Data access management method and system, electronic equipment and storage medium

Abstract

The invention discloses a data access management method and system, electronic equipment and a storage medium, and relates to the technical field of cloud. The method comprises the steps that a mounting request, sent by a virtual server, of a network attached storage is received, and the mounting request carries authentication information corresponding to a user to which the virtual server belongs; the network attached storage comprises a storage instance, the storage instance is used for storing data information of a plurality of users, and the data information of each user is stored in a respective corresponding private file directory; and authenticating the authentication information to obtain an authentication result, and executing an operation corresponding to the authentication result. According to the embodiment of the invention, the technical problems that the number of service users of the NAS service provided in the related technology is limited, and the speed of reading and writing files on the NAS by the users is low can be solved.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and more specifically to a data access management method, system, electronic device, and storage medium. Background Technology

[0002] With the continuous development of cloud technology, NAS (Network Attached Storage) uses standard network protocols to achieve data transmission, providing file sharing and data backup for computers with various operating systems in the cloud network. In related technologies, cloud NAS service providers offer NAS services by creating a corresponding NAS instance for each NAS user. Since each NAS instance corresponds to an independent NAS storage unit, and the NAS storage capacity provided by the NAS service provider has an upper limit, this method can only support a limited number of NAS instances, making it unsuitable for large-scale user deployments. Furthermore, because the NAS read / write bandwidth performance of a NAS instance is directly proportional to the storage space corresponding to the NAS instance purchased by the user, when the storage space corresponding to the purchased NAS instance is small, the user will experience slow file read / write speeds on the NAS, resulting in a poor user experience. Summary of the Invention

[0003] In view of the above problems, this application provides a data access management method, system, electronic device and storage medium to at least solve the technical problems of limited number of NAS service users and slow file reading and writing speed on NAS provided in related technologies.

[0004] According to a first aspect of the embodiments of this application, a data access management method is provided, applied to a storage service client, which receives a mounting request for network-attached storage sent by a virtual server, the mounting request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, the storage instance being used to store data information of multiple users, each user's data information being stored in its respective private file directory; the authentication information is authenticated to obtain an authentication result, and an operation corresponding to the authentication result is performed.

[0005] According to a second aspect of the embodiments of this application, a data access management device is provided, applied to a storage service terminal. The device includes: a receiving unit, which receives a mounting request for network-attached storage sent by a virtual server, the mounting request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, the storage instance being used to store data information of multiple users, each user's data information being stored in its respective private file directory; and an authentication unit, which authenticates the authentication information to obtain an authentication result and performs an operation corresponding to the authentication result.

[0006] According to a third aspect of the embodiments of this application, a data access management system is provided, including: a storage service client and a virtual server; the virtual server is configured to send a network-attached storage mounting request to the storage service client in response to a resource acquisition request; the network-attached storage includes a storage instance, the storage instance being used to store data information of multiple users, and the data information of each user is stored in their respective private file directories;

[0007] The storage service client is configured to receive a mounting request for network-attached storage sent by the virtual server, the mounting request carrying authentication information corresponding to the user to which the virtual server belongs; to authenticate the authentication information to obtain an authentication result, and to execute an operation corresponding to the authentication result.

[0008] According to a fourth aspect of the embodiments of this application, a data access management system is provided, including: a first cloud server, a second cloud server, and a virtual server;

[0009] The virtual server is used to send a mount request for the network-attached storage to the first cloud server in response to the resource acquisition request of the target application; the network-attached storage includes a storage instance, which is used to store data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0010] The first cloud server is configured to receive a mounting request for network-attached storage sent by the virtual server, the mounting request carrying authentication information corresponding to the user to which the target application belongs in the virtual server; send the authentication information to the second cloud server; receive the authentication result sent by the second cloud server; and perform the operation corresponding to the authentication result.

[0011] The second cloud server is used to receive authentication information sent by the first cloud server; to authenticate the authentication information; and to send the authentication result back to the first cloud server.

[0012] According to a fifth aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the data access management method of the first aspect through the computer program.

[0013] According to a sixth aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the data access management method of the first aspect described above when running.

[0014] According to a seventh aspect of the embodiments of this application, a computer program product is also provided, including a computer program, which is executed by a processor to manage the data access method of the first aspect described above.

[0015] In this embodiment, a method is employed that receives a mount request for network-attached storage sent by a virtual server, the mount request carrying authentication information corresponding to the user to whom the virtual server belongs; the network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directories; the authentication information is authenticated to obtain an authentication result, and an operation corresponding to the authentication result is executed. This application uses a single storage instance to store the data information of multiple users, with each user's data information stored independently in the storage space of that storage instance. That is, the data information of multiple users is stored on a shared NAS storage. Therefore, compared to related technologies that provide independent NAS storage for each NAS user, this application can significantly improve the utilization rate of NAS storage space, thereby enabling support for a large number of users on a large scale. Furthermore, since the data information of each NAS user is placed on a shared NAS storage, compared to the independent NAS storage space for a single user in the prior art, this application can improve the speed of file reading and writing on the NAS, enhancing the user experience. Attached Figure Description

[0016] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiments below. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0017] Figure 1 This is a schematic diagram of an application environment for an optional data access management method according to an embodiment of this application;

[0018] Figure 2This is a schematic diagram of an application environment for an optional data access management method based on related technologies;

[0019] Figure 3 This is a flowchart illustrating an optional data access management method according to an embodiment of this application;

[0020] Figure 4 This is a schematic diagram of an application environment for another optional data access management method according to an embodiment of this application;

[0021] Figure 5 This is a flowchart illustrating another optional data access management method according to an embodiment of this application;

[0022] Figure 6 This is a flowchart illustrating another optional data access management method according to an embodiment of this application;

[0023] Figure 7 This is a flowchart illustrating another optional data access management method according to an embodiment of this application;

[0024] Figure 8 This is a schematic diagram of the structure of a data access management device provided in an embodiment of this application;

[0025] Figure 9 This is a schematic diagram of the structure of a data access management system provided in an embodiment of this application;

[0026] Figure 10 This is a schematic diagram of another data access management system provided in an embodiment of this application;

