Data encryption distribution method and device based on CDN (Content Delivery Network), medium and electronic equipment

Abstract

The invention provides a CDN (Content Delivery Network)-based data encryption distribution method and device, a medium and electronic equipment. The method comprises the following steps: in response to a file acquisition request of a link node serving as an authorizer in a CDN network, acquiring a target file which is transmitted to a user side through the CDN network after being encrypted; symmetrically encrypting the target file by adopting the first key to obtain an encrypted file body; performing asymmetric encryption on the first secret key according to a first public key of an authorizer to generate a first authorization string; and sending the encrypted file body carrying the first authorization string to an authorizer so as to store or forward the encrypted file body in a CDN network. In a CDN network, an encrypted file body carrying a first authorization string is transmitted between a source station and a link node, and the link node generates the authorization string and the encrypted file body of a user side according to the first authorization string of an authorizer and a public key of the user side, so that the user accesses the encrypted file through a private key of the user side, the security of the first key is improved, and the user experience is improved. And thus, the security of the target file is improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data processing, and particularly relates to a data encryption distribution method and device based on a CDN network, a medium and an electronic device. BACKGROUND

[0002] In order to meet the privacy requirement of data, a digital file can be encrypted in a propagation process. For an encrypted digital file, only a specified authorized user can decrypt and use the file. There are two main methods for encrypting a digital file, one is symmetric encryption, and the other is asymmetric encryption.

[0003] For symmetric encryption, a digital file can be encrypted and decrypted by using the same key. When an encrypted digital file is sent to an authorized user, the decryption key is also sent to the authorized user. If the authorized user discloses the key, the encrypted digital file will also be disclosed, and the security is low.

[0004] For asymmetric encryption, an authorized user encrypts a file by using a public key of an authorized user, and then the authorized user decrypts the encrypted file by using a private key of the authorized user. Although this encryption method has high security, the authorized user needs to perform asymmetric encryption multiple times for different authorized users, and the encryption efficiency is low. SUMMARY

[0005] Therefore, the present disclosure provides a data encryption distribution method and device based on a CDN network, a medium and an electronic device.

[0006] According to a first aspect of an embodiment of the present disclosure, a data encryption distribution method based on a CDN network is provided, and the method is applied to a source station connected to a CDN (Content Delivery Network) network; the method comprises the following steps: In response to a file acquisition request of a link node as an authorized user in the CDN network, a target file to be encrypted and transmitted to a user end via the CDN network is acquired, wherein the authorized user can grant a use permission of an encrypted file body to the user end in response to an authorization request from the user end; The target file is symmetrically encrypted by using a first key to obtain an encrypted file body; The first key is asymmetrically encrypted according to a first public key of the authorized user to generate a first authorization string; The encrypted file body carrying the first authorization string is sent to the authorized user, so as to be stored or forwarded in the CDN network.

[0007] In some embodiments, the asymmetric encryption of the first key according to the first public key of the authorized party generates a first authorization string, including: The source station asymmetrically encrypts the first key according to the first public key of the link node to generate a first authorization string, so that the link node decrypts the first authorization string according to the private key corresponding to the first public key to obtain the first key; wherein the first public key is obtained from the received file acquisition request sent by the link node.

[0008] In some embodiments, the link node as an authorized party includes a parent node and an edge node. The sending of the encrypted file body carrying the first authorization string to the authorized party includes: The source station sends the encrypted file body carrying the first authorization string to the parent node, so that the parent node caches the encrypted file body carrying the first authorization string and sends the encrypted file body carrying the first authorization string to the edge node.

[0009] In some embodiments, the sending of the encrypted file body carrying the first authorization string to the authorized party includes: The first authorization string and authorization information are encapsulated into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the use permission of the target file by the authorized party. Based on the electronic envelope, the encrypted file body carrying the first authorization string is sent to the link node in the CDN network.

[0010] According to a second aspect of the embodiments of the present disclosure, a data encryption and distribution method based on a CDN network is provided, the method is applied to a link node of the CDN network, the link node acts as an authorized party, and the method includes: The authorized party in the CDN network receives an encrypted file body carrying a first authorization string forwarded by a source station connected to the CDN network; the first authorization string is generated by asymmetrically encrypting a first key based on a first public key of the authorized party, and the encrypted file body is obtained by symmetrically encrypting a target file using the first key; If an authorization request sent by a user terminal of the CDN network is received, identity authentication is performed on the corresponding user terminal in the authorization request; If the identity authentication is passed, the user terminal is confirmed as an authorized party, and a second authorization string exclusive to the authorized party is generated based on the first authorization string; the authorized party is a user terminal that sends an authorization request to the authorized party and obtains use permission; sending the second authorization string to the authorized party, so that the authorized party decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key; the second private key is a private key of the authorized party.

[0011] In some embodiments, the method further comprises: In response to the authorization request, determining whether the authorized party caches the encrypted file body carrying the first authorization string; If the encrypted file body carrying the first authorization string is not cached, sending a file acquisition request to a superior node of the CDN network to acquire the encrypted file body carrying the first authorization string; receiving the encrypted file body carrying the first authorization string sent by the superior node, and sending the encrypted file body carrying the first authorization string to the authorized party.

[0012] In some embodiments, the link node comprises a parent node and an edge node. If the encrypted file body carrying the first authorization string is not cached, sending a file acquisition request to a superior node of the CDN network to acquire the encrypted file body carrying the first authorization string, comprises: In response to the edge node receiving the authorization request, determining whether the edge node caches the encrypted file body carrying the first authorization string; If the edge node does not cache the encrypted file body carrying the first authorization string, sending a file acquisition request to the parent node, so that the parent node sends the encrypted file body carrying the first authorization string to the edge node.

[0013] In some embodiments, the second authorization string specific to the authorized party is generated based on the first authorization string, comprising: decrypting the first authorization string by using a first private key to obtain the first key; the first private key is a private key of the authorized party; performing asymmetric encryption on the first key according to a second public key in the authorization request to obtain the second authorization string; the second public key is a public key of the authorized party.

[0014] In some embodiments, the identity authentication of the user corresponding to the authorization request comprises at least one of: authenticating the identity of the authorized party based on a username and a password provided by the authorized party in the authorization request; authenticating the identity of the authorized party based on an authentication token of the authorized party in the authorization request; authenticating the identity of the authorized party based on a digital certificate provided by the authorized party in the authorization request.

[0015] According to a third aspect of the embodiments of the present disclosure, a CDN network-based data encryption distribution apparatus is provided, the apparatus being applied to a source station connected with a CDN network, and the apparatus comprising: an obtaining unit configured to obtain a target file to be encrypted and transmitted to a user terminal via the CDN network in response to a file obtaining request of a link node as an authorized party in the CDN network, wherein the authorized party is capable of granting a use permission of an encrypted file body to the user terminal in response to an authorization request from the user terminal; a first encryption unit configured to symmetrically encrypt the target file by using a first key to obtain the encrypted file body; a second encryption unit configured to asymmetrically encrypt the first key according to a first public key of the authorized party to generate a first authorization string; a processing unit configured to send the encrypted file body carrying the first authorization string to the authorized party to be stored or forwarded in the CDN network.

[0016] In some embodiments, the second encryption unit is configured to: the source station asymmetrically encrypts the first key according to a first public key of the link node to generate a first authorization string, so that the link node decrypts the first authorization string according to a private key corresponding to the first public key to obtain the first key; wherein the first public key is obtained from a file obtaining request sent by the received link node.

[0017] In some embodiments, the link node as the authorized party comprises a parent node and an edge node. The processing unit is configured to: the source station sends the encrypted file body carrying the first authorization string to the parent node, so that the parent node caches the encrypted file body carrying the first authorization string and sends the encrypted file body carrying the first authorization string to the edge node.

