Digital resource secure storage and authorized access method based on distributed cloud architecture

Abstract

The invention discloses a digital resource secure storage and authorized access method based on a distributed cloud architecture, and relates to the field of digital resource secure storage, and the encryption method comprises the steps: generating a resource key based on a user identifier of an uploader of a resource file and random salt derivation; encrypting the header data by using the resource key to obtain header encrypted data; storing the main body data to an object storage server, and obtaining an access address of the main body data; generating resource index data of the resource file, and storing the resource index data into a main server; when the third party is allowed to temporarily access, generating an authorization record and signing and issuing an access bill; when the third party accesses temporarily, the access bill and the authorization record are verified, and an audit log is recorded; when the third-party temporary access needs to be revoked, updating a revocation state in the authorization record; the storage pressure of a main server is shared through distributed storage, and refined access control of encrypted resources is realized through authorization records, access bills and audit log mechanisms.

Description

Technical Field

[0001] This application relates to the field of secure storage of digital resources, and in particular to a method for secure storage and authorized access of digital resources based on a distributed cloud architecture. Background Technology

[0002] With the advent of the digital age, the application areas of digital resources are constantly expanding, from Web3D technology to digital media, from online education to digital asset management, and the demand for secure storage of various digital files is growing. Secure storage of digital resources is directly related to information integrity, confidentiality, and availability. Once vulnerabilities occur in the storage process, it can not only lead to the leakage of personal privacy and property damage, but also cause the loss or alteration of core corporate data, triggering operational crises and legal risks.

[0003] In traditional solutions, digital resources are stored in plaintext or encrypted form as a whole file. Once the access control mechanism is breached, attackers can easily obtain the complete resource file, posing a serious risk of the entire file being stolen and parsed, resulting in low storage security for resource data. Summary of the Invention

[0004] The purpose of this application is to provide a method for secure storage and authorized access to digital resources based on a distributed cloud architecture, which can solve the problem that "once the access control mechanism is breached, attackers can easily obtain the complete resource files, posing a serious risk of the entire file being stolen and parsed, resulting in low storage security of resource data".

[0005] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for secure storage and authorized access to digital resources based on a distributed cloud architecture, including: Retrieve the resource file to be encrypted; A resource key is generated based on the user identifier of the uploader of the resource file and a random salt. The resource file is separated into header data and body data; The header data is encrypted using the resource key to obtain encrypted header data; The main data is stored in an object storage server, and the access address of the main data is obtained; Generate resource index data for the resource file and store it on the main server. The resource index data includes the resource key, the header encryption data, and the access address. When granting temporary access to a third party, an authorization record is generated and an access ticket is issued; When the third party makes a temporary access request, verify the access ticket and the authorization record, and record an audit log. When it is necessary to revoke the temporary access of the third party, update the revocation status in the authorization record and deny access to the revoked access ticket.

[0006] In one embodiment, the step of separating the resource file into header data and body data specifically includes: Data of a predetermined length is extracted from the beginning of the resource file as header data, and the remaining part of the resource file is used as body data.

[0007] In one embodiment, the step of encrypting the header data using the resource key to obtain encrypted header data specifically includes: The header data is encrypted using the resource key using AES-256. The encrypted header data is converted into a Base64 encoded string and used as the encrypted header data.

[0008] In one embodiment, the AES-256 encryption uses CBC mode.

[0009] In one embodiment, the step of generating a resource key based on the uploader's user identifier and a random salt specifically includes: Perform the first stage of HKDF derivation, using the user identifier and random salt as input to obtain the user-derived key; The user-derived key is combined with a preset base key, and the combined result is subjected to a second-stage HKDF derivation to obtain a resource key.

[0010] In one embodiment, the authorization record includes an authorization identifier, a resource identifier, an authorized user identifier, a scope of permissions, an expiration time, and a revocation status.

[0011] In one embodiment, the authorization record further includes an audit random seed, and the access ticket further includes the audit random seed and a random number.

[0012] In one embodiment, the step of verifying the access ticket and the authorization record, and recording an audit log when the third party makes a temporary access, specifically includes: When the third party makes a temporary access request, the signature of the access ticket, the revocation status of the authorization record, and the expiration time are verified. The record includes the authorization identifier, access action, timestamp, and random number in the audit log.

[0013] In one embodiment, the access ticket is signed and verified using the HMAC-SHA256 algorithm or the EdDSA algorithm.

