Data access method based on dynamic token, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data security, in particular to a data access method based on a dynamic token, electronic equipment and a storage medium, the method comprises the following steps: in response to a token application request of a first entity, generating and issuing a data access token to the first entity through a preset trusted third party, the second entity triggers a verification request after receiving a data access request carrying the data access token sent by the first entity, the preset trusted third party receives the verification request for the data access token sent by the second entity, the validity of the data access token is verified through the preset trusted third party, and a verification result is returned to the second entity; the execution of the data access request of the first entity by the second entity is controlled; according to the invention, the current authority of both parties of the data transaction can be verified at the same time, so that the data transaction security during data interaction between cross-domain or mutual-mutual-trust entities is ensured.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data access method, electronic device, and storage medium based on dynamic tokens. Background Technology

[0002] In cross-domain or cross-organizational data sharing and exchange scenarios, such as inter-enterprise collaborative R&D, supply chain collaboration, or risk control data verification, the entities involved in data interaction often lack sufficient direct trust. Currently, the mainstream technical solutions for achieving secure and controllable data access in such scenarios mainly rely on bidirectional Transport Layer Security (TLS) authentication based on public key infrastructure, or use static application interface keys, offline verifiable tokens, and other technical means. However, they all have significant limitations when facing dynamic and fine-grained access control requirements.

[0003] Specifically, while two-way TLS authentication can establish trusted identities between communicating parties and ensure the security of the transmission channel by exchanging certificates, it cannot manage each specific data access request based on real-time changing business policies, such as temporary authorization and permission revocation. Even if an entity's business permissions are revoked, a technical connection can still be established as long as the certificate has not expired, posing a certain data security risk. Although static keys and tokens that can be verified offline can both be used for authorization, the former lacks fine-grainedness and timeliness, and the risk is huge once leaked. The latter, although it includes an expiration time, its verification usually does not rely on real-time status queries from a central authority, making it impossible to effectively and promptly revoke the issued tokens, which is insufficient to meet the high security requirements for real-time and precise control over data access. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a data access method, electronic device, and storage medium based on dynamic tokens. By issuing dynamic tokens and performing real-time token verification, the current permissions of both parties in a data transaction can be verified simultaneously, thereby ensuring the security of data transactions when interacting with data across domains or between entities that do not trust each other.

[0005] According to a first aspect of the present invention, a data access method based on a dynamic token is provided, comprising the following steps: In response to the token request of the first entity, a data access token is generated and issued to the first entity through a preset trusted third party. The data access token contains access authorization information and access time window for the second entity. Both the first entity and the second entity refer to entities that have been endorsed by the preset trusted third party. The first entity and the second entity have established a two-way encrypted communication connection.

[0006] The system receives a verification request for a data access token from a second entity via a pre-defined trusted third party; wherein the verification request is triggered by the second entity after receiving a data access request carrying a data access token from a first entity.

[0007] The validity of the data access token is verified by a pre-set trusted third party; the validity of the data access token verification includes at least verifying whether the data access token was issued by the pre-set trusted third party itself, whether it has not been revoked, and whether it is within the access time window.

[0008] The verification result is returned to the second entity to control the execution of the second entity's data access request to the first entity.

[0009] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored therein, the at least one instruction or the at least one program being loaded and executed by a processor to implement the above-described data access method based on dynamic tokens.

[0010] According to a third aspect of the present invention, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0011] The present invention has at least the following beneficial effects: This invention provides a data access method based on dynamic tokens. First, in response to a token request from a first entity, a data access token is generated and issued to the first entity by a pre-set trusted third party. The data access token contains access authorization information and an access time window for a second entity, ensuring the credibility and consistency of the authorization source and reducing the risk of data leakage. After receiving a data access request carrying the data access token from the first entity, the second entity triggers a verification request. A pre-set trusted third party receives the verification request for the data access token sent by the second entity and verifies the validity of the data access token. This method utilizes a trusted third party to issue dynamic tokens. Real-time token verification simultaneously verifies the current permissions of both parties in a data transaction, decoupling static identity authentication from dynamic business authorization. This enables fine-grained, temporary access control, and the validity of the token is ensured through multi-dimensional verification, thereby guaranteeing secure data transmission. Finally, the verification result is returned to the second entity to control its execution of data access requests to the first entity. This invention constructs a dynamic trust system based on short-term credentials, fundamentally solving the problems of existing credentials lacking real-time performance and the inability to revoke them in a fine-grained manner. This significantly improves the security of data transactions when data is exchanged between cross-domain or untrusted entities. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A flowchart of a data access method based on dynamic tokens provided in an embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] This invention provides a data access method based on dynamic tokens, such as... Figure 1 As shown, the method includes the following steps: S1, in response to the token application request of the first entity, a data access token is generated and issued to the first entity through a preset trusted third party. The data access token contains access authorization information and access time window for the second entity. It can be understood that the preset trusted third party is a pre-built authoritative basic support platform. The data access token (DAT) issued to the first entity has authorization information to access any entity in any basic support platform. At this time, the second entity refers to any entity.

