Cloud disk file access control method and device, equipment, medium and product

Abstract

The invention relates to a cloud disk file access control method and device, equipment, a medium and a product, and the method comprises the steps: obtaining an original file uploaded by a first user, and processing the original file to obtain a plurality of file slices; the data contained in each file slice is data of which the semantic coherence degree meets the requirement; clustering the plurality of file slices to obtain a plurality of slice clusters, and constructing an access control tree based on the plurality of slice clusters; wherein nodes in the access control tree are used for indicating each slice cluster, file slices contained in the slice cluster and authority information of a second user to each node in the access control tree; and in response to an access request of a second user for a target node in the access control tree, verifying the access permission, and returning the file slice corresponding to the target node to the second user under the condition that the access permission verification is passed. According to the invention, the fine-grained access control of the cloud disk file can be realized, and the sharing security of the cloud disk file is improved.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, medium, and product for access control of cloud disk files. Background Technology

[0002] With the popularization of cloud storage technology, users' demand for sharing files through cloud drives is growing. In the current cloud storage and document sharing scenarios, users' sharing and authorization of files are usually limited to the entire file level. However, in practical applications, users often have more granular sharing needs, such as sharing only a paragraph of text in a document or a column of data in a spreadsheet.

[0003] Existing cloud drive sharing solutions fail to meet fine-grained sharing needs, leaving users with limited control over shared files. This not only impacts user experience but also poses a risk of unnecessary data leaks. Therefore, a cloud drive file access control method is urgently needed to meet users' growing demand for sophisticated sharing features. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, medium, and product for access control of cloud disk files.

[0005] According to a first aspect of this disclosure, a method for access control of files on a cloud drive is provided, the method comprising: The original file uploaded by the first user is obtained and processed to obtain multiple file slices; the data contained in each file slice is data whose semantic coherence meets the requirements. The multiple file slices are clustered to obtain multiple slice clusters, and an access control tree is constructed based on the multiple slice clusters; wherein, the nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree; In response to the second user's access request to the target node in the access control tree, the access permission is verified, and if the access permission verification is successful, the file slice corresponding to the target node is returned to the second user.

[0006] Furthermore, the processing of the original file to obtain multiple file slices includes: The original file is divided into multiple data blocks, and the feature vector of each data block is extracted; Based on the feature vector, the multiple data blocks are grouped to obtain multiple target slice sets; Encrypting all the target slice sets yields the plurality of file slices; wherein, encrypting one target slice set yields one file slice.

[0007] Further, the step of grouping the multiple data blocks based on the feature vector to obtain multiple target slice sets includes: The first semantic coherence degree between any two data blocks is calculated based on the feature vector; wherein, the first semantic coherence degree is used to characterize the degree of semantic association between the two data blocks; The multiple data blocks are grouped according to the splitting order to obtain multiple initial slice sets, and the second semantic coherence of the initial slice set is calculated based on the first semantic coherence between any two data blocks in each initial slice set. The third semantic coherence between any two adjacent initial slice sets is calculated based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. The initial slice set corresponding to the one with the largest second semantic coherence and the smallest third semantic coherence is determined as the target slice set.

[0008] Furthermore, the clustering of the multiple file slices to obtain multiple slice clusters includes: The logical correlation between any two file slices is calculated using a third formula; wherein, the third formula is: The The degree of logical relevance, Let the semantic coherence of any two file slices be denoted as . The size of the intersection of any two file slices. Let the size of the union of any two file slices be denoted as . For hyperparameters; A coherence matrix is ​​constructed based on the logical correlation, and the coherence matrix is ​​processed by a spectral clustering algorithm to obtain the multiple slice clusters.

[0009] Furthermore, the method also includes determining the permission information of each second user in the following manner: Determine the access sequence of the second user to the file slice; wherein the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; The access habits of the second user to the file slice are determined based on the access sequence; Based on the access habits, the access permissions of the second user to each node in the access control tree are determined.

[0010] Further, the step of responding to the second user's access request to the target node in the access control tree, verifying access permissions, and returning the file slice corresponding to the target node to the second user if the access permissions verification is successful includes: In response to the second user's access request to a target node in the access control tree, the identity of the second user is verified. If the second user's identity verification is successful, a target access path for the access control tree is determined based on the access request. Based on the second user's permission information, verify the second user's access permissions on the target access path, and if the access permission verification is successful, return the file slice corresponding to the target node to the second user.

[0011] Furthermore, after returning the file slice corresponding to the target node to the second user, the method further includes: An access record is generated based on the access request, and the access record is stored in the blockchain.

[0012] Furthermore, after verifying the access permission in response to the second user's access request to the target node in the access control tree, the method further includes: If the access permission verification fails, the access request is rejected.

[0013] Furthermore, after constructing the access control tree based on the multiple slice clusters, the method further includes: The access control tree is updated based on the change information of the file slice and the change information of the access sequence to obtain the updated access control tree; wherein, the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; Select any node in the updated access control tree as the first node; In the neighborhood nodes of the first node, a second node that minimizes the objective function is determined, and the position of the second node is determined as the target position; wherein, the objective function is used to characterize the optimization balance index between the access control tree and the access permission matching efficiency and structural complexity. Move the first node to the target location; Repeat the above steps until the structure of the updated access control tree converges or the maximum preset number of iterations is reached to obtain the target access control tree.

[0014] Furthermore, in response to the second user's access request to a target node in the access control tree, the method verifies access permissions, and if the access permissions verification is successful, the method further includes: The file slice is decrypted to obtain a plaintext slice, and the plaintext slice is returned to the second user.

[0015] According to a second aspect of this disclosure, a cloud disk file access control device is provided, the device comprising: The first acquisition module is used to acquire the original file uploaded by the first user and process the original file to obtain multiple file slices; the data contained in each file slice is data whose semantic coherence meets the requirements; A construction module is used to cluster the multiple file slices to obtain multiple slice clusters, and to construct an access control tree based on the multiple slice clusters; wherein, the nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree; The verification module is used to respond to the second user's access request to the target node in the access control tree, verify the access permission, and return the file slice corresponding to the target node to the second user if the access permission verification is successful.

