Identity authentication method and device of network disk system

Abstract

The invention relates to the technical field of information security, and particularly provides an identity authentication method and device for a network disk system. The method comprises the following steps: sending label information and verification offset of all network disk files of a target user in a network disk system to a client; receiving verification data of a target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the label information, and the verification data is generated based on the authentication information and a verification offset corresponding to the label information of the target local file; determining a target network disk file from all network disk files by using the verification data of the target local file; and performing identity authentication on the target user based on all the network disk files and the target network disk file by using a pre-constructed identity authentication calculation model. According to the invention, identity authentication can be carried out without depending on emails, short messages, biological recognition technologies and other external means, so that the confidentiality and security of identity authentication are guaranteed.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and in particular to an identity authentication method and apparatus for a cloud storage system. Background Technology

[0002] As a crucial component of modern internet services, the login system is primarily responsible for managing the user login process, ensuring that users can securely and conveniently access system resources. Identity authentication is the core function of the login system, designed to verify the user's identity and ensure that only legitimate users can access the system.

[0003] In related technologies, the authentication methods of cloud storage systems can typically include account passwords, email verification codes, SMS verification codes, biometric technology, etc. If a user forgets their account password when logging into the cloud storage system, they need to rely on other external means such as email, SMS, biometric technology to authenticate their identity. Summary of the Invention

[0004] This disclosure is made in view of the above-mentioned problems. This disclosure provides an identity authentication method and apparatus for a cloud storage system.

[0005] According to one aspect of this disclosure, an authentication method for a cloud storage system is provided, comprising: Send the tag information and verification offset of all files in the target user's cloud storage system to the client; The system receives verification data of a target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and a verification offset corresponding to the tag information of the target local file; Using the verification data of the target local file, the target cloud drive file is determined from all the cloud drive files; Using a pre-built identity authentication calculation model, the target user is authenticated based on all the cloud storage files and the target cloud storage file.

[0006] According to another aspect of this disclosure, an identity authentication device for a cloud storage system is provided, comprising: The communication module is used to send the tag information and verification offset of all files of the target user in the cloud storage system to the client; The communication module is also used to receive verification data of the target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and a verification offset corresponding to the tag information of the target local file; The processing module is used to determine the target cloud drive file from all the cloud drive files using the verification data of the target local file; The processing module is also used to perform identity authentication on the target user based on all the cloud drive files and the target cloud drive file using a pre-built identity authentication calculation model.

[0007] In another aspect of exemplary embodiments of this disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the methods described in exemplary embodiments of this disclosure.

[0008] In another aspect of exemplary embodiments of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described in exemplary embodiments of the present disclosure.

[0009] In another aspect of the exemplary embodiments of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the methods described in the exemplary embodiments of this disclosure.

[0010] As will be described in detail below, the authentication method and apparatus for a cloud storage system according to embodiments of this disclosure include: sending tag information and verification offsets of all cloud storage files of a target user to a client; receiving verification data of a target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and the verification offset corresponding to the tag information of the target local file; using the verification data of the target local file, the target cloud storage file is determined from all cloud storage files; and using a pre-built authentication calculation model, the target user is authenticated based on all cloud storage files and the target cloud storage file. This method enables authentication of the target user by comparing local files in their local storage with cloud storage files in the cloud storage system when logging into the cloud storage system, and by using the pre-built authentication calculation model, without relying on other external means such as email, SMS, or biometrics, thus ensuring the confidentiality and security of the cloud storage system's authentication.

[0011] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0012] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 A flowchart illustrating the identity authentication method of the cloud storage system provided in an exemplary embodiment of this disclosure is shown. Figure 2 This illustration shows a schematic diagram of the data structure of the verification data of the target local file provided in an exemplary embodiment of this disclosure; Figure 3 A graph of the normal distribution model of user types provided in the exemplary embodiments of this disclosure is shown; Figure 4 A graph of the normal distribution model of authentication reliability provided in the exemplary embodiments of this disclosure is shown; Figure 5 This illustration shows a schematic diagram of the structure of the identity authentication device for a cloud storage system provided in an exemplary embodiment of the present disclosure; Figure 6 A schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this disclosure is shown; Figure 7 A schematic diagram of the structure of a computer system provided in an exemplary embodiment of this disclosure is shown. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0015] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0016] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0017] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0018] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0019] Cloud storage systems boast a massive user base due to their cloud storage services, and their product strategies span multiple platforms, permeating all aspects of users' lives. To adapt to the challenges posed by different scenarios, enhance account security, and provide an exceptional user experience, a new identity authentication method for cloud storage systems has become crucial.

