Data access methods, devices, equipment, and readable storage media

Abstract

Embodiments of this disclosure provide data access methods, apparatus, devices, and readable storage media. [Solution] The method includes: sending a data access permission request to a data resource to multiple clients of the target application associated with the data resource, in response to the demand for processing a data resource generated by the target application; receiving permission information for the data access permission request from at least one of the multiple clients; obtaining at least one access credential corresponding to at least one client based on the permission information; and using the at least one access credential to access the target data in the data resource associated with at least one client.

Description

Technical Field

[0004] , , , ,

[0003]

[0001] Exemplary embodiments of the present disclosure generally relate to the field of computers, and particularly relate to data access methods, devices, equipment, and readable storage media.

Background Art

[0002] As the importance of data security has been increasing, strengthening data security has become an urgent and attention-required issue. Particularly, in the process of data interaction between a user terminal and the cloud, how to ensure the security of data generated by the user terminal is an urgent issue to be solved.

Summary of the Invention

Means for Solving the Problems

[0003] In a first aspect of the present disclosure, a data access method is provided. This method is applied to the user side of data resources, and in response to the need to process data resources generated by a target application, it transmits a data access permission request for the data resources to a plurality of clients of the target application. The plurality of clients are associated with the data resources, and respectively receive permission information for the data access permission request from at least one client among the plurality of clients, and based on the permission information, obtain at least one access credential corresponding to at least one client respectively, and use at least one access credential to access the target data in the data resources associated with at least one client in order to process the target data.

[0004] A second aspect of this disclosure provides a data access method. The method is applied to a client of a target application and includes: sending access credentials for data access to the credential management service in response to the credential management service's successful verification; processing target data generated by the client in the target application using processing credentials corresponding to the access credentials; storing the processed target data on a data storage side; and receiving a data access permission request from a user of a data resource, wherein the data resource includes target data; generating permission information for the data access permission request in response to an affirmative instruction to the data access permission request; and transmitting the permission information to the user of the data resource.

[0005] A third aspect of this disclosure provides a data access method, which is applied to a credential management service, and includes sending a certification report to multiple clients of a target application, the certification report indicating the reliability of an environment storing access credentials; receiving multiple access credentials from the multiple clients, each of which is used to access data associated with the corresponding client; and sending access credentials to the data resource user in response to receiving an access credential request from the data resource user for at least one of the multiple clients.

[0006] A fourth aspect of the present disclosure provides an electronic device comprising at least one processing unit and at least one memory coupled to the at least one processing unit and storing instructions to be executed by the at least one processing unit. When the instructions are executed by the at least one processing unit, the electronic device causes the electronic device to perform the method of the first aspect.

[0007] A fifth aspect of this disclosure provides a computer-readable storage medium on which a computer program is stored, and which, when executed by a processor, implements the method of the first aspect.

[0008] It should be understood that the contents described in this section are not intended to limit the main or important features of the embodiments of this disclosure, nor to limit the scope of this disclosure. Other features of this disclosure will be readily apparent from the following description.

[0009] The above and other features, advantages, and aspects of each embodiment of this specification will become more apparent upon further detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals indicate the same or similar elements. [Brief explanation of the drawing]

[0010] [Figure 1] A schematic diagram of an exemplary environment in which embodiments of the embodiments of this disclosure may be implemented is shown. [Figure 2] The following are block diagrams of data access processes according to some embodiments of this disclosure. [Figure 3] A schematic diagram illustrating the principle of a data access process according to some embodiments of this disclosure is shown. [Figure 4] The following are block diagrams of data access processes according to several other embodiments of this disclosure. [Figure 5] Schematic diagrams of interaction interfaces according to some embodiments of this disclosure are shown. [Figure 6]The following are block diagrams of data access processes according to several other embodiments of this disclosure. [Figure 7] A schematic block diagram of a data access device according to several embodiments of this disclosure is shown. [Figure 8] A schematic block diagram of a data access device according to several other embodiments of this disclosure is shown. [Figure 9] A schematic block diagram of a data access device according to several other embodiments of this disclosure is shown. [Figure 10] A block diagram of an electronic device that may implement one or more embodiments of this disclosure is shown. [Modes for carrying out the invention]

[0011] The embodiments of this disclosure will be described in more detail below with reference to the accompanying drawings. While the accompanying drawings illustrate several embodiments of this disclosure, it should be understood that this disclosure can be realized in various forms and should not be construed as being limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0012] In describing embodiments of this disclosure, the term “including” and similar terms should be understood as non-restrictive inclusion, i.e., “including, but not limited to.” The term “based on” should be understood as “based at least in part.” The term “embodiment” or “this embodiment” should be understood as “at least one embodiment.” The term “several embodiments” should be understood as “at least several embodiments.” Further explicit and implicit definitions may be included below.

[0013] In this specification, unless expressly stated otherwise, performing the step “in response to A” does not mean performing this step immediately after “A,” and may include one or more intermediate steps.

[0014] Please understand that the data related to this proposed technology (including, but not limited to, the data itself, its acquisition, use, storage, and deletion) will comply with the requirements of applicable laws and regulations.

[0015] Before using any of the technical proposals disclosed in each embodiment of this specification, you should notify the relevant users of the type of information related to this disclosure, the scope of use, and the usage scenarios, etc., by appropriate means in accordance with applicable laws and regulations, and obtain the approval of the relevant users. Please understand that relevant users may include any type of rights holder, such as individuals, companies, and organizations.

[0016] For example, in response to receiving an unsolicited request from a user, the relevant user can autonomously choose whether to provide information to software or hardware such as electronic devices, applications, servers, or storage media that perform the operation of the proposed technical demonstration of this disclosure by sending a prompt message to the relevant user that explicitly reminds the relevant user that the requested action requires access to and use of the relevant user's information.

