A multi-tenant file processing method and device based on dynamic path authentication

Abstract

The application discloses a kind of multi-tenant file processing method and device based on dynamic path authentication, it is related to object storage service technical field.The method comprises: obtaining the configuration information table of pre-construction, which stores the mapping of business grouping, module name and upload mode, permission type, storage space name;In response to file upload request, according to the configuration of business parameter inquiry, the corresponding upload mode and permission type are obtained, and the specified storage path of embedding channel identification and enterprise identification is generated according to it, file is uploaded to the path and records metadata;In response to file access request, tenant identification is parsed from the specified storage path, the identity of request party is authenticated in conjunction with the permission type corresponding to file, and access link is generated after passing through.The tenant identification of the application is embedded in storage path and is bound with authentication rule, realizes the fine multi-tenant file access control of configuration driving, and improves service security and universality.

Description

Technical Field

[0001] This invention relates to the field of object storage service technology, and specifically to a multi-tenant file processing method and apparatus based on dynamic path authentication. Background Technology

[0002] With the widespread adoption of enterprise applications and SaaS (Software as a Service) platforms, file uploading, storage, and downloading have become fundamental and critical functions. A common solution is to directly use object storage services provided by cloud service providers, such as Alibaba Cloud OSS, Tencent Cloud COS, and AWS S3. While these services offer basic Access Control List (ACL) functionality and bucket-level permission settings, their permission models are relatively coarse-grained, typically limited to a few fixed modes such as private read / write, public read, and public read / write. This fails to meet the needs of complex business scenarios requiring fine-grained isolation and access control for multi-tenant data.

[0003] Multi-tenancy refers to the sharing of the same system or service by multiple tenants, such as different channels or different enterprises, with strict data isolation required for each tenant. In existing technical solutions, to achieve permission management for such multi-tenant files, business users often need to write a lot of code in their own application layer to implement permission logic, resulting in high service coupling, difficulty in maintenance, and vulnerability to security vulnerabilities such as unauthorized access.

[0004] Specifically, existing technologies have the following drawbacks: First, the granularity of access control is coarse. The native ACL mechanism provided by existing object storage services cannot support multi-dimensional access judgments based on business logic such as channel identifiers and enterprise identifiers. Second, complex access logic needs to be repeatedly developed by business parties at the application layer, resulting in poor service scalability. Third, simple ACL control is prone to unauthorized access due to improper configuration or logical vulnerabilities. Fourth, for private files, a signature URL (Uniform Resource Locator) needs to be generated for each download, which is inefficient and increases computational costs. Using public read mode sacrifices security.

[0005] Therefore, there is an urgent need for a multi-tenant file management solution that offers more refined access control at the tenant level, greater versatility and scalability, and balances access efficiency and security. Summary of the Invention

[0006] This invention aims to address the technical problems of high coupling, insufficient security, and lack of versatility in existing object storage services for multi-tenant file management scenarios. Therefore, it provides a multi-tenant file processing method and apparatus based on dynamic path authentication.

[0007] One aspect of the present invention provides a multi-tenant file processing method based on dynamic path authentication, comprising: Retrieve and store the pre-built business module configuration information table; The upload request carries the file to be uploaded and business parameters. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Based on the business group and business module name carried in the upload request, the corresponding upload mode, permission type and storage space name are obtained from the configuration information table. The obtained storage space name is used to indicate the specified storage space of the file to be uploaded in the object storage service. Based on the obtained upload mode and the business parameters, a directory name is generated to construct the specified storage path of the file to be uploaded in the specified storage space; The file to be uploaded is uploaded to the specified storage path, and the access control list attribute of the file in the object storage service is set according to the upload mode. A first access link is generated according to the access control list attribute, and the specified storage path and the first access link are returned to the upload requester. In response to a file access request, the system obtains the specified storage path of the file to be accessed, as well as the channel identifier and enterprise identifier of the requesting party, carried in the file access request; it extracts the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the requesting party from the uploading party. Obtain the permission type corresponding to the file to be accessed. Based on the permission type of the file to be accessed, compare and authenticate the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed. If the authentication is successful, generate a second access link based on the access control list attribute of the file to be accessed and return it to the access requester. If the authentication fails, return an access denied response to the access requester.