[0020] Related technologies, such as account passwords, email verification codes, and SMS verification codes, have many shortcomings in the identity authentication methods of cloud storage systems: account passwords are simple and direct, but there is a risk of forgetting or having the password stolen; email and SMS verification codes are relatively secure, but they rely on the availability of the user's email address and mobile phone number. Once the user cannot log in to the email or receive SMS messages, these authentication methods will also fail; biometric technology relies on specific hardware devices or may be affected by environmental factors in some cases.

[0021] Taking cloud storage systems as an example, when users forget their passwords, have unpaid phone numbers, or cancel their accounts, they cannot access important files and data through any existing login method.

[0022] Related technologies have also improved the diversity and security of identity authentication methods. For example, some systems have introduced biometric technologies, such as fingerprint recognition and facial recognition, to improve the convenience and security of authentication. However, this identity authentication method requires the use of advanced biometric technologies, which poses security risks.

[0023] In commercial scenarios, enterprise cloud storage systems deployed within closed intranets cannot interact with email systems, SMS verification code systems, or install sensor devices due to security and confidentiality requirements. In such cases, authentication using only account passwords is insufficient, necessitating a security verification method that can be used even within a closed system.

[0024] Therefore, to address the aforementioned issues, this disclosure provides an authentication method for a cloud storage system. This method identifies all files uploaded locally by the target user within the cloud storage system. The authentication method is based on cloud storage files and is inextricably linked to the cloud storage system. It can be integrated with the security scenarios of China Mobile's cloud storage service, enhancing both security and user experience.

[0025] The identity authentication method of the cloud storage system provided in this embodiment can be executed by the server or by a chip applied to the server.

[0026] For example, the server described above can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. This exemplary embodiment does not limit the scope of the disclosure.

[0027] Figure 1 A flowchart illustrating the identity authentication method of the cloud storage system provided in an exemplary embodiment of this disclosure is shown. Figure 1 As shown, the authentication methods of this cloud storage system include: S101, send the tag information and verification offset of all cloud storage files of the target user in the cloud storage system to the client; S102, receive the verification data of the target user's local file sent by the client; wherein, the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on the authentication information and the verification offset corresponding to the tag information of the target local file; S103, using the verification data of the target local file, determine the target cloud drive file from all cloud drive files; S104 uses a pre-built identity authentication calculation model to authenticate the target user based on all cloud storage files and the target cloud storage file.

[0028] Specifically, in cloud storage systems, the core user behavior is uploading and downloading files, meaning a file can exist simultaneously on both the server and local storage. In other words, the same file can be stored both on the server's cloud storage system and locally on the user's device. These files might be user-written documents, photos, or data generated by the system. These user-specific files combine to form a unique personal record, serving as a way to identify a user. The inherent file storage attribute of cloud storage systems can be maximized to create a method of identity authentication.

[0029] When a target user needs to authenticate their identity on the cloud storage system, the server can first obtain the tag information of all the target user's cloud storage files in the cloud storage system and randomly generate the verification offset of these cloud storage files; then, it sends the tag information and verification offset of all the target user's cloud storage files to the client.

[0030] Here, the tag information is used to distinguish different cloud storage files; cloud storage files with the same tag information are the same. The verification offset is a random number generated by the server for each cloud storage file, and its size ranges from 1KB to -2KB.

[0031] It should be noted that before sending the tag information and verification offset of all the target user's cloud storage files to the client, the tag information and verification offset of all the target user's cloud storage files to the client need to be de-identified. Data that may involve privacy, confidentiality or sensitivity needs to be modified, hidden or replaced in order to protect information security and avoid leakage of sensitive content.