[0016] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0017] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0018] According to a fifth aspect of this disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, implements the methods described above in this disclosure.

[0019] This disclosure provides a method, apparatus, device, medium, and product for access control of cloud disk files. First, the original file uploaded by a first user is obtained and processed to obtain multiple file slices; each file slice contains data with semantic coherence requirements. Then, the multiple file slices are clustered to obtain multiple slice clusters, and an access control tree is constructed based on these clusters. Nodes in the access control tree indicate each slice cluster and the file slices contained within that cluster, as well as the second user's permission information for each node in the access control tree. Finally, in response to the second user's access request to a target node in the access control tree, access permissions are verified, and if the access permission verification is successful, the file slice corresponding to the target node is returned to the second user.

[0020] As described above, this disclosed technical solution obtains multiple file slices by slicing the original file uploaded by the first user. Each file slice contains data with semantic coherence that meets the requirements, breaking away from the coarse-grained sharing model of the existing technology that uses the entire file as a unit. This achieves fine-grained splitting and secure storage of file content. Furthermore, this disclosed technical solution clusters file slices and constructs an access control tree. The nodes in the tree explicitly indicate the second user's permission information for each node, extending permission management to the slice clustering and specific file slice levels. This satisfies the second user's differentiated access needs for different parts of the original file, enhancing the fine-grainedness and flexibility of permission control. When responding to the second user's access request for a target node, this disclosed technical solution verifies access permissions and, after the access permission is granted, returns the file slice corresponding to the target node to the second user. This ensures the security and controllability of the access process while meeting the user's need for fine-grained access to file content. This disclosed technical solution improves the security and flexibility of cloud drive file sharing while also enhancing the user experience. Attached Figure Description

[0021] Further details, features, and advantages of this disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart of a cloud disk file access control method provided as an exemplary embodiment of this disclosure; Figure 2 A flowchart of a cloud disk file access control method provided as another exemplary embodiment of this disclosure; Figure 3 A flowchart of a cloud disk file access control method provided as another exemplary embodiment of this disclosure; Figure 4 A flowchart of a cloud disk file access control method provided as another exemplary embodiment of this disclosure; Figure 5 A schematic diagram of an initial multi-level access control tree structure provided for an exemplary embodiment of this disclosure; Figure 6 A schematic diagram of an access control tree structure provided for another exemplary embodiment of this disclosure; Figure 7 A flowchart of a cloud disk file access control method provided as another exemplary embodiment of this disclosure; Figure 8 A flowchart of a cloud disk file access control method provided as another exemplary embodiment of this disclosure; Figure 9 A schematic block diagram of the functional modules of a cloud disk file access control device provided as an exemplary embodiment of the present disclosure; Figure 10 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure; Figure 11 A structural block diagram of a computer system provided as an exemplary embodiment of this disclosure; Figure 12 A structural block diagram of a computer program product provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0022] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0023] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0024] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0025] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more". The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0026] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0027] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0028] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0029] In one embodiment, such as Figure 1 As shown, a method for access control of cloud disk files is provided, including the following steps: Step 101: Obtain the original file uploaded by the first user and process the original file to obtain multiple file slices.

[0030] Here, the executing entity can obtain the original file uploaded by the first user and perform slice processing on the original file to obtain multiple file slices. The first user is the uploader of the original file, which can be a Word file or an Excel file. It should be noted that the specific type of the original file is not restricted here.

[0031] In one possible embodiment, such as Figure 2 As shown, the original file is processed to obtain multiple file slices, including the following steps: Step 1011: Divide the original file into multiple data blocks and extract the feature vector of each data block.

[0032] Here, after obtaining the original file uploaded by the first user, the executing entity can divide the original file into multiple data blocks and extract the feature vector of each data block.

[0033] In one possible embodiment, assume that the executing entity obtains the original file F uploaded by the first user, which consists of a series of data blocks. Composed of, and each data block B i Corresponding to a feature vector v i Where vi, j represents data block B i The value taken on the j-th feature.

[0034] For example, taking an Excel file as an example, firstly, the executing entity will load the Excel file... Parsing the data into a two-dimensional table, each cell represents a data block B. i The file F consists of n data blocks, that is The executing entity for each data block B i The extracted features include: the cell's data type (numeric, string, date, etc.), represented using One-Hot encoding; the cell's numerical value (for numeric cells); the length of the cell's content (for string cells); the cell's row and column numbers; the location of other cells referenced in the cell's formula; and the hash value of the cell's formatting information (font, color, borders, etc.). The executing entity performs this process on each data block B. i After feature extraction, the extracted features are normalized to generate cells, which are data blocks B. i eigenvector v i , where v i The expression is d is the dimension of the feature vector.

[0035] Step 1012: Group multiple data blocks based on feature vectors to obtain multiple target slice sets.

[0036] Here, after the execution entity divides the original file into multiple data blocks and extracts the feature vector of each data block, it can group the multiple data blocks based on the feature vector and obtain multiple target slice sets through the content-aware adaptive file slicing algorithm (CAFA-Slicing).

[0037] In one possible embodiment, multiple data blocks are grouped based on feature vectors to obtain multiple target slice sets, including the following steps: Calculate the first semantic coherence between any two data blocks based on feature vectors; The multiple data blocks are grouped according to the splitting order to obtain multiple initial slice sets. The second semantic coherence of the initial slice set is calculated based on the first semantic coherence between any two data blocks in each initial slice set. The third semantic coherence between any two adjacent initial slice sets is calculated based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. The initial slice set corresponding to the maximum second semantic coherence and the minimum third semantic coherence is determined as the target slice set.

[0038] Specifically, after the execution entity divides the original file into multiple data blocks and extracts the feature vector of each data block, it first calculates the first semantic coherence between any two data blocks based on the feature vector. The first semantic coherence is used to characterize the degree of semantic association between any two data blocks. Then, the execution entity groups the multiple data blocks according to the division order to obtain multiple initial slice sets. Based on the first semantic coherence between any two data blocks in each initial slice set, the execution entity calculates the second semantic coherence of that initial slice set. After that, the execution entity calculates the third semantic coherence between any two adjacent initial slice sets based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. Finally, the execution entity determines the initial slice set corresponding to the largest second semantic coherence and the smallest third semantic coherence as the target slice set.