[0027] Figure 11 This is a schematic diagram of the structure of another data access management device provided in an embodiment of this application;

[0028] Figure 12 This is a schematic diagram of the structure of another data access management device provided in the embodiments of this application;

[0029] Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0030] Figure 14 This is a schematic diagram of the structure of another electronic device provided in an embodiment of this application;

[0031] Figure 15 This is a schematic diagram of the structure of another electronic device provided in the embodiments of this application. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] As an optional implementation, the above-described data access management method can be applied, but is not limited to, to applications such as... Figure 1 The application environment shown may include, but is not limited to, a virtual server 102 for human-computer interaction, a network 110, and a storage service client 112. One or more applications run on the virtual server 102. The virtual server 102 includes a processor 106 and a memory 104. The processor 106 responds to resource acquisition requests from the one or more applications by sending a mount request for the network-attached storage to the storage service client 112; the memory 104 stores authentication information corresponding to the user to which the virtual server 102 belongs. Furthermore, the storage service client 112 includes a database 114 and a processing engine 116. The database stores application data information for multiple users. The processing engine 116 receives the mount request for the network-attached storage sent by the virtual server 102, the mount request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, which stores data information for multiple users, each user's data information stored in their respective private file directories; the authentication information is authenticated to obtain an authentication result, and the operation corresponding to the authentication result is executed.

[0035] The specific process is as follows: Virtual server 102 executes step S102, sending a mount request for network-attached storage to storage service client 112. The mount request carries the authentication information corresponding to the user to which virtual server 102 belongs. Storage service client 112 executes steps S104-S106, receiving the mount request for network-attached storage sent by virtual server 102. The mount request carries the authentication information corresponding to the user to which virtual server 102 belongs. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories. The authentication information is authenticated to obtain an authentication result, and the operation corresponding to the authentication result is executed.

[0036] Optionally, the virtual server 102 may include a server with network storage capabilities, such as a virtual machine or virtual server that provides Elastic Compute Service (ECS), and may also include an ECS instance corresponding to a single user. The network may include, but is not limited to, wired networks and wireless networks. The wired network includes local area networks (LANs), metropolitan area networks (MANs), and wide area networks (WANs), and the wireless network includes Bluetooth, Wi-Fi, and other networks that enable wireless communication. The storage service client 112 may be a single storage server, a storage server cluster consisting of multiple storage servers, or a cloud storage server. The cloud storage server may include, but is not limited to, private cloud storage servers or public cloud storage servers. The above is merely an example, and no limitations are imposed in this embodiment.

[0037] In related technologies, cloud NAS service providers offer NAS services by creating a corresponding NAS instance for each NAS user, such as... Figure 2 As shown, after user A purchases NAS service, the cloud NAS service provider creates a corresponding NAS instance 1 for them; after user B purchases NAS service, the cloud NAS service provider creates a corresponding NAS instance 2 for them; and after user N purchases NAS service, the cloud NAS service provider creates a corresponding NAS instance N for them. However, since each NAS instance corresponds to an independent NAS storage unit, and the NAS storage capacity provided by the NAS service provider has an upper limit, the number of NAS instances that can be supported using this method is limited, making it unsuitable for large-scale use by many users. Furthermore, since the NAS read / write bandwidth performance of a NAS instance is directly proportional to the storage space corresponding to the NAS instance purchased by the user, when the storage space corresponding to the NAS instance purchased by the user is small, the speed of reading and writing files on the NAS will be slow, resulting in a poor user experience.

[0038] To address the aforementioned technical problems, as an optional implementation method, such as Figure 3 As shown in the figure, this application provides a data access management method applied to a storage service client, including the following steps:

[0039] S302, receive a mount request for network-attached storage sent by the virtual server, the mount request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, the storage instance is used to store data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0040] Specifically, in this embodiment, taking the aforementioned virtual server as an example of the ECS instance corresponding to the current user, after the operating system of the ECS instance starts, the ECS instance sends a mount request to the storage service provider for network-attached storage, requesting the operating system to use the storage space corresponding to the network-attached storage. Once the storage space is requested, the data generated by the operating system can be stored in that storage space. In another example, after the target application running on the ECS instance starts, the ECS instance sends a mount request to the storage service provider for the network-attached storage corresponding to the target application, requesting the target application to use the storage space corresponding to the network-attached storage. Once the storage space is requested, the data generated by the target application can be stored in that storage space. The authentication information mentioned above in this embodiment includes, for example, the user registration information corresponding to the user who purchased the virtual server, as well as the NAS access address and NAS storage space information corresponding to the user.

[0041] It should be noted that, as Figure 4 As shown, the network-attached storage involved in this application includes a storage instance ( Figure 4 The storage instance (a shared NAS instance) is used to store data information for multiple users. Each user's data information is stored in its own corresponding private file directory. For example, user A's private file directory in this storage instance is: User A's file directory. User B's private file directory in this storage instance is: User B's file directory. User N's ​​private file directory in this storage instance is: User N's ​​file directory.

[0042] S304, authenticate the authentication information to obtain the authentication result, and perform the operation corresponding to the authentication result.

[0043] Specifically, in this embodiment, when the storage service client receives the authentication information sent by the virtual server, it determines whether the authentication information is valid based on the authentication information corresponding to each user stored in the authentication database. If valid, the file directory is mounted to the virtual server according to the access path of the file directory corresponding to the user. If the authentication information is invalid, an authentication failure result is generated, and a mounting failure feedback message is sent to the virtual server.

[0044] In this embodiment, a method is employed that receives a mount request for network-attached storage sent by a virtual server, the mount request carrying authentication information corresponding to the user to whom the virtual server belongs; the network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directories; the authentication information is authenticated to obtain an authentication result, and an operation corresponding to the authentication result is executed. This application uses a single storage instance to store the data information of multiple users, with each user's data information stored independently in the storage space of that storage instance. That is, the data information of multiple users is stored on a shared NAS storage. Therefore, compared to related technologies that provide independent NAS storage for each NAS user, this application can significantly improve the utilization rate of NAS storage space, thereby enabling support for a large number of users on a large scale. Furthermore, since the data information of each NAS user is placed on a shared NAS storage, compared to the independent NAS storage space for a single user in the prior art, this application can improve the speed of file reading and writing on the NAS, enhancing the user experience.