[0032] After receiving the tag information and verification offset of all the target user's cloud storage files, the client first obtains all the target user's local files. Then, it filters all local files using the cloud storage file tag information, selecting the local files whose tag information matches that of the cloud storage files as the target local files. Based on the authentication information of the target local files and the verification offset of the cloud storage files corresponding to the target local files' tag information, it generates the verification data for the target user's target local files and sends the verification data for the target user's target local files to the server.

[0033] Here, it can be understood that the target local files are local files that the target user stores simultaneously on both the cloud storage system and their local machine. The number of target local files can be zero, one, or even multiple.

[0034] The server receives verification data for the target user's local file from the client. Using this verification data, it identifies the target file from all cloud storage files. This step can initially determine the possible presence of the target local file in all cloud storage files of the target user using the verification offset. Then, it can further confirm the presence of the target local file in all cloud storage files of the target user using authentication information, thus confirming that the target file exists in all cloud storage files.

[0035] Figure 2 This illustration shows a schematic diagram of the data structure of the verification data of the target local file provided in an exemplary embodiment of this disclosure, such as... Figure 2 As shown, the verification data for the target local file can be generated based on the verification offset 210 and authentication information 220. Authentication information 220 may include 1KB of initial data 221 and 1KB of final data 222. The target local file, matched using tag information, is read in three segments: 1KB of initial data 221, 1KB of final data 222, and 1KB of data starting from the verification offset 210. If the verification data is less than 3KB, the complete verification data is read directly. The client sends the tag information of the target local file and the read verification data to the server. The server compares the tag information and verification data of the target local file with those of the cloud drive file to confirm whether they are the same file and records the successful verification result, thus obtaining the target cloud drive file. This verification step is to prevent duplicate results in the digest algorithm and to prevent attackers from forging matching results.

[0036] After identifying the target cloud storage file from all cloud storage files using the verification data of the target local file, a pre-built identity authentication calculation model is used to authenticate the target user based on all cloud storage files and the target cloud storage file. When logging into the cloud storage system, the target user's local files are compared with the cloud storage files in the cloud storage system, and the pre-built identity authentication calculation model is used for authentication. This method does not rely on other external means such as email, SMS, or biometric technology. It is based on the cloud storage file and is inseparable from the cloud storage system, ensuring the confidentiality and security of the cloud storage system's identity authentication.

[0037] According to the technical solution of the exemplary embodiments of this disclosure, the target local file is determined from all local files of the target user in the cloud storage system by sending tag information and verification offset of all cloud storage files of the target user to the client; the target local file is determined from all local files of the target user based on tag information, and the verification data is generated based on authentication information and the verification offset corresponding to the tag information of the target local file; the target cloud storage file is determined from all cloud storage files using the verification data of the target local file; and the target user is authenticated based on all cloud storage files and the target cloud storage file using a pre-built identity authentication calculation model. This allows for identity authentication of the target user by comparing local files in the target user's local storage with cloud storage files in the cloud storage system when logging into the cloud storage system, and by using the pre-built identity authentication calculation model. This eliminates the need to rely on other external means such as email, SMS, or biometrics, thus ensuring the confidentiality and security of the cloud storage system's identity authentication.

[0038] In some embodiments, the tag information includes a file fingerprint and the file's memory usage; the method may further include: Obtain a pre-built fingerprint calculation model and all cloud storage files of all users in the cloud storage system; Using a fingerprint calculation model, the file fingerprints of all cloud storage files for all users are determined.

[0039] Specifically, the fingerprint calculation model mentioned above can be a digest algorithm (also known as a hash algorithm) such as MD5 or SHA-256, or other calculation models used to determine the file fingerprint of the stored file on the cloud drive. The specific model can be selected according to actual needs, and this disclosure does not impose any specific limitations on it.

[0040] Among them, digest algorithms (also known as hash algorithms) such as MD5 and SHA-256 are important tools in cryptography. They can convert input data of arbitrary length into fixed-length output (i.e., "digest" or "hash value"), and have the characteristics of irreversibility and collision resistance. They are widely used in scenarios such as data integrity verification, password storage, and digital signatures.