[0039] In one possible implementation, the executing entity first creates a paper vector model LDSC (Latent Dirichlet Semantic Coherence) to calculate the first semantic coherence between any two data blocks. The calculation formula is:

[0040] Among them, the first semantic coherence Used to characterize the degree of semantic association between any two data blocks. This is an adjustable hyperparameter used to control the steepness of the coherence curve. B represents the dot product of vectors. i and B j Represents any two data blocks, such as cells in an Excel file, v i and v j Indicates data block B i and B j The corresponding feature vector, each element v of the feature vector i,k This represents the value of the data block on the k-th feature. and Represents the eigenvector v i and v j The Euclidean norm (L2 norm) of a vector is its length or size. Represents the feature vector v i and v j The inner product of.

[0041] Then, the execution entity groups the multiple data blocks according to the splitting order, resulting in multiple initial slice sets. For example, the initial slice set is... Each initial slice set Sk The included data blocks are The execution entity is based on each initial slice set S k First semantic coherence between any two data blocks Calculate the initial slice set S k Second semantic coherence The calculation formula is:

[0042] in, For the second semantic coherence, For the initial set of slices, For the initial set of slices Any two data blocks in It represents the first semantic coherence between any two data blocks in the initial slice set.

[0043] Subsequently, the executing entity calculates the third semantic coherence between any two adjacent initial slice sets based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. The calculation formula is:

[0044] in, S represents the third semantic coherence. k+1 To be with S k Adjacent initial slice sets, The first semantic coherence is defined as the relationship between any data block in the initial slice set and any data block in the adjacent initial slice set.

[0045] Finally, the executing entity determines the initial slice set corresponding to the maximum second semantic coherence and the minimum third semantic coherence as the target slice set. For example, the executing entity can determine the target slice set through an optimization algorithm, where the algorithm's objective is to find the optimal set of slice points. The target slice set is such that the cumulative second semantic coherence within all target slice sets is maximized, while the third semantic coherence between adjacent slices is minimized. This can be described by the following optimization problem, with the specific formula as follows:

[0046] in, Let M be the upper limit of semantic coherence between adjacent slices, M be the maximum number of slices, and L be the minimum slice length. The above optimization problem can be solved using a dynamic programming algorithm, with the execution subject defining the state. The maximum internal cumulative second semantic coherence is represented by the state transition equation when the first i data blocks are divided into j slices:

[0047] Among them, S k,i Represents data block The algorithm's time complexity is O(n log n). The executing entity obtains the optimal set of slice points based on dynamic programming. In other words, the executing entity divides the original file F into m target slice sets. , where each target slice set S k Contains data blocks .

[0048] Step 1013: Encrypt the entire target slice set to obtain multiple file slices.

[0049] Here, the execution entity groups multiple data blocks based on feature vectors. After obtaining multiple target slice sets, it can encrypt all target slice sets to obtain multiple file slices. One target slice set is encrypted to obtain one file slice.

[0050] In one possible implementation, following the previous example, the executing entity will take the original file. Cut into A set of target slices Each target slice set contains data blocks. The executing entity uses an encryption algorithm to process each target slice set S k Encryption is performed to obtain multiple file slices. One file slice is obtained by encrypting a set of target slices. It should be noted that the specific choice of encryption algorithm is not limited here, as long as it can encrypt the set of target slices.

[0051] In this embodiment, firstly, the execution entity divides the original file into multiple data blocks and extracts the feature vector of each data block; then, the execution entity groups the multiple data blocks based on the feature vectors to obtain multiple target slice sets; finally, the execution entity encrypts all target slice sets to obtain multiple file slices.

[0052] As described above, this embodiment addresses the issue of unintelligent file slicing in existing technologies by dividing the original file into multiple data blocks and extracting feature vectors. Based on these feature vectors, a first semantic coherence between data blocks is calculated. Furthermore, a second semantic coherence between the initial slice set and a third semantic coherence between adjacent initial slice sets are calculated. Finally, the initial slice set with the highest second semantic coherence and the lowest third semantic coherence is determined as the target slice set. The target slice set is then encrypted to obtain file slices. This effectively achieves adaptive slice grouping based on semantic features, avoiding the limitations of fixed-size slices, improving the logical independence and semantic integrity of the target slice set, optimizing storage space utilization and slicing efficiency, and laying an intelligent and efficient slicing foundation for subsequent fine-grained file sharing and access control.

[0053] Step 102: Cluster the multiple file slices to obtain multiple slice clusters, and construct an access control tree based on the multiple slice clusters.

[0054] Here, after the executing entity slices the original file to obtain multiple file slices, it can cluster the multiple file slices to obtain multiple slice clusters, and construct an access control tree based on the multiple slice clusters. The nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree.

[0055] In one possible embodiment, such as Figure 3 As shown, clustering multiple file slices to obtain multiple slice clusters includes the following steps: Step 1021: Calculate the logical correlation between any two file slices using the third formula.

[0056] Here, after the executing entity slices the original file to obtain multiple file slices, it can calculate the logical correlation between any two file slices using a third formula, where the third formula is: , For the degree of logical relevance, Let the semantic coherence of any two file slices be denoted as . Let be the size of the intersection of any two file slices. Let be the size of the union of any two file slices. This is a hyperparameter.

[0057] In one possible embodiment, the execution entity defines a coherence matrix A between file slices, wherein the elements in coherence matrix A are... S represents a file slice. i and S j The degree of logical relevance, elements It can be calculated using the third formula, the specific formula is as follows:

[0058] in, The semantic coherence of any two file slices calculated using the CAFA-Slicing algorithm is given by... Let be the size of the intersection of any two file slices. Let be the size of the union of any two file slices. This is a hyperparameter.

[0059] Step 1022: Construct a coherence matrix based on the degree of logical correlation, and process the coherence matrix using a spectral clustering algorithm to obtain multiple slice clusters.