[0008] Furthermore, the upload modes include: private mode, ordinary public mode, and public mode accelerated by content delivery network; The business parameters include business group, business module name, channel identifier, and enterprise identifier; The first-level directory name is determined based on the upload mode, where the private mode corresponds to the private directory name, and the ordinary public mode and the public mode of content delivery network acceleration correspond to the public directory name.

[0009] Furthermore, setting the access control list attribute of the file in the object storage service according to the upload mode includes: When the upload mode is private mode, the access control list attribute is set to private; When the upload mode is a normal public mode or a content delivery network accelerated public mode, the access control list attribute is set to public.

[0010] Furthermore, generating the first access link based on the access control list attribute includes: if the access control list attribute is private, generating a temporary authorized access link; if the access control list attribute is public, generating a direct access link or a content delivery network accelerated link.

[0011] Furthermore, the permission types include one or more of the following: public type, channel public type, enterprise protection type, and channel private type; The step of comparing and authenticating the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed, based on the permission type of the file to be accessed, includes: When the permission type is public, authentication is automatically successful. When the permission type is public channel type, it is determined whether the channel identifier of the access requester is consistent with the extracted channel identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is enterprise protection type, it is determined whether the enterprise identifier of the access requester is consistent with the extracted enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is channel private, it is determined whether the channel identifier and enterprise identifier of the access requester are consistent with the extracted channel identifier and enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails.

[0012] Another aspect of the present invention provides a multi-tenant file processing apparatus based on dynamic path authentication, comprising: The configuration management module is used to obtain and store pre-built business module configuration information tables; The upload processing module is used to obtain the file to be uploaded and business parameters carried in the upload request. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Based on the business group and business module name carried in the upload request, the module obtains the corresponding upload mode, permission type and storage space name from the configuration information table. The obtained storage space name is used to indicate the specified storage space of the file to be uploaded in the object storage service. The path generation module is used to generate a directory name based on the obtained upload mode and the business parameters, so as to construct the specified storage path of the file to be uploaded in the specified storage space. The upload execution module is used to upload the file to be uploaded to the specified storage path, set the access control list attribute of the file in the object storage service according to the upload mode, generate a first access link according to the access control list attribute, and return the specified storage path and the first access link to the upload requester. The access processing module is used to respond to a file access request by obtaining the specified storage path of the file to be accessed, as well as the channel identifier and enterprise identifier of the access requester, carried in the file access request; extracting the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the access requester from the upload requester. The authentication module is used to obtain the permission type corresponding to the file to be accessed, and compare the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed for authentication based on the permission type of the file to be accessed; if the authentication is successful, a second access link is generated based on the access control list attribute of the file to be accessed and returned to the access requester; if the authentication fails, an access-prohibited response is returned to the access requester.

[0013] The multi-tenant file processing method and apparatus based on dynamic path authentication provided by this invention deeply binds the configuration information of business modules, including upload mode, permission type, and storage space name, with the hierarchical structure of file storage paths, thereby achieving natural support for multi-tenant data isolation at the server architecture level. The channel identifier and enterprise identifier embedded at specific levels in the storage path eliminate the need to query complex permission databases during the authentication process; it can be completed simply by parsing the path and making a simple comparison, resulting in extremely high efficiency. Furthermore, the configuration information table-driven design ensures that the access of new business modules and changes in permission policies do not require code modifications, greatly improving the service's versatility and scalability. Attached Figure Description

[0014] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating a multi-tenant file processing method based on dynamic path authentication provided in one embodiment of this application; Figure 2 This is a schematic diagram of the structure of a multi-tenant file processing device based on dynamic path authentication provided in one embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] I. Meaning of Key Technical Terms To facilitate understanding of this invention, the meanings of key technical terms involved in this application are explained.

[0017] Multi-tenancy refers to the sharing of the same system or service by multiple tenants, with each tenant's data requiring strict isolation. In this invention, tenants are distinguished by channel identifiers and enterprise identifiers.