[0014] Secondly, this application also provides a digital resource secure storage and authorized access device based on a distributed cloud architecture, comprising: The file acquisition module retrieves the resource file to be encrypted; The key derivation module generates a resource key based on the user identifier of the uploader of the resource file and a random salt. The file separation module separates the resource file into header data and body data; The header encryption module uses the resource key to encrypt the header data to obtain encrypted header data; The distributed storage module stores the main data in an object storage server and obtains the access address of the main data. The index management module generates resource index data for the resource file and stores it in the main server. The resource index data includes the resource key, the header encryption data, and the access address. The authorization management module generates authorization records and issues access tickets when allowing temporary access to third parties; The access control module verifies the access ticket and the authorization record when the third party temporarily accesses the site, and records the audit log. The revocation management module updates the revocation status in the authorization record and denies access to the revoked access ticket when it is necessary to revoke the temporary access of the third party.

[0015] Thirdly, this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method.

[0016] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0017] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application provides a method for secure storage and authorized access to digital resources based on a distributed cloud architecture. The method involves obtaining a resource file to be encrypted; generating a resource key based on the uploader's user identifier and a random salt; separating the resource file into header data and body data; and encrypting the header data using the resource key to obtain encrypted header data. Thus, by separating the header and body of the resource file and encrypting the header data, even if the body of the resource file on the object storage server is obtained, it cannot be correctly parsed and used, thereby enhancing security.

[0018] In this application, the main data is stored in an object storage server, and the access address of the main data is obtained; resource index data of resource files is generated and stored in the main server. The resource index data includes resource keys, header encrypted data and access addresses. Thus, the server load is reduced through distributed storage. The data-intensive main resource files are stored on a dedicated object storage server, while only the resource index data is stored on the main server. This effectively distributes the storage pressure on the main server and improves the overall system performance.

[0019] In this application, when allowing temporary access to third parties, an authorization record is generated and an access ticket is issued; when a third party makes temporary access, the access ticket and authorization record are verified, and an audit log is recorded; when it is necessary to revoke the temporary access of a third party, the revocation status in the authorization record is updated, and access to the access ticket associated with the revoked authorization record is denied; through the authorization record, access ticket, and audit log mechanism, revocable and traceable fine-grained access control for encrypted resources is achieved, and revocation does not require re-encrypting the header, thus improving the security of resource storage. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a method for secure storage and authorized access to digital resources based on a distributed cloud architecture, according to an embodiment of this application. Figure 2 This is an interactive flowchart of a method for secure storage and authorized access to digital resources based on a distributed cloud architecture, according to an embodiment of this application. Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0022] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] See Figure 1 This application provides a method for secure storage and authorized access to digital resources based on a distributed cloud architecture, including the following steps: Step 100: Obtain the resource file to be encrypted; Step 200: Generate a resource key based on the uploader's user identifier and a random salt; Step 300: Separate the resource file into header data and body data; Step 400: Encrypt the header data using the resource key to obtain the encrypted header data; Step 500: Store the main data in the object storage server and obtain the access address of the main data; Step 600: Generate resource index data for the resource file and store it on the main server. The resource index data includes the resource key, header encrypted data, and access address. Step 700: When granting temporary access to a third party, generate an authorization record and issue an access ticket; Step 800: When a third party makes temporary access, verify the access ticket and authorization record, and log the audit log; Step 900: When it is necessary to revoke temporary access to a third party, update the revocation status in the authorization record and deny access to the revoked access ticket.

[0025] In step 100, the client uploads the resource files to the main server. The resource files are usually digital resources required for 3D exhibition halls and virtual scenes, and can include various file formats such as obj, fbx, glb, png and jpg.

[0026] In step 200, specifically, the step of generating a resource key based on the uploader's user identifier and a random salt includes: performing a first-stage HKDF derivation to obtain a user-derived key using the user identifier and random salt as input; combining the user-derived key with a preset base key, and performing a second-stage HKDF derivation on the combination result to obtain the resource key. Here, HKDF derivation is a key derivation function based on HMAC; the preset base key is a master key predefined and securely stored by the system to enhance the security of the key derivation process.

[0027] This application improves key entropy and isolation through hierarchical derivation of a two-stage HKDF, ensuring that the keys generated for each user and each file are completely independent and do not affect each other, reducing the risk of brute-force enumeration and dictionary attacks, and allowing key rotation to be achieved by replacing the base key without affecting the user identifier.

[0028] In step 300, specifically, a predetermined length of data is extracted from the beginning of the resource file as header data, and the remaining part of the resource file is used as the body data. For example, the main server performs the following operations: extracting the complete path and filename of the resource file, extracting the first 1024 bytes of data from the resource file as the resource file header, and using the remaining part as the resource file body.

[0029] Preferably, the first 1024 bytes of data from each resource file are extracted as the resource file header. This header may contain key information such as file format identifiers and structural parameters. In other embodiments, data of other predetermined lengths may be extracted as header data, and those skilled in the art can choose according to the actual situation.