[0060] Here, after calculating the logical correlation between any two file slices using the third formula, the executing entity can construct a coherence matrix based on the logical correlation and process the coherence matrix using a spectral clustering algorithm to obtain multiple slice clusters.

[0061] In one possible implementation, continuing from the previous example, the executing entity considers the logical correlation between any two file slices. Construct the coherence matrix A, As elements in the coherence matrix A, and the executing entity processes the coherence matrix A using a spectral clustering algorithm, dividing the file slices into l slice clusters. For example, the l slice clusters can be... .

[0062] In this embodiment, firstly, the execution entity calculates the logical correlation between any two file slices using the third formula; then, the execution entity constructs a coherence matrix based on the logical correlation and processes the coherence matrix using a spectral clustering algorithm to obtain multiple slice clusters.

[0063] As described above, in this embodiment, the logical correlation between any two file slices is calculated using the third formula. This comprehensively considers the semantic coherence of the slices and the ratio of their intersection and union, accurately depicting the inherent logical connections between slices. Furthermore, the coherence matrix constructed based on this logical correlation can effectively quantify the strength of the connections between slices. Then, by processing the coherence matrix using a spectral clustering algorithm, slices with high logical correlation can be clustered into one class, forming multiple slice clusters with clear logical meaning. This provides a basic structure that conforms to the logical relationship of the file content for the subsequent generation of the access control tree, helping to improve the rationality and targeting of the access control tree, thereby supporting the efficient implementation of fine-grained access control.

[0064] In one possible embodiment, multiple file slices are clustered to obtain multiple slice clusters. The execution entity then constructs an access control tree based on the multiple slice clusters. The nodes in the access control tree are used to indicate each slice cluster and the file slices contained in that slice cluster, as well as the permission information of the second user for each node in the access control tree.

[0065] In one possible embodiment, such as Figure 4 As shown, constructing an access control tree based on multiple slice clusters includes the following steps: Step 201: Determine the access sequence of the second user to the file slice.

[0066] Here, the executing entity clusters multiple file slices. After obtaining multiple slice clusters, it can determine the access sequence of the second user to the file slices. The access sequence is used to characterize the access information of the second user to the file slices within a historical time period. For example, the executing entity will assign the second user u i The access sequence of a file slice is represented as follows .

[0067] Step 202: Determine the second user's access habits for file slices based on the access sequence.

[0068] Here, after determining the second user's access sequence to the file slice, the executing entity can determine the second user's access habits to the file slice based on the access sequence.

[0069] In one possible implementation, following the previous example, the executing entity will use the second user. The access sequence of a file slice is represented as follows Furthermore, it utilizes existing algorithms, such as the Skip-gram algorithm, to slice files. Output the second user u as the unit. i Distributed representation of file slice access habits e i The calculation formula is:

[0070] Where d is the dimension of the distributed representation, the Skip-gram algorithm maximizes the probability of co-occurrence slices, and the second user u i The access patterns are encoded into a low-dimensional space to generate a distributed representation of the second user's access habits to file slices. i .

[0071] Step 203: Based on access habits, determine the second user's access permissions to each node in the access control tree.

[0072] Here, after the executing entity determines the second user's access habits to file slices based on the access sequence, it can determine the second user's access permissions to each node in the access control tree based on the access habits.

[0073] In one possible embodiment, the execution entity clusters based on slices. Generate the initial multi-level access control tree. ,like Figure 5 As shown, Figure 5 An exemplary schematic diagram of an initial multi-level access control tree structure is shown, with each tree node in the diagram... This represents a slice cluster; the leaf nodes of a tree node contain the file slices of that slice cluster. The execution body defines the access control tree. The distance between the two nodes x and y is

[0074]

[0075] in, This indicates that nodes x and y are in the access control tree. The shortest path length on v i and v j These represent file slices S respectively. i and S j eigenvectors, and The number of file slices contained in the node. This is a hyperparameter.

[0076] The executing entity for each second user In the access control tree Find the node that best matches its access pattern. The specific formula is as follows:

[0077] in, Indicates the second user u i In the initial multi-level access control tree The optimal matching node is the node whose access pattern is most similar to that of the second user and is the closest to it. S represents a file slice. j In the current tree node path, e i For the second user u i Distributed representation of access patterns, c x This represents the center vector of the access pattern of node x. Represents the dot product of two vectors, used to measure e. i and c x The degree of similarity, and Representing vector e respectively i and c x The L2 norm is used for normalization. This indicates taking a negative exponent, used to convert similarity into a single value. Regarding the values ​​within the range, it should be noted that during the node matching process, the executing entity not only considers the distance between the node and the slice path, but also introduces the cosine similarity between the access pattern and the node pattern center to more comprehensively evaluate the matching degree between the second user and the node.

[0078] The executing entity will transfer the second user u i The permission information is attached to the optimal node. The tree structure is then adjusted accordingly to obtain a dynamically updated access control tree. ,like Figure 6 As shown, Figure 6 An exemplary access control tree structure diagram is shown, in which the permission information (R) of the second user u1 is appended to its matching optimal node Q1-2, indicating that u1 has read permission for the file slice; the permission information (RW) of the second user u2 is appended to its matching optimal node Q2-1, indicating that u2 has read and write permission for the file slice; and the permission information (W) of the second user u3 is appended to its matching optimal node Q3-2, indicating that u1 has read and write permission for the file slice. Write permissions are granted to the file slice. Other slice subset nodes that did not match the second user, such as nodes Q1-1, Q2-2, Q3-1, and Q3-3, remain unchanged, and their access permissions are inherited from the parent nodes, i.e., each tree node. The slice clustering is represented.

[0079] In this implementation, firstly, the executing entity determines the second user's access sequence to the file slice; then, the executing entity determines the second user's access habits to the file slice based on the access sequence; finally, the executing entity determines the second user's access permissions to each node in the access control tree based on the access habits.