[0018] Object storage services refer to storage services provided by cloud service providers based on a storage bucket and object storage path model, including but not limited to Alibaba Cloud OSS, Tencent Cloud COS, Huawei Cloud OBS, and AWS S3. A storage bucket is the top-level container in an object storage service, and a storage path is a unique location identifier for a file within that storage bucket.

[0019] Business Module Configuration Information Table: This refers to a data table pre-registered by the administrator, used to store the mapping relationship between different business groups, business modules and their corresponding upload modes, permission types, and storage space names. A combination of a business group and a business module name corresponds to a unique configuration record.

[0020] Upload mode: refers to the settings for classifying, storing and accessing files. In this invention, it includes private mode, ordinary public mode and public mode accelerated by content delivery network.

[0021] Permission type: refers to the authentication rules that need to be met when accessing a file. In this invention, it includes one or more of the following: public type, channel public type, enterprise protection type, and channel private type. The permission type is stored as file metadata associated with the file and is used to determine whether the requester has the right to obtain the access link when accessing the file.

[0022] Access control list attributes: These refer to the inherent access permission attributes of a file in an object storage service. Defined by the object storage service provider, they include at least private and public attributes. Private attributes mean that only the file owner can access the file, while public attributes mean that anyone can read the file content.

[0023] Specify storage path: refers to the storage path of the file in the object storage service. In this invention, it consists of multi-level directories and file names, wherein at least some directory levels embed tenant identification information. The specified storage path also serves as a unique location identifier for the file, which is returned to the upload requester during the upload phase and carried by the access requester to locate the file during the access phase.

[0024] II. Method Examples This embodiment details a multi-tenant file processing method based on dynamic path authentication. For example... Figure 1 As shown, the method mainly includes the following steps.

[0025] Step S101: Obtain and store the pre-built business module configuration information table.

[0026] This step aims to decouple business logic from file storage access strategies. A configuration information table needs to be built in advance to associate the groups and modules in the business with specific technical strategies.

[0027] Specifically, the configuration information table contains multiple configuration records, each including at least the following fields: business group (group_name), business module name (module_name), upload mode (mode), permission type (auth), and storage space name (bucket_name). The combination of the business group and business module name uniquely identifies a configuration record. That is, by using these two conditions, a matching configuration record can be precisely retrieved from the configuration information table, thus obtaining the corresponding upload mode, permission type, and storage space name from that record.

[0028] This step, by pre-registering configuration information, enables subsequent upload and access steps to automatically match the corresponding technical strategies based on the business parameters passed in by the business party, thus achieving transparency for the business party.

[0029] Step S102: Obtain the file to be uploaded and business parameters carried in the upload request. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Based on the business group and business module name carried in the upload request, obtain the corresponding upload mode, permission type and storage space name from the configuration information table. The obtained storage space name is used to indicate the specified storage space of the file to be uploaded in the object storage service.

[0030] Specifically, the upload request retrieves the file to be uploaded and the business parameters. The file to be uploaded is the actual data content that the user wants to store, such as a PDF contract or a photo. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded, including: business group, business module name, channel identifier (source_id), and enterprise identifier (ent_id).

[0031] After obtaining the business group and business module name, the system uses these two parameters as joint query conditions to search for target configuration records in the configuration information table stored in step S101 that match both the business group and business module name. If a matching record is found, the system retrieves the upload mode, permission type, and storage space name from that record; otherwise, an error is returned, and the upload process is interrupted.

[0032] The obtained storage space name is used to indicate the specified storage space in the object storage service where the file to be uploaded will be stored, that is, in which storage space the file will be stored.

[0033] Step S103: Generate a directory name based on the obtained upload mode and the business parameters to construct the specified storage path of the file to be uploaded in the specified storage space.

[0034] This step is the core of the path-based permission rules in this invention. Based on the upload mode obtained in step S102, and the business group, business module name, channel identifier, and enterprise identifier in the business parameters, a directory name is generated to construct the specified storage path for the file to be uploaded within the specified storage space.