[0016] Specifically, both the first entity and the second entity refer to entities whose identities have been endorsed by a pre-set trusted third party; this can be understood as the pre-set trusted third party issuing trust certificates to both the first entity and the second entity. For example, the entities whose identities have been endorsed by the pre-set trusted third party can be enterprises, institutions, etc.

[0017] In practice, the first entity and the second entity have established a two-way encrypted communication connection. For example, a two-way encrypted communication connection has been established within a Certificate Authority (CA) platform that is mutually trusted by both parties.

[0018] Furthermore, the establishment of a bidirectional encrypted communication connection between the first entity and the second entity constitutes a bidirectional TLS authentication connection between the first entity and the second entity.

[0019] As described above, after two entities establish a mutual trust relationship through bidirectional encrypted communication, considering that if one entity is prohibited from data transaction permissions, other entities may continue to conduct data transactions without knowing this, thus causing data security risks, the above solution introduces a pre-set trusted third party to verify the permissions of entities that need to conduct data transactions in real time, based on bidirectional TLS authentication. This decouples static identity authentication from dynamic business authorization, achieving fine-grained and temporary access control. Furthermore, by using precise access authorization information and access time windows, the risk of data leakage is reduced. In addition, all tokens are issued by a unique trusted third party, ensuring the credibility and consistency of the authorization source.

[0020] S2, receiving a verification request for a data access token sent by a second entity through a pre-set trusted third party; wherein, the verification request is triggered by the second entity after receiving a data access request carrying a data access token from the first entity.

[0021] In practice, when the first entity needs to conduct data transactions with the second entity, the first entity sends a data access token when sending a data access request to the second entity. When the second entity receives the data access request, it needs to send the data access token to a pre-set trusted third party for verification.

[0022] As mentioned above, when the first entity and the second entity need to conduct data transactions, it is necessary to verify whether both parties have the authority to conduct data transactions. The first entity applies for a data access token and sends the token to the second entity. A pre-set trusted third party receives the verification request for the token sent by the second entity. The authorization verification logic is centralized in the trusted third party, making the verification results more fair and reliable. Furthermore, the online verification mechanism provides a channel for the real-time revocation of weights in the future.

[0023] S3, verify the validity of the data access token by a preset trusted third party; the validity of the data access token verification includes at least verifying whether the data access token was issued by the preset trusted third party itself, whether it has not been revoked, and whether it is within the access time window.

[0024] Furthermore, verifying the validity of the data access token also includes verifying whether the second entity identifier recorded in the data access token matches the second entity that initiated the verification request. In this embodiment, the first entity needs to explicitly include the specific entity object to be involved in the data transaction in the token request when sending the token request, and a trusted third party is pre-set to carry the second entity identifier to be involved in the data transaction in the data access token sent to the first entity.

[0025] In one specific embodiment, the method further includes the following steps: In response to a permission revocation command, the data access token received by the first entity, issued by a pre-defined trusted third party and within the access time window, is marked as revoked, thus invalidating the verification result of the data access token. For example, when an entity has a significant problem and its data transaction permissions are revoked, a permission revocation command is sent to the pre-defined trusted third party.

[0026] As described above, verifying the issuance source of data access tokens can prevent token forgery. Checking the revocation status can immediately suspend the permissions of any issued tokens and prevent the continued use of revoked tokens, achieving real-time dynamic security control. Furthermore, by verifying the time window, it can ensure that access permissions do not expire, meeting temporary access needs while also improving the security of data transactions. Through multi-dimensional verification, the validity of the token can be ensured, that is, both parties to the transaction have the transaction permissions, thereby guaranteeing the secure transmission of data.

[0027] S4 returns the verification result to the second entity to control the execution of the second entity's data access request to the first entity; this can be understood as follows: when the verification is successful, it indicates that both the first entity and the second entity have transaction permissions, and the second entity performs the corresponding allow or deny operation based on the data access request of the first entity; when the verification fails, it indicates that neither the first entity nor the second entity has data transaction permissions, and the data transmission channel is closed.

