Cloud data authorization method based on user authorization

Abstract

The invention provides a cloud data authorization method based on user authorization. The method comprises the following steps: classifying user data; setting different permission rules according to the category of the user data; user data are uploaded to the cloud; and the user accesses cloud data. According to the method, a perfect data access authorization mode is designed for the user, and the privacy of the user is effectively protected in a big data environment. According to the method, the user side data is classified, the identification bits which are uploaded by the user and can represent different data types and limitation rules are matched, data access permission control meeting the requirements of the user uploading the data is achieved by means of permission judgment during data access, and the method is flexible, controllable, high in operability, safe and stable.

Description

Technical Field

[0001] This invention belongs to the field of data processing technology, specifically relating to a cloud data authorization method based on user authorization. Background Technology

[0002] Data storage is the process of recording data in some form on certain storage media. Common storage media include hard drives, optical discs, USB flash drives, and flash memory chips. There are various methods of data storage, such as direct storage and network storage. Direct storage stores data on devices with processors and memory, such as personal computers or servers. Network storage stores data on storage devices connected via a network, such as NAS (Network Attached Storage) or SAN (Storage Area Network). Network-connected storage devices are typically designed for high availability, ensuring continuous data availability. Network storage systems can usually be easily expanded in capacity and performance to meet the growing needs of businesses. Network storage allows for faster access and processing of large amounts of data and provides data backup, recovery, and encryption functions to ensure data security. Therefore, network storage of data is becoming increasingly widely used. However, in the current internet environment, once a user submits data, they can no longer manage it. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a cloud data authorization method based on user authorization, which designs a comprehensive data access authorization method for users and effectively protects user privacy in a big data environment.

[0004] To achieve the above objectives, the technical solution of the present invention is as follows:

[0005] The cloud data authorization method based on user authorization includes the following steps:

[0006] Step 1, User Data Classification

[0007] User data is categorized into different types, including: privacy data, unrestricted access data, restricted access data, and user-authorized access data; restricted access data is further subdivided into smaller categories based on different restriction rules.

[0008] Step 2: Set different permission rules based on the category of user data.

[0009] Set access identifiers, which should include at least: privacy identifier, restriction identifier, and authorization identifier, to identify the specific category of data;

[0010] Set various restriction rules to restrict access to data; associate access identifiers with restriction rules;

[0011] Step 3: Upload user data to the cloud.

[0012] The categorized data has a unique data identifier, and the categorized data, along with its data identifier and access identifier, is uploaded to the cloud; the restriction rules are uploaded to the cloud separately or transmitted to the cloud storage together with the categorized data.

[0013] Step 4, user accesses cloud data

[0014] When a user sends a request to access cloud data, the cloud authentication system determines that the user is a legitimate user before proceeding to the next steps.

[0015] The server obtains the access identifier of the data to be accessed, and performs the following operations based on the access identifier:

[0016] (1) When it is determined that the access identifier indicates that the data is private data, the user's access request is denied;

[0017] (2) When it is determined that the access identifier indicates that the data is unrestricted access data, allow the user to access the data;

[0018] (3) When it is determined that the access identifier indicates that the data is restricted access data, the corresponding restriction rules are obtained according to the access identifier. The restriction rules are used to determine whether the user who made the access request and the relevant environment meet the restriction conditions. If the restriction conditions are met, the user is allowed to access the data. If the restriction conditions are not met, the user's access request is rejected.

[0019] (4) When it is determined that the access identifier indicates that the data is authorized by the user, collect the relevant user data, send the data identifier of the data that the user wants to access and the relevant user data to the user terminal to which the data belongs, and allow the user who sent the access request to access the data if the user is granted access authorization within the specified time. If the user is not granted access authorization within the specified time, the user who sent the access request is denied access to the data.

[0020] Furthermore, in step 4, if the user ID is the same as the user ID to which the data belongs, then there is no need to determine the access identifier, and the user is allowed to access the data.

[0021] Furthermore, set overall access permissions, which indicate whether user data can be subject to access identification and restriction rules, or whether it is generally in an accessible / denied access state.

[0022] Furthermore, a total access permission flag is set. When the total access permission flag is "0", user data is not open to access, and the server does not need to judge the access flag in step 4, and directly denies access to other users. When the total access permission flag is "1", the access flag and restriction rules are applied, and step 4 is executed. When the total access permission flag is "2", the server does not need to judge the access flag in step 4, and access is fully open.

[0023] Furthermore, it also includes the following steps:

[0024] Step 5: Data access identifiers and restriction rules are updated regularly.

[0025] Furthermore, in step 2, a privacy identifier value of 0 or 1 indicates whether the data is private or not. A restriction identifier value of 0 indicates unrestricted access, and a value of n indicates the nth restriction category, where n = 1 to 9. An authorization identifier value of 0 or 1 indicates whether real-time user authorization is required or not.