[0035] Specifically, the specified storage path is a hierarchical structure containing multiple levels of directories. In one embodiment, starting from the root directory, the directory structure is as follows: a first-level directory corresponding to the upload mode, a second-level directory corresponding to the business group, a third-level directory corresponding to the business module name, a fourth-level directory corresponding to the channel identifier, a fifth-level directory corresponding to the enterprise identifier, and a filename portion containing a unique identifier and the original filename, such as private / group_a / module_b / source_id_123 / ent_id_456 / uuid_filename.ext; wherein, the first-level directory name is determined by the upload mode. In this embodiment of the invention, the upload mode includes private mode, ordinary public mode, and public mode accelerated by Content Delivery Network (CDN). When the upload mode is private mode, the first-level directory name corresponds to the private directory name, such as private; when the upload mode is ordinary public mode or public mode accelerated by CDN, the first-level directory name corresponds to the public directory name, such as public. The unique identifier is a unique string, or UUID, generated by the server for each file to prevent filename conflicts in the same directory. The unique identifier is combined with the original filename to form the filename part of the path.

[0036] This step embeds the channel identifier and enterprise identifier directly into the directory hierarchy of the storage path, so that the file path itself carries tenant ownership information, laying the foundation for subsequent path resolution and authentication.

[0037] Step S104: Upload the file to be uploaded to the specified storage path, set the access control list attribute of the file in the object storage service according to the upload mode, generate a first access link according to the access control list attribute, and return the specified storage path and the first access link to the upload requester.

[0038] Specifically, the file to be uploaded is uploaded to the specified storage path constructed in step S103. Simultaneously, based on the upload mode obtained in step S102, the access control list (ACL) attribute of the file in the object storage service is set. When the upload mode is private, the ACL attribute is set to private; when the upload mode is normal public mode or content delivery network (CDN) accelerated public mode, the ACL attribute is set to public. The ACL attribute settings are the same for both CDN accelerated public mode and normal public mode, both set to public. The difference lies in the generation method of the access link in the next stage: when generating a public access link, CDN accelerated public mode uses the CDN accelerated domain name instead of the origin server domain name to provide faster access speeds.

[0039] After setting the access control list attributes, the first access link is generated based on the configured access control list attributes. If the access control list attribute is private, a temporary authorized access link (signed URL) is generated, which has a time limit; if the access control list attribute is public and the upload mode is normal public mode, a direct access link (direct URL) is generated; if the access control list attribute is public and the upload mode is content delivery network accelerated public mode, a content delivery network accelerated link (CDN URL) is generated.

[0040] The constructed specified storage path and the first access link are returned to the upload requester. The specified storage path serves as a unique location identifier for the file, which the upload requester stores in its business database for use when initiating subsequent file access requests; the first access link allows the upload requester to view or use the file immediately.

[0041] Furthermore, the metadata of the uploaded file is recorded in the file information table. The file metadata includes at least: the specified storage path, upload mode, permission type, and access control list attributes. Optionally, it may also include information such as storage space name, channel identifier, enterprise identifier, and original filename. Recording the file metadata allows the server to quickly query the corresponding permission type and access control list attributes during subsequent file access, providing a basis for authentication.

[0042] Step S105: In response to a file access request, obtain the specified storage path of the file to be accessed and the channel identifier and enterprise identifier of the requesting party carried in the file access request; extract the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the requesting party from the uploading party.

[0043] When a file needs to be accessed or downloaded, the requesting party initiates a file access request to the server. The requesting party can obtain the specified storage path in several ways: after receiving the specified storage path in step S104, the uploading party stores it in the business database; the requesting party obtains the path by querying the business database; or the uploading party passes the path as a parameter to the requesting party.

[0044] After receiving a file access request, the server retrieves the specified storage path of the file to be accessed, as well as the channel identifier and enterprise identifier of the requesting party, carried in the request. It then extracts the channel identifier and enterprise identifier associated with the file to be accessed from the directory within the specified storage path. Since the specified storage path has a fixed hierarchical structure during construction, the server can accurately extract these identifiers from a preset directory hierarchy. For example, in one embodiment, the channel identifier is located in the fourth-level directory of the storage path, and the enterprise identifier is located in the fifth-level directory.

[0045] Step S106: Obtain the permission type corresponding to the file to be accessed. Based on the permission type of the file to be accessed, compare and authenticate the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed. If the authentication is successful, generate a second access link based on the access control list attribute of the file to be accessed and return it to the access requester. If the authentication fails, return a prohibited access response to the access requester.