[0030] For resource files in various formats such as obj, fbx, glb, png, and jpg, extracting the first 1024 bytes of data from each resource file as the resource file header has universality. This means that resource files in these formats cannot be parsed or rendered correctly if the header is missing. Since the resource file header contains crucial information such as file format and structure, this application separates the resource file header and body, and encrypts the header data. This prevents unauthorized users from correctly parsing and using these files even if they obtain the resource file body on the object storage server, thereby enhancing security and privacy protection. Furthermore, encrypting only the header, rather than the entire file, significantly reduces encryption computation, improves the efficiency of large file processing, and achieves a balance between security and system performance.

[0031] In step 400, specifically, the header data is encrypted using the resource key using AES-256; the encrypted header data is then converted into a Base64 encoded string to form a "resource header string", which serves as the encrypted header data.

[0032] For example, the master server uses a resource key to encrypt the header data of the resource file using AES-256 encryption. AES encryption employs CBC mode to enhance encryption strength. The master server then converts the encrypted resource file header into a Base64 encoded string, forming the resource header string. Base64 encoding ensures that the encrypted binary data can be securely stored in the text database. Thus, by converting the encrypted header data into a Base64 string for transmission, potential data corruption or security risks during network transmission of binary data are avoided.

[0033] In steps 500 and 600, for example, the master server sends the separated resource file body (i.e., the file portion after removing the header) to the object storage server (OSS server) with the original filename for storage. The object storage server receives and stores these header-less resource files and generates an accessible resource URL (the access address for the body data). After receiving a resource storage success message from the object storage server, the master server writes a resource index record to the database, which includes the following fields: resource URL (as the primary key); resource key; and resource header string.

[0034] This application reduces server load by using distributed storage. It stores the main body of data-intensive resource files on a dedicated object storage server, while storing resource index data only on the main server. This effectively reduces the storage pressure on the main server and improves the overall system performance.

[0035] In steps 700-900, the authorization record includes the authorization identifier, resource identifier, authorized user identifier, permission scope, expiration time, and revocation status.

[0036] Furthermore, the authorization record also includes an audit random seed, and the access ticket also includes an audit random seed and a random number.

[0037] Specifically, when a third party makes a temporary access request, the steps of verifying the access ticket and authorization record, and recording the audit log include: verifying the signature of the access ticket, the revocation status of the authorization record and the expiration time; and recording the audit log, which includes the authorization identifier, access action, timestamp and random number.

[0038] In this application, access tickets are signed and verified using either the HMAC-SHA256 algorithm or the EdDSA algorithm. The HMAC-SHA256 algorithm is a message authentication code technology based on the SHA-256 hash algorithm, used to verify the integrity and authenticity of messages; the Edwards curve digital signature algorithm is a modern digital signature scheme based on a distorted Edwards curve.

[0039] To support temporary access by third parties and compliance traceability, this application introduces an authorization record and access ticket mechanism: (1) Authorization Creation: The resource owner submits parameters such as the authorized user identifier, resource identifier, permission scope, and expiration time. The system generates an authorization record (including authorization identifier, revocation status, and audit random seed, etc.) and issues an access ticket containing a random number and an audit random seed (signed using the HMAC-SHA256 algorithm or EdDSA algorithm). The permission scope may include one or a combination of readHead (request header), readBody (request body), and render (reconstruction) to refine the hierarchical control over the decryption header, reading body, and rendering.

[0040] (2) Access verification: The authorized user submits an access ticket, and the main server verifies the signature, revocation status and expiration time. After verification, the resource index data is loaded and the header is decrypted using the resource key derived from the two-stage HKDF. Optionally, a temporary session key can be obtained by performing HKDF derivation based on the ticket random number and audit random seed to encapsulate the decrypted header a second time, reducing the risk of plaintext header data being leaked during transmission or use.

[0041] (3) Audit logs: The logs contain authorization identifiers, access actions (request headers, request bodies, reassembly), timestamps and random numbers; among them, the random numbers are used for replay detection.

[0042] (4) Revocation: When the resource owner initiates a revocation command, only the revocation status of the authorization record is updated and the associated cache is invalidated. Subsequent ticket requests are immediately rejected without the need to re-encrypt the stored resource header.

[0043] (5) Security and performance: Temporary session keys expire after a preset window period to reduce the risk of ticket leakage; revocation delay control is within one second to ensure immediacy; IP hashes in audit logs are obtained by performing hash calculations on the original IP and audit random seed, and the combination of audit random seed and IP hash balances privacy and evidence collection capabilities.

[0044] Based on the same inventive concept, this application also provides a digital resource secure storage and authorized access device based on a distributed cloud architecture. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more embodiments of the digital resource secure storage and authorized access device based on a distributed cloud architecture provided below can be found in the limitations of the digital resource secure storage and authorized access method based on a distributed cloud architecture described above, and will not be repeated here.