[0017] In an optional and non-limiting embodiment, a prompt message may be sent to the relevant user in response to the receipt of an unsolicited request from the relevant user, for example, by a pop-up window, in which the prompt message may be presented in text. Furthermore, the pop-up window may include a selection controller for the user to choose whether to "agree" or "disagree" to providing information to the electronic device.

[0018] It should be understood that the above process of obtaining the notice and user authorization is merely exemplary and does not limit the embodiments of the present disclosure, and other methods that comply with relevant laws and regulations can also be applied to the embodiments of the present disclosure.

[0019] FIG. 1 shows a schematic diagram of an exemplary environment 100 in which embodiments of the present disclosure can be implemented. As shown in FIG. 1, the exemplary environment 100 may include a client 120 of a user 140 and a host device 110 in a cloud environment.

[0020] As shown in FIG. 1, a trusted execution environment 115 may be disposed in the host device 110. In this trusted execution environment 115, a computing engine 112 may be executed. The trusted execution environment (TEE) is a hardware-based security technology that constructs a secure computing environment isolated from the outside by dividing it into a secure part and a non-secure part. The secure computing environment can guarantee the confidentiality and integrity of the data and code loaded inside the trusted execution environment 115. The trusted execution environment 115 is isolated from the normal environment and has a higher security level suitable for executing processing on confidential data therein. The computing engine can provide a confidential cloud computing (CCC) service executed in the trusted execution environment 115, and the confidential cloud computing service provided by the computing engine is intended to protect the security of user data.

[0021] The credential management service can be executed in a trusted execution environment 115. The credential management service can be executed independently of the host device 110. The credential management service may be a Trusted Key Service (TKS). The credential management service is intended to provide users with hardware-protected access credential management and proxy services as a security service executed in the trusted execution environment 115.

[0022] The access credentials obtained from the client 120 may be stored in the access credential management database 114 using the credential management service. Further, the host device 110 may store the data resources generated by the target application obtained from the client 120 in the data storage side 116. It is not difficult to understand that the above data resources are data resources generated by the target application obtained through the permission and approval of the user 140. Exemplarily, the data resources may include geographical location data, click behavior data, etc.

[0023] In some embodiments, the host device 110 communicates with the client 120 to enable data access and analysis. The client 120 may be any type of mobile, fixed, or portable terminal, and includes mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio receivers, e-book readers, game devices, or any combination thereof, and further includes accessories and peripherals for these devices, or any combination thereof. In some embodiments, the client 120 may also support any type of user-specific interface (e.g., “wearable” circuitry).

[0024] The host device 110 may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain services, security services, content delivery networks, big data, and artificial intelligence platforms. The host device 110 may also include computing systems / servers such as mainframes, edge computing nodes, and computing devices in a cloud environment. The host device 110 may provide background services for data management to the client 120. An example of the host device 110 is a host machine of a cloud vendor.

[0025] A communication connection may be established between the host device 110 and the client 120. The communication connection may be established by wired or wireless means. The communication connection may include, but is not limited to, Bluetooth® connections, mobile network connections, Universal Serial Bus connections, Wireless Fidelity connections, etc., and the embodiments of this disclosure are not limited in this respect.

[0026] The structure and function of each element within Environment 100 are described for illustrative purposes only and should not be understood as limiting the scope of this disclosure in any way. In other words, the structure, function, number, and connectivity of the elements within Environment 100 can be modified according to actual needs. This disclosure is not limited in this respect.

[0027] Currently, there are many security risks in the interaction between clients and host devices in the cloud. For example, users have no way of knowing whether their data is encrypted before transmission, or how their data is being used or processed. As a result, there is a risk that data may be intercepted, misused, or shared without the user's knowledge, leading to the leakage of personal information.

[0028] Embodiments of this disclosure provide an improved data access solution. In this solution, a user of a data resource sends data access permission requests to multiple clients of the target application in response to the need to process the data resource generated by the target application, and the multiple clients are associated with the data resource. The user receives authorization information about the data access permission request from at least one of the multiple clients. Based on the authorization information, at least one access credential is obtained corresponding to each of the at least one clients. The user accesses the target data using the at least one access credential to process the target data in the data resource associated with the at least one client.

[0029] Through the above process, sending data access permission requests to multiple clients by the user of the data resource constitutes a peer-to-peer request, thus preventing man-in-the-middle attacks. The user of the data resource receives permission information fed back by at least one client in response to the data access permission request, and the retrieved data includes data resources generated by the target application running on the client, thus ensuring that the retrieval of user data is achieved under the user's authorization. These improvements significantly enhance data security, avoiding the risk of unauthorized access to or leakage of data resources and resolving data security issues.

[0030] Several exemplary embodiments of this disclosure are described below in detail with reference to examples in the accompanying drawings. It should be understood that the interfaces shown in the accompanying drawings are merely examples, and various interface designs are possible in practice. Individual graphical elements within an interface may have different arrangements and different visual representations, one or more elements may be omitted or replaced, and one or more other elements may be present. Embodiments of this disclosure are not limited in this respect.

[0031] Figure 2 shows a block diagram of a data access process 200 according to some embodiments of the present disclosure. This data access process may be implemented in a host device 110 that can function as a user of data resources. The task processing process shown in Figure 2 is described below in relation to Figure 1.

[0032] In box 201, the host device 110 responds to the demand for processing data resources generated by the target application by sending data access permission requests to multiple clients of the target application, and the multiple clients are associated with the data resources. Exemplaryly, the host device 110 may utilize scenarios such as data access tasks and data analysis tasks performed by the compute engine 112, and the compute engine 112 performing a data access task or data analysis task may be used as a trigger command for generating and sending data access permission requests.

[0033] Figure 3 shows a schematic diagram of a data access process 300 according to some embodiments of the present disclosure. As shown in relation to Figure 3, for example, the host device 110 may trigger the transmission of a request to access a data resource in step 302 by having the computing engine 112 perform a point of interest recommendation task. As shown in Figure 3, the data storage side 116 and the computing engine 112 are shown on one host device 110, but in a real-world scenario, the data storage side 116 and the computing engine 112 may be distributed across different host devices 110. Furthermore, there may be multiple host devices 110.