[0045] As an alternative implementation method, such as Figure 5 As shown in the figure, this application provides a data access management method, including the following steps:

[0046] S502, receive a mount request for network-attached storage sent by the virtual server, the mount request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, the storage instance is used to store data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0047] S504, Obtain user information and storage information corresponding to network-attached storage from the authentication information, and compare the user information and storage information with the authentication data in the authentication database;

[0048] If the authentication database contains authentication data that matches the user information and storage information, an authentication result including the access path of the file directory is generated;

[0049] If the authentication database does not contain authentication data that matches the user information and stored information, an authentication failure result is generated.

[0050] Specifically, in this embodiment, the aforementioned user information can be user registration information, such as a user's registered name or user identity identifier. The storage information corresponding to the network-attached storage can be a NAS access address, NAS storage space configuration information, etc. The aforementioned authentication information can be a token obtained by encrypting the user information and the storage information corresponding to the network-attached storage; the token information is decrypted, and the user information and the storage information corresponding to the network-attached storage are obtained from the decrypted information. The user information and storage information are compared with authentication data in the authentication database. When the authentication database contains authentication data that matches the user information and storage information, it indicates that the identity authentication is successful, and an authentication result including the access path of the file directory corresponding to the user is generated. When the authentication database does not contain authentication data that matches the user information and storage information, an authentication failure result is generated. Based on the above technical means, this application can improve the utilization rate of NAS storage space and increase the speed of users reading and writing files on the NAS while ensuring the security of user data.

[0051] S506, perform the operation corresponding to the authentication result.

[0052] Steps S502 and S506 have been described above and will not be repeated here.

[0053] In one or more embodiments, the step of authenticating the authentication information to obtain an authentication result includes:

[0054] Obtain the validity period corresponding to the authentication information. If the validity period is expired, generate an authentication failure result.

[0055] Specifically, in this application embodiment, the above-mentioned authentication information is set with an expiration period, which can not only reduce the risk of authentication information (such as token information) being stolen and prevent the NAS system from being maliciously accessed, but also avoid the computing resources of the storage service side being occupied for a long time.

[0056] As an alternative implementation method, such as Figure 6 As shown in the figure, this application provides a data access management method, including the following steps:

[0057] S602, receive a mount request for network-attached storage sent by the virtual server, the mount request carrying authentication information corresponding to the user to which the virtual server belongs; the network-attached storage includes a storage instance, the storage instance is used to store data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0058] S604, the authentication information is authenticated to obtain the authentication result.

[0059] S606, Based on the authentication result including the access path of the file directory, mount the file directory to the virtual server according to the access path;

[0060] If the authentication result is authentication failure, a mounting failure feedback message will be sent to the virtual server.

[0061] Specifically, in this embodiment of the application, when the storage service client authenticates the authentication information, if the authentication database contains authentication data that matches the user information and storage information, it indicates that the identity authentication is successful. An authentication result including the access path of the file directory corresponding to the user is generated. According to the access path in the authentication result, the file directory corresponding to the user is mounted to the virtual server, and the data generated by the user in the virtual server can be stored in the file directory.

[0062] If the authentication database does not contain authentication data that matches the user information and storage information, an authentication failure result is generated, and the storage service client sends the mounting failure feedback information to the virtual server.

[0063] Steps S602 and S604 have been described above and will not be repeated here.

[0064] As an alternative implementation method, such as Figure 7 As shown in the figure, this application provides a data access management method, including the following steps:

[0065] S702, Obtain the user's registration information for the network-attached storage, and generate configuration information corresponding to the registration information;

[0066] S704, Based on the configuration information, allocate a corresponding file directory to the user in the network-attached storage, and configure access permissions for the file directory for the user.

[0067] Specifically, in this embodiment, the registration information may include, for example, the user's username or the ECS instance name of the ECS instance used by the user. The registration information may also include the storage capacity purchased by the user on the network-attached storage. In one example, after user A registers for the service corresponding to the network-attached storage, configuration information corresponding to the registration information is generated based on user A's registration information. This configuration information includes, for example, the file directory information corresponding to user A, and user A's file directory access permissions on the network-attached storage. The storage service client allocates a corresponding file directory for user A on the network-attached storage based on this file directory information. Similarly, assuming user B registers for the service corresponding to the network-attached storage, a corresponding file directory is allocated to user B, and the following file directory organization will be generated in the network-attached storage:

[0068] / NAS root working directory

[0069] Public Folder

[0070] |-userA folder

[0071] |-userB folder

[0072] In the above file directory organization, the file directory corresponding to the folder "userA" and its subfolders is user A's private file directory. The storage service client assigns access permissions to these file directories for user A and user B. For example, user A is assigned read-only permissions to the public folder and read / write permissions to the folder "userA". User B is assigned read-only permissions to the public folder and read / write permissions to the folder "userB".

[0073] In one example, the registration information mentioned above can also be the size of the resource package corresponding to the network secondary storage purchased by the user. The resource package is the traffic package purchased by the user to access the network secondary storage. That is, the traffic package is the amount of data that the user can transmit within a certain period of time, including the total amount of data read from the network secondary storage and data written to the network secondary storage.

[0074] S706, Receive a mount request for network-attached storage sent by a virtual server. The mount request carries authentication information corresponding to the user to which the virtual server belongs. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories.

[0075] S708, authenticate the authentication information to obtain the authentication result, and perform the operation corresponding to the authentication result.

[0076] Steps S706 and S708 have been described above and will not be repeated here.

[0077] In one or more embodiments, the step of allocating a file directory to the user in the network-attached storage according to the configuration information, and configuring access permissions for the file directory to the user, includes:

[0078] Based on the configuration information, create a private file directory corresponding to the user in the network-attached storage;

[0079] Based on the configuration information, access permissions for the private file directory and the public file directory are configured for the user; the public file directory is used to store shared files accessible to multiple users.