[0080] As described above, in this implementation, by determining the second user's access sequence to file slices, the actual access behavior trajectory of the second user can be accurately captured. Based on the access sequence, the access habits of the second user to file slices can be effectively extracted, and the regular behavioral characteristics of the second user during the access process can be determined. Then, based on these access habits, the access permissions of the second user to each node in the access control tree can be determined, making the permission settings more in line with the actual usage needs of the second user, improving the pertinence and dynamic adaptability of access control tree permission management, strongly supporting the accurate implementation of fine-grained access control, and enhancing the flexibility and rationality of authorization management.

[0081] Step 103: In response to the second user's access request to the target node in the access control tree, verify the access permission, and if the access permission verification is successful, return the file slice corresponding to the target node to the second user.

[0082] Here, after the execution entity processes the coherence matrix using the spectral clustering algorithm to obtain multiple slice clusters, it can respond to the second user's access request to the target node in the access control tree, verify the access permission, and, if the access permission verification is successful, decrypt the file slice corresponding to the target node to obtain the plaintext slice, and return the plaintext slice to the second user.

[0083] In one possible implementation, such as Figure 7 As shown, in response to a second user's access request to a target node in the access control tree, the access permission is verified, and if the access permission verification is successful, the file slice corresponding to the target node is returned to the second user, including the following steps: Step 1031: In response to the second user's access request to the target node in the access control tree, verify the identity of the second user. If the second user's identity verification is successful, determine the target access path for the access control tree based on the access request.

[0084] Here, in response to a second user's access request to a target node in the access control tree, the executing entity verifies the identity of the second user, and if the second user's authentication is successful, it can determine the target access path for the access control tree based on the access request.

[0085] In one possible implementation, the second user's access request to the target node in the access control tree carries the second user's access token. After responding to the second user's access request to the target node in the access control tree, the executing entity verifies the validity and integrity of the access token. After the validity and integrity of the access token are verified, the executing entity determines the second user's target access path for the access control tree based on the access request.

[0086] Step 1032: Verify the second user's access permissions on the target access path based on the second user's permission information, and if the access permission verification is successful, return the file slice corresponding to the target node to the second user.

[0087] Here, the executing entity verifies the second user's access permissions on the target access path based on the second user's permission information, and returns the file slice corresponding to the target node to the second user if the access permission verification is successful.

[0088] In one possible embodiment, for example, the second user's target access path is Q2 to Q2-1, and the executing entity traverses the access control tree according to the target access path Q2 to Q2-1, such as... Figure 6 As shown, in the access control tree, the permission information (RW) of the second user u2 is attached to node Q2-1, indicating that the second user u2 has read and write permissions to the file slice. If the access permission verification is successful, the executing entity returns the file slice corresponding to the target node Q2-1 to the second user.

[0089] In one embodiment, in response to a second user's access request to a target node in the access control tree, access permissions are verified, and if the access permissions are verified successfully, the following steps are further included: The file slice is decrypted to obtain the plaintext slice, and the plaintext slice is returned to the second user.

[0090] Here, in response to the second user's access request to the target node in the access control tree, the executing entity verifies the access permissions. If the access permissions are verified, the entity can decrypt the file slice to obtain the plaintext slice and return the plaintext slice to the second user.

[0091] As described above, in this embodiment, if the access permission verification is successful, the executing entity decrypts the file slice to obtain the plaintext slice and returns the plaintext slice to the second user. The decryption process further enhances the security of the cloud disk file access control method.

[0092] In one embodiment, after verifying access permissions in response to a second user's access request to a target node in the access control tree, the method further includes the following steps: If access permission verification fails, the access request is denied.

[0093] Here, the executing entity responds to the second user's access request to the target node in the access control tree, verifies the access permissions, and then denies the access request if the access permission verification fails.

[0094] In this embodiment, firstly, in response to the second user's access request to the target node in the access control tree, the executing entity verifies the identity of the second user. If the identity verification of the second user is successful, the executing entity determines the target access path for the access control tree based on the access request. Then, the executing entity verifies the second user's access permissions on the target access path based on the second user's permission information. If the access permission verification is successful, the executing entity decrypts the file slice corresponding to the target node, obtains the plaintext slice, and returns it to the second user. If the access permission verification fails, the access request is rejected.

[0095] As described above, in this embodiment, when the executing entity responds to the second user's access request to a target node in the access control tree, it first verifies the second user's identity, effectively ensuring the legitimacy of the accessing entity and reducing the risk of unauthorized access from the source. After successful identity verification, it determines the target access path for the access control tree based on the access request, clarifying the access scope and level, and providing accurate basis for subsequent permission verification. Then, it verifies the second user's access permissions on the target access path based on the second user's permission information, realizing hierarchical and fine-grained permission control of the access control tree and ensuring the accuracy of permission verification. Finally, after the access permission verification is successful, the file slice corresponding to the target node is decrypted and returned to the second user. This not only ensures the legitimate user's normal access to authorized content, but also strengthens the security and controllability of data access through a multi-layered verification mechanism, strongly supporting the reliable implementation of fine-grained access control.

[0096] This disclosure provides a method, apparatus, device, medium, and product for access control of cloud disk files. First, the original file uploaded by a first user is obtained and processed to obtain multiple file slices; each file slice contains data with semantic coherence requirements. Then, the multiple file slices are clustered to obtain multiple slice clusters, and an access control tree is constructed based on these clusters. Nodes in the access control tree indicate each slice cluster and the file slices contained within that cluster, as well as the second user's permission information for each node in the access control tree. Finally, in response to the second user's access request to a target node in the access control tree, access permissions are verified, and if the access permission verification is successful, the file slice corresponding to the target node is returned to the second user.

[0097] As described above, this disclosed technical solution obtains multiple file slices by slicing the original file uploaded by the first user. Each file slice contains data with semantic coherence that meets the requirements, breaking away from the coarse-grained sharing model of the existing technology that uses the entire file as a unit. This achieves fine-grained splitting and secure storage of file content. Furthermore, this disclosed technical solution clusters file slices and constructs an access control tree. The nodes in the tree explicitly indicate the second user's permission information for each node, extending permission management to the slice clustering and specific file slice levels. This satisfies the second user's differentiated access needs for different parts of the original file, enhancing the fine-grainedness and flexibility of permission control. When responding to the second user's access request for a target node, this disclosed technical solution verifies access permissions and, after the access permission is granted, returns the file slice corresponding to the target node to the second user. This ensures the security and controllability of the access process while meeting the user's need for fine-grained access to file content. This disclosed technical solution improves the security and flexibility of cloud drive file sharing while also enhancing the user experience.