[0018] In some embodiments, the processing unit is configured to: encapsulate the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine a use permission of the target file by the authorized party; send the encrypted file body carrying the first authorization string to the link node in the CDN network based on the electronic envelope.

[0019] According to a fourth aspect of the embodiments of the present disclosure, a CDN network-based data encryption distribution apparatus is provided, the apparatus being used in a link node of a CDN network, the link node acting as an authorizer; the apparatus comprising: a receiving unit configured to receive, by an authorizer in a CDN network, an encrypted file body carrying a first authorization string forwarded by a source station connected to the CDN network; the encrypted file body being shared by users of the CDN network, and the encrypted file body and the first authorization string not containing exclusive information of the authorizer; the first authorization string being generated by asymmetrically encrypting a first key based on a first public key of the authorizer, and the encrypted file body being obtained by symmetrically encrypting a target file using the first key; a first verifying unit configured to, if receiving an authorization request sent by a user end of the CDN network, perform identity verification on the user end corresponding to the authorization request; a generating unit configured to, if the identity verification is passed, confirm the user end as an authorized user, and generate a second authorization string exclusive to the authorized user based on the first authorization string; a first sending unit configured to send the second authorization string to the authorized user, so that the authorized user decrypts the second authorization string using a second private key to obtain the first key, and decrypts the encrypted file body using the first key; the second private key being a private key of the authorized user.

[0020] In some embodiments, the apparatus further comprises: a determining unit configured to, in response to the authorization request, determine whether the authorizer has cached the encrypted file body carrying the first authorization string; a requesting unit configured to, if the encrypted file body carrying the first authorization string is not cached, send a file acquisition request to a superior node of the CDN network to acquire the encrypted file body carrying the first authorization string; a second sending unit configured to receive the encrypted file body carrying the first authorization string sent by the superior node to cache, and send the encrypted file body carrying the first authorization string to the authorized user.

[0021] In some embodiments, the link node comprises a parent node and an edge node. The requesting unit is configured to: in response to the edge node receiving the authorization request, determine whether the edge node has cached the encrypted file body carrying the first authorization string; if the edge node has not cached the encrypted file body carrying the first authorization string, send a file acquisition request to the parent node, so that the parent node sends the encrypted file body carrying the first authorization string to the edge node.

[0022] In some embodiments, the generating unit is configured to: decrypt the first authorization string by using a first private key to obtain the first key; the first private key is a private key of the authorizer; perform asymmetric encryption on the first key according to a second public key in the authorization request to obtain a second authorization string; the second public key is a public key of the authorized person.

[0023] In some embodiments, the first verifying unit is configured to: verify the identity of the authorized person based on a username and a password provided by the authorized person in the authorization request; verify the identity of the authorized person based on a verification token of the authorized person in the authorization request; verify the identity of the authorized person based on a digital certificate provided by the authorized person in the authorization request.

[0024] According to a fifth aspect of the embodiments of the present disclosure, a CDN network-based data encryption distribution method is provided, which is applied to a data encryption system including a source station connected with a CDN network and a link node in the CDN network as an authorizer; The method includes: The source station acquires a target file to be encrypted, performs symmetric encryption on the target file by using a first key to obtain an encrypted file body; The source station performs asymmetric encryption on the first key according to a first public key of the link node to generate a first authorization string, and sends the encrypted file body carrying the first authorization string to the link node, so that the link node sends the encrypted file body carrying the first authorization string to a user terminal; The link node performs identity verification on a user terminal corresponding to an authorization request in response to receiving the authorization request; after the identity verification is passed, the user terminal is confirmed as an authorized person, and a second authorization string special for the authorized person is generated based on the first authorization string; The link node sends the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key.

[0025] According to a sixth aspect of the embodiments of the present disclosure, a CDN network-based data encryption distribution system is provided, which includes a source station connected with a CDN network and a link node in the CDN network as an authorizer; The source station is configured to acquire a target file to be encrypted, perform symmetric encryption on the target file by using a first key to obtain an encrypted file body, perform asymmetric encryption on the first key according to a first public key of the link node to generate a first authorization string, and send the encrypted file body carrying the first authorization string to the link node, so that the link node sends the encrypted file body carrying the first authorization string to a user. The link node is configured to perform identity authentication on a user end corresponding to an authorization request of a CDN network user end in response to receiving the authorization request, confirm the user end as an authorized person after the identity authentication passes, generate a second authorization string special for the authorized person based on the first authorization string, and send the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string by using a second private key to obtain the first key and decrypts the encrypted file body by using the first key.

[0026] According to a seventh aspect of the embodiments of the present disclosure, a computer readable storage medium is provided, which stores a computer program. The program is executed by a processor to implement the steps of the method according to the first aspect or the second aspect or the fifth aspect.

[0027] According to an eighth aspect of the embodiments of the present disclosure, a computer device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor implements the steps of the method according to the first aspect or the second aspect or the fifth aspect when executing the program.

[0028] According to a ninth aspect of the embodiments of the present disclosure, a computer program product is provided, which includes computer readable code or a non-volatile computer readable storage medium carrying the computer readable code. When the computer readable code is executed in a processor of an electronic device, the processor in the electronic device implements the steps of the method according to the first aspect or the second aspect or the fifth aspect.

[0029] The technical solutions provided by the embodiments of the present disclosure can have the following beneficial effects: The embodiment of the present disclosure encrypts the target file in a symmetric encryption manner, can complete the encryption of the target file through one-time encryption, improves the encryption efficiency of the target file, then encrypts the first key of the symmetric encryption in an asymmetric encryption manner, improves the security of the first key, and further improves the security of the target file. And the source station in the CDN network symmetrically encrypts the target file to obtain an encrypted file body, and then encrypts the symmetrically encrypted key by using the public key of the link node to obtain the first authorization string. The source station sends the encrypted file body carrying the first authorization string to the link node in the CDN network, so that all the link nodes can cache the encrypted file body carrying the first authorization string, so that the link node can quickly send the encrypted file body carrying the first authorization string to the user, realizes the rapid propagation of the file in the form of the encrypted file in the CDN network, and improves the security of the CDN network. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 is a transmission flow chart of an existing target file according to an example embodiment of the present disclosure; Figure 2 is a data encryption method flow chart according to an example embodiment of the present disclosure; Figure 3 is a flow chart of storing or forwarding an encrypted file body according to an example embodiment of the present disclosure; Figure 4 is a data encryption method flow chart according to an example embodiment of the present disclosure; Figure 5 is a flow chart of processing an authorization request according to an example embodiment of the present disclosure; Figure 6 is a flow chart of generating a second authorization string according to an example embodiment of the present disclosure; Figure 7 is a data encryption method flow chart according to an example embodiment of the present disclosure; Figure 8 is a transmission flow chart of a target file according to an example embodiment of the present disclosure; Figure 9 is a data encryption distribution device block diagram based on a CDN network according to an example embodiment of the present disclosure; Figure 10 is a data encryption distribution device block diagram based on a CDN network according to an example embodiment of the present disclosure; Figure 11 is a data encryption distribution device block diagram based on a CDN network according to an example embodiment of the present disclosure; Figure 12 is a hardware structure diagram of an electronic device according to an example embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description herein relates to the drawings, which show by way of illustration, rather than limitation, the exemplary embodiments. Unless otherwise noted, the same elements in the different drawings are denoted by the same reference numerals. The embodiments described in the following exemplary embodiments are not meant to represent all embodiments consistent with the present disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0032] The terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. As used in the present disclosure and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0033] It will be understood that, although the terms first, second, third, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used solely to distinguish one from another only. For example, a first information can be termed a second information, and similarly, a second information can also be termed a first information, without departing from the scope of the present disclosure. Depending on the context, the word "if' as used herein can be interpreted to mean "when" or "in response to determining" or "in response to a determination".