[0080] Specifically, in this embodiment, for example, after user A registers for the network-attached storage service, the storage service provider creates a corresponding private file directory for user A in the network-attached storage based on user A's configuration information, such as the file directory corresponding to the aforementioned userA folder. Simultaneously, the storage service provider assigns access permissions to both the userA folder and the public folder to user A. For example, user A is assigned read-only access to the public folder and read-write access to the userA folder. The aforementioned public file directory can store, for example, application material data or template data. Based on the above technical means, this application enables users to use the network-attached storage service securely and efficiently, while also ensuring data security and the legitimacy of access, thus improving the user experience.

[0081] In one or more embodiments, the data access management method further includes at least one of the following:

[0082] Obtain a first whitelist of users with access rights to the network-attached storage, and prevent users outside the first whitelist from accessing the network-attached storage;

[0083] Obtain a second whitelist of users who have access to the network-attached storage during the target time period, and prevent users outside the second whitelist from accessing the network-attached storage during the target time period.

[0084] Specifically, in this embodiment, the first whitelist and the second whitelist may include, for example, the network address of the ECS instance used by the user. The storage service can generate the first whitelist based on the user's network address information to prevent users outside the first whitelist from accessing the network-attached storage. In one example, when user X encounters an abnormality in accessing the network-attached storage, removing user X from the first whitelist will prevent user X from accessing the network-attached storage.

[0085] In another example, assuming user Y's account on the network-attached storage is compromised, and user Y exhibits abnormal access to the network-attached storage during a target time period, removing the user from the second whitelist will prevent user Y from accessing the network-attached storage during that time period. Based on the above technical measures, the security and integrity of data in the network-attached storage can be ensured, reducing the risk of data leakage or misuse.

[0086] In one or more embodiments, prior to receiving the mount request for network-attached storage sent by the virtual server, the process includes:

[0087] Receive a resource acquisition request sent by the virtual server, the resource acquisition request carrying the user's user information and storage information corresponding to the network-attached storage;

[0088] In response to the resource acquisition request, the authentication information is generated based on the user information and the storage information;

[0089] The authentication information is sent to the virtual server.

[0090] Specifically, in this embodiment of the application, taking the ECS instance corresponding to the current user as an example, when the operating system of the ECS instance starts, the ECS instance sends a resource acquisition request to the storage service provider. The storage service provider generates authentication information including user registration information, the NAS access address corresponding to the user registration information, and the NAS storage space based on the user information and the storage information corresponding to the network auxiliary storage carried in the resource acquisition request. The authentication information is then sent to the ECS instance, and the ECS instance generates a mount request for the network auxiliary storage corresponding to the operating system based on the authentication information.

[0091] In another example, after the target application running on the ECS instance starts, it sends a resource acquisition request corresponding to the target application to the storage service. The storage service generates authentication information for the target application, including user registration information, NAS access address, and NAS storage space based on the resource acquisition request. The authentication information is then sent to the ECS instance, and the ECS instance generates a mount request for the network-attached storage corresponding to the target application based on the authentication information.

[0092] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0093] According to another aspect of the embodiments of this application, a data access management device for implementing the above-described data access management method is also provided, applied to a storage service client. For example... Figure 8 As shown, the device includes:

[0094] The receiving unit 802 receives a mounting request for network-attached storage sent by the virtual server. The mounting request carries authentication information corresponding to the user to which the virtual server belongs. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories.

[0095] The authentication unit 804 is used to authenticate the authentication information to obtain an authentication result and perform an operation corresponding to the authentication result.

[0096] In this embodiment, a method is employed that receives a mount request for network-attached storage sent by a virtual server, the mount request carrying authentication information corresponding to the user to whom the virtual server belongs; the network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directories; the authentication information is authenticated to obtain an authentication result, and an operation corresponding to the authentication result is executed. This application uses a single storage instance to store the data information of multiple users, with each user's data information stored independently in the storage space of that storage instance. That is, the data information of multiple users is stored on a shared NAS storage. Therefore, compared to related technologies that provide independent NAS storage for each NAS user, this application can significantly improve the utilization rate of NAS storage space, thereby enabling support for a large number of users on a large scale. Furthermore, since the data information of each NAS user is placed on a shared NAS storage, compared to the independent NAS storage space for a single user in the prior art, this application can improve the speed of file reading and writing on the NAS, enhancing the user experience.

[0097] In one or more embodiments, the authentication unit 804 includes:

[0098] The acquisition module is used to acquire user information and storage information corresponding to network-attached storage from the authentication information, and compare the user information and storage information with the authentication data in the authentication database;

[0099] The first generation module is used to generate an authentication result including the access path of the file directory corresponding to the user if the authentication database contains authentication data that matches the user information and storage information.

[0100] The second generation module is used to generate an authentication failure result if the authentication database does not contain authentication data that matches the user information and the stored information.

[0101] In one or more embodiments, the authentication unit 804 includes:

[0102] The third generation module is used to obtain the validity period corresponding to the authentication information. If the validity period is expired, an authentication failure result is generated.

[0103] In one or more embodiments, the authentication unit 804 includes:

[0104] The mounting module is used to mount the file directory to the virtual server based on the access path of the file directory included in the authentication result.

[0105] The feedback module is used to send a mounting failure feedback message to the virtual server if the authentication result is authentication failure.

[0106] In one or more embodiments, the data access management device further includes:

[0107] The second acquisition unit is used to acquire the user's registration information for the network-attached storage and generate configuration information corresponding to the registration information;

[0108] The allocation unit is configured to allocate a corresponding file directory to the user in the network-attached storage according to the configuration information, and to configure access permissions for the file directory for the user.

[0109] In one or more embodiments, the allocation unit includes:

[0110] A creation module is used to create a private file directory corresponding to the user in the network-attached storage based on the configuration information.

[0111] The configuration permission module is used to configure access permissions for the user's private file directory and public file directory based on the configuration information; the public file directory is used to store shared files accessible to multiple users.