[0098] In one embodiment, after returning the file slice corresponding to the target node to the second user, the following steps are also included: Access records are generated based on access requests and stored on the blockchain.

[0099] Here, after the executing entity returns the file slice corresponding to the target node to the second user, it can generate an access record based on the access request and save the access record in the blockchain, thus realizing detailed access auditing.

[0100] As described above, in this embodiment, the executing entity generates an access record based on the access request and stores the access record in the blockchain. By leveraging the immutable nature of the blockchain, the authenticity, integrity, and security of the access record can be ensured. This effectively achieves full recording and reliable evidence storage of the file access process, making up for the problem of incomplete audit trails in the prior art. It provides a credible basis for post-audit, further enhances the security and traceability of data access, and strongly supports the audit management needs in refined access control.

[0101] In one embodiment, such as Figure 8 As shown, after constructing the access control tree based on multiple slice clusters, the following steps are also included: Step 801: Update the access control tree based on the changes in file slices and access sequences to obtain the updated access control tree.

[0102] Here, after constructing the access control tree based on multiple slice clusters, the execution entity can update the access control tree based on the change information of the file slices and the change information of the access sequence to obtain the updated access control tree. The access sequence is used to represent the access information of the second user to the file slices in the historical time period.

[0103] In one possible implementation, the executing entity constructs an access control tree. Subsequently, because the first user might upload new original files or the second user might modify the control tree... If the access sequence of a file slice changes, the execution entity can update the access control tree based on the changes in the file slice and the access sequence, that is, update the nodes in the access control tree to obtain the updated access control tree.

[0104] Step 802: Determine any node in the updated access control tree as the first node.

[0105] Here, after obtaining the updated access control tree, the executing entity can determine any node in the updated access control tree as the first node.

[0106] In one possible implementation, the executing entity defines a regularization term. Used to characterize the updated access control tree The complexity is given by the following formula:

[0107] in, Indicates the updated access control tree The number of nodes, This represents the i-th node in the tree. and To balance the hyperparameters of tree size and node distance, Represents a node and The distance on the access control tree, when a new slice is generated or the user access pattern changes significantly, triggers a dynamic optimization process for the access control tree, executing the main body-defined optimization objective function, the formula of which is:

[0108] in, Describes the second user set. Indicates the second user Matching node in the current access control tree To balance the trade-off between matching loss and tree complexity, This represents the complexity of the access control tree. This represents the updated access control tree. The executing entity randomly selects a node x in the updated access control tree and determines node x as the first node.

[0109] Step 803: Determine the second node that minimizes the objective function among the neighboring nodes of the first node, and determine the location of the second node as the target location.

[0110] Here, after the executing entity determines any node in the updated access control tree as the first node, it can determine the second node that minimizes the objective function among the neighboring nodes of the first node, and determine the position of the second node as the target position. The objective function is used to characterize the optimization balance index between the matching efficiency of access permissions and the structural complexity of the updated access control tree.

[0111] In one possible implementation, continuing from the previous example, the executing entity traverses the neighboring nodes of the first node x. Determine the second node that minimizes the objective function. The objective function is:

[0112] in, This indicates that after the first node x moves to position y, the second user u... i The new matching node, This represents the complexity of the new tree after the first node x is moved to position y. To balance the matching loss with the tree complexity.

[0113] Step 804: Move the first node to the target position.

[0114] In one possible implementation, continuing from the previous example, if the implementing entity finds a better second node... Then the first node Move to the second node And adjust the structure of the updated access control tree accordingly.

[0115] Step 805: Repeat the above steps until the structure of the updated access control tree converges or the maximum preset number of iterations is reached, and the target access control tree is obtained.

[0116] Here, the execution entity repeats steps 802-804 until the structure of the updated access control tree converges or the maximum preset number of iterations is reached, thus obtaining the target access control tree.

[0117] In one possible embodiment, the executing entity continuously selects a node as the first node from the updated access control tree during each iteration. It then searches for the second node that minimizes the objective function by traversing its neighboring nodes and moves the first node to the target position. This dynamically adjusts the tree's hierarchical structure and node distribution. During this process, the optimization effect of the tree structure is continuously evaluated based on the objective function. The balance between access permission matching loss and tree complexity after node movement is monitored in real time. When the change in the objective function value is less than a preset threshold after multiple iterations (i.e., the tree structure converges) or the number of iterations reaches a preset maximum limit, the iteration process is stopped. The final target access control tree can effectively reduce structural complexity while ensuring access permission matching efficiency, making it more consistent with the changing trends of file slices and the changes in the access patterns of the second user.

[0118] In this embodiment, firstly, the execution entity updates the access control tree based on the changes in file slices and access sequences to obtain an updated access control tree. Then, the execution entity determines any node in the updated access control tree as the first node. After that, the execution entity determines the second node that minimizes the objective function among the neighboring nodes of the first node and determines the position of the second node as the target position. Then, the execution entity moves the first node to the target position. Finally, the execution entity repeats the above steps until the structure of the updated access control tree converges or the maximum preset number of iterations is reached to obtain the target access control tree.

[0119] As described above, in this embodiment, the execution entity first updates the access control tree based on the changes in file slices and access sequences to obtain an updated access control tree. This enables the access control tree to respond promptly to dynamic changes in slice content and user access patterns, ensuring the timeliness of the tree structure. Any node in the updated access control tree is designated as the first node, and a second node that minimizes the objective function is found among its neighboring nodes as the target position. By precisely adjusting the node positions, an optimal balance between access permission matching efficiency and tree structure complexity is achieved. The first node is then moved to the target position, and the above steps are repeated until the updated access control tree structure converges or reaches the maximum preset number of iterations to obtain the target access control tree. This process continuously optimizes the tree's hierarchical distribution and node associations, effectively improving the access control tree's adaptability to dynamic scenarios and the accuracy of permission decisions, providing more reliable structural support for fine-grained access control.