[0034] For a task performed by the computing engine 112, the host device 110 may determine at least one client 120 based on multidimensional factors such as correlation, quality, and reliability of data resources. The host device 110 then sends a generated data access permission request to the determined at least one client 120.

[0035] In box 202, the host device 110 receives authorization information for data access permission requests from at least one of the multiple clients. The authorization information may also be sent to the host device 110 by client 120 as feedback to the data access permission request.

[0036] Client 120 receives a data access permission request, and user 140 may either grant or deny the data access permission request. If user 140 denies granting the data access permission request, the entire process terminates. Conversely, as shown in relation to Figure 3, if user 140 agrees to grant the data access permission request, client 120 generates permission information and sends it to host device 110.

[0037] Generally, authorization information includes at least the access token of client 120 (or user 140), which may represent the client's identification information. The authorization information may also include additional information such as the scope of permission to use the authorized data resources, the purpose of the permission, and the expiration date of the permission. For example, the scope of permission to use the data resources may indicate the category of data resources generated by the target application. The expiration date of the permission may be one day, one hour, etc. The purpose of the permission may be to authorize the host device 110 to perform a specific data computation task or a specific data analysis task.

[0038] In box 203, the host device 110 obtains at least one access credential corresponding to at least one client based on the authorization information. As shown in relation to Figure 3, after receiving the authorization information, the host device 110 may, in step 304-1, use the credential management service to obtain access credentials for data resources from the access credential management database 114. Furthermore, the host device 110 may, in step 304-2, obtain data resources from the data storage side 116.

[0039] Exemplary, in step 301-1, the access credentials for a data resource may be uploaded to the access credential management database 114 by the client 120. Furthermore, in step 301-2, the client 120 may process the data resource generated by the target application using processing credentials and then upload it to the data storage side 116. Exemplary, processing the data resource using processing credentials may include encrypting the data resource using processing credentials. The processing credentials correspond to the access credentials uploaded to the access credential management database 114. Exemplary, the encrypted data resource can be decrypted using the access credentials.

[0040] The host device 110 may obtain access credentials for data resources from the access credential management database 114. Alternatively, it may obtain data resources processed by processing credentials from the data storage side 116.

[0041] In box 204, the host device 110 accesses target data using at least one access credential to process the target data in the data resource associated with at least one client. Based on the decrypted data resource, the compute engine 112 may perform corresponding compute and processing tasks. The execution process of accessing the target data associated with at least one client using at least one access credential can be completed in a trusted execution environment 115, ensuring the security of the data in processing and preventing data leakage or misuse.

[0042] Through the above process, the host device 110 ensures the legitimacy of access to data resources through the feedback of authorization information and prevents the acquisition of unauthorized data resources. At the same time, the access credential mechanism ensures the security of data during transmission and use, preventing data leakage and tampering.

[0043] The above is an overview of the overall process of the host device 110. Next, the acquisition of access credentials for data resources and the acquisition of data resources will be described in detail. First, the process of acquiring access credentials for data resources will be described. In some embodiments, the host device 110 determines an access token for at least one client based on authorization information. It sends an access credential request for the data resource to the credential management service, and the access credential request includes at least an access token. The host device 110 receives at least one access token from the credential management service, corresponding to at least one client.

[0044] The host device 110 first determines the access token for client 120 based on the authorization information fed back from client 120. The access token may represent the identification information of client 120. In the access credential management database 114, the credential management service configures each access credential entry to consist of unique identification information and corresponding access credentials. This identification information may be a unique identifier for the client. The access credentials may be used to decrypt data resources.

[0045] The host device 110 sends an access credential request for the data resource to a credential management service that manages the access credentials for the data resource, and the access credential request includes at least an access token. The credential management service can quickly and accurately retrieve the corresponding access credentials based on the identification information within the access credential management database 114 based on a structured storage scheme. This allows the host device 110 to receive the access credentials from the credential management service. The credential management service may be a security service running in a trusted execution environment.

[0046] The access credential request may further include a security report, which demonstrates the reliability of the trusted execution environment 115 for processing the data resource. The host device 110 sends an access credential request for the data resource to the credential management service, and the access credential request may include both an access token and a security report. This security report is used to demonstrate that the trusted execution environment 115 of the compute engine 112 for processing the data resource is secure, reliable, and complies with a predetermined security standard.

[0047] For example, the security report may include the operating system version of the host device 110 where the compute engine 112 resides. If the compute engine 112 is running on a virtual machine, the version and configuration of the virtual machine software will be reported. The security report may also further include the code version of any specific application or software running on the compute engine 112. The operating system version may indicate the security and update status of the system environment. The virtual machine software version may indicate the security of the virtualization environment. The code version of any specific application or software may indicate that the application or software has not been tampered with and is running in the expected state.

[0048] The credential management service may perform security report verification. If the verification is successful, the host device 110 will be able to receive access credentials for the data resources. By setting security reports in the access credential request, the security of the computing engine 112 can be proven. For example, by verifying the version and confirming that the latest security patches have been applied to system components and software, the risk of malware or insecure software being used in the data request process can be reduced.

[0049] The acquisition of access credentials for data resources has been described above. Next, the acquisition of data resources will be described. In some embodiments, the host device 110 acquires data resources from the data storage side 116, which are stored on the data storage side 116 by the provider based on a received certification report, and the certification report indicates the reliability of the environment in which the data resources are stored.

[0050] The data resource is authorized by client 120 and stored on the data storage side 116. Authorization by client 120 may include performing a check against the certification report sent by host device 110 and deriving the authorization after concluding that the check was successful.