[0112] In one or more embodiments, the data access management device further includes at least one of the following:

[0113] The first management unit is used to obtain a first whitelist of users with access rights to the network-attached storage and to prevent users outside the first whitelist from accessing the network-attached storage.

[0114] The second restriction unit is used to obtain a second whitelist of users who have access to the network-attached storage during the target time period, and to prevent users outside the second whitelist from accessing the network-attached storage during the target time period.

[0115] In one or more embodiments, the data access management device further includes:

[0116] The generation unit is configured to receive a resource acquisition request sent by the virtual server and generate the authentication information in response to the resource acquisition request;

[0117] A sending unit is used to send the authentication information to the virtual server.

[0118] According to another aspect of the embodiments of this application, a data access management system for implementing the above-described data access management method is also provided, such as... Figure 9 As shown, the system includes: a storage service client and a virtual server;

[0119] The virtual server is used to send a mount request for the network-attached storage to the storage service client in response to a resource acquisition request. The network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directory.

[0120] The storage service client is configured to receive a network-attached storage mounting request sent by the virtual server, the mounting request carrying authentication information corresponding to the user to which the virtual server belongs; to authenticate the authentication information to obtain an authentication result, and to perform an operation corresponding to the authentication result.

[0121] According to another aspect of the embodiments of this application, a data access management system for implementing the above-described data access management method is also provided, such as... Figure 10 As shown, the system includes: a first cloud server, a second cloud server, and a virtual server;

[0122] The virtual server is used to send a mount request for the network-attached storage to the first cloud server in response to the resource acquisition request of the target application; the network-attached storage includes a storage instance, which is used to store data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0123] The first cloud server is configured to receive a mounting request for network-attached storage sent by the virtual server, the mounting request carrying authentication information corresponding to the user to which the target application belongs in the virtual server; send the authentication information to the second cloud server; receive the authentication result sent by the second cloud server; and perform the operation corresponding to the authentication result.

[0124] The second cloud server is used to receive authentication information sent by the first cloud server; authenticate the authentication information; and send the authentication result back to the first cloud server.

[0125] Specifically, in this embodiment, the virtual server can be, for example, an ECS instance corresponding to the current user. When the operating system of the ECS instance starts, and the user clicks on a target application on the ECS instance, the ECS instance sends a mount request to the first cloud server for the network-attached storage corresponding to the target application, requesting the target application to use the storage space corresponding to the network-attached storage. Upon receiving the mount request, the first cloud server sends the authentication information carried in the mount request to a second cloud server. The second cloud server authenticates the authentication information and sends the authentication result back to the first cloud server. The first cloud server determines whether the authentication information corresponds to storage space based on the authentication result. Once the target application requests storage space, all data generated by the target application can be stored in that storage space. In this embodiment, the authentication information includes, for example, the user registration information corresponding to the user who purchased the virtual server, the NAS access address corresponding to the user, and information about the NAS storage space.

[0126] In this application embodiment, a cloud storage instance is used to store the data information of multiple users. The data information of each user is stored independently in the storage space of the storage instance. That is, the data information of multiple users is stored on a shared NAS storage. Therefore, compared with the related technology that provides independent NAS storage for each NAS user, this application can significantly improve the utilization rate of NAS storage space, thereby enabling support for a large number of users to use it on a large scale. In addition, the data information of each NAS user in this application is placed on a shared NAS storage. Compared with the independent NAS storage space for a single user in the prior art, this application can improve the speed of reading and writing files on the NAS and improve the user experience.

[0127] In one or more embodiments, the first cloud server is specifically used to obtain the user's registration information for the network-attached storage and send the registration information to the second cloud server;

[0128] The system receives configuration information from the second cloud server in response to the registration information, allocates a corresponding file directory for the user in the network-attached storage according to the configuration information, and configures access permissions for the file directory for the user.

[0129] Specifically, in this embodiment, the registration information may include, for example, the user's username or the ECS instance name of the ECS instance used by the user. The registration information may also include the storage capacity purchased by the user in the network-attached storage. In one example, after user A registers for the network-attached storage service, the first cloud server sends the registration information to the second cloud server. The second cloud server generates configuration information corresponding to the registration information based on user A's registration information. This configuration information includes, for example, the file directory information corresponding to user A, and user A's file directory access permissions in the network-attached storage. Then, the second cloud server sends this configuration information to the first cloud server, and the first cloud server allocates a corresponding file directory for user A in the network-attached storage based on this file directory information. Similarly, assuming user B registers for the network-attached storage service and the first cloud server allocates a corresponding file directory for user B, the following file directory organization will be generated in the network-attached storage:

[0130] / NAS root working directory

[0131] Public Folder

[0132] |-userA folder

[0133] |-userB folder

[0134] In the above file directory organization, the file directory corresponding to the folder "userA" and its subfolders is user A's private file directory. The storage service client assigns access permissions to these file directories for user A and user B. For example, user A is assigned read-only permissions to the public folder and read / write permissions to the folder "userA". User B is assigned read-only permissions to the public folder and read / write permissions to the folder "userB".

[0135] In one or more embodiments, the first cloud server is specifically configured to create a private file directory corresponding to the user in the network-attached storage according to the configuration information;

[0136] Based on the configuration information, access permissions for the private file directory and the public file directory are configured for the user; the public file directory is used to store shared files accessible to multiple users.

[0137] Specifically, in this embodiment, for example, after user A registers for the network-attached storage service, the first cloud server creates a corresponding private file directory for user A in the network-attached storage based on user A's configuration information, such as the file directory corresponding to the aforementioned userA folder. Simultaneously, the first cloud server assigns access permissions for the userA folder and public folders to user A. For example, user A is assigned read-only access to the public folder and read-write access to the userA folder. The aforementioned public file directory can store, for example, application material data or template data. Based on the above technical means, this application enables users to use the network-attached storage service securely and efficiently, while also ensuring data security and the legitimacy of access, thus improving the user experience.

[0138] In one or more embodiments, the first cloud server is specifically configured to receive a first whitelist sent by the second cloud server, the first whitelist including users with access rights to the network-attached storage, and to prevent users outside the first whitelist from accessing the network-attached storage; and / or

[0139] Receive a second whitelist sent by a second cloud server. The second whitelist includes users who have access to the network-attached storage during the target time period. Prevent users outside the second whitelist from accessing the network-attached storage during the target time period.