[0034] A digital file refers to a data file stored in digital form. Such files can include, but are not limited to, various types of data such as text, images, audio, and video, etc. In some application scenarios, it is necessary to encrypt a digital file to ensure that only a specific user can use the data information in the encrypted digital file. When encrypting a digital file, symmetric encryption or asymmetric encryption can be used. In symmetric encryption, the same key is used for encryption and decryption of data. In asymmetric encryption, a pair of keys is used for encryption and decryption of data, one of which is a public key and the other is a private key.

[0035] After the authorized party encrypts the digital file, the authorized party can obtain the encrypted digital file, and after decrypting the digital file, the data information in the digital file can be obtained.

[0036] In symmetric encryption, the authorizer needs to share the encryption key with the authorized user. Once the authorized user obtains the key and the encrypted digital file, they can forward both to other users, allowing them to access the data within the digital file. In other words, with symmetric encryption, if the key is leaked, the data within the digital file will also be leaked, resulting in relatively low security for the digital file.

[0037] To improve the security of digital files, asymmetric encryption can be used. However, because asymmetric encryption requires the public key of the authorized party to encrypt the digital file, and different public keys are used for different authorized parties, the encrypted digital files will be different. In other words, for asymmetric encryption, the authorizing party needs to encrypt the digital file multiple times for different authorized parties, which is inefficient and hinders the dissemination of digital files.

[0038] In related technologies, the process of transferring the target file can be found in [reference needed]. Figure 1 The flowchart shown below, in which, Figure 1 This includes origin servers and CDN network nodes, where parent nodes and edge nodes are both node devices within the CDN network. The origin server can be a file storage server, essentially providing the file source. For example, the file a user needs might initially be stored on the origin server. The parent node can be a backbone node or central node in the CDN network, located closer to the origin server, and is responsible for fetching files from the origin server and distributing them to the edge nodes. The edge nodes can be numerous nodes in the CDN network, located closer to the user, and are directly responsible for delivering files to the end user.

[0039] When a user requests a file from a link node, the link node needs to request it from the origin server. The origin server then encrypts the target file using the user's public key, generating a unique encrypted file for the user. This encrypted file is then sent to the user via the link node. In other words, in existing technology, every time a user requests an encrypted file, the origin server needs to encrypt the target file using that user's public key. This is because different users have different public keys, resulting in different encrypted files, thus requiring encryption tailored to each user.

[0040] For example, User 1 obtains an encrypted file by encrypting it at the source server to obtain encrypted file 1, which is then transmitted through parent node 1 and edge node 1. User 2 obtains an encrypted file by encrypting it at the source server to obtain encrypted file 2, which is then transmitted through parent node 1 and edge node 2. Even for the same target file, the encrypted files are different due to the different user public keys. Therefore, even if both User 1's and User 2's encrypted files pass through parent node 1, parent node 1 cannot transmit User 1's file to User 2.

[0041] As described above, in the related art, if each file needs to be dynamically encrypted by the source station and different versions are generated for different users, the pressure on the source station will be great. For example Figure 1 As shown in the example, n users need to generate n encrypted files respectively, and these encrypted files need to be forwarded step by step from the source station through the parent nodes and edge nodes of the CDN network to finally reach the users. It can be imagined that when the number of users needing the file is large, the traffic pressure of the entire path from the source station to the user side will be great, and even congestion may occur, affecting the user experience. Moreover, when different users want to obtain the file, the encrypted file corresponding to the user needs to be regenerated from the source station and transmitted to the user through the CDN network, which reduces the efficiency of the user obtaining the file. In summary, the scheme of the related art causes great load pressure on the source station and the CDN network, and the efficiency of the user obtaining the file is low.

[0042] Based on this, the present disclosure provides a CDN network-based data encryption distribution method, which is applied to a source station connected with a CDN network. Please see Figure 2 , Figure 2 is a data encryption method flowchart provided by an exemplary embodiment of the present disclosure, which includes the following steps: S201, in response to a file acquisition request of a link node as an authorized person in the CDN network, acquiring a target file to be encrypted and transmitted to a user end via the CDN network.

[0043] The file acquisition request is a request initiated by the link node in the CDN network to the source station. For example, the user end requests the target file to the link node, but the link node itself does not cache the target file, so the link node initiates a file acquisition request to the source station, and the source station acquires the target file according to the information in the request after receiving the file acquisition request.

[0044] The authorized person can grant the use permission of the encrypted file body to the user end in response to an authorization request from the user end, the source station acquires the target file to be encrypted, and the data in the target file includes but is not limited to text, image, audio, and video, etc. The target file can be a file pre-stored in the source station, and the source station acquires the target file by querying its own cache.

[0045] In this step, it can be understood that the source station receiving the file acquisition request of the link node as the authorized person in the CDN network can be a request sent directly by the link node as the authorized person to the source station, or a request forwarded by the link node as the authorized person to the source station through other network nodes, which is not limited.

[0046] S202, symmetrically encrypting the target file by using the first key to obtain an encrypted file body.

[0047] After obtaining the target file, a random key string is used as the first key, and the length and strength of the first key depend on the symmetric encryption algorithm used. For example, the AES (Advanced Encryption Standard) algorithm can use an encryption key of 128 bits, 192 bits, or 256 bits.

[0048] After determining the first key, the target file can be encrypted according to the first key. In some embodiments, when the target file is encrypted, the target file can be loaded first, and then the data information in the target file is converted into a byte stream, and then the encryption algorithm and the first key are used to encrypt the data information in the target file. In the process of encryption, the data is processed block by block or byte by byte, and encrypted data is generated. After all the data in the digital file is encrypted, the encrypted file body is obtained. The symmetric encryption algorithm can be AES, DES (Data Encryption Standard), and 3DES (Triple DES) symmetric encryption algorithm.

[0049] S203, asymmetrically encrypting the first key according to the first public key of the authorized party to generate a first authorization string.

[0050] The first public key is the public key of the authorized party of the CDN network. The authorized party can be a link node in the CDN network, such as an edge node, which authorizes the encrypted file body to the user end through the edge node. After obtaining the encrypted file body, the first key can be further encrypted to ensure the security of the first key. In some embodiments, the public key of the authorized party can be used to asymmetrically encrypt the first key, and after encryption, the first authorization string of the target file is obtained. By encrypting the first key, it can prevent the first key from being obtained and decrypted by unauthorized users, and improve the security of the target file. Asymmetrically encrypting the first key with the public key of the authorized party can ensure that only the authorized party can decrypt the first authorization string.

[0051] It should be noted that the first public key is the key of the link node in the CDN network, and the keys of all link nodes in the CDN network can be the same, or the link nodes can be classified and categorized, and the keys of link nodes in the same category are the same. Therefore, after obtaining the encrypted file body, the encrypted file body can be shared by the nodes and users in the CDN network. Different nodes and users can share the same encrypted file body, thereby improving the propagation speed of the encrypted file body in the CDN network.

[0052] In some embodiments, the first authorization string does not contain the exclusive information of the authorized person, which is the user sending the authorization request to the authorized person and obtaining the use permission. Therefore, the encrypted file body carrying the first authorization string can be widely spread in the CDN network, because the encrypted file body received by all nodes of the CDN is the same.

[0053] S204, the encrypted file body carrying the first authorization string is sent to the authorized person for storage or forwarding in the CDN network.