[0051] A certification report may demonstrate the reliability of the environment in which data resources are stored. Exemplary examples may include information such as hardware TCB (Trusted Computing Base) information, application metric values, application custom data, and hardware signatures. Application metric values ​​typically refer to a set of values ​​obtained after metricing an application or its components in a trusted execution environment. These values ​​are used to verify the integrity and authenticity of the application and to ensure that the application has not been tampered with. Application custom data typically refers to data defined by the application according to its specific needs and included in the certification report. This data may be application-specific configuration, identification information, or other content that helps to demonstrate the security and reliability of the application.

[0052] After successfully verifying the certification report, client 120 uploads the access credentials to the access credential management database 114, and the credential management service is responsible for managing the access credentials. Client 120 also encrypts some data resources using processing credentials and then uploads the data resources to the data storage side 116 within the host device 110. In other words, once client 120 successfully verifies the certification report, it is authorized to process the data resources generated within client 120 by the target application and then upload them to the data storage side 116.

[0053] When the host device 110 sends a data access permission request to the client 120 based on a task to be performed by the computing engine 112, the client 120 may grant access. That is, it may grant the host device 110 permission to retrieve all or part of the data resources already stored on the data storage side 116.

[0054] Through the above process, client 120 can securely upload data resources to data storage side 160 and authorize the computing engine 112 of host device 110 to access these data resources as needed. This ensures that the process of accessing and transmitting data resources complies with security requirements.

[0055] For at least one of the clients, the target data stored on the data storage side 160 is data that has been processed by the client using processing credentials corresponding to the client's access credentials, and then transmitted to the data storage side 160.

[0056] In client 120, processing of data generated by the target application may include processing the data generated by the target application using processing credentials and then transmitting it to the data storage side 116. These processing credentials may correspond to access credentials uploaded by client 120 to the access credential management database 114. Exemplaryly, the credential management service may decrypt data resources based on the access credentials of the data resources. Decryption may be performed within a trusted execution environment 115.

[0057] Within the trusted execution environment 115, the host device 110 may further ensure data security by processing data resources and access credentials for those data resources. Specifically, in response to the fulfillment of predetermined conditions, the host device 110 may remove the target data and access credentials for the target data from the trusted execution environment, the predetermined conditions including the termination of access to the target data or the expiration of the permission to use the target data.

[0058] Based on the acquired access credentials, the host device 110 may perform a decryption process on the data resource within the trusted execution environment 115. Since the decryption process is completed within the trusted execution environment 115, the decrypted data resource is not exposed to an untrusted environment.

[0059] The decrypted data resources reside within the trusted execution environment 115, and the host device 110 performs access to the data resources processed by the access credentials based on data access tasks. These tasks may include data analysis, computation, and the like. Because these accesses are performed within the trusted execution environment 115, the integrity and confidentiality of the data resources are effectively protected.

[0060] When access to a data resource ends or the permission to use the data resource expires, according to predefined conditions, the host device 110 deletes the data resource and its corresponding access credentials within the trusted execution environment 115. The conditions can be set according to different security policies to ensure that data resources and access credentials do not remain for extended periods. For example, the conditions may instruct the deletion of the data resource and its corresponding access credentials after a data analysis task or data access task has completed its execution. Alternatively, the conditions may instruct the deletion of the data resource and its corresponding access credentials after the permission to use the data resource has expired.

[0061] Through the above process, decryption and data access are performed within a trusted execution environment, reducing the risk of data resources (especially those potentially containing sensitive information) being exposed in an untrusted environment. Furthermore, under specified conditions, data resources and access credentials are ensured to be securely deleted upon termination of access or expiration of the usage license, preventing unauthorized use of data resources. Meanwhile, transparent security authentication and a rigorous data access process enhance the level of data security.

[0062] Access to data resources is performed based on a data access permission request. The data access permission request may be directed to a specified provider. The process for generating a data access permission request is described below. The host device 110 determines at least one data resource type corresponding to a data processing task, based on the data processing task to be performed, and the data resource contains data of at least one data resource type. A data access permission request is generated based on the at least one data resource type.

[0063] Data processing tasks may include a variety of categories. For example, a data processing task may include analyzing the behavioral data of newly registered users in an application in order to optimize the user experience.

[0064] The host device 110 determines the data resource acquisition range and data resource type corresponding to the data processing task based on the data processing task of the computing engine 112. The data resource acquisition range may correspond to clients such as newly registered users (e.g., users with a registration period of less than one month) or users in a certain region.

[0065] Based on the data resource acquisition scope and data resource type, the host device 110 may generate a data access permission request. Exemplary, a data access permission request may include the purpose corresponding to the data access task, the data type, and the expiration date. The purpose corresponding to the data access task may be content recommendation, feature improvement, etc. The data type may indicate different types of data resources. The expiration date may be one day, five days, etc.

[0066] Through the process described above, after receiving a data access permission request via the client, the user can clearly understand which data resources are being accessed and used. In other words, because the data access permission request includes information such as the detailed purpose of the request, the scope of data resource acquisition, and the type of data resource, the user can more clearly understand and control their data usage.

[0067] With respect to the data resource types involved in the process of generating data access permission requests, the process of determining the data resource types may include determining multiple data resource types corresponding to data processing tasks, and determining at least one data resource type based on the relevance of the data of the multiple data resource types to multiple clients.

[0068] A single data processing task typically involves multiple data resource types. For data of multiple data resource types, the level may be determined based on its relevance to the client. For example, high-level, medium-level, and low-level data resources. The criteria for leveling can be determined on a case-by-case basis.

[0069] The data resource types may be determined by selecting from multiple data resource types. For example, only high-level data resources may be retained, meaning that data access requests may only be generated for high-level data resources. Alternatively, both high-level and mid-level data resources may be retained, and data access requests may be generated for both high-level and mid-level data resources. Through this process, data resource types are selected, and access requests are generated only for important data. Frequent notifications of data requests are avoided, reducing intrusion on the user.