[0046] The server uses the specified storage path as a query condition and retrieves the permission type corresponding to the file to be accessed from the file information table recorded in step S104. In this embodiment, the permission type includes one or more of the following: public type, channel public type, enterprise protection type, and channel private type. Based on the obtained permission type, the server compares the channel identifier and enterprise identifier provided by the access requester with the channel identifier and enterprise identifier extracted from the specified storage path of the file to be accessed to obtain the authentication result. For example, when the permission type is public, authentication is directly passed without comparison; when the permission type is channel public, the channel identifier of the access requester must match the extracted file channel identifier, otherwise authentication fails; when the permission type is enterprise protection, the enterprise identifier of the access requester must match the extracted file enterprise identifier, otherwise authentication fails; when the permission type is channel private, the channel identifier and enterprise identifier of the access requester must match the extracted file channel identifier and enterprise identifier, respectively, otherwise authentication fails.

[0047] If authentication succeeds, the system generates a second access link based on the access control list attributes of the file to be accessed and returns it to the requester. The generation rules are similar to those in step S104: if the access control list attribute is private, a temporary authorized access link is generated; if the access control list attribute is public, a direct access link or a content delivery network (CDN) accelerated link is generated. If authentication fails, the system returns an access denied response to the requester.

[0048] This step uses a path-based authentication mechanism to deeply bind permission judgment to the file path. It eliminates the need for complex real-time permission database queries and completes authentication with only a single file information table query and simple comparison, making it extremely efficient.

[0049] The complete process of this embodiment will be illustrated below through a specific application scenario.

[0050] A certain SaaS platform provides order management services to multiple enterprises, where channel identifiers represent different business channels and enterprise identifiers represent different enterprise customers. The platform has two main business modules: an order system (grouped as `order_system`) and a user center (grouped as `user_center`).

[0051] The administrator pre-registered two modules in the configuration information table: the invoice module under the order system, configured as private mode, enterprise protection type, and stored in private-bucket; and the avatar module under the user center, configured as public mode, public type, and stored in cdn-bucket for content delivery network acceleration.

[0052] A company with enterprise ID ent_5001 belongs to channel source_100. The company's finance personnel upload an invoice file through the order system. The server, based on the input group=order_system and module=invoice, queries the configuration information table and matches an upload mode of private mode, a permission type of enterprise protection, and a storage space named private-bucket.

[0053] The server generates a first-level directory named "private" based on the private mode, and then generates a specified storage path based on business parameters: private / order_system / invoice / source_100 / ent_5001 / uuid123_invoice.pdf.

[0054] The server uploads the invoice file to the aforementioned path in the private-bucket, sets its access control list attribute to private, generates a temporary authorized access link with a longer validity period as the first access link, and returns it to the order system along with the specified storage path. The order system saves this path to the invoice record table.

[0055] When another employee of the company needs to download the invoice, the requesting party queries the invoice record table for the specified storage path, and initiates a file access request with the path and its own identity information such as channel identifier source_100 and enterprise identifier ent_5001.

[0056] The server extracts the channel identifier (source_100) and enterprise identifier (ent_5001) associated with the file from the path. It then queries the file information table and finds that the file's permission type is enterprise protection. The server compares the requester's enterprise identifier (ent_5001) with the extracted enterprise identifier (ent_5001), and since they match, authentication is successful. Based on the file's access control list attribute being private, the server generates a new temporary authorized access link and returns it as a secondary access link to the requester for download completion.

[0057] As can be seen from the above process, files from different companies are naturally isolated through their storage paths. Even if files from two companies are stored in the same storage space, their paths are completely independent due to the different company identifiers. During authentication, dual verification through path resolution and configured permission types effectively prevents unauthorized access.

[0058] III. Device Examples See Figure 2 Another embodiment of the present invention provides a multi-tenant file processing device 200 based on dynamic path authentication, including a configuration management module 201, an upload processing module 202, a path generation module 203, an upload execution module 204, an access processing module 205, and an authentication module 206. The multi-tenant file processing device 200 based on dynamic path authentication can execute the multi-tenant file processing method based on dynamic path authentication in the method embodiment.

