy of private data access by considering the number of target storage nodes and switching time when judging whether an access request matches the partitioning rules. From a security perspective, this mechanism can effectively prevent illegal access. Because only when the number of target storage nodes and the switching time of the access request strictly comply with the partitioning rules will it be considered a match, which increases the difficulty for illegal accessors to bypass the rules and obtain private data. In terms of accuracy, it ensures that access requests can be carried out according to a reasonable storage plan, allowing users to access private data stored on the corresponding nodes at the right time, avoiding the problem of data acquisition failure or data inconsistency due to erroneous access. This sophisticated matching judgment mechanism helps to maintain the stability of the decentralized storage system and better protect the security of private data.

[0104] Based on the above technical solutions, optionally, the authorization tag includes at least two target storage nodes and the switching time between the target storage nodes.

[0105] In this solution, the authorization tag may carry at least two target storage nodes and the switching time between the target storage nodes.

[0106] This technical solution, by setting up multiple target storage nodes, enables decentralized storage of private data, making it more difficult for data to be illegally accessed and improving data security. Furthermore, the clear switching time allows the data management server to process access requests according to predetermined rules, ensuring that access requests reach the private data stored on the corresponding target storage node at the correct time. This design avoids the risk of access failure or data leakage caused by timing errors or target storage node errors. This precise control mechanism effectively ensures secure access to private data.

[0107] Example 3

[0108] Figure 3 This is a schematic diagram of the structure of the decentralized storage privacy data access log analysis device provided in Example 3 of this application. The device is configured on a data management server, which is connected to a storage node; Figure 3 As shown, the device includes:

[0109] The data storage module 301 is configured to obtain a partitioning rule for private data from a storage planning server and, based on the partitioning rule, use multiple different storage nodes for storage; wherein the partitioning rule includes the time period for generating private data allocated to the storage nodes;

[0110] The authorization tag identification module 302 is used to receive an access request for private data from an access terminal and identify whether the access request includes an authorization tag issued by a storage planning server;

[0111] A first type access log generating module 303 is configured to deny access if the access request does not have an authorization tag, generate a first type access log for the access request, and generate a first prompt message when a first type access log is identified;

[0112] A second type access log generating module 304 is configured to generate a second type access log if there is an authorization tag, and identify whether the target storage node of the access request matches the partitioning rule;

[0113] A first suffix adding module 305 is configured to add the first suffix to the second type access log if a match is found, and allow access;

[0114] The second suffix adding module 306 is configured to add a second suffix to the second type access log and prohibit access if there is no match; and generate a second prompt message when a second type access log with the second suffix is identified.

[0115] In an embodiment of the present application, a data storage module is used to obtain a partitioning rule for privacy data from a storage planning server, and adopt multiple different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating privacy data allocated to the storage node; an authorization tag identification module is used to receive an access request for privacy data issued by an access terminal, and identify whether the access request includes an authorization tag issued by the storage planning server; a first type access log generation module is used to deny access if there is no authorization tag, and generate a first type access log for the access request, and generate a first prompt message when identifying a first type access log; a second type access log generation module is used to generate a second type access log if there is an authorization tag, and identify whether the target storage node of the access request matches the partitioning rule; a first suffix adding module is used to add a first suffix to the second type access log if there is a match, and allow access; a second suffix adding module is used to add a second suffix to the second type access log if there is no match, and prohibit access; and generate a second prompt message when identifying a second type access log with a second suffix. The above technical solution generates corresponding access logs for access requests to private data, and identifies whether the access requests are safe access requests based on the access logs to control access to private data, thereby improving the security of decentralized data storage.

[0116] The decentralized access log analysis device for private data in the embodiments of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, the mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc., and the embodiments of the present application do not specifically limit this.

[0117] The decentralized storage private data access log analysis device in the embodiments of the present application can be a device having an operating system. The operating system can be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.

[0118] The access log analysis device for decentralized storage of private data provided in the embodiment of the present application can implement the various processes implemented in the above-mentioned embodiments one to four. To avoid repetition, they will not be described here.