[0054] After obtaining the first authorization string, the first authorization string and the encrypted file body of the target file can be stored or forwarded. In order to improve the security of the target file, the first authorization string and the encrypted file body can be packaged together, so that the encrypted file body carries the first authorization string, and thus people who cannot decrypt the first authorization string cannot decrypt the encrypted file body.

[0055] In some embodiments, after the encrypted file body carries the first authorization string, the encrypted file body carrying the first authorization string can be forwarded in the CDN network. Since the decryption key of the encrypted file body is encrypted in the first authorization string, even if different CDN nodes forward the encrypted file body to the user, the user cannot decrypt the first authorization string, and even if the user receives the encrypted file body, the user cannot decrypt the encrypted file body. Through the encryption method provided by the present disclosure, the encrypted file body can be widely spread in the CDN network, and the security of the encrypted file body can be guaranteed.

[0056] In some embodiments, the CDN network includes a link node, and the authorized person of the CDN network is the link node; the process of asymmetrically encrypting the first key can be performed by a source station connected to the CDN network.

[0057] For example, when the link node sends a file acquisition request to the source station, the asymmetrically encrypted first public key of the link node can be sent to the source station at the same time. After the source station encrypts the target file according to the first key to obtain the encrypted file body, and uses the first public key of the link node to asymmetrically encrypt the first key to generate the first authorization string. Finally, the source station sends the encrypted file body carrying the first authorization string to the link node, so that the link node can store the encrypted file body carrying the first authorization string, and send the encrypted file body to the user end of the CDN network. The user end can be a device used by the user, such as the user's mobile phone, the user's computer, etc.

[0058] It should be noted that after the link node receives the encrypted file body carrying the first authorization string, the link node can decrypt the first authorization string by using its own key, but when storing, the link node can continue to store in the form of an encrypted file to avoid the target file being spread in the CDN network in the form of plaintext, and improve the security of the target file.

[0059] In an embodiment, the link node includes a parent node and an edge node. When the source station sends the encrypted file body carrying the first authorization string to the link node, the source station can first send the encrypted file body carrying the first authorization string to the parent node, the parent node buffers the encrypted file body carrying the first authorization string, and then sends the encrypted file body carrying the first authorization string to the edge node, and finally the edge node buffers the encrypted file body carrying the first authorization string and sends the encrypted file body carrying the first authorization string to the user. Since the first public key of all link nodes can be the same, the link nodes in the CDN network can share the encrypted file body carrying the first authorization string and decrypt the encrypted file body.

[0060] In an optional embodiment, the first public key of the link node in the CDN network can also be pre-stored to the source station. After a file is first uploaded and written to the source station, the source station can directly perform symmetric encryption on the first uploaded file according to the first key, and encrypt the first key according to the first public key to generate an encrypted file body carrying the first authorization string. Then a pseudo request is triggered manually or by a script, so that the source station obtains a file acquisition request sent by a preset link node, and sends the encrypted file body carrying the first authorization string to the link node in the CDN network according to the address of the preset link node. When the user end requests authorization from the link node, the link node can directly generate a second authorization string special for the user end according to the public key of the user end, and send the encrypted file body carrying the second authorization string to the user end, so that the user end decrypts the encrypted file body. Wherein, the first public keys of different link nodes in the CDN network are the same, and the address of the preset link node can be the address of part or all of the link nodes in the CDN network, which can be pre-set according to business requirements. For example, after a source station newly uploads an activity page, the source station can encrypt the activity page to make the activity page into an encrypted file body, and encrypt the first key according to the first public key of the link node in the CDN network to obtain the encrypted file body carrying the first authorization string. Then, the source station can send the encrypted file body carrying the first authorization string to the specified link node 1, link node 2 and link node 3, so that the link nodes cache the encrypted file body. When the user end needs to access the activity page, if the link node closest to the user end is the link node 1, the link node 1 can directly send the encrypted file body carrying the first authorization string to the user end according to the cache, and then generate a second authorization string special for the user end according to the public key of the user end, and send the second authorization string to the user end, so that the user decrypts to obtain the activity page. Alternatively, the link node 1 can directly generate a second authorization string special for the user end according to the second public key of the user end, and send the encrypted file body carrying the second authorization string to the user end, so that the user decrypts to obtain the activity page.

[0061] The embodiments of the present disclosure encrypt the target file by the source station in the CDN network to obtain an encrypted file body, and then encrypt the symmetric encryption key by the public key of the link node to obtain a first authorization string. The source station sends the encrypted file body carrying the first authorization string to the link node in the CDN network, so that all the link nodes can cache the encrypted file body carrying the first authorization string, so that the link node can quickly send the encrypted file body carrying the first authorization string to the user, which realizes the rapid propagation of the file in the form of the encrypted file in the CDN network, and improves the security of the CDN network.

[0062] In some embodiments, the method shown in Figure 3 may be used to store or forward the encrypted file body, Figure 3The flowchart shown includes the following steps: S301, encapsulating the first authorization string and authorization information into an electronic envelope of the encrypted file body.

[0063] S302, sending the encrypted file body carrying the first authorization string to a link node in the CDN network for storage or forwarding in the CDN network.

[0064] The authorization information is used to determine the use permission of the authorized person (such as a user in the CDN network) to the target file. For example, the authorization information can include read permission information, write permission information, use period information, and authorized person information. Among them, the read permission information is used to determine whether the authorized person can read the file; the write permission information is used to determine whether the authorized person can modify the file; the use period information is used to determine the validity period of the target file, and the target file cannot be accessed after the validity period; and the authorized person information is used to indicate the identity of the authorized person, for example, the signature of the authorized person. In an embodiment, the read permission and the use period of 7 days are included in the authorization information. Then, after the authorized person decrypts the target file, the authorized person can only read the data information in the target file within 7 days after decryption.

[0065] The electronic envelope is used to ensure the privacy, integrity, and authenticity of the file during transmission. The encrypted content and the encrypted key used to encrypt the content, i.e., the encrypted file body and the first authorization string, are included in the encapsulated electronic envelope. In addition, the authorization information and the first authorization string are encapsulated into the file header of the electronic envelope. Then, the first authorization string and the encrypted file body are stored and forwarded based on the electronic envelope.

[0066] The user can obtain the electronic envelope through various channels, such as Internet transmission, U disk copy, or disk copy, etc. However, the user cannot decrypt the encrypted file body, and thus cannot obtain the data information in the target file, thereby improving the security of the target file.

[0067] Corresponding to the foregoing embodiment, the present disclosure also provides an embodiment of a CDN network-based data encryption distribution method, which is applied to a CDN network, for example, a link node in the CDN network. Please refer to Figure 4 , Figure 4 is a flowchart of a data encryption method provided by an exemplary embodiment of the present disclosure, which includes the following steps: S401, the authorized person in the CDN network receives the encrypted file body carrying the first authorization string forwarded by the source station connected to the CDN network.

[0068] In some embodiments, the authorized node in the CDN network is a link node in the CDN network. After the source station encrypts the target file and asymmetrically encrypts the encryption key based on the first public key of the authorized node, the source station can send the encrypted file body carrying the first authorization string to the authorized node, so that the authorized node can receive the encrypted file body carrying the first authorization string sent by the source station.

[0069] It should be noted that the encrypted file body is shared by users of the CDN network, and the encrypted file body and the first authorization string do not contain exclusive information of the authorized node. The first authorization string is generated by asymmetrically encrypting the first key based on the first public key of the authorized node, and the encrypted file body is obtained by symmetrically encrypting the target file using the first key. Therefore, the encrypted file body can be shared in the CDN network without authorization by the authorized node, and the user cannot directly decrypt it, thereby improving the security of file transmission.