[0070] Figure 4 shows a schematic diagram of a data access process 400 according to some embodiments of the present disclosure. This data access process may be performed on a client 120 of the target application. The data access process shown in Figure 4 is described below in relation to Figure 1.

[0071] As shown in Figure 4, in box 401, in response to the credential management service successfully verifying the credentials, it sends access credentials for data access to the credential management service.

[0072] The credential management service may send a certification report to client 120. The certification report may be sent by the credential management service or by the electronic device 110. The certification report can certify the security of the host device 110. Exemplary, the certification report may include information such as hardware TCB (Trusted Computing Base) information, application metric values, application custom data, and hardware signatures. Application metric values ​​typically refer to a set of values ​​obtained after metricing an application or its components in a trusted execution environment. These values ​​are used to verify the integrity and authenticity of the application and to confirm that the application has not been tampered with. Application custom data typically refers to data defined by the application according to the application's specific needs and included in the certification report. This data may be application-specific configuration, identification information, or other content that helps certify the security and reliability of the application. User 140's confirmation of the certification report may indicate that the credential management service has successfully verified it. As a result, access credentials for data access can be sent to the credential management service.

[0073] In box 402, client 120 processes the target data generated by the target application using processing credentials corresponding to the access credentials.

[0074] Client 120 may periodically upload data resources generated by the target application to the cloud. The uploaded data resources may be processed using processing credentials. For example, access credentials may be used to encrypt the specified data resources and retrieve the target data.

[0075] In box 403, client 120 may upload the target data to electronic device 110, thereby storing the processed target data on data storage side 116.

[0076] In box 404, client 120 receives a data access permission request from the user of a data resource, and the data resource contains target data. On the host device 110 side, scenarios such as data access tasks and data analysis tasks executed by the computing engine 112 may be used, and the execution of a data access task or data analysis task by the computing engine 112 may be sent to client 120 as a trigger command for generating and sending a data access permission request. This allows client 120 to receive a data access permission request from the user of the data resource.

[0077] In box 405, client 120 generates authorization information for a data access permission request in response to an affirmative instruction for the data access permission request. Figure 5 shows a schematic diagram of an interaction interface 500 between client 120 and host device 110 according to some embodiments of the present disclosure. Referring to interface 501, client 120 receives a data access permission request. In response to a “click details” command from the user, data usage details may be displayed, such as shown in interface 502. Exemplary, data usage details may include, for example, the scope of data use, expiration date, and purpose of use. Authorization information may be generated in response to an affirmative instruction. For example, an affirmative instruction may be user 140 clicking “Allow” in interface 502.

[0078] The authorization information may correspond to data usage details, i.e., indicate the scope of data use, expiration date, purpose of use, etc. Based on the authorization information, client 120 may store an authorization record. Referring to interface 503, the authorization record may correspond to the authorization information, i.e., the authorization record may include the scope of data use authorization, expiration date, and purpose of use, etc.

[0079] For example, the scope of permission to use data resources may indicate the category of data resources generated by the target application. The permission period may be one day, one hour, etc. The purpose of permission may be to allow the host device 110 to perform a certain data calculation task or a certain data analysis task.

[0080] In box 406, client 120 sends authorization information to the data resource user. Client 120 sends authorization information to the data resource user so that the data resource user can obtain the corresponding data resource. Through this process, authorization information makes the data access process more transparent and defines the scope and duration of usage in detail, ensuring that the user's data is always under control during use and preventing misuse or unauthorized access. Users can clearly see which data is being accessed and for what period of time, thus improving the level of protection for data resources.

[0081] In some embodiments, the credential management service receives a certification report from the credential management service, which is verified by indicating the reliability of the environment storing the access credentials and by verifying the credential management service based on the certification report.

[0082] The certification report may be sent by the credential management service. The certification report may include information such as hardware TCB information, application metric values, application custom data, and hardware signatures. The certification can be verified by the target program on client 120.

[0083] In some embodiments, the authorization information includes the client's access token. The authorization information also indicates at least one of the following: the scope of permission to use the target data, the purpose of permission, and the duration of permission.

[0084] The authorization information includes the client's access token, which may represent the client 120's identification information. Based on the identification information, the credential management service configures each access credential entry to consist of a unique identification information and corresponding access credentials. Furthermore, the authorization information may correspond to data usage details, such as the scope of data use, expiration date, and purpose of use.

[0085] Figure 6 shows a schematic diagram of a data access process 600 according to some embodiments of the present disclosure. This data access process may be implemented in a credential management service. The data access process shown in Figure 6 is described below in relation to Figure 1.

[0086] In Box 601, the credential management service sends a certification report to multiple clients of the target application, and the certification report demonstrates the reliability of the environment where the access credentials are stored.

[0087] The certification report may demonstrate the trustworthiness of the environment in which the credential management service stores data resources. Exemplary, the certification report may include information such as hardware TCB information, application metric values, application custom data, and hardware signatures. The credential management service may send the certification report to multiple clients 120 of the target application to self-certify its trustworthiness.

[0088] In box 602, the credential management service receives multiple access credentials from multiple clients 120, each corresponding to one of the clients 120. The access credentials among these multiple access credentials are used to access the data associated with the corresponding client 120.

[0089] After client 120 successfully validates the verification report, it uploads the access credentials to the access credential management database 114, and the credential management service may be responsible for managing them. The credential management service configures each access credential entry to consist of a unique identifier and the corresponding access credentials. This identifier may be a unique identifier for client 120, and the identifier may correspond to the access token of client 120. The access credentials may be used to access data associated with the corresponding client 120.

[0090] In box 603, the credential management service, in response to receiving an access credential request from the data resource user for at least one of several clients, sends access credentials corresponding to at least one client to the data resource user.