[0026] The beneficial effects of this invention are as follows:

[0027] This invention provides a cloud data authorization method that categorizes user-end data and matches user-uploaded identifiers that represent different data types and restriction rules. When accessing data, it relies on permission judgment to implement data access permission control that meets the needs of the user who uploaded the data. It is flexible, controllable, highly operable, secure, and stable. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the cloud data authorization method based on user authorization provided by the present invention. Detailed Implementation

[0029] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0030] This invention provides a cloud data authorization method based on user authorization, the flowchart of which is as follows: Figure 1 As shown, it includes the following steps:

[0031] Step 1, User Data Classification

[0032] User data should be categorized according to data access permissions, and the access permission rules should be designed according to these categories. This embodiment uses the following data categories as examples: privacy data, unrestricted access data, restricted access data, and user-authorized access data. Privacy data can only be accessed by the user who uploaded it; unrestricted access data can be accessed by all users on the network; restricted access data allows access by the responsible user under certain conditions; and user-authorized access data requires real-time authorization from the user before access is permitted. Restricted access data can have various restriction rules; therefore, restricted access data can be further subdivided into smaller categories based on different restriction rules.

[0033] Step 2: Set different permission rules based on the category of user data.

[0034] This invention sets access identifier data to indicate specific data permissions. Specifically, in this embodiment, a privacy identifier, a restriction identifier, and an authorization identifier are set to identify the specific category of data. The privacy identifier value is 0 or 1, indicating whether it belongs to privacy data or not. A restriction identifier value of 0 indicates unrestricted access, and a value of n indicates the nth restricted category, where n = 1 to 9. An authorization identifier value of 0 or 1 indicates whether real-time user authorization is required or not. Each type of data has its own identifier bits, and when the data is uploaded to the cloud, the identifier bits and the corresponding data are packaged together. The first bit of the identifier bits is the privacy identifier, the second bit is the restriction identifier, and the third bit is the authorization identifier. Therefore, the access identifier for privacy data is "101", the access identifier for unrestricted access data is "000", the access identifier for restricted access data is "010", and the access identifier for user-authorized access data is "001". More bits can be reserved for the access identifier to allow for future updates of more information bits used for judgment.

[0035] In addition, various restriction rules can be set to limit access to data, such as the IP address and ID of the user, the number of times the same user can access the data, the total number of accesses, and the access time. Examples are as follows: Restriction rule 1 (maximum total accesses 99), Restriction rule 2 (access time before 23:59 on December 31, 2023 (inclusive)), and Restriction rule 3 (maximum accesses for the same ID 9 times, access time before 23:59 on June 30, 2024 (inclusive)).

[0036] Step 3: Upload user data to the cloud.

[0037] Classified data should be assigned a unique data identifier, which, combined with an access identifier, should be uploaded to the cloud. This unique data identifier contains a code sufficient to identify the data and the user who uploaded it. It should be noted that the number of data identifiers should correspond to the number of categories of restricted access data. Various restriction rules for restricted access data should also be uploaded along with the restricted access data, with the uploaded restriction rules being {Restricted Access Rule 1, Restricted Access Rule 2, ...}. Therefore, the data uploaded to the cloud is {User ID, Privacy Data, Data Identifier, Access Identifier; Unrestricted Access Data, Data Identifier, Access Identifier; Restricted Access Data 1, Data Identifier, Access Identifier; Restricted Access Data 2, Data Identifier, Access Identifier, ...; Restriction Rules; User-Authorized Access Data, Data Identifier, Access Identifier}. Restriction rules can also be uploaded to the cloud separately, but in most cases, they should be pre-transmitted to cloud storage before the data is uploaded.

[0038] User data is uploaded to a cloud storage center via the network. Privacy-sensitive data must be stored encrypted. In addition, legally accessed data, restricted access data, and user-authorized access data are all stored with limited encryption. Encryption can be performed both on the user's end and in the cloud, using common encryption methods.

[0039] Step 4, user accesses cloud data

[0040] When other users send requests to access cloud data, authentication is first performed in the cloud to determine if they are legitimate users. If the user is legitimate, the subsequent steps for accessing cloud data continue. If the user is not legitimate, access is denied.

[0041] When another user successfully authenticates and needs to access certain data, the server obtains the data access identifier and performs the following operations based on the access identifier:

[0042] (1) When the access identifier is determined to be “101”, the user access request is rejected and the user ID and access time are recorded.

[0043] (2) When the access identifier is determined to be “000”, allow the user to access the data and record the user ID, access time, number of times the user accessed the data, and total number of times the data was accessed.

[0044] (3) When the access identifier is "0n0", i.e., the restriction identifier is non-zero, the corresponding access rule is extracted based on the value of n. For example, if the access identifier is 010, the access rule 1 is used to determine whether the total number of accesses to the data has reached the upper limit. If it has not reached the upper limit, the user is allowed to access the data, and the user ID, access time, number of times the user accessed the data, and the total number of accesses to the data are recorded. If the access identifier is 030, the access rule 3 is used to determine whether the number of times the user accessed the data exceeds 9 and whether the access time exceeds 23:59 on June 30, 2024. If neither of these conditions is met, the data access is allowed, and the user ID, access time, number of times the user accessed the data, and the total number of accesses to the data are recorded. If the access rules are not met, the user access request is rejected, and the user ID and access time are recorded.