[0070] S402, if the authorization request sent by the user end of the CDN network is received, the user in the authorization request is authenticated.

[0071] If the link node receives the authorization request of the user end of the CDN network, it means that the user needs to decrypt the encrypted file body. Therefore, the edge node can first authenticate the user to determine the legality of the user identity, so as to avoid authorizing the encrypted file body to the user who does not meet the authentication rules, thereby improving the decryption security of the encrypted file body.

[0072] In an optional embodiment, if the user obtains the encrypted file body and wants to access the data information in the encrypted file body, the user can send an authorization request to the authorized node according to the authorization information in the electronic envelope to request the authorized node to open the permission. For example, if the authorization information includes write permission information, the authorized node can apply for the write permission of the target file to the authorized node.

[0073] If the authorized node receives the authorization request initiated by the authorized node, the authorization request can be processed. For details, refer to the flowchart shown in Figure 5 The flowchart includes at least the following steps: S501, if the authorization request is received, the authorized node in the authorization request is authenticated.

[0074] S502, if the identity authentication of the authorized node in the authorization request is passed, the second authorization string exclusive to the authorized node is generated based on the first authorization string.

[0075] The authorization request includes at least the authorized person identity information and the use permission information. The use permission is the use permission obtained by the authorized person after being authorized by the authorizer. If the authorizer receives the authorization request initiated by the authorized person, the identity of the authorized person can be verified based on the authorization request. Since the authorization request includes the authorizer information, the identity of the authorizer can be verified based on the authorizer information. For example, the username and password provided by the authorized person in the authorization request can be compared with the username and password stored in the database. If the username and password of the authorized person exist in the database, it means that the identity verification is passed. Alternatively, the identity of the authorized person can be verified based on the verification token of the authorized person in the authorization request. The verification token can be obtained by the username and password when the authorized person logs in for the first time. When the authorized person initiates the authorization request, the verification token can be carried in the request header of the authorization request. Then the authorizer confirms the identity of the authorized person by verifying the validity of the verification token. Alternatively, the authorizer can determine the identity of the authorized person based on the digital certificate provided by the authorized person in the authorization request.

[0076] The way of verifying the identity of the authorized person is various and is not limited to the above-mentioned verification way. By verifying the identity of the authorized person, the legality of the identity of the authorized person can be determined, and the accuracy of authorization and the security of the target file are improved.

[0077] The authorization request also includes the public key of the authorized person. If the identity of the authorized person is verified, the authorizer can decrypt the first key used to encrypt the target file based on the first authorization string, and then encrypt the first key based on the public key of the authorized person to generate a second authorization string exclusive to the authorized person.

[0078] S403, if the identity verification is passed, the user end is confirmed as the authorized person, and the second authorization string exclusive to the authorized person is generated based on the first authorization string.

[0079] If the identity of the user end is verified, it means that the user end initiating the authorization request is a legal user in the CDN network, and it is determined that the user can be the authorized person. Then the authorizer can decrypt the first authorization string based on the private key to obtain the first key of the encrypted file body, and then generate the second authorization string exclusive to the authorized person based on the public key of the authorized person. It should be noted that the authorized person in the embodiments of the present disclosure is a legal user who has passed the identity verification, that is, a user who can decrypt the encrypted file body and use the target file.

[0080] In some embodiments, the method for generating the second authorization string is as shown in Figure 6 The flowchart includes the following steps: S601, the first authorization string is decrypted by the first private key to obtain the first key.

[0081] S602, performing asymmetric encryption on the first key according to the second public key in the authorization request to obtain a second authorization string.

[0082] The first private key is a private key of the authorizer, and the second public key is a public key of the authorized user. The authorizer first decrypts the first authorization string. Since the first authorization string is encrypted by using the public key of the authorizer and the asymmetric encryption algorithm on the first key, the private key of the authorizer, that is, the first private key, can be called to decrypt the first authorization string by using the same asymmetric encryption algorithm, so that the first key in the first authorization string is obtained. After the first key is obtained, the first key is asymmetrically encrypted by using the public key of the authorized user in the authorization request, so that the second authorization string is obtained. Since the second public key is the public key of the authorized user, the second authorization string is the exclusive authorization string of the authorized user, and other users cannot decrypt the second authorization string.

[0083] After the authorizer encrypts to generate the second authorization string, S404 is performed to send the second authorization string to the corresponding authorized user. The authorized user uses the second private key, that is, the private key of the authorizer, to decrypt the second authorization string by using the asymmetric encryption algorithm, so that the first key is obtained. After the first key is obtained, the encrypted file body is decrypted by using the first key and the symmetric encryption algorithm, so that the use permission of the target file is obtained. That is to say, in the CDN environment, the first authorization string of the authorizer and the encrypted file body are transmitted from the source station to the edge node. The edge node generates the second authorization string exclusive to the user and the encrypted file body according to the authorization string of the authorizer and the public key of the user terminal, and transmits them to the user. The user can access the file by using the private key of the user. Alternatively, the edge node can directly transmit the encrypted file body carrying the first authorization string to the user terminal according to the self cache, then generate the second authorization string exclusive to the user according to the public key of the user terminal, and transmit the second authorization string to the user, so that the user decrypts to obtain the encrypted file body.

[0084] In some embodiments, the CDN network includes a link node; and the authorizer of the CDN network is the link node. After the link node receives the authorization request sent by the user terminal, it can first determine whether the encrypted file body carrying the first authorization string is locally cached. If the link node does not cache the encrypted file body carrying the first authorization string, the link node can send a file acquisition request to the upper node or the source station in the CDN network to acquire the encrypted file body carrying the first authorization string.

[0085] For example, when the link node is an edge node, if the edge node receives the authorization request, it first checks whether it caches the encrypted file body carrying the first authorization string. If the edge node does not cache the encrypted file body carrying the first authorization string, it can initiate a file acquisition request to the parent node of the upper level, acquire the encrypted file body carrying the first authorization string in the parent node, and send the encrypted file body carrying the first authorization string to the user terminal through the edge node.

[0086] If the parent node does not cache the encrypted file body carrying the first authorization string, it can initiate a file acquisition request to the source station of the upper level, send the public key of the link node to the source station when making the request, make the source station encrypt the target file to generate the encrypted file body carrying the first authorization string, and make the source station send the encrypted file body carrying the first authorization string to the parent node. If the parent node caches the encrypted file body carrying the first authorization string, it sends the encrypted file body carrying the first authorization string to the edge node, and then makes the edge node send the encrypted file body carrying the first authorization string to the user terminal. It should be noted that because the first public key of the parent node and the edge node is the same, the parent node can directly send the encrypted file body carrying the first authorization string cached by itself to the edge node when sending the file to the edge node, and the edge node can use its private key to decrypt the first authorization string to authorize the user terminal.

[0087] After the link node acquires the encrypted file body carrying the first authorization string, it can locally cache the encrypted file body carrying the first authorization string, and send the encrypted file body carrying the first authorization string to the user terminal.

[0088] In some embodiments, after the edge node receives the authorization request initiated by the user at the user terminal and passes the identity verification of the user terminal, it can directly decrypt the first authorization string according to its private key, encrypt the first key according to the public key of the user terminal to obtain a second authorization string, and send the second authorization string to the user terminal together with the encrypted file body. In some embodiments, the edge node can also send the encrypted file body carrying the first authorization string to the user after receiving the authorization request of the user, generate a second authorization string according to the public key of the user in the authorization request, and then send the second authorization string to the user, so that the user decrypts the second authorization string through the second private key to obtain the first key, and decrypts the encrypted file body using the first key.