[0091] As a user of data resources, the host device 110 responds to the demand to process data resources generated by the target application by sending data access permission requests to multiple clients 120 of the target application. After obtaining authorization information from at least one of the multiple clients in response to the data access permission request, the host device 110 determines an access token for at least one client based on the authorization information. Based on the access token of at least one client, the host device 110 may send an access credential request for the data resources to the credential management service.

[0092] The credential management service, in response to an access credential request, sends access credentials corresponding to at least one client to the user of the data resource.

[0093] An access credential request includes at least an access token. In response that the access credential request includes at least one client's access token, the credential management service validates the access credential request based on the access token of at least one client. In response that the access credential request has been successfully validated, it sends the access credentials of at least one client to the user of the data resource.

[0094] As described above, the credential management service configures each access credential entry to consist of unique identification information and corresponding access credentials, and the access token may represent the client's identification information. Based on this, the credential management service can quickly and accurately retrieve the corresponding access credentials based on the identification information within the access credential management database 114, based on a structured storage scheme. It sends the access credentials of at least one client to the user of the data resource.

[0095] The access credential request may further include a security report, which indicates the reliability of a trusted execution environment for processing the data resource. In response to the successful verification of the security report in the access credential request, the credential management service sends the access credentials of at least one client to the user of the data resource, which indicates the reliability of the environment for processing the data resource.

[0096] Regarding access credentials, each access credential corresponds to a processing credential. That is, one processing credential and one access credential may form a credential pair. Client 120 may process target data generated by the target application based on the processing credentials. Exemplaryly, the processing may include encryption processing. The processed target data is stored on the data storage side 116.

[0097] The host device 110 sends an access credential request for the data resource to the credential management service, which may include both an access token and a security report. The credential management service may determine the corresponding client 120 based on the access token and obtain the corresponding access credentials. The security report is used to prove that the trusted execution environment 115 of the computing engine 112 for processing the data resource is secure, reliable, and complies with a predetermined security standard. The credential management service may perform verification of the security report, and if it determines that the verification was successful, it may send the access credentials for the data resource to the host device 110.

[0098] Figure 7 shows a schematic block diagram of a data access device 700 according to some embodiments of the present disclosure. The device 700 may be implemented in, for example, a host device 110, or may be included in the host device 110. Individual modules / components within the device 700 may be implemented by hardware, software, firmware, or any combination thereof.

[0099] As shown in the figure, the device 700 includes a data access permission request sending module 701 configured to send data access permission requests to a data resource to a plurality of clients of a target application in response to the demand for processing a data resource generated by the target application, wherein the plurality of clients include a data access permission request sending module 701 associated with the data resource, a data acquisition module 702 configured to receive permission information about the data access permission request from at least one of the plurality of clients, an access credential acquisition module 703 configured to acquire at least one access credential corresponding to at least one client based on the permission information, and a data access module 704 configured to access the target data in order to process the target data in the data resource associated with at least one client.

[0100] In some embodiments, the data acquisition module 702 may be configured to specifically determine an access token for at least one client based on authorization information, and to send an access credential request for a data resource to a credential management service, wherein the access credential request includes at least an access token, and to receive at least one access credential from the credential management service corresponding to at least one client.

[0101] In some embodiments, the access credential request further includes a security report demonstrating the reliability of the environment for processing data resources.

[0102] In some embodiments, the data acquisition module 702 further acquires target data from the data storage side, the target data being stored on the data storage side by at least one client based on a received certification report, the certification report may be configured to indicate the reliability of the environment storing the data resources.

[0103] In some embodiments, for at least one of the clients, the target data stored on the data storage side is transmitted to the data storage side after the client has processed the data generated by the target application using processing credentials corresponding to the client's access credentials.

[0104] In some embodiments, access credentials to data resources are performed within a trusted execution environment, and this further includes a data deletion module. The data deletion module is configured to delete the target data and the access credentials for the target data from the trusted execution environment in response to the fulfillment of certain conditions, which include the termination of access to the target data or the expiration of the permission to use the target data.

[0105] In some embodiments, the data access permission request transmission module 701 may be configured to specifically determine, based on a data processing task to be performed, at least one data resource type corresponding to a data processing task, wherein the data resource contains data of at least one data resource type, and to generate a data access permission request based on the at least one data resource type.

[0106] In some embodiments, the data access permission request transmission module 701 may be configured to specifically determine a plurality of data resource types corresponding to a data processing task, and to determine at least one data resource type based on the relevance of the data of the plurality of data resource types to a plurality of clients.

[0107] Figure 8 shows a schematic block diagram of a data access device 800 according to some embodiments of the present disclosure. The device 800 may be implemented in, for example, a client 120, or may be included in a client 120. Individual modules / components within the device 800 may be implemented by hardware, software, firmware, or any combination thereof.

[0108] As shown in the figure, the device 800 includes an access credential transmission module 801 configured to send access credentials for data access to the credential management service in response to the credential management service successfully verifying the access credentials; a data processing module 802 configured to process target data generated by the client in the target application using processing credentials corresponding to the access credentials; a data storage module 803 configured to store the processed target data on the data storage side; an access request receiving module 804 configured to receive data access permission requests from users of data resources containing target data; an authorization information generation module 805 configured to generate authorization information for a data access permission request in response to an affirmative instruction for the data access permission request; and an authorization information transmission module 806 configured to send the authorization information to the user of the data resource.

[0109] In some embodiments, the credential transmission module 801 may further be configured to receive a certification report from the credential management service indicating the reliability of the environment in which the access credentials are stored, and to verify the credential management service based on the certification report.

[0110] In some embodiments, the authorization information includes the client's access token.

[0111] In some embodiments, the authorization information indicates at least one of the following: the scope of authorization for use of the target data, the purpose of authorization, or the duration of authorization.

[0112] Figure 9 shows a schematic block diagram of a data access device 900 according to some embodiments of the present disclosure. The device 900 may be implemented in, for example, a credential management service, or may be included in a credential management service. Individual modules / components within the device 900 may be implemented by hardware, software, firmware, or any combination thereof.