[0041] This disclosure embodiment can utilize a fingerprint calculation model to determine the file fingerprints of all files for all users in the cloud storage system. These file fingerprints can be used to distinguish different cloud storage files; cloud storage files with the same file fingerprint and the same file memory usage are considered to be the same cloud storage file.

[0042] Table 1 shows the tag information and verification offset of some cloud storage files of the target user provided in this embodiment of the disclosure. The client scans all local files of the target user according to the tag information of the cloud storage files as shown in Table 1, and finds local files that match the tag information, that is, the file fingerprint and the file memory usage match at the same time.

[0043] Table 1. Tag information and verification offset of some files in the target user's cloud storage.

[0044] In some embodiments, all cloud storage files are categorized into trusted cloud storage files and untrusted cloud storage files based on file type identifiers. Using a pre-built identity authentication calculation model, the target user's identity is authenticated based on all files on the cloud drive and the target cloud drive file, including: Use file type identifiers to identify target trusted cloud storage files and / or target untrusted cloud storage files within the target cloud storage file; Obtain the pre-built identity authentication calculation model, and count the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files respectively; Using an identity authentication calculation model, the target user's identity is authenticated based on the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files.

[0045] Specifically, the core scenario for cloud storage systems is the sharing and dissemination of files. If other users also have the same files on a user's cloud storage, then identity authentication based on these files could be forged, leading to a decrease in security. Therefore, it is necessary to analyze and differentiate the "trustworthiness" of cloud storage files to improve security when using them for identity authentication.

[0046] This disclosure embodiment can classify all cloud storage files of a target user into trusted cloud storage files and untrusted cloud storage files according to file type identification. Table 2 shows the tag information and file type identification of some cloud storage files of the target user provided in this disclosure embodiment.

[0047] Table 2. Tag information and file type identifiers of some cloud storage files for target users.

[0048] As shown in Table 2, this embodiment of the disclosure can match all cloud storage files. If the same cloud storage file exists in different users' cloud storage system accounts, these files are marked as untrusted cloud storage files, and the file type identifier is marked as "untrusted". Cloud storage files are also marked as untrusted cloud storage files if they fall into any of the following categories: they have been shared by users, saved through sharing by other users, or saved through external methods such as offline download.

[0049] Files on cloud storage that are not marked as untrusted files, i.e., files uploaded by users from their local devices and not copied by others, can be considered trustworthy files and are marked as "trustworthy" in the file type identifier.

[0050] At this point, the present embodiment can count the number of trusted cloud storage files, untrusted cloud storage files, and all cloud storage files of the target user.

[0051] Based on this, the embodiments of this disclosure can use file type identifiers to classify at least one target cloud storage file as "trustworthy" and "untrustworthy", determine the target trustworthy cloud storage files and target untrustworthy cloud storage files included, and count the number of target trustworthy cloud storage files and target untrustworthy cloud storage files respectively.

[0052] Here, when there is only one target file, it can be either a trusted or untrusted target file. When there are multiple target files, they can include both trusted and untrusted target files, or they can include only trusted or untrusted target files.

[0053] This disclosure embodiment can also obtain a pre-built identity authentication calculation model, and use the identity authentication calculation model to authenticate the target user based on the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files.

[0054] For example, using an identity authentication calculation model, the target user is authenticated based on the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files, including: Using an identity authentication calculation model, the authentication reliability rate of the target user is calculated based on the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files. If the authentication reliability rate meets the preset authentication pass conditions, then the target user's identity will be authenticated.

[0055] Specifically, by comparing local files in the target user's local storage with files in the cloud storage system, an identity authentication calculation model is used to calculate the target user's authentication reliability rate based on the number of target trusted cloud storage files, target untrusted cloud storage files, trusted cloud storage files, and all cloud storage files. This authentication reliability rate is a numerical value that measures whether user identity authentication is reliable, and can be compared to the similarity score in facial recognition technology.

[0056] The authentication reliability rate is calculated based on the matching and hit rate of the target trusted cloud storage files. If the target cloud storage file matches all trusted cloud storage files in the target user's cloud storage system, the authentication reliability rate of the target user is 100%, otherwise it is 0%. The matching and hit rate of the target untrusted cloud storage files is used as a bonus to provide a small increase in the authentication reliability rate result.