[0089] The effect achieved by the scheme of the embodiments of the present disclosure can be understood through the following scheme comparison: For example, for a file, according to the scheme in the prior art, assuming that there are 5 users to obtain the file, the source station encrypts the file by using different user keys to obtain 5 encrypted files. The 5 encrypted files are transmitted to the users through the link nodes in the CDN network. This scheme will cause a large load of the source station and a large transmission pressure of the CDN network, and the efficiency of the users to obtain the file is also low.

[0090] According to the scheme described above in the embodiments of the present disclosure, for example, the link node can send a file obtaining request to the source station in response to a file request of a first user to obtain the file, and the encrypted file of the source station can be transmitted to each link node in the CDN network, such as an edge node, and the edge node transmits the file to the user. Since the encrypted file body and the first authorization string transmitted in the CDN network are irrelevant to the user, that is, do not contain the exclusive information of the user, the CDN network can quickly spread. For other users in the above 5 users, since the same file has been stored in the edge node, when the user obtains the file, the user can directly obtain the file from the edge node without requesting the source station again. For example, referring to the example of Figure 1 The source station can send the encrypted file body generated according to the foregoing embodiments of the present disclosure to the edge node 1 to the edge node n, so that the user 1 to the user n can directly obtain the file from the edge node. To put it another way, even if the user 4 is the first user to request the file, the edge node n requests the file from the source station, and the source station only sends the file to the edge node n, the user 5 and the user n sharing the edge node n with the user 4 can also directly obtain the file from the edge node n without obtaining the file from the source station again. In this way, the transmission pressure of the CDN network is reduced, and the speed of the user to obtain the file is improved.

[0091] In the embodiments of the present disclosure, the target file is first symmetrically encrypted by using the first key to obtain an encrypted file body, and then the first key is asymmetrically encrypted by using the public key of the authorized person to obtain a first authorization string, and the first authorization string and the authorization information are encapsulated into the file header of the encrypted file body. At this time, the exclusive information of the authorized person does not exist in the encrypted file body and the first authorization string, so that the encrypted file body can be widely spread. For example, in the CDN service process, the digital file can be conveniently cached and shared, and all users can share the file body, thereby saving storage space and network resources. However, the first authorization string is obtained by asymmetrically encrypting the public key of the authorized person, so that the user cannot decrypt the data information in the encrypted file body, and needs to send an authorization request to the authorized person to obtain the use permission, thereby improving the security of the file.

[0092] After the user initiates an authorization request to the authorizer and applies for the use permission, the authorizer can perform identity authentication on the user, and after the identity authentication is passed, the first authorization string is decrypted by using the private key to obtain the first key in the first authorization string. Then, the first key is asymmetrically encrypted according to the public key of the user carried in the authorization request to obtain the second authorization string special for the user. After the user receives the second authorization string, the user becomes the authorized person, can decrypt the second authorization string by using the private key of the user, thereby obtaining the first key, and then decrypts the encrypted file body by using the first key, thereby obtaining the use permission of the target file. The authorizer generates the second authorization string special for the authorized person by performing identity authentication on the authorized person, so that the authorized person can decrypt the encrypted file body according to the second authorization string, thereby improving the security of the target file.

[0093] In some embodiments, the CDN network-based data encryption distribution method can also be applied to a data encryption system, the system comprising a source station connected with a CDN network and a link node in the CDN network as an authorizer, wherein the source station is configured to obtain a target file to be encrypted, perform symmetric encryption on the target file by using a first key to obtain an encrypted file body, perform asymmetric encryption on the first key according to a first public key of the link node to generate a first authorization string, and send the encrypted file body carrying the first authorization string to the link node, so that the link node sends the encrypted file body carrying the first authorization string to a user terminal. The link node is configured to perform identity authentication on a user terminal corresponding to an authorization request in response to receiving the authorization request, and after the identity authentication is passed, confirm the user terminal as an authorized person, generate a second authorization string special for the authorized person based on the first authorization string, and send the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key.

[0094] The CDN network-based data encryption distribution method can be seen from the flowchart shown in Figure 7 The flowchart comprises the following steps: S701, the source station obtains a target file to be encrypted, performs symmetric encryption on the target file by using a first key to obtain an encrypted file body.

[0095] S702, the source station performs asymmetric encryption on the first key according to a first public key of the link node to generate a first authorization string, and sends the encrypted file body carrying the first authorization string to the link node.

[0096] S703, in response to receiving the authorization request of the user terminal, the link node authenticates the user in the authorization request, and after the authentication is passed, generates a second authorization string special for the authorized user based on the first authorization string; wherein the authorized user is a user who sends an authorization request to the authorizer and obtains the use permission; and the authorizer is the link node.

[0097] S704, the link node sends the second authorization string to the authorized user, so that the authorized user decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key.

[0098] In some embodiments, before performing S701, the source station can first initiate a file acquisition request by the user to the link node, and if the link node checks that the target file requested by the user is not cached in the link node, the link node initiates a file acquisition request to the source station, and the source station performs S701 to encrypt the target file according to the file acquisition request, and performs S702 to asymmetrically encrypt the first key according to the first public key in the file acquisition request sent by the link node.

[0099] After receiving the encrypted file body carrying the first authorization string, the link node can directly send the encrypted file body to the user. Then, according to the authorization request initiated by the user of the CDN network, S703 and S704 are performed.

[0100] In summary, the transmission process of the target file in the embodiment of the disclosure can refer to the flowchart shown in Figure 8 The first authorization string is encapsulated into the file header of the encrypted file body, so that the encrypted file body carrying the first authorization string is sent to the link node. The link node is the authorizer, and the link node can include a parent node and an edge node. After the source station sends the encrypted file body carrying the first authorization string to the parent node, the parent node is cached and sent to the edge node, and the edge node is cached and forwarded to the user connected to the edge node. Because the encrypted file body carrying the first authorization string does not include any information special for the user, the edge node can send the encrypted file body carrying the first authorization string to different users.

[0101] Compared with the prior art, the embodiment of the disclosure has the advantages that Figure 1In the prior art, when the source station forwards the target file to the link node after encrypting the target file, the parent node and the edge node in the link node can cache the encrypted file, and then send the encrypted file to the user through the edge node, and authorize the user through the edge node to generate a second authorization string special for the user, so that the user obtains the permission to obtain the encrypted file body. Therefore, in the embodiment of the present disclosure, the transmission data of the encrypted file can be improved, especially between the source station, the parent node and the edge node. Because the parent node and the edge node can cache the encrypted file, it is not necessary to request the encrypted file from the source station every time, so the transmission speed of the encrypted file in the CDN network can be improved. For example, when the edge node receives an authorization request from a second user, the edge node can directly send the encrypted file body carrying the first authorization string cached by the edge node to the second user, without requesting the parent node again, and without encrypting the encrypted file according to the public key of the second user by the source station, thereby saving the data transmission process of the source station-parent node and the parent node-edge node, and improving the transmission speed of the encrypted file in the CDN network. Moreover, the same edge node can connect multiple users, and when different users request the encrypted file from the same edge node, the edge node can distribute the encrypted file body carrying the first authorization string cached locally to different users. The encrypted files received by different users are the same, but cannot be decrypted, thereby improving the forwarding efficiency of the file while improving the security of the file. Moreover, the same parent node can also connect multiple different edge nodes, and the parent node can also send the encrypted file body to different edge nodes, and then send the encrypted file body to the user through the edge node, so as to improve the transmission efficiency of the encrypted file body in the CDN network.

[0102] Corresponding to the foregoing embodiment of the CDN network-based data encryption distribution method, the present disclosure also provides an embodiment of a CDN network-based data encryption distribution device.