[0113] As shown in the figure, the device 900 includes: a certification report sending module 901 configured to send a certification report indicating the reliability of the environment storing access credentials to multiple clients of a target application; an access credential receiving module 902 configured to receive multiple access credentials from multiple clients, each corresponding to one of the multiple clients, wherein the access credentials among the multiple access credentials are used to access data associated with the corresponding client; and an access credential sending module 903 configured to send access credentials corresponding to at least one client to the data resource user in response to receiving an access credential request for at least one of the multiple clients from the data resource user.

[0114] In some embodiments, the access credentials corresponding to a client among multiple clients have corresponding processing credentials, which are used by the client to process target data generated by the target application, and the processed target data is stored on the data storage side.

[0115] In some embodiments, the access credential transmission module 903 may be configured to specifically verify an access credential request based on the access token of at least one client in response to the access credential request including at least the access token of at least one client, and to transmit the access credential of at least one client to the user of the data resource in response to the access credential request being successfully verified.

[0116] In some embodiments, the access credential transmission module 903 may be configured to send access credentials for at least one client to the user of the data resource in response to the successful verification of a security report in the access credential request, the security report indicating the reliability of the environment for processing the data resource.

[0117] Figure 10 shows a block diagram of an electronic device 1000 in which one or more embodiments of the present disclosure may be implemented. It should be understood that the electronic device 1000 shown in Figure 10 is merely illustrative and should not constitute any limitation to the functionality and scope of the embodiments described herein. The electronic device 1000 shown in Figure 10 may include, or be implemented as, the host device 110, client 120, credential management service in Figure 1, device 700 in Figure 7, device 800 in Figure 8, or device 900 in Figure 9.

[0118] As shown in Figure 10, the electronic device 1000 is in the form of a general-purpose electronic device. The components of the electronic device 1000 may include, but are not limited to, one or more processors or processing units 1010, memory 1020, storage devices 1030, one or more communication units 1040, one or more input devices 1050, and one or more output devices 1060. The processing unit 1010 may be an actual processor or a virtual processor and is capable of performing various processes based on a program stored in memory 1020. In a multiprocessor system, multiple processing units execute computer executable instructions in parallel to increase the parallel processing capability of the electronic device 1000.

[0119] The electronic device 1000 typically includes multiple computer storage media. Such media may include, but are not limited to, volatile and non-volatile media, removable and non-removable media, and may be any available media accessible to the electronic device 1000. Memory 1020 may be volatile memory (e.g., registers, caches, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or a combination thereof. Storage device 1030 may be removable or non-removable media, and may include machine-readable media such as flash drives, magnetic disks, or any other media that can be used to store information and / or data and may be accessible within the electronic device 1000.

[0120] The electronic device 1000 may further include other removable / non-removable, volatile / non-volatile storage media. Although not shown in Figure 10, a magnetic disk drive for reading from and writing to removable non-volatile magnetic disks (e.g., “floppy disks”) and an optical disk drive for reading from and writing to removable non-volatile optical disks may be provided. In these cases, each drive may be connected to a bus (not shown) via one or more data media interfaces. The memory 1020 may include a computer program product 1025 having one or more program modules configured to perform various methods or operations of various embodiments of the present disclosure.

[0121] The communication unit 1040 enables communication with other electronic devices via a communication medium. Furthermore, the functionality of the components of the electronic device 1000 may be implemented as a single computing cluster or multiple computing machines that can communicate via a communication connection. Thus, the electronic device 1000 can use logical connections to one or more other servers, networked personal computers (PCs), or other network nodes to operate in a networked environment.

[0122] The input device 1050 may be one or more input devices, such as a mouse, keyboard, or tracking ball. The output device 1060 may be one or more output devices, such as a monitor, speaker, or printer. The electronic device 1000 may, if necessary, communicate with one or more external devices (not shown), such as a storage device or display device, via the communication unit 1040, with one or more devices that enable a user to interact with the electronic device 1000, or with any device (e.g., a network card or modem) that enables the electronic device 1000 to communicate with one or more other electronic devices. Such communication may be performed via an input / output (I / O) interface (not shown).

[0123] According to exemplary embodiments of the present disclosure, a computer-readable storage medium is provided in which computer-executable instructions are stored, and the computer-executable instructions are executed by a processor to implement the method described above. According to exemplary embodiments of the present disclosure, a computer program product is also provided, which is stored in a non-temporary computer-readable medium as a tangible object, and has computer-executable instructions, which are executed by a processor to implement the method described above.

[0124] Each aspect of this disclosure is described herein with reference to flowcharts and / or block diagrams of methods, apparatus, devices and computer program products implemented in accordance with this disclosure. It should be understood that each box in the flowcharts and / or block diagrams, and each combination of boxes in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0125] These computer-readable program instructions, when provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, generate a machine that, when executed by the processing unit of the computer or other programmable data processing device, produces a device that performs the functions / operations specified in one or more boxes of a flowchart and / or block diagram. Furthermore, by storing these computer-readable program instructions, which cause computers, programmable data processing devices, and / or other devices to operate in a particular manner, in a computer-readable storage medium, the computer-readable medium on which the instructions are stored has a product containing instructions that perform each of the functions / operations specified in one or more boxes of a flowchart and / or block diagram.

[0126] When computer-readable program instructions are loaded onto a computer, other programmable data processing device, or other device, a series of operational steps are executed on the computer, other programmable data processing device, or other device to generate a computer implementation process, thereby enabling the instructions executed on the computer, other programmable data processing device, or other device to realize a function / operation specified in one or more boxes of a flowchart and / or block diagram.