[0140] In this embodiment, the aforementioned first whitelist and second whitelist may, for example, include the network address of the ECS instance used by the user. The second cloud server can generate the first whitelist based on the user's network address information, and then send the first whitelist to the second cloud server, which can then prevent users not on the first whitelist from accessing the network-attached storage. In one example, when user X encounters an abnormality in accessing the network-attached storage, the second cloud server removes user X from the first whitelist, and the first cloud server can then prevent user X from accessing the network-attached storage.

[0141] In another example, assuming user Y's account on the network-attached storage is compromised, and user Y exhibits abnormal access to the network-attached storage during a target time period, the second cloud server removes the user from the second whitelist, allowing the first cloud server to then prevent user Y from accessing the network-attached storage during the target time period. Based on these technical measures, the security and integrity of data in the network-attached storage can be ensured, reducing the risk of data leakage or misuse.

[0142] In one or more embodiments, the second cloud server is specifically configured to receive a resource acquisition request sent by the virtual server and generate the authentication information in response to the resource acquisition request;

[0143] The authentication information is sent to the virtual server.

[0144] Specifically, in this embodiment of the application, for example, after the target application running on the ECS instance is started, the ECS instance sends a resource acquisition request corresponding to the target application to the second cloud server. The storage service server generates authentication information including user registration information corresponding to the target application, NAS access address corresponding to the user registration information, and NAS storage space based on the resource acquisition request. The authentication information is sent to the ECS instance, and the ECS instance generates a mount request for network-attached storage based on the authentication information.

[0145] In one or more embodiments, the second cloud server is specifically used to obtain user information and storage information corresponding to network-attached storage from the authentication information, and compare the user information and storage information with authentication data in the authentication database;

[0146] If the authentication database contains authentication data that matches the user information and storage information, an authentication result including the access path of the file directory is generated;

[0147] If the authentication database does not contain authentication data that matches the user information and stored information, an authentication failure result is generated.

[0148] Specifically, in this embodiment, the aforementioned user information can be user registration information, such as a user's registered name or user identity identifier. The storage information corresponding to the network-attached storage can be a NAS access address, NAS storage space configuration information, etc. The aforementioned authentication information can be a token obtained by encrypting the user information and the storage information corresponding to the network-attached storage. The second cloud server decrypts the token information, obtains the user information and the storage information corresponding to the network-attached storage from the decrypted information, and compares the user information and storage information with the authentication data in the authentication database. When the authentication database contains authentication data that matches the user information and storage information, it indicates successful authentication, and an authentication result including the access path of the file directory corresponding to the user is generated. When the authentication database does not contain authentication data that matches the user information and storage information, an authentication failure result is generated. Based on the above technical means, this application can improve the utilization rate of NAS storage space and increase the speed of users reading and writing files on the NAS while ensuring the security of user data.

[0149] In one or more embodiments, the second cloud server is specifically used to obtain the validity period corresponding to the authentication information, and if the validity period is expired, generate an authentication failure result.

[0150] Send a prompt message for re-authentication to the virtual server.

[0151] Specifically, in this embodiment, the authentication information is set to have an expiration date, and the second cloud server detects the expiration date. When the expiration date is expired, an authentication failure result is generated, and then the second cloud server sends a prompt for re-authentication to the virtual server. This not only reduces the risk of authentication information (such as token information) being stolen and prevents malicious access to the NAS system, but also avoids the storage service server's computing resources being occupied for a long time.

[0152] According to another aspect of the embodiments of this application, a data access management device for implementing the above-described data access management method is also provided, applied to a first cloud server. For example... Figure 11 As shown, the device includes:

[0153] The receiving unit 1102 is used to receive a mounting request for network-attached storage sent by the virtual server. The mounting request carries authentication information corresponding to the user to which the target application belongs in the virtual server. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories.

[0154] The processing unit 1104 is used to send the authentication information to the second cloud server; receive the authentication result sent by the second cloud server; and perform the operation corresponding to the authentication result.

[0155] According to another aspect of the embodiments of this application, a data access management device for implementing the above-described data access management method is also provided, applied to a second cloud server. For example... Figure 12 As shown, the device includes:

[0156] The receiving unit 1202 is used to receive authentication information sent by the first cloud server; the authentication information includes user information for the mounting request of the network-attached storage; the network-attached storage includes a storage instance, which is used to store the data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0157] The authentication unit 1204 is used to authenticate the authentication information and send the authentication result to the first cloud server.

[0158] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described data access management method is also provided. This electronic device may be... Figure 1 The virtual server or storage service client shown. This embodiment uses the electronic device as an example to illustrate the concept. Figure 13 As shown, the electronic device includes a memory 1302 and a processor 1304. The memory 1302 stores a computer program, and the processor 1304 is configured to execute the steps of any of the above method embodiments through the computer program.

[0159] Optionally, in this embodiment, the aforementioned electronic device may be at least one of a plurality of network devices in a computer network.

[0160] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0161] S11, Receive a mount request for network-attached storage sent by the virtual server. The mount request carries the authentication information corresponding to the user to which the virtual server belongs. The network-attached storage includes a storage instance, which is used to store the data information of multiple users. The data information of each user is stored in their respective private file directories.

[0162] S12, authenticate the authentication information to obtain the authentication result, and perform the operation corresponding to the authentication result.

[0163] The memory 1302 can be used to store software programs and modules, such as the program instructions / modules corresponding to the data access management method and apparatus in this embodiment. The processor 1304 executes various functional applications and data processing by running the software programs and modules stored in the memory 1302, thereby realizing the aforementioned data access management method. The memory 1302 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1302 may further include memory remotely located relative to the processor 1304, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Specifically, the memory 1302 may be used, but is not limited to, to store user authentication information and user data information.

[0164] As an example, such as Figure 13As shown, the memory 1302 may include, but is not limited to, the receiving unit 802 and the authentication unit 804 in the data access management device. Furthermore, it may include, but is not limited to, other module units in the data access management device, which will not be elaborated upon in this example.