[0103] Reference is made to Figure 9 , Figure 9 A CDN network-based data encryption distribution device diagram is schematically shown in the embodiment of the present disclosure. The device is applied to a source station connected with a CDN network. The device comprises: An acquisition unit 901 is configured to acquire a target file to be encrypted and transmitted to a user end through the CDN network in response to a file acquisition request of a link node as an authorizer in the CDN network. The authorizer can grant the use permission of an encrypted file body to the user end in response to an authorization request from the user end. A first encryption unit 902 is configured to symmetrically encrypt the target file by using a first key to obtain an encrypted file body. A second encryption unit 903 is configured to asymmetrically encrypt the first key according to a first public key of the authorizer to generate a first authorization string. The processing unit 904 is configured to send the encrypted file body carrying the first authorization string to the authorized person, so as to store or forward in the CDN network.

[0104] In some embodiments, the CDN network comprises a link node; and the authorized person of the CDN network is the link node. The second encryption unit 903 is configured to asymmetrically encrypt the first key according to a first public key of the link node to generate a first authorization string, so that the link node decrypts the first authorization string according to a private key corresponding to the first public key to obtain the first key; wherein the first public key is obtained from a file acquisition request sent by the link node.

[0105] In some embodiments, the link node as the authorized person comprises a parent node and an edge node. The processing unit 904 is configured to: The source station sends the encrypted file body carrying the first authorization string to the parent node, so that the parent node caches the encrypted file body carrying the first authorization string and sends the encrypted file body carrying the first authorization string to the edge node.

[0106] In some embodiments, the processing unit 904 is configured to: encapsulate the first authorization string and authorization information into an electronic envelope of the encrypted file body, wherein the authorization information is used to determine the use permission of the target file by the authorized person; send the encrypted file body carrying the first authorization string to the link node in the CDN network based on the electronic envelope.

[0107] In a fourth aspect of the present disclosure, an embodiment of a CDN network-based data encryption distribution device is also provided, which is shown in the following Figure 10 , Figure 10 A CDN network-based data encryption distribution device is shown in the following for the embodiment of the present disclosure, which is used for a link node of a CDN network, and the link node is an authorized person; the device comprises: A receiving unit 1001 is configured to receive, by an authorized person in a CDN network, an encrypted file body carrying a first authorization string forwarded by a source station connected to the CDN network; the encrypted file body is shared by a user of the CDN network, and no exclusive information of an authorized person exists in the encrypted file body and the first authorization string; the first authorization string is generated by asymmetrically encrypting a first key based on a first public key of the authorized person, and the encrypted file body is obtained by symmetrically encrypting a target file by using the first key. The first verification unit 1002 is configured to verify the user end in the authorization request if the authorization request sent by the user end of the CDN network is received. The generating unit 1003 is configured to confirm the user end as an authorized person if the verification is passed, and generate a second authorization string special for the authorized person based on the first authorization string. The first sending unit 1004 is configured to send the second authorization string to the authorized person, so that the authorized person decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key; the second private key is the private key of the authorized person.

[0108] In some embodiments, the apparatus further includes: The determining unit is configured to determine whether the authorized person caches the encrypted file body carrying the first authorization string in response to the authorization request. The requesting unit is configured to send a file acquisition request to a superior node of the CDN network to acquire the encrypted file body carrying the first authorization string if the encrypted file body carrying the first authorization string is not cached. The second sending unit is configured to cache the encrypted file body carrying the first authorization string sent by the superior node, and send the encrypted file body carrying the first authorization string to the authorized person.

[0109] In some embodiments, the link node includes a parent node and an edge node. The requesting unit is configured to: In response to the edge node receiving the authorization request, determine whether the edge node caches the encrypted file body carrying the first authorization string. If the edge node does not cache the encrypted file body carrying the first authorization string, send a file acquisition request to the parent node, so that the parent node sends the encrypted file body carrying the first authorization string to the edge node.

[0110] In some embodiments, the generating unit 1003 is configured to: Decrypt the first authorization string by using a first private key to obtain the first key; the first private key is the private key of the authorized person. Asymmetrically encrypt the first key according to a second public key in the authorization request to obtain the second authorization string; the second public key is the public key of the authorized person.

[0111] In some embodiments, the first verification unit 1002 is configured to: authenticate the authorized party based on a username and password provided by the authorized party in the authorization request; authenticate the authorized party based on a verification token of the authorized party in the authorization request; authenticate the authorized party based on a digital certificate provided by the authorized party in the authorization request.

[0112] In a fifth aspect of the present disclosure, an embodiment of a CDN network-based data encryption distribution device is also provided, which is shown in detail as follows. Figure 11 , Figure 11 A CDN network-based data encryption distribution device is shown in the figure for the embodiment of the present disclosure, which is used in a data encryption system; the data encryption system includes a source station connected with a CDN network and a link node of the CDN network; The device includes: A third encryption unit 1101 is configured to acquire, by the source station, a target file to be encrypted, perform symmetric encryption on the target file by using a first key, and obtain an encrypted file body; A fourth encryption unit 1102 is configured to perform asymmetric encryption on the first key according to a first public key of the link node, generate a first authorization string, and send the encrypted file body carrying the first authorization string to the link node, so that the link node sends the encrypted file body carrying the first authorization string to a user terminal; A second authentication unit 1103 is configured to perform, by the link node, identity authentication on a user in an authorization request in response to receiving the authorization request; after the identity authentication is passed, the user terminal is confirmed as an authorized party, and a second authorization string special for the authorized party is generated based on the first authorization string; A second sending unit 1104 is configured to send, by the link node, the second authorization string to the authorized party, so that the authorized party decrypts the second authorization string by using a second private key to obtain the first key, and decrypts the encrypted file body by using the first key.

[0113] The implementation process of the functions and roles of each unit in the above device is specifically shown in the implementation process of the corresponding steps in the above method, which will not be repeated here.

[0114] For the apparatus embodiment, since it basically corresponds to the method embodiment, the relevant part can be seen from the part of the method embodiment. The apparatus embodiment described above is only illustrative, wherein the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present disclosure according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0115] The embodiment of the data encryption distribution apparatus based on the CDN network of the present disclosure can be applied to an electronic device. The apparatus embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking the software implementation as an example, as a logical apparatus, it is formed by reading the corresponding computer program instructions in the non-volatile memory to the memory for running by the processor of the electronic device where it is located. From the hardware level, as shown in Figure 12 Figure 12 In addition to the processor, the memory, the network interface, and the non-volatile memory shown in the figure, the electronic device where the apparatus is located in the embodiment can also include other hardware according to the actual function of the electronic device, which will not be described here.

[0116] Based on the same inventive concept, the present disclosure also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any step of the data encryption distribution method based on the CDN network when executing the program.

[0117] Based on the same inventive concept, the present disclosure also provides a computer program product, wherein the program product implements any step of the data encryption distribution method based on the CDN network when executed by the processor.

[0118] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0119] The above only describes the preferred embodiments of the present disclosure and does not limit the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.​

Claims

1. A data encryption and distribution method based on a CDN network, characterized in that, The method is applied to an origin server connected to a CDN network; the method includes: In response to a file retrieval request from a link node acting as an licensor in the CDN network, the licensor retrieves the target file to be encrypted and transmitted to the user terminal via the CDN network, wherein the licensor is able to grant the user terminal access to the encrypted file body in response to an authorization request from the user terminal. The target file is symmetrically encrypted using the first key to obtain the encrypted file body; The first key is asymmetrically encrypted using the first public key of the authorizer to generate a first authorization string; The encrypted file body carrying the first authorization string is sent to the authorizer so that it can be stored or forwarded in the CDN network.