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate architectures, functions, and operations that may be implemented in several implemented systems, methods, and computer program products relating to this disclosure. In this regard, each box in the flowchart or block diagram may represent a module, program segment, or part of an instruction, and a module, program segment, or part of an instruction may contain one or more executable instructions for realizing a specified logical function. In some alternative implementations, the functions associated with a box may occur in a different order than those associated with the accompanying drawings. For example, two consecutive boxes may actually be executed substantially in parallel, or in reverse order depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and combinations of boxes in the block diagram and / or flowchart, may be implemented in a dedicated hardware-based system that performs a given function or operation, or in a combination of dedicated hardware and computer instructions.

[0128] The above descriptions of the various implementations of this disclosure are illustrative, not exhaustive, and not limited to the disclosed implementations. Many modifications and changes will be apparent to the ordinary art without departing from the scope and spirit of the described implementations. The choice of terms used herein is intended to best describe the principles, practical applications, or improvements in the technology in the market of each implementation, or to enable other ordinary art in the art to understand the embodiments disclosed herein.

Claims

1. A data access method applied to the user of a data resource, In response to the demand for processing data resources generated by the target application, the target application sends data access permission requests to the data resources to multiple clients of the target application, wherein the multiple clients are associated with the data resources. The recipient receives permission information regarding the data access permission request from at least one of the aforementioned clients, Based on the aforementioned authorization information, obtain at least one access credential corresponding to each of the at least one clients, To process the target data in the data resource associated with the at least one client, access the target data using the at least one access credential, Data access methods, including those mentioned above.

2. Obtaining at least one access credential corresponding to each of the aforementioned at least one clients is: Based on the permission information, determine the access token of the at least one client, Sending an access credential request for the data resource to the credential management service, wherein the access credential request includes at least the access token. Receiving at least one access credential corresponding to each of the at least one clients from the credential management service, The data access method according to claim 1, including the method described in claim 1.

3. The data access method according to claim 2, wherein the access credential request further includes a security report indicating the reliability of the environment for processing the data resource.

4. This further includes obtaining the target data from the data storage side, The target data is stored on the data storage side by the at least one client based on the received certification report, and the certification report indicates the reliability of the environment in which the data resources are stored. The data access method according to claim 1.

5. The data access method according to claim 4, wherein, with respect to one of the clients, the target data stored on the data storage side is transmitted to the data storage side after the client has processed the data generated by the target application using processing credentials corresponding to the client's access credentials.

6. Accessing the target data within the data resource associated with the at least one client is performed within a trusted execution environment, and the data access method is Further including removing the target data and access credentials for the target data from the trusted execution environment in response to the fulfillment of predetermined conditions, The data access method according to claim 1, wherein the predetermined conditions include termination of access to the target data or expiration of the permission to use the target data.

7. The aforementioned data access permission request is Based on the data processing task to be performed, determine at least one data resource type corresponding to the data processing task, wherein the data resource includes data of the at least one data resource type. To generate the data access permission request based on the at least one data resource type, A data access method according to claim 1, determined by [the specified method].

8. Determining at least one data resource type corresponding to the aforementioned data processing task is: Determining multiple data resource types corresponding to the aforementioned data processing task, Based on the degree of relevance between the data of the plurality of data resource types and the plurality of clients, determine the at least one data resource type, The data access method according to claim 7, including the method described in claim 7.

9. A data access method applied to the client of the target application, In response to the credential management service successfully verifying the credentials, access credentials for data access are sent to the credential management service. Using the processing credentials corresponding to the access credentials, the client processes the target data generated by the target application. The processed target data is stored on the data storage side, Receiving a data access permission request from the user of a data resource, wherein the data resource includes the target data. In response to an affirmative instruction for the aforementioned data access permission request, the system generates permission information for the aforementioned data access permission request. Sending the aforementioned permission information to the user of the data resource, Data access methods, including those mentioned above.

10. The aforementioned credential management service is: Receiving a certification report from the credential management service that demonstrates the reliability of the environment in which access credentials are stored, Based on the aforementioned certification report, the credential management service will be verified, The data access method according to claim 9, as verified by [the relevant authority].

11. The data access method according to claim 9, wherein the authorization information includes the client's access token.

12. The aforementioned permission information is, The scope of permission to use the aforementioned target data, Permitted use purposes; License period, The data access method according to claim 9, wherein at least one of the following is shown.

13. A data access method applicable to a credential management service, Sending a certification report demonstrating the trustworthiness of the environment storing access credentials to multiple clients of the target application, The process involves receiving multiple access credentials from the multiple clients, each of which corresponds to a specific client, wherein the access credentials among the multiple access credentials are used to access data associated with the corresponding client. In response to receiving an access credential request from the data resource user for at least one of the aforementioned clients, the access credential corresponding to the at least one client is sent to the data resource user. Data access methods, including those mentioned above.

14. The data access method according to claim 13, wherein the access credentials corresponding to a client among the plurality of clients have corresponding processing credentials, the corresponding processing credentials are used by the client to process target data generated by the target application, and the processed target data is stored on the data storage side.

15. Sending access credentials corresponding to at least one of the aforementioned clients to the user of the data resource is: In response to the access credential request including at least the access token of the at least one client, the access credential request is verified based on the access token of the at least one client. In response to the successful verification of the access credential request, the access credentials of at least one client are sent to the user of the data resource. The data access method according to claim 13, including the method described in claim 13.

16. Sending access credentials corresponding to at least one of the aforementioned clients to the user of the data resource is: In response to the successful verification of the security report in the access credential request, the access credentials of at least one client are sent to the user of the data resource. The security report indicates the reliability of the environment for processing the data resources. The data access method according to claim 13.

17. At least one processing unit, An electronic device comprising: at least one memory connected to at least one processing unit, which stores instructions to be executed by at least one processing unit; When the instruction is executed by at least one processing unit, it causes an electronic device to perform the data access method described in any one of claims 1 to 16. electronic equipment.

18. In order to realize the data access method described in any one of claims 1 to 16, a computer program that can be executed by a processor is stored. Computer-readable storage medium.

Images