[0165] Optionally, the transmission device 1306 described above is used to receive or send data via a network. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1306 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1306 is a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0166] In addition, the aforementioned electronic device also includes a connection bus 1308 for connecting various module components in the aforementioned electronic device.

[0167] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described data access management method is also provided. This electronic device may be... Figure 10 The first cloud server or the second cloud server shown. This embodiment uses the electronic device as an example of the first cloud server. Figure 14 As shown, the electronic device includes a memory 1402 and a processor 1404. The memory 1402 stores a computer program, and the processor 1404 is configured to execute the steps of any of the above method embodiments via the computer program.

[0168] Optionally, in this embodiment, the aforementioned electronic device may be at least one of a plurality of network devices in a computer network.

[0169] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0170] S21 is used to receive a mounting request for network-attached storage sent by the virtual server. The mounting request carries authentication information corresponding to the user to which the target application belongs in the virtual server. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories.

[0171] S22, send the authentication information to the second cloud server; receive the authentication result sent by the second cloud server, and perform the operation corresponding to the authentication result.

[0172] The memory 1402 can be used to store software programs and modules, such as the program instructions / modules corresponding to the data access management method and apparatus in this embodiment. The processor 1404 executes various functional applications and data processing by running the software programs and modules stored in the memory 1402, thereby realizing the aforementioned data access management method. The memory 1402 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1402 may further include memory remotely located relative to the processor 1404, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Specifically, the memory 1402 may be used, but is not limited to, to store user authentication information.

[0173] As an example, such as Figure 14 As shown, the memory 1402 may include, but is not limited to, the receiving unit 1102 and the processing unit 1104 in the data access management device. Furthermore, it may include, but is not limited to, other module units in the data access management device, which will not be described further in this example.

[0174] Optionally, the transmission device 1406 described above is used to receive or send data via a network. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1406 includes a Network Interface Controller (NIC), which can be connected to other network devices and routers via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1406 is a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0175] In addition, the aforementioned electronic device also includes a connection bus 1408 for connecting various module components in the aforementioned electronic device.

[0176] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described data access management method is also provided. This electronic device may be... Figure 10 The first cloud server or the second cloud server is shown. This embodiment uses the electronic device as an example of the second cloud server. Figure 15 As shown, the electronic device includes a memory 1502 and a processor 1504. The memory 1502 stores a computer program, and the processor 1504 is configured to execute the steps of any of the above method embodiments via the computer program.

[0177] Optionally, in this embodiment, the aforementioned electronic device may be at least one of a plurality of network devices in a computer network.

[0178] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0179] S31 is used to receive authentication information sent by the first cloud server; the authentication information includes user information for the mounting request of the network-attached storage; the network-attached storage includes a storage instance, which is used to store the data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0180] S32, authenticate the authentication information and send the authentication result to the first cloud server.

[0181] The memory 1502 can be used to store software programs and modules, such as the program instructions / modules corresponding to the data access management method and apparatus in this embodiment. The processor 1504 executes various functional applications and data processing by running the software programs and modules stored in the memory 1502, thereby realizing the aforementioned data access management method. The memory 1502 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1502 may further include memory remotely located relative to the processor 1504, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Specifically, the memory 1502 may be used, but is not limited to, to store user authentication information.

[0182] As an example, such as Figure 15 As shown, the memory 1502 may include, but is not limited to, the receiving unit 1202 and the authentication unit 1204 in the data access management device. Furthermore, it may include, but is not limited to, other module units in the data access management device, which will not be elaborated upon in this example.

[0183] Optionally, the transmission device 1506 described above is used to receive or send data via a network. Specific examples of the network described above may include wired networks and wireless networks. In one example, the transmission device 1506 includes a Network Interface Controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In another example, the transmission device 1506 is a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0184] In addition, the aforementioned electronic device also includes a connection bus 1508 for connecting various module components in the aforementioned electronic device.

[0185] S31 is used to receive authentication information sent by the first cloud server; the authentication information includes user information for the mounting request of the network-attached storage; the network-attached storage includes a storage instance, which is used to store the data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0186] S32, authenticate the authentication information and send the authentication result to the first cloud server.

[0187] In other embodiments, the aforementioned electronic device can be a node in a distributed system, which can be a blockchain system. This blockchain system is formed by connecting multiple nodes through network communication. The nodes can form a peer-to-peer (P2P) network, and any type of computing device, such as a server or terminal, can become a node in the blockchain system by joining this peer-to-peer network.

[0188] In one or more embodiments, this application also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data access management method described above. The computer program is configured to execute the steps in any of the method embodiments described above when it runs.

[0189] Optionally, in this embodiment, the computer-readable storage medium described above may be configured to store a computer program for performing the following steps:

[0190] S11, Receive a mount request for network-attached storage sent by the virtual server. The mount request carries the authentication information corresponding to the user to which the virtual server belongs. The network-attached storage includes a storage instance, which is used to store the data information of multiple users. The data information of each user is stored in their respective private file directories.

[0191] S12, authenticate the authentication information to obtain an authentication result, and perform the operation corresponding to the authentication result. Alternatively, a computer program can be used to perform the following steps:

[0192] S21 is used to receive a mounting request for network-attached storage sent by the virtual server. The mounting request carries authentication information corresponding to the user to which the target application belongs in the virtual server. The network-attached storage includes a storage instance, which is used to store data information of multiple users. The data information of each user is stored in their respective private file directories.

[0193] S22, send the authentication information to the second cloud server; receive the authentication result sent by the second cloud server, and perform the operation corresponding to the authentication result. Alternatively, a computer program for performing the following steps:

[0194] S31 is used to receive authentication information sent by the first cloud server; the authentication information includes user information for the mounting request of the network-attached storage; the network-attached storage includes a storage instance, which is used to store the data information of multiple users, and the data information of each user is stored in their respective private file directories.

[0195] S32, authenticate the authentication information and send the authentication result to the first cloud server.

[0196] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0197] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0198] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention.