2. The method according to claim 1, characterized in that, The step of performing asymmetric encryption on the first key based on the authorizer's first public key to generate a first authorization string includes: The source station performs asymmetric encryption on the first key based on the first public key of the link node to generate a first authorization string, so that the link node can decrypt the first authorization string based on the private key corresponding to the first public key to obtain the first key; The first public key is obtained from the file retrieval request sent by the received link node.

3. The method according to claim 1, characterized in that, The link nodes include: parent nodes and edge nodes; Sending the encrypted file body carrying the first authorization string to the authorizer includes: The source station sends the encrypted file body carrying the first authorization string to the parent node, so that the parent node caches the encrypted file body carrying the first authorization string and sends the encrypted file body carrying the first authorization string to the edge node.

4. The method according to claim 1, characterized in that, Sending the encrypted file body carrying the first authorization string to the authorizer includes: The first authorization string and authorization information are encapsulated in an electronic envelope containing the encrypted file body, wherein the authorization information is used to determine the authorized person's usage rights to the target file; Based on the electronic envelope, the encrypted file body carrying the first authorization string is sent to the link node in the CDN network.

5. A data encryption and distribution method based on a CDN network, characterized in that, The method is applied to link nodes in a CDN network, where the link node acts as an authorizer; the method includes: In a CDN network, an authorizer receives an encrypted file body carrying a first authorization string forwarded by an origin server connected to the CDN network. The first authorization string is generated by asymmetric encryption of a first key with the authorizer's first public key, and the encrypted file body is obtained by symmetric encryption of a target file using the first key. If an authorization request is received from a user client in the CDN network, the user client corresponding to the authorization request will be authenticated. If the authentication is successful, the user terminal is confirmed as the authorized party, and a second authorization string exclusive to the authorized party is generated based on the first authorization string. The second authorization string is sent to the authorized party, so that the authorized party can decrypt the second authorization string using the second private key to obtain the first key, and use the first key to decrypt the encrypted file body; the second private key is the private key of the authorized party.

6. The method according to claim 5, characterized in that, The method further includes: In response to the authorization request, determine whether the authorizer has cached an encrypted file body carrying the first authorization string; If the encrypted file body carrying the first authorization string is not cached, a file retrieval request is sent to the upstream node of the CDN network to retrieve the encrypted file body carrying the first authorization string. The system receives the encrypted file body carrying the first authorization string sent by the superior node and sends the encrypted file body to the authorized party.

7. The method according to claim 6, characterized in that, The link nodes include: parent nodes and edge nodes; If the encrypted file body carrying the first authorization string is not cached, a file retrieval request is sent to the upstream node of the CDN network, including: In response to the edge node receiving the authorization request, it is determined whether the edge node has cached the encrypted file body carrying the first authorization string; If the edge node does not cache the encrypted file body carrying the first authorization string, it sends a file retrieval request to the parent node, so that the parent node sends the encrypted file body carrying the first authorization string to the edge node.

8. The method according to claim 5, characterized in that, The step of generating a second authorization string specific to the authorized person based on the first authorization string includes: The first authorization string is decrypted using the first private key to obtain the first key; the first private key is the private key of the authorizer. The first key is asymmetrically encrypted using the second public key in the authorization request to obtain a second authorization string; the second public key is the public key of the authorized party.

9. The method according to claim 5, characterized in that, The authentication of the user terminal corresponding to the authorization request includes at least one of the following: Based on the username and password provided by the authorized person in the authorization request, the authorized person is authenticated. The authorized person is authenticated based on the verification token of the authorized person in the authorization request; The authorized person is authenticated based on the digital certificate provided by the authorized person in the authorization request.

10. A data encryption and distribution device based on a CDN network, characterized in that, The device is applied to an origin server connected to a CDN network; the device includes: The acquisition unit is configured to acquire, in response to a file acquisition request from a link node acting as an licensor in the CDN network, a target file to be encrypted and transmitted to the user terminal via the CDN network, wherein the licensor is able to grant the user terminal access to the encrypted file body in response to an authorization request from the user terminal. The first encryption unit is used to perform symmetric encryption on the target file using a first key to obtain an encrypted file body; The second encryption unit is used to perform asymmetric encryption on the first key based on the first public key of the authorizer to generate a first authorization string; The processing unit is configured to send an encrypted file body carrying the first authorization string to the authorizer so that it can be stored or forwarded in the CDN network.

11. A data encryption and distribution device based on a CDN network, characterized in that, The device is applied to a link node in a CDN network, where the link node acts as an licensor; the device includes: A receiving unit is configured to receive, from an authorizer in a CDN network, an encrypted file body carrying a first authorization string forwarded by an origin server connected to the CDN network; the encrypted file body is shared by users of the CDN network, and neither the encrypted file body nor the first authorization string contains any information specific to the authorizer; the first authorization string is generated by asymmetric encryption of a first key with the authorizer's first public key, and the encrypted file body is obtained by symmetric encryption of a target file using the first key; The first verification unit is used to verify the identity of the user terminal corresponding to the authorization request if it receives an authorization request sent by a user terminal in the CDN network. The generation unit is configured to, if the authentication is successful, confirm the user as the authorized party and generate a second authorization string specific to the authorized party based on the first authorization string; The first sending unit is configured to send the second authorization string to the authorized party, so that the authorized party can decrypt the second authorization string using the second private key to obtain the first key, and use the first key to decrypt the encrypted file body; the second private key is the private key of the authorized party.

12. A data encryption and distribution method based on a CDN network, characterized in that, The method is applied to a data encryption system, which includes an origin server connected to a CDN network and a link node in the CDN network acting as an licensor. The method includes: In response to the file retrieval request sent by the link node, the source station obtains the target file to be encrypted, and performs symmetric encryption on the target file using the first key to obtain the encrypted file body; The source station performs asymmetric encryption on the first key based on the first public key of the link node to generate a first authorization string, and sends the encrypted file body carrying the first authorization string to the link node, so that the link node sends the encrypted file body to the user terminal; The link node responds to the authorization request from the user terminal by authenticating the user terminal corresponding to the authorization request; after the authentication is successful, the user terminal is confirmed as the authorized party, and a second authorization string exclusive to the authorized party is generated based on the first authorization string. The link node sends the second authorization string to the authorized party, so that the authorized party can decrypt the second authorization string using the second private key to obtain the first key, and use the first key to decrypt the encrypted file body.

13. A data encryption and distribution system based on a CDN network, characterized in that, The system includes an origin server connected to a CDN network and link nodes in the CDN network that act as licensors. The source station is used to obtain the target file to be encrypted, perform symmetric encryption on the target file using a first key to obtain an encrypted file body; perform asymmetric encryption on the first key according to the first public key of the link node to generate a first authorization string, and send the encrypted file body carrying the first authorization string to the link node so that the link node sends the encrypted file body to the user; The link node is used to verify the identity of the user corresponding to the authorization request received from the CDN network user. After successful authentication, the user terminal is confirmed as the authorized party, and a second authorization string exclusive to the authorized party is generated based on the first authorization string; and the second authorization string is sent to the authorized party so that the authorized party can decrypt the second authorization string with the second private key to obtain the first key, and use the first key to decrypt the encrypted file body.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by a processor, it implements the steps of the method according to any one of claims 1-4, 5-9, or 12.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1-4, 5-9, or 12.

16. A computer program product, comprising a computer program, characterized in that, Includes computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is executed in a processor of an electronic device, the processor in the electronic device performs the steps of any of the methods of claims 1-4, 5-9, or 12.

Images