[0028] The verification result is returned to the second entity, that is, the decision of the pre-set trusted third party is fed back to the data holder. The data holder executes subsequent operations according to the instructions of the pre-set trusted third party. It cannot bypass the authorization verification on its own. This builds a dynamic trust system based on short-term credentials, which fundamentally solves the problems of traditional static credentials or offline verification credentials lacking real-time performance and unable to revoke permissions in terms of permission management. It improves the dynamic control and high security of cross-organizational data transmission and data sharing.

[0029] In another specific embodiment, the response to the token request from the first entity, which generates and issues a data access token to the first entity through a pre-set trusted third party, is further replaced by the following steps: A pre-defined trusted third party is controlled to periodically push the data access token corresponding to the pre-defined entity to each pre-defined entity at a pre-defined time interval Δt; wherein, the push period is the same for different pre-defined entities but the sending time points are staggered. Specifically, the data access token is dynamically generated based on the account identifier of the preset entity, its current storage space, preset interaction characteristic attributes, and the current issuance timestamp. The preset entity can be any entity whose identity has been endorsed by a preset trusted third party. For example, the preset interaction characteristic attributes can be data transmission frequency, historical active interaction time periods, secure channel fingerprints, or data transaction types. The generation of the token integrates the specific identifier and interaction characteristics of the target entity, making the token itself more unique and scenario-specific.

[0030] When the first entity receives a data access token, it stores the token and deletes it if the token exceeds the access time window. This localized storage and automatic deletion mechanism ensures that the token is only available within a limited time window, even after it is issued, and reduces storage space usage.

[0031] When the first entity sends a data access request to the second entity, it also sends the currently stored data access token to the second entity.

[0032] The above-mentioned approach replaces the original embodiment by periodically pushing data access tokens to each entity through a pre-set trusted third party. This eliminates the need for entities to apply for tokens before each data transaction, reducing interaction latency and network request overhead. This allows the first entity to initiate the data transaction process even during subsequent short offline periods or periods of network instability. At the same time, by distributing the token issuance pressure from real-time request peaks to the periodic push process, it helps to smooth the processing load of the pre-set trusted third party, improve system stability, and further enhance the overall system efficiency and reliability in high-concurrency or frequent transaction scenarios by staggering the push times of different entities.

[0033] Furthermore, the pre-defined trusted third party generates a data access token through the following steps: Based on a preset time interval Δt, the number of daily data access tokens corresponding to any preset entity is obtained. The number of daily data access tokens corresponding to any preset entity is the value obtained by rounding up the total daily duration divided by the preset time interval Δt.

[0034] If the number of data access tokens per day is less than a preset threshold, a supplementary numerical coefficient is generated for each data access token per day based on a preset numerical generation rule. The product of the supplementary numerical coefficient and the number of days corresponding to that day is then added to the data access token as a supplementary parameter, generating a new data access token. This can be understood as the number of days corresponding to that day within the valid period of the preset numerical generation rule. In practice, the preset numerical generation rule can be modified periodically, or the counting of days can be restarted after a certain preset time period, such as one year.

[0035] Specifically, the preset quantity threshold is the number of values ​​that can be generated based on the preset value generation rules.

[0036] Preferably, the preset value generation rule refers to generating all prime numbers within a preset maximum value. Those skilled in the art can set the preset maximum value according to actual needs, such as one thousand, which will not be elaborated upon here.

[0037] As mentioned above, considering that without adding supplementary parameters, if the dynamic parameters in the data access token are not updated, multiple consecutive data access tokens may have the same string except for the issuance timestamp, which is easy to crack and has low security, while adding random numbers will make it impossible to crack. This embodiment dynamically sets a supplementary parameter that conforms to local rules, injecting unpredictable differentiated variables into each token, so that each token has high uniqueness and date correlation, effectively making up for the security weaknesses that may exist in the automatic push mode, greatly improving the security of the token itself, and when a security event is sent, by analyzing the parameters in the token, the issuance date of the token can be quickly and accurately located, improving the traceability of the system.

[0038] If the number of data access tokens per day is not less than a preset threshold, a corresponding supplementary numerical coefficient is generated for each data access token per day based on the preset numerical generation rules, until a preset threshold of supplementary numerical coefficients are generated. Then, the corresponding supplementary numerical coefficients are generated for the remaining data access tokens of the day based on the preset numerical rules, and the product of each supplementary numerical coefficient and the corresponding number of days is added to the data access token as a supplementary parameter to generate a new data access token.