[0045] This application provides a digital resource secure storage and authorized access device based on a distributed cloud architecture, including: The file acquisition module retrieves the resource file to be encrypted; The key derivation module generates resource keys based on the user identifier of the uploader of the resource file and a random salt. The file separation module separates resource files into header data and body data; The header encryption module uses a resource key to encrypt the header data, resulting in encrypted header data. The distributed storage module stores the main data in the object storage server and obtains the access address of the main data. The index management module generates resource index data for resource files and stores it on the main server. The resource index data includes resource keys, encrypted header data, and access addresses. The authorization management module generates authorization records and issues access tickets when allowing temporary access to third parties; The access control module verifies access tickets and authorization records when a third party grants temporary access, and logs the results in an audit log. The revocation management module updates the revocation status in the authorization record when it is necessary to revoke temporary access from a third party, and denies access to the revoked access ticket.

[0046] In one exemplary embodiment, a computer device is provided, which may be a server or a terminal, and its internal structure diagram may be as follows. Figure 3 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection.

[0047] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0048] In one exemplary embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0049] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0050] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0052] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0053] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0054] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0055] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for secure storage and authorized access of digital resources based on a distributed cloud architecture, characterized in that, The method comprises the following steps: obtaining a resource file to be encrypted; deriving a resource key based on a user identifier of an uploader of the resource file and a random salt; separating the resource file into header data and body data; encrypting the header data using the resource key to obtain header encrypted data; storing the body data to an object storage server and obtaining an access address of the body data; generating resource index data of the resource file, and storing the resource index data into a master server, wherein the resource index data comprises the resource key, the header encrypted data and the access address; when temporary access of a third party is allowed, generating an authorization record and issuing an access ticket; when the third party temporarily accesses, verifying the access ticket and the authorization record, and recording an audit log; when the temporary access of the third party needs to be revoked, updating a revocation state in the authorization record, and rejecting access of the revoked access ticket.

2. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 1, characterized in that, The step of separating the resource file into header data and body data specifically comprises: cutting data of a predetermined length from the beginning of the resource file as the header data, and taking the remaining part of the resource file as the body data. 3.The method of claim 1, wherein, The step of encrypting the header data using the resource key to obtain header encrypted data specifically comprises: performing AES-256 encryption processing on the header data using the resource key; converting the encrypted header data into a Base64 encoded string as the header encrypted data.

4. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 3, characterized in that, The AES-256 encryption adopts a CBC mode.

5. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 1, wherein, The step of deriving the resource key based on the user identifier of the uploader of the resource file and the random salt specifically comprises: performing first-stage HKDF derivation to obtain a user-derived key using the user identifier and the random salt as inputs; combining the user-derived key with a preset base key, and performing second-stage HKDF derivation on the combination result to obtain the resource key.

6. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 1, wherein, The authorization record comprises an authorization identifier, a resource identifier, an authorized user identifier, a permission range, an expiration time and a revocation state.

7. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 6, characterized in that, The authorization record further comprises an audit random seed, and the access ticket further comprises the audit random seed and a random number.

8. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 7, characterized in that, The step of verifying the access ticket and the authorization record when the third party temporarily accesses, and recording an audit log specifically comprises: verifying the signature of the access ticket, the revocation state and the expiration time of the authorization record when the third party temporarily accesses; recording an audit log comprising the authorization identifier, an access action, a timestamp and the random number.

9. The method for secure storage and authorized access of digital resources based on distributed cloud architecture according to claim 1, wherein, The access ticket is signed and verified using an HMAC-SHA256 algorithm or an EdDSA algorithm.

10. A device for secure storage and authorized access of digital resources based on a distributed cloud architecture, characterized in that, The method comprises the following steps: a file obtaining module obtains a resource file to be encrypted; a key derivation module derives a resource key based on a user identifier of an uploader of the resource file and a random salt; a file separating module separates the resource file into header data and body data; a header encryption module encrypts the header data using the resource key to obtain header encrypted data; a distributed storage module, storing the subject data to an object storage server and obtaining an access address of the subject data; an index management module, generating resource index data of the resource file, and storing the resource index data into a master server, the resource index data including the resource key, the header encryption data and the access address; an authorization management module, generating an authorization record and issuing an access ticket when temporarily allowing a third party to access; an access control module, verifying the access ticket and the authorization record when the third party temporarily accesses, and recording an audit log; a revocation management module, updating a revocation status in the authorization record when it is necessary to revoke the temporary access of the third party, and rejecting the access of the revoked access ticket.

11. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the method of any one of claims 1-9.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the method of any one of claims 1-9.

Images