[0059] Specifically, the multi-tenant file processing device 200 based on dynamic path authentication includes: Configuration management module 201 is used to obtain and store pre-built business module configuration information tables; The upload processing module 202 is used to obtain the file to be uploaded and business parameters carried in the upload request. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Based on the business group and business module name carried in the upload request, the module obtains the corresponding upload mode, permission type and storage space name from the configuration information table. The obtained storage space name is used to indicate the specified storage space of the file to be uploaded in the object storage service. The path generation module 203 is used to generate a directory name based on the obtained upload mode and the business parameters, so as to construct the specified storage path of the file to be uploaded in the specified storage space; The upload execution module 204 is used to upload the file to be uploaded to the specified storage path, set the access control list attribute of the file in the object storage service according to the upload mode, generate a first access link according to the access control list attribute, and return the specified storage path and the first access link to the upload requester. The access processing module 205 is used to respond to a file access request by obtaining the specified storage path of the file to be accessed and the channel identifier and enterprise identifier of the access requester carried in the file access request; extracting the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the access requester from the upload requester. The authentication module 206 is used to obtain the permission type corresponding to the file to be accessed, and to compare the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed for authentication based on the permission type of the file to be accessed; if the authentication is successful, a second access link is generated based on the access control list attribute of the file to be accessed and returned to the access requester; if the authentication fails, an access denied response is returned to the access requester.

[0060] It should be noted that the technical solutions of the multi-tenant file processing device 200 based on dynamic path authentication provided in this embodiment, which can be used to execute various method embodiments, are similar in implementation principle and technical effect to the methods, and will not be repeated here.

[0061] Figure 3 This is a schematic diagram of an electronic device 300 provided in another embodiment of the present invention. The electronic device 300 is used to implement the multi-tenant file processing method based on dynamic path authentication in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, smartphones, tablet computers, PCs, laptops, etc. Figure 3 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0062] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0063] Typically, the following devices can be connected to I / O interface 305: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0064] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A multi-tenant file processing method based on dynamic path authentication, characterized in that, include: Retrieve and store the pre-built business module configuration information table; Obtain the file to be uploaded and business parameters carried in the upload request. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Obtain the corresponding upload mode, permission type and storage space name from the configuration information table according to the business group and business module name carried in the upload request. The obtained storage space name is used to represent the specified storage space of the file to be uploaded in the object storage service; Based on the obtained upload mode and the business parameters, a directory name is generated to construct the specified storage path of the file to be uploaded in the specified storage space; The file to be uploaded is uploaded to the specified storage path, and the access control list attribute of the file in the object storage service is set according to the upload mode. A first access link is generated according to the access control list attribute, and the specified storage path and the first access link are returned to the upload requester. In response to a file access request, obtain the specified storage path of the file to be accessed, as well as the channel identifier and enterprise identifier of the requesting party, carried in the file access request. Extract the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the access requester from the upload requester; Obtain the permission type corresponding to the file to be accessed, and compare and authenticate the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed based on the permission type of the file to be accessed. If authentication is successful, a second access link is generated based on the access control list attribute of the file to be accessed and returned to the access requester. If authentication fails, an access denied response is returned to the party that made the access request.

2. The multi-tenant file processing method based on dynamic path authentication according to claim 1, characterized in that: The upload modes include: private mode, normal public mode, and public mode accelerated by content delivery network; The business parameters include business group, business module name, channel identifier, and enterprise identifier; The first-level directory name is determined based on the upload mode, where the private mode corresponds to the private directory name, and the ordinary public mode and the public mode of content delivery network acceleration correspond to the public directory name.

3. The multi-tenant file processing method based on dynamic path authentication according to claim 2, characterized in that, Setting the access control list attribute of the file in the object storage service according to the upload mode includes: When the upload mode is private mode, the access control list attribute is set to private; When the upload mode is a normal public mode or a content delivery network accelerated public mode, the access control list attribute is set to public.