[0120] As described above, the technical solution disclosed herein utilizes a content-aware adaptive file slicing algorithm (CAFA-Slicing) to adaptively adjust the slice size and boundaries based on file content characteristics, thereby improving the logical independence, semantic integrity, and storage utilization of slices and enhancing the versatility and flexibility in processing different types of files. Furthermore, this technical solution employs a dynamic multi-level access control tree generation algorithm (DMAC-TreeGen) to generate an access control tree. This access control tree supports fine-grained access control for files, enabling refined authorization management based on multiple dimensions such as users, clusters, and slices. It also improves the efficiency of permission decision-making through an efficient tree search algorithm, making it particularly suitable for large-scale user and resource scenarios. This technical solution combines blockchain technology to store access policies, authorization records, and access events on the blockchain, ensuring data immutability, improving audit trail mechanisms, and significantly enhancing data security and privacy protection capabilities. Simultaneously, the adaptive slicing capability of this technical solution reduces redundant transmission and optimizes storage and transmission performance, making it widely applicable in cloud storage, data sharing, collaborative office scenarios, and other scenarios, meeting the data security needs of various industries, and possessing significant commercial value and application prospects.

[0121] By dividing each function into corresponding functional modules, this disclosure provides an access control device for cloud disk files. This access control device can be a server or a chip applied to a server. Figure 9 This is a schematic block diagram of the functional modules of a cloud disk file access control device provided as an exemplary embodiment of this disclosure. Figure 9 As shown, the access control device for the cloud disk files includes: The first acquisition module 901 is used to acquire the original file uploaded by the first user and process the original file to obtain multiple file slices; the data contained in each file slice is data whose semantic coherence meets the requirements. The construction module 902 is used to cluster the multiple file slices to obtain multiple slice clusters, and to construct an access control tree based on the multiple slice clusters; wherein, the nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree; The verification module 903 is used to verify access permissions in response to the second user's access request to the target node in the access control tree, and return the file slice corresponding to the target node to the second user if the access permissions are verified.

[0122] In one embodiment, the first acquisition module 901 includes: A segmentation unit is used to segment the original file into multiple data blocks and extract the feature vector of each data block; A grouping unit is used to group the multiple data blocks based on the feature vector to obtain multiple target slice sets; An encryption unit is used to encrypt all the target slice sets to obtain the plurality of file slices; wherein, encrypting one target slice set yields one file slice.

[0123] In one embodiment, the first acquisition module 901 includes: The first computing unit is used to calculate a first semantic coherence degree between any two data blocks based on the feature vector; wherein, the first semantic coherence degree is used to characterize the degree of semantic association between the two data blocks; The second calculation unit is used to group the multiple data blocks according to the splitting order of the multiple data blocks to obtain multiple initial slice sets, and to calculate the second semantic coherence of the initial slice set based on the first semantic coherence between any two data blocks in each initial slice set. The third calculation unit is used to calculate the third semantic coherence between any two adjacent initial slice sets based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. The first determining unit is used to determine the initial slice set corresponding to the second semantic coherence being the largest and the third semantic coherence being the smallest as the target slice set.

[0124] In one embodiment, the construction module 902 includes: The fourth calculation unit is used to calculate the logical correlation between any two file slices using the third formula; wherein, the third formula is... The The degree of logical relevance, Let the semantic coherence of any two file slices be denoted as . The size of the intersection of any two file slices. Let the size of the union of any two file slices be denoted as . For hyperparameters; The construction unit is used to construct a coherence matrix based on the logical correlation degree, and process the coherence matrix using a spectral clustering algorithm to obtain the multiple slice clusters.

[0125] In one embodiment, the construction module 902 includes: The second determining unit is configured to determine the access sequence of the second user to the file slice; wherein the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; The third determining unit is used to determine the access habits of the second user to the file slice based on the access sequence; The fourth determining unit is used to determine the access permissions of the second user to each node in the access control tree based on the access habits.

[0126] In one embodiment, the verification module 903 includes: The response unit is configured to respond to the second user's access request to a target node in the access control tree, verify the identity of the second user, and determine the target access path for the access control tree based on the access request if the second user's identity verification is successful. The return unit is used to verify the second user's access permissions on the target access path based on the second user's permission information, and if the access permission verification is successful, return the file slice corresponding to the target node to the second user.

[0127] In one embodiment, the apparatus further includes: The generation module is used to generate an access record based on the access request and store the access record in the blockchain.

[0128] In one embodiment, the apparatus further includes: The verification module is used to reject the access request if the access permission verification fails.

[0129] In one embodiment, the apparatus further includes: An update module is used to update the access control tree based on the change information of the file slice and the change information of the access sequence to obtain an updated access control tree; wherein, the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; The first determining module is used to determine any node in the updated access control tree as the first node; The second determining module is used to determine a second node that minimizes the objective function among the neighboring nodes of the first node, and to determine the position of the second node as the target position; wherein, the objective function is used to characterize the optimization balance index between the matching efficiency of access permissions and the structural complexity of the updated access control tree; A moving module is used to move the first node to the target location; The second acquisition module is used to repeat the above steps until the structure of the updated access control tree converges or the maximum preset number of iterations is reached, so as to obtain the target access control tree.

[0130] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0131] In one embodiment, the apparatus further includes: The decryption module is used to decrypt the file slice to obtain a plaintext slice, and return the plaintext slice to the second user.

[0132] Figure 10 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 10 As shown, the electronic device 1000 includes at least one processor 1001 and a memory 1002 coupled to the processor 1001. The processor 1001 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0133] The processor 1001 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 1001 or by software instructions. The processor 1001 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 1002, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 1001 reads information from the memory 1002 and, in conjunction with its hardware, completes the steps of the method described above.