[0045] (4) When the access identifier is determined to be “001”, collect relevant user data, such as ID, access time, IP region, etc., and send the data identifier of the data that the user wants to access and the relevant user data to the user terminal to which the data belongs. When the user is granted access authorization within the specified time, the user who sent the access request is allowed to access the data. If the user is not authorized within the specified time, the user who sent the access request is denied access to the data.

[0046] It should be noted that when the user ID is the same as the user ID to which the data belongs, there is no need to check the access identifier, and the user is allowed to access the data they uploaded.

[0047] As an improvement, a total access permission can be set. This permission indicates whether user data can be subject to access identifiers and restriction rules, or whether it is generally in an accessible / denied access state. The total access permission can also be distinguished by an identifier. For example, when the total access permission identifier is "0", user data is not open to access, and the server does not need to determine the access identifier, directly denying access to other users. In this case, access is also denied to the user who uploaded the data. When the total access permission is "1", the access identifier and restriction rules are applied, i.e., the steps mentioned above, where the server operates based on the data access identifier, are executed. When the total access permission is "2", access is completely open. Setting a total access permission allows users to pre-set an overall access permission, enabling quick control over whether all uploaded data is allowed access, eliminating the need to determine access for each type of data, thus improving efficiency.

[0048] Step 5, update access identifiers and restriction rules

[0049] The cloud platform should periodically interact with users who upload data to determine if data access identifiers and restriction rules need to be changed. Users can also proactively send new data access identifiers and restriction rules to the cloud. Updates to overall access permissions involve a wide range of data and require secondary confirmation (preferably with a delayed operation) to prevent accidental data leaks.

[0050] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A cloud data authorization method based on user authorization, characterized in that, Includes the following steps: Step 1, User Data Classification User data is categorized into different types, including: privacy data, unrestricted access data, restricted access data, and user-authorized access data; restricted access data is further subdivided into smaller categories based on different restriction rules. Step 2: Set different permission rules based on the category of user data. Set access identifiers, which should include at least: privacy identifier, restriction identifier, and authorization identifier, to identify the specific category of data; Set various restriction rules to restrict access to data; associate access identifiers with restriction rules; Step 3: Upload user data to the cloud. The categorized data has a unique data identifier, and the categorized data, along with its data identifier and access identifier, is uploaded to the cloud; the restriction rules are uploaded to the cloud separately or transmitted to the cloud storage together with the categorized data. Step 4, user accesses cloud data When a user sends a request to access cloud data, the cloud authentication system determines that the user is a legitimate user before proceeding to the next steps. The server obtains the access identifier of the data to be accessed, and performs the following operations based on the access identifier: (1) When it is determined that the access identifier indicates that the data is private data, the user's access request is denied; (2) When it is determined that the access identifier indicates that the data is unrestricted access data, allow the user to access the data; (3) When it is determined that the data represented by the access identifier is restricted access data, the corresponding restriction rule is obtained according to the association between the access identifier and the restriction rule. The restriction rule is used to determine whether the user who made the access request and the relevant environment meet the restriction conditions. If the restriction conditions are met, the user is allowed to access the data. If the restriction conditions are not met, the user's access request is rejected. (4) When it is determined that the access identifier indicates that the data is authorized by the user, collect the relevant user data, send the data identifier of the data that the user wants to access and the relevant user data to the user terminal to which the data belongs, and allow the user who sent the access request to access the data if the user is granted access authorization within the specified time. If the user is not granted access authorization within the specified time, the user who sent the access request is denied access to the data.

2. The cloud data authorization method based on user authorization according to claim 1, characterized in that, In step 4, if the user ID is the same as the user ID to which the data belongs, then there is no need to determine the access identifier, and the user is allowed to access the data.

3. The cloud data authorization method based on user authorization according to claim 1, characterized in that, Set overall access permissions, which indicate whether user data can be subject to access identification and restriction rules, or whether it is generally in an accessible / denied access state.

4. The cloud data authorization method based on user authorization according to claim 3, characterized in that, Set the total access permission flag. When the total access permission flag is "0", user data is not open to access. In step 4, the server does not need to check the access flag and directly denies access to other users. When the total access permission flag is "1", the access flag and restriction rules are applied and step 4 is executed. When the total access permission flag is "2", the server does not need to check the access flag in step 4 and fully opens access.

5. The cloud data authorization method based on user authorization according to claim 1, characterized in that, It also includes the following steps: Step 5: Data access identifiers and restriction rules are updated regularly.

6. The cloud data authorization method based on user authorization according to claim 1, characterized in that, In step 2, the privacy identifier value is 0 or 1, indicating whether it belongs to privacy data or not. When the restriction identifier value is 0, it indicates unrestricted access; when it is n, it is the nth restriction category, where n = 1 to 9. The authorization identifier value is 0 or 1, indicating whether real-time user authorization is not required or real-time user authorization is required.

Images