[0119] Example 4

[0120] like Figure 4 As shown, an embodiment of the present application also provides an electronic device 400, including a processor 401, a memory 402, and a program or instruction stored in the memory 402 and executable on the processor 401. When the program or instruction is executed by the processor 401, the various processes of the above-mentioned decentralized storage privacy data access log analysis method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0121] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0122] Example 5

[0123] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned decentralized storage privacy data access log analysis method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0124] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0125] Example 6

[0126] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned decentralized storage privacy data access log analysis method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0127] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0128] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0129] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of this application.

[0130] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

[0131] The above are only preferred embodiments of the present application and the technical principles employed. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions that are possible for those skilled in the art will not depart from the scope of protection of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments and may include more other equivalent embodiments without departing from the concept of the present application. The scope of the present application is determined by the scope of the claims.

Claims

1. A method for analyzing access logs of decentralized private data, characterized in that: The method is executed by a data management server connected to a storage node; the method includes: Obtaining a partitioning rule for the private data from a storage planning server, and using a plurality of different storage nodes for storage according to the partitioning rule; wherein the partitioning rule includes a time period for generating the private data allocated to the storage node; receiving an access request for private data from an access terminal, and identifying whether the access request includes an authorization tag issued by a storage planning server; If the authorization tag is not present, access is denied, and a first type of access log of the access request is generated, and when the first type of access log is identified, a first prompt message is generated; If there is an authorization tag, a second type of access log is generated, and whether the target storage node of the access request matches the partition rule is identified; If a match is found, the first suffix is added to the second type of access log and access is allowed; If there is no match, a second suffix is added to the second type access log and access is prohibited; and when a second type access log with the second suffix is identified, a second prompt message is generated.

2. The method for analyzing access logs of decentralized private data according to claim 1, characterized in that: Identifying whether a target storage node of the access request matches the partitioning rule includes: When identifying that there are multiple target storage nodes in the authorization tag of the access request, determining that the target storage nodes match the partitioning rule; When the authorization tag of the access request identifies that the target storage node is one, it is determined that the node does not match the partitioning rule.

3. The method for analyzing access logs of decentralized private data according to claim 2, characterized in that: When identifying that there are multiple target storage nodes in the authorization tag of the access request, determining that the target storage nodes match the partitioning rule includes: When there are multiple target storage nodes in the authorization tag identifying the access request and the switching times of the multiple target storage nodes correspond to the division rule, it is determined that the nodes match the division rule.

4. The method for analyzing access logs of decentralized private data according to claim 3, wherein: The authorization tag includes at least two target storage nodes and the switching time between the target storage nodes.

5. The method for analyzing access logs of decentralized private data according to claim 1, wherein: Obtain the privacy data partitioning rules from the storage planning server, including: At the start of each monitoring cycle, the division rules for the privacy data in the current monitoring cycle are obtained from the storage planning server.

6. The method for analyzing access logs of decentralized private data according to claim 5, characterized in that: The division rule of each monitoring period is generated at the start time of the monitoring period.

7. The method for analyzing access logs of decentralized private data according to claim 1, characterized in that: The method further comprises: When it is identified that the same access terminal issues multiple access requests for private data and generates second prompt information, the access terminal is added to a blacklist.

8. A decentralized storage private data access log analysis device, characterized in that: The device is configured on a data management server, which is connected to a storage node; the device includes: A data storage module is configured to obtain a partitioning rule for private data from a storage planning server and, based on the partitioning rule, use multiple different storage nodes for storage; wherein the partitioning rule includes a time period for generating private data allocated to the storage node; An authorization tag identification module is used to receive an access request for private data from an access terminal and identify whether the access request includes an authorization tag issued by a storage planning server; a first type access log generating module, configured to deny access if the access request does not have an authorization tag, generate a first type access log for the access request, and generate a first prompt message when a first type access log is identified; A second type access log generating module, configured to generate a second type access log if there is an authorization tag, and identify whether a target storage node of the access request matches the partitioning rule; a first suffix adding module, configured to add the first suffix to the second type access log and allow access if a match is found; The second suffix adding module is used to add a second suffix to the second type access log and prohibit access if there is no match; and generate a second prompt message when identifying the second type access log with the second suffix.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of the access log analysis method for decentralized storage of private data are implemented as described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the access log analysis method for decentralized storage of private data as described in any one of claims 1 to 7 are implemented.

Images