[0057] During this stage, when the server interacts with the client, a random verification security mechanism is introduced to prevent external attacks and improve the security of the computation process.

[0058] In some embodiments, the above identity authentication calculation model can be represented as:

[0059] in, This indicates the authentication reliability rate of the target user. This indicates the number of target trusted cloud storage files for the target user in the cloud storage system. This indicates the number of trusted files belonging to the target user in the cloud storage system. This indicates the number of untrusted files in the target cloud storage system belonging to the target user. This indicates the total number of all files in the target user's cloud storage system.

[0060] In some embodiments, the method may further include: Retrieve all cloud storage files and trusted cloud storage files for each user across all users in the cloud storage system, and calculate the percentage of trusted cloud storage files for each user; Based on the percentage of trusted files on the cloud storage system, all users of the cloud storage system are divided into low-trust users, medium-trust users, and high-trust users. Using an identity authentication calculation model, the authentication reliability rates for medium-trusted users and high-trusted users are calculated respectively. Based on the authentication reliability rates of medium-trusted users and high-trusted users, the preset authentication pass conditions are determined.

[0061] Specifically, different cloud storage products have different user habits due to factors such as different market segments and operational strategies. This leads to variations in the authentication reliability rate calculated by the method in this embodiment, resulting in different authentication results on different cloud storage systems. To eliminate the impact of this difference, this embodiment introduces the concept of user type and uses statistical tools to set segmentation thresholds for different cloud storage systems. That is, this embodiment can set different preset authentication pass conditions based on user type for different cloud storage systems.

[0062] For each user in the cloud storage system, retrieve all their cloud storage files and trusted cloud storage files, and calculate the percentage of trusted cloud storage files for that user. The formula for calculating the percentage of trusted cloud storage files for a user is:

[0063]

[0064] in, Indicates user jPercentage of trusted cloud storage files. n Indicates user j The number of all files on the cloud drive. i This indicates the files in the cloud drive being traversed. i , k i Indicates files on cloud storage i Is it credible?

[0065] Table 3 shows the percentage of trusted cloud storage files for some users of the cloud storage system provided in this embodiment of the disclosure. This percentage of trusted cloud storage files is related to the security of user authentication; the lower the percentage of trusted cloud storage files, the more likely they are to be forged by others. Based on this, the percentage of trusted cloud storage files can be used to classify all users of the cloud storage system into low-trust users, medium-trust users, and high-trust users.

[0066] Table 3. Percentage of Trusted Files for Selected Users of the Cloud Storage System

[0067] The percentage of trusted cloud storage files for all users in the cloud storage system is statistically analyzed using a normal distribution tool to calculate the expected value and standard deviation of the normal distribution model for user types. Figure 3 A graph of the normal distribution model of user types provided in the exemplary embodiments of this disclosure is shown.

[0068]

[0069]

[0070] in, This represents the mathematical expectation of the normal distribution model of user types. This represents the standard deviation of the normal distribution model of user types. m This indicates the total number of users who own the files on the cloud drive. Indicates user j The percentage of trusted files on cloud storage.

[0071] Based on the results obtained above, we can calculate... and Based on statistical distribution properties, the percentage of trusted cloud storage files for most users falls between these two thresholds. Therefore, users can be categorized into three types: those with a higher percentage of trusted cloud storage files than [a certain threshold]. Users are considered highly trusted; the percentage of trusted files on the cloud storage is [percentage missing]. to Users between these thresholds are considered medium-trusted users: the percentage of trusted cloud storage files is less than [a certain percentage]. The users are considered low-trust users. Table 4 shows the user types of some users in the cloud storage system provided in this embodiment of the disclosure.

[0072] Table 4 User Types of Some Users in the Cloud Storage System

[0073] To eliminate the influence of non-target user groups, the results calculated based on user type can be used to exclude low-trust users and collect only the authentication reliability rates of medium-trust and high-trust users. This data is then used to determine the normal distribution model of the authentication reliability rate, in order to prevent the preset authentication pass conditions from being too low and reducing security.