4. The multi-tenant file processing method based on dynamic path authentication according to claim 3, characterized in that, The step of generating the first access link based on the access control list attribute includes: if the access control list attribute is private, generating a temporary authorized access link; if the access control list attribute is public, generating a direct access link or a content delivery network accelerated link.

5. The multi-tenant file processing method based on dynamic path authentication according to claim 1, characterized in that, The permission types include one or more of the following: public type, channel public type, enterprise protection type, and channel private type; The step of comparing and authenticating the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed, based on the permission type of the file to be accessed, includes: When the permission type is public, authentication is automatically successful. When the permission type is public channel type, it is determined whether the channel identifier of the access requester is consistent with the extracted channel identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is enterprise protection type, it is determined whether the enterprise identifier of the access requester is consistent with the extracted enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is channel private, it is determined whether the channel identifier and enterprise identifier of the access requester are consistent with the extracted channel identifier and enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails.

6. A multi-tenant file processing device based on dynamic path authentication, characterized in that, include: The configuration management module is used to obtain and store pre-built business module configuration information tables; The upload processing module is used to obtain the file to be uploaded and business parameters carried in the upload request. The business parameters are used to identify the multi-tenant ownership information of the file to be uploaded. Based on the business group and business module name carried in the upload request, the module obtains the corresponding upload mode, permission type and storage space name from the configuration information table. The obtained storage space name is used to represent the specified storage space of the file to be uploaded in the object storage service; The path generation module is used to generate a directory name based on the obtained upload mode and the business parameters, so as to construct the specified storage path of the file to be uploaded in the specified storage space. The upload execution module is used to upload the file to be uploaded to the specified storage path, set the access control list attribute of the file in the object storage service according to the upload mode, generate a first access link according to the access control list attribute, and return the specified storage path and the first access link to the upload requester. The access processing module is used to respond to a file access request by obtaining the specified storage path of the file to be accessed, as well as the channel identifier and enterprise identifier of the requesting party. Extract the channel identifier and enterprise identifier associated with the file to be accessed from the directory of the specified storage path of the file to be accessed; the specified storage path of the file to be accessed carried in the access request is obtained by the access requester from the upload requester; The authentication module is used to obtain the permission type corresponding to the file to be accessed, and to compare and authenticate the channel identifier and enterprise identifier of the access requester with the extracted channel identifier and enterprise identifier associated with the file to be accessed based on the permission type of the file to be accessed. If authentication is successful, a second access link is generated based on the access control list attribute of the file to be accessed and returned to the access requester. If authentication fails, an access denied response is returned to the party that made the access request.

7. A multi-tenant file processing device based on dynamic path authentication according to claim 6, characterized in that: The upload modes include: private mode, normal public mode, and public mode accelerated by content delivery network; The business parameters include business group, business module name, channel identifier, and enterprise identifier; The path generation module is further used to: determine the first-level directory name according to the upload mode, wherein the private mode corresponds to the private directory name, and the ordinary public mode and the public mode of content delivery network acceleration correspond to the public directory name.

8. A multi-tenant file processing device based on dynamic path authentication according to claim 7, characterized in that, The upload execution module is further used for: When the upload mode is private mode, the access control list attribute is set to private; When the upload mode is a normal public mode or a content delivery network accelerated public mode, the access control list attribute is set to public.

9. A multi-tenant file processing device based on dynamic path authentication according to claim 8, characterized in that, The upload execution module is further configured to: generate a temporary authorized access link if the access control list attribute is private; and generate a direct access link or a content delivery network acceleration link if the access control list attribute is public.

10. A multi-tenant file processing device based on dynamic path authentication according to claim 6, characterized in that, The permission types include one or more of the following: public type, channel public type, enterprise protection type, and channel private type; The authentication module is further used for: When the permission type is public, authentication is automatically successful. When the permission type is public channel type, it is determined whether the channel identifier of the access requester is consistent with the extracted channel identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is enterprise protection type, it is determined whether the enterprise identifier of the access requester is consistent with the extracted enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails. When the permission type is channel private, it is determined whether the channel identifier and enterprise identifier of the access requester are consistent with the extracted channel identifier and enterprise identifier associated with the file to be accessed. If they are consistent, the authentication is successful; otherwise, the authentication fails.

Images