[0039] As mentioned above, by controlling the threshold, the data access token generation scheme can be automatically switched when the number of values ​​generated according to the preset value generation rules is insufficient. This allows the scheme to adapt to application scenarios with different access frequencies, improving the versatility and scalability of the scheme.

[0040] Embodiments of the present invention also provide a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a method in the method embodiments, wherein the at least one instruction or the at least one program is loaded and executed by the processor to implement the data access method based on dynamic tokens provided in the above embodiments.

[0041] Embodiments of the present invention also provide an electronic device, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0042] While specific embodiments of the invention have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of the invention. It should also be understood that various modifications can be made to the embodiments without departing from the scope and spirit of the invention. The scope of the invention is defined by the appended claims.

Claims

1. A data access method based on dynamic tokens, characterized in that, The method includes the following steps: In response to a token request from a first entity, a data access token is generated and issued to the first entity through a pre-set trusted third party. The data access token contains access authorization information and an access time window for the second entity. Both the first entity and the second entity refer to entities that have been endorsed by the pre-set trusted third party. The first entity and the second entity have established a two-way encrypted communication connection. The system receives a verification request for a data access token from a second entity via a pre-defined trusted third party; wherein the verification request is triggered by the second entity after receiving a data access request carrying a data access token from a first entity. The validity of the data access token is verified by a pre-set trusted third party; the validity of the data access token verification includes at least verifying whether the data access token was issued by the pre-set trusted third party itself, whether it has not been revoked, and whether it is within the access time window; The verification result is returned to the second entity to control the execution of the second entity's data access request to the first entity.

2. The data access method based on dynamic tokens according to claim 1, characterized in that, The validity of the verification data access token also includes whether the second entity identifier recorded in the verification data access token matches the second entity that initiated the verification request.

3. The data access method based on dynamic tokens according to claim 1, characterized in that, The method further includes the following steps: In response to the permission revocation command, the data access token received by the first entity, issued by a preset trusted third party and within the access time window, is marked as revoked, so that the verification result of the data access token is invalid.

4. The data access method based on dynamic tokens according to claim 1, characterized in that, The first entity and the second entity have established a two-way encrypted communication connection, which is a two-way TLS certified connection between the first entity and the second entity.

5. The data access method based on dynamic tokens according to claim 1, characterized in that, In response to the token request from the first entity, a data access token is generated and issued to the first entity by a pre-set trusted third party, and then replaced through the following steps: A preset trusted third party is controlled to periodically push a data access token corresponding to each preset entity at a preset time interval Δt; wherein, the push period is the same for different preset entities but the sending time points are staggered; the data access token is dynamically generated based on the preset entity's own account identifier, current storage space, preset interaction feature attributes and current issuance timestamp; the preset entity is any entity that has been endorsed by the preset trusted third party. When the first entity receives the data access token, it stores the data access token and deletes it when it detects that the data access token has exceeded the access time window. When the first entity sends a data access request to the second entity, it also sends the currently stored data access token to the second entity.

6. The data access method based on dynamic tokens according to claim 5, characterized in that, The pre-defined trusted third party also generates a data access token through the following steps: Based on a preset time interval Δt, obtain the number of daily data access tokens corresponding to any preset entity; If the number of data access tokens per day is less than a preset threshold, a corresponding supplementary numerical coefficient is generated for each data access token per day based on a preset numerical generation rule. The product of the supplementary numerical coefficient and the number of days corresponding to that day is added to the data access token as a supplementary parameter to generate a new data access token. The preset threshold is the number of values ​​that can be generated based on the preset numerical generation rule. If the number of data access tokens per day is not less than a preset threshold, a corresponding supplementary numerical coefficient is generated for each data access token per day based on the preset numerical generation rules, until a preset threshold of supplementary numerical coefficients are generated. Then, the corresponding supplementary numerical coefficients are generated for the remaining data access tokens of the day based on the preset numerical rules, and the product of each supplementary numerical coefficient and the corresponding number of days is added to the data access token as a supplementary parameter to generate a new data access token.

7. The data access method based on dynamic tokens according to claim 6, characterized in that, The preset value generation rule refers to generating all prime numbers within a preset maximum value.

8. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program segment is loaded and executed by the processor to implement the data access method based on dynamic tokens as described in any one of claims 1-7.

9. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 8.

Images