[0134] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 11 The computer system 1100 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including functions such as those described above. Figure 11 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0135] Computer system 1100 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0136] like Figure 11As shown, the computer system 1100 includes a computing unit 1101, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 1102 or a computer program loaded into random access memory (RAM) 1103 from a storage unit 1108. The RAM 1103 may also store various programs and data required for the operation of the computer system 1100. The computing unit 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0137] Multiple components in computer system 1100 are connected to I / O interface 1105, including: input unit 1106, output unit 1107, storage unit 1108, and communication unit 1109. Input unit 1106 can be any type of device capable of inputting information into computer system 1100. Input unit 1106 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 1107 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 1108 may include, but is not limited to, hard disks and optical disks. Communication unit 1109 allows computer system 1100 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0138] The computing unit 1101 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1101 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 1000 via ROM 1102 and / or communication unit 1109. In some embodiments, the computing unit 1101 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0139] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0140] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0141] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0142] Figure 12 A computer program product 1200 is provided as an exemplary embodiment of the present disclosure. The computer program product 1200 includes a computer program 1201, wherein the computer program 1201, when executed by a processor, implements the methods disclosed in the embodiments of the present disclosure.

[0143] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0145] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0146] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0147] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0148] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A method for access control of files on a cloud drive, characterized in that, The method includes: The original file uploaded by the first user is obtained and processed to obtain multiple file slices; the data contained in each file slice is data whose semantic coherence meets the requirements. The multiple file slices are clustered to obtain multiple slice clusters, and an access control tree is constructed based on the multiple slice clusters; wherein, the nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree; In response to the second user's access request to the target node in the access control tree, the access permission is verified, and if the access permission verification is successful, the file slice corresponding to the target node is returned to the second user.

2. The method according to claim 1, characterized in that, The process of processing the original file to obtain multiple file slices includes: The original file is divided into multiple data blocks, and the feature vector of each data block is extracted; Based on the feature vector, the multiple data blocks are grouped to obtain multiple target slice sets; Encrypting all the target slice sets yields the plurality of file slices; wherein, encrypting one target slice set yields one file slice.

3. The method according to claim 2, characterized in that, The process of grouping the multiple data blocks based on the feature vector to obtain multiple target slice sets includes: The first semantic coherence degree between any two data blocks is calculated based on the feature vector; wherein, the first semantic coherence degree is used to characterize the degree of semantic association between the two data blocks; The multiple data blocks are grouped according to the splitting order to obtain multiple initial slice sets, and the second semantic coherence of the initial slice set is calculated based on the first semantic coherence between any two data blocks in each initial slice set. The third semantic coherence between any two adjacent initial slice sets is calculated based on the first semantic coherence between any two data blocks in any two adjacent initial slice sets. The initial slice set corresponding to the one with the largest second semantic coherence and the smallest third semantic coherence is determined as the target slice set.

4. The method according to claim 1, characterized in that, The clustering of the multiple file slices to obtain multiple slice clusters includes: The logical correlation between any two file slices is calculated using a third formula; wherein, the third formula is: The The degree of logical relevance, Let the semantic coherence of any two file slices be denoted as . The size of the intersection of any two file slices. Let the size of the union of any two file slices be denoted as . For hyperparameters; A coherence matrix is ​​constructed based on the logical correlation, and the coherence matrix is ​​processed by a spectral clustering algorithm to obtain the multiple slice clusters.

5. The method according to claim 1, characterized in that, The method further includes determining the permission information for each second user in the following manner: Determine the access sequence of the second user to the file slice; wherein the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; The access habits of the second user to the file slice are determined based on the access sequence; Based on the access habits, the access permissions of the second user to each node in the access control tree are determined.

6. The method according to claim 1, characterized in that, The step of responding to the second user's access request to a target node in the access control tree, verifying access permissions, and returning the file slice corresponding to the target node to the second user if the access permissions are verified, includes: In response to the second user's access request to a target node in the access control tree, the identity of the second user is verified. If the second user's identity verification is successful, a target access path for the access control tree is determined based on the access request. Based on the second user's permission information, verify the second user's access permissions on the target access path, and if the access permission verification is successful, return the file slice corresponding to the target node to the second user.

7. The method according to claim 1, characterized in that, After returning the file slice corresponding to the target node to the second user, the method further includes: An access record is generated based on the access request, and the access record is stored in the blockchain.

8. The method according to claim 1, characterized in that, After verifying the access permission in response to the second user's access request to the target node in the access control tree, the method further includes: If the access permission verification fails, the access request is rejected.

9. The method according to claim 1, characterized in that, After constructing the access control tree based on the multiple slice clusters, the method further includes: The access control tree is updated based on the change information of the file slice and the change information of the access sequence to obtain the updated access control tree; wherein, the access sequence is used to characterize the access information of the second user to the file slice within a historical time period; Select any node in the updated access control tree as the first node; In the neighborhood nodes of the first node, a second node that minimizes the objective function is determined, and the position of the second node is determined as the target position; wherein, the objective function is used to characterize the optimization balance index between the access control tree and the access permission matching efficiency and structural complexity. Move the first node to the target location; Repeat the above steps until the structure of the updated access control tree converges or the maximum preset number of iterations is reached to obtain the target access control tree.

10. The method according to claim 2, characterized in that, In response to the second user's access request to a target node in the access control tree, the method verifies access permissions, and if the access permissions are verified, the method further includes: The file slice is decrypted to obtain a plaintext slice, and the plaintext slice is returned to the second user.

11. A cloud disk file access control device, characterized in that, The device includes: The first acquisition module is used to acquire the original file uploaded by the first user and process the original file to obtain multiple file slices; the data contained in each file slice is data whose semantic coherence meets the requirements; A construction module is used to cluster the multiple file slices to obtain multiple slice clusters, and to construct an access control tree based on the multiple slice clusters; wherein, the nodes in the access control tree are used to indicate each slice cluster and the file slices contained in the slice cluster, as well as the permission information of the second user for each node in the access control tree; The verification module is used to respond to the second user's access request to the target node in the access control tree, verify the access permission, and return the file slice corresponding to the target node to the second user if the access permission verification is successful.

12. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1-10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-10.

Images