[0074] This embodiment of the disclosure can utilize the identity authentication calculation model described above to calculate the authentication reliability rate for medium-trusted users and high-trusted users respectively; then, based on the authentication reliability rates for medium-trusted users and high-trusted users, the expected value and standard deviation of the normal distribution model of authentication reliability rate are determined; based on the expected value and standard deviation of the normal distribution model of authentication reliability rate, the preset authentication pass conditions are determined.

[0075] Here, when calculating the authentication reliability rate of medium-trusted users and high-trusted users, only the authentication reliability rate on the master device is considered. When a user logs in to their account using a client and uploads local files, the user login information and the number of files uploaded for each device are recorded. Then, the master device of a user is determined according to the following conditions; users whose devices do not meet the conditions are not included in the calculation of the authentication reliability rate of medium-trusted users and high-trusted users.

[0076] The criteria for identifying a primary device are: the device is used by only one user; and the user has uploaded the most files among all devices they have used. If a user has multiple devices, the devices are sorted in descending order of the number of uploaded files, and each device is then considered as the primary device. If a device ranked higher has multiple users, it is excluded, and devices ranked lower are considered in order of priority. If multiple devices have multiple users, none of them can be identified as the primary device.

[0077] This disclosure embodiment calculates the authentication reliability rates of medium-trusted users and high-trusted users with master devices, forming the authentication reliability rates of medium-trusted users and high-trusted users as shown in Table 5.

[0078] Table 5. Authentication reliability rates for trusted users and highly trusted users.

[0079] After statistically analyzing the authentication reliability rates of trusted and highly trusted users, the normal distribution tool was also used to calculate the expected value and standard deviation of the normal distribution model for authentication reliability rates. Figure 4A graph of the normal distribution model of authentication reliability provided in the exemplary embodiments of this disclosure is shown.

[0080]

[0081]

[0082] in, This represents the mathematical expectation of the normal distribution model of certification reliability. This represents the standard deviation of the certification reliability rate normal distribution model. T This indicates the number of medium-trusted users and high-trusted users. Indicates user t The reliability of authentication, users t For medium-trust users or high-trust users.

[0083] Based on the results obtained above, we can calculate... and Based on statistical distribution properties, the authentication reliability rate of most users falls between these two thresholds. Therefore, authentication reliability can be categorized into three types: authentication reliability rate greater than... The authentication result is highly reliable; the authentication reliability rate is within [percentage missing]. to The authentication result between them is considered medium reliability; the authentication reliability rate is less than [percentage missing]. The authentication result is low reliability authentication.

[0084] At this point, the preset authentication pass condition can be determined as: the authentication reliability rate of high-reliability authentication. That is, if the authentication reliability rate of the target user meets the authentication reliability rate of high-reliability authentication, then the target user's identity authentication is successful.

[0085] In practical applications, the embodiments of this disclosure can also be combined with other risk conditions to determine the preset certification pass conditions as: the certification reliability rate of high reliability certification and medium reliability certification.

[0086] The identity authentication method for cloud storage systems provided in this disclosure is closely integrated with cloud storage files, forming an inseparable whole, and can be applied to all cloud storage systems. This authentication method not only perfectly meets the security requirements of cloud storage system services but also significantly enhances its security, unlocks the security value of digital assets, and greatly improves the user experience.

[0087] In specific application scenarios, this new authentication method can not only be used directly as an independent authentication means, but also be combined with existing authentication methods to form a multi-factor authentication mechanism, thereby further improving authentication security. For example, during the login process, in addition to traditional account and password verification, users can also be required to verify their identity through cloud storage files to ensure account security.

[0088] Furthermore, when users forget their passwords, this file-based authentication method can also serve as a supplementary authentication tool, combining with security questions, identity information, and other methods to help users retrieve their passwords and avoid login difficulties caused by forgotten passwords. This multi-layered authentication approach not only enhances account security but also improves the ease with which users can retrieve their passwords, thereby optimizing the overall user experience.

[0089] In summary, the identity authentication method for cloud storage systems provided in this disclosure, which is based on cloud storage file authentication, has broad application prospects and practical value, and can provide cloud storage systems with more secure and convenient identity authentication services.