[0199] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0200] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0201] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0202] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0203] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

[0204] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

Claims

1. A data access management method, characterized in that, Applied to the storage service side, the method includes: The system receives a mount request for network-attached storage from a virtual server. The mount request carries authentication information corresponding to the user to whom the virtual server belongs. The network-attached storage includes a storage instance, which is used to store data information of multiple users. Each user's data information is stored in its own corresponding private file directory. The authentication information is authenticated to obtain an authentication result, and the operation corresponding to the authentication result is executed.

2. The method according to claim 1, characterized in that, The authentication result obtained by authenticating the authentication information includes: Obtain user information and storage information corresponding to network-attached storage from the authentication information, and compare the user information and the storage information with the authentication data in the authentication database; If the authentication database contains authentication data that matches the user information and the storage information, an authentication result including the access path of the file directory is generated; If the authentication database does not contain authentication data that matches the user information and the stored information, an authentication failure result is generated.

3. The method according to claim 2, characterized in that, The authentication of the authentication information to obtain the authentication result also includes: Obtain the validity period corresponding to the authentication information. If the validity period is expired, generate an authentication failure result.

4. The method according to any one of claims 1 to 3, characterized in that, The operation corresponding to the authentication result includes: Based on the authentication result, including the access path of the file directory, the file directory is mounted to the virtual server according to the access path; If the authentication result is authentication failure, a mounting failure feedback message will be sent to the virtual server.

5. The method according to any one of claims 1 to 3, characterized in that, Before receiving the mount request for network-attached storage sent by the virtual server, the method further includes: Obtain the user's registration information for the network-attached storage, and generate configuration information corresponding to the registration information; Based on the configuration information, the system allocates a corresponding file directory to the user in the network-attached storage and configures access permissions for the file directory for the user.

6. The method according to claim 5, characterized in that, The step of allocating a file directory for the user in the network-attached storage according to the configuration information, and configuring access permissions for the file directory for the user, includes: Based on the configuration information, create a private file directory corresponding to the user in the network-attached storage; Based on the configuration information, access permissions for the private file directory and the public file directory are configured for the user; the public file directory is used to store shared files accessible to multiple users.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes at least one of the following: Obtain a first whitelist of users with access rights to the network-attached storage, and prevent users outside the first whitelist from accessing the network-attached storage; Obtain a second whitelist of users who have access to the network-attached storage during the target time period, and prevent users outside the second whitelist from accessing the network-attached storage during the target time period.

8. The method according to any one of claims 1 to 3, characterized in that, Before receiving the mount request for network-attached storage sent by the virtual server, the process includes: Receive a resource acquisition request sent by the virtual server, the resource acquisition request carrying the user's user information and storage information corresponding to the network-attached storage; In response to the resource acquisition request, the authentication information is generated based on the user information and the storage information; The authentication information is sent to the virtual server.

9. A data access management system, characterized in that, include: Storage service clients and virtual servers; The virtual server is used to send a network-attached storage mount request to the storage service client in response to a resource acquisition request. The network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directories. The storage service client is used to receive a mount request for network-attached storage sent by the virtual server, the mount request carrying authentication information corresponding to the user to which the virtual server belongs; The authentication information is authenticated to obtain an authentication result, and the operation corresponding to the authentication result is executed.

10. A data access management system, characterized in that, include: First cloud server, second cloud server, and virtual server; The virtual server is used to send a network-attached storage mounting request to the first cloud server in response to the resource acquisition request of the target application. The network-attached storage includes a storage instance, which is used to store data information of multiple users, with each user's data information stored in their respective private file directories. The first cloud server is used to receive a network-attached storage mounting request sent by the virtual server, wherein the mounting request carries authentication information corresponding to the user to which the target application belongs in the virtual server; The authentication information is sent to the second cloud server. Receive the authentication result sent by the second cloud server and perform the operation corresponding to the authentication result; The second cloud server is used to receive authentication information sent by the first cloud server; The authentication information is authenticated, and the authentication result is sent to the first cloud server.

11. The system according to claim 10, characterized in that, The first cloud server is specifically used to obtain the user's registration information for the network-attached storage and send the registration information to the second cloud server; The system receives configuration information from the second cloud server in response to the registration information, allocates a corresponding file directory for the user in the network-attached storage according to the configuration information, and configures access permissions for the file directory for the user.

12. The system according to claim 11, characterized in that, The first cloud server is specifically used to create a private file directory corresponding to the user in the network-attached storage according to the configuration information; Based on the configuration information, access permissions for the private file directory and the public file directory are configured for the user; the public file directory is used to store shared files accessible to multiple users.

13. The system according to claim 10 or 11, characterized in that, The first cloud server is specifically used to receive a first whitelist sent by the second cloud server. The first whitelist includes users with access rights to the network-attached storage, and prevents users outside the first whitelist from accessing the network-attached storage. And / or, Receive a second whitelist sent by a second cloud server. The second whitelist includes users who have access to the network-attached storage during the target time period. Prevent users outside the second whitelist from accessing the network-attached storage during the target time period.

14. The system according to claim 10, characterized in that, The second cloud server is specifically used to receive resource acquisition requests sent by the virtual server and generate the authentication information in response to the resource acquisition requests; The authentication information is sent to the virtual server.

15. The system according to claim 10 or 14, characterized in that, The second cloud server is specifically used to obtain user information and storage information corresponding to network-attached storage from the authentication information, and compare the user information and storage information with the authentication data in the authentication database; If the authentication database contains authentication data that matches the user information and storage information, an authentication result including the access path of the file directory is generated; If the authentication database does not contain authentication data that matches the user information and stored information, an authentication failure result is generated.

16. The system according to claim 10 or 14, characterized in that, The second cloud server is specifically used to obtain the validity period corresponding to the authentication information. If the validity period is expired, an authentication failure result is generated. Send a prompt message for re-authentication to the virtual server.

17. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the method as described in any one of claims 1 to 8.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by a processor to implement the method as described in any one of claims 1 to 8.

19. A computer program product, comprising a computer program, characterized in that, The computer program is executed by a processor to implement the method according to any one of claims 1 to 8.

Images