[0090] The foregoing mainly describes the solutions provided by the embodiments of this disclosure. It is understood that, in order to achieve the above functions, the electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this disclosure can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0091] This disclosure embodiment can divide the electronic device into functional units according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this disclosure embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0092] By dividing each function into corresponding functional modules, an exemplary embodiment of this disclosure provides an identity authentication device for a cloud storage system. The identity authentication device for the cloud storage system can be a server or a chip applied to a server. Figure 5 A schematic diagram of the structure of the identity authentication device of the cloud storage system provided in an exemplary embodiment of this disclosure is shown. Figure 5As shown, the device 500 includes: Communication module 501 is used to send the tag information and verification offset of all files of the target user in the cloud storage system to the client; The communication module 501 is further configured to receive verification data of the target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and a verification offset corresponding to the tag information of the target local file; Processing module 502 is used to determine the target cloud drive file from all the cloud drive files using the verification data of the target local file; The processing module 502 is also used to perform identity authentication on the target user based on all the cloud drive files and the target cloud drive file using a pre-built identity authentication calculation model.

[0093] In some embodiments, the tag information includes a file fingerprint and the file's memory usage; The processing module 502 is also used to obtain a pre-built fingerprint calculation model and all cloud storage files of all users in the cloud storage system; and to determine the file fingerprints of all cloud storage files of all users using the fingerprint calculation model.

[0094] In some embodiments, all cloud storage files are categorized into trusted cloud storage files and untrusted cloud storage files based on file type identifiers; The processing module 502 is further configured to use the file type identifier to determine the target trusted cloud storage file and / or the target untrusted cloud storage file in the target cloud storage file; obtain a pre-constructed identity authentication calculation model, and count the number of the target trusted cloud storage file, the target untrusted cloud storage file, the trusted cloud storage file, and all cloud storage files respectively; and use the identity authentication calculation model to authenticate the target user based on the number of the target trusted cloud storage file, the target untrusted cloud storage file, the trusted cloud storage file, and all cloud storage files.

[0095] In some embodiments, the processing module 502 is further configured to use the identity authentication calculation model to calculate the authentication reliability rate of the target user based on the number of the target trusted cloud storage file, the target untrusted cloud storage file, the trusted cloud storage file, and all cloud storage files; if the authentication reliability rate meets the preset authentication pass conditions, then the identity authentication of the target user is passed.

[0096] In some embodiments, the identity authentication calculation model is represented as:

[0097] in, This indicates the authentication reliability rate of the target user. This indicates the number of target trusted cloud storage files for the target user in the cloud storage system. This indicates the number of trusted files belonging to the target user in the cloud storage system. This indicates the number of untrusted files in the target cloud storage system belonging to the target user. This indicates the total number of all files in the target user's cloud storage system.

[0098] In some embodiments, the processing module 502 is further configured to obtain all cloud storage files and trusted cloud storage files of each user among all users of the cloud storage system, and calculate the percentage of trusted cloud storage files for each user; using the percentage of trusted cloud storage files, classify all users of the cloud storage system into low-trust users, medium-trust users, and high-trust users; using the identity authentication calculation model, calculate the authentication reliability rate of the medium-trust users and the high-trust users respectively; and determine the preset authentication pass conditions based on the authentication reliability rates of the medium-trust users and the high-trust users.

[0099] This disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the methods disclosed in this disclosure.

[0100] Figure 6 A schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this disclosure is shown. For example... Figure 6 As shown, the electronic device 600 includes at least one processor 601 and a memory 602 coupled to the processor 601. The processor 601 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0101] The processor 601 described above can also be referred to as a Central Processing Unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 601 or by software instructions. The processor 601 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 602, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 601 reads information from the memory 602 and, in conjunction with its hardware, completes the steps of the method described above.

[0102] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, for example, Figure 7 The computer system 700 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including functions such as those described above. Figure 7 A schematic diagram of the structure of a computer system provided in an exemplary embodiment of this disclosure is shown.

[0103] Computer system 700 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0104] like Figure 7As shown, the computer system 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. The RAM 703 may also store various programs and data required for the operation of the computer system 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0105] Multiple components in the computer system 700 are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 can be any type of device capable of inputting information into the computer system 700. The input unit 706 can receive input numerical or character information and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 707 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. The storage unit 708 may include, but is not limited to, a hard disk and an optical disk. The communication unit 709 allows the computer system 700 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, a modem, network card, infrared communication device, wireless communication transceiver, and / or chipset, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0106] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 702 and / or communication unit 709. In some embodiments, the computing unit 701 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0107] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0108] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0109] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0110] This disclosure also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, it implements the methods disclosed in the embodiments of this disclosure.

[0111] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0112] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0113] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0114] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0115] The above description is merely an illustration of some embodiments of this disclosure and the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0116] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. An authentication method for a cloud storage system, characterized in that, include: Send the tag information and verification offset of all files in the target user's cloud storage system to the client; The system receives verification data of a target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and a verification offset corresponding to the tag information of the target local file; Using the verification data of the target local file, the target cloud drive file is determined from all the cloud drive files; Using a pre-built identity authentication calculation model, the target user is authenticated based on all the cloud storage files and the target cloud storage file.

2. The method as described in claim 1, characterized in that, The tag information includes a file fingerprint and the file's memory usage; the method further includes: Obtain the pre-built fingerprint calculation model and all cloud storage files of all users in the cloud storage system; Using the fingerprint calculation model, the file fingerprints of all cloud storage files for all users are determined.

3. The method as described in claim 1, characterized in that, All files in the cloud storage are categorized into trusted cloud storage files and untrusted cloud storage files based on their file type. The step of using a pre-built identity authentication calculation model to authenticate the target user based on all the cloud storage files and the target cloud storage file includes: The target trusted cloud storage file and / or target untrusted cloud storage file in the target cloud storage file are determined using the file type identifier; Obtain the pre-built identity authentication calculation model, and count the number of the target trusted cloud storage file, the target untrusted cloud storage file, the trusted cloud storage file, and all cloud storage files respectively; Using the aforementioned identity authentication calculation model, the target user is authenticated based on the number of the target trusted cloud storage files, the target untrusted cloud storage files, the trusted cloud storage files, and all the cloud storage files.

4. The method as described in claim 3, characterized in that, The step of using the identity authentication calculation model to authenticate the target user based on the number of the target trusted cloud storage files, the target untrusted cloud storage files, the trusted cloud storage files, and all cloud storage files includes: Using the aforementioned identity authentication calculation model, the authentication reliability rate of the target user is calculated based on the number of the target trusted cloud storage file, the target untrusted cloud storage file, the trusted cloud storage file, and all cloud storage files. If the authentication reliability rate meets the preset authentication pass conditions, then the target user's identity is authenticated.

5. The method as described in claim 4, characterized in that, The identity authentication calculation model is represented as follows: in, This indicates the authentication reliability rate of the target user. This indicates the number of target trusted cloud storage files for the target user in the cloud storage system. This indicates the number of trusted files belonging to the target user in the cloud storage system. This indicates the number of untrusted files in the target cloud storage system belonging to the target user. This indicates the total number of all files in the target user's cloud storage system.

6. The method as described in claim 4, characterized in that, The method further includes: Obtain all cloud storage files and trusted cloud storage files of each user in the cloud storage system, and calculate the percentage of trusted cloud storage files for each user; Based on the percentage of trusted files in the cloud storage system, all users of the cloud storage system are divided into low-trust users, medium-trust users, and high-trust users. Using the aforementioned identity authentication calculation model, the authentication reliability rates of the medium-trusted user and the high-trusted user are calculated respectively. The preset authentication pass conditions are determined based on the authentication reliability rates of the medium-trusted users and the high-trusted users.

7. An identity authentication device for a cloud storage system, characterized in that, include: The communication module is used to send the tag information and verification offset of all files of the target user in the cloud storage system to the client; The communication module is also used to receive verification data of the target local file of the target user sent by the client; wherein the target local file is determined from all local files of the target user based on the tag information, and the verification data is generated based on authentication information and a verification offset corresponding to the tag information of the target local file; The processing module is used to determine the target cloud drive file from all the cloud drive files using the verification data of the target local file; The processing module is also used to perform identity authentication on the target user based on all the cloud drive files and the target cloud drive file using a pre-built identity authentication calculation model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method described in any one of claims 1 to 6.

Images