File access control method and system, apparatus, medium, and program product

Abstract

The present application belongs to the field of data processing. Disclosed are a file access control method and system, an apparatus, a medium, and a program product. The method comprises: sequentially sending a plurality of acquisition requests to a network cache apparatus, wherein each acquisition request comprises a user identifier and block information of a file block corresponding to a user key, such that the network cache apparatus searches for cached file blocks corresponding to the block information in the acquisition requests, and requests, from a file service apparatus, uncached file blocks corresponding to the block information in the acquisition requests, the user key comprises a data block, the data block is obtained by means of dividing a target file, and the file blocks are obtained by means of dividing the target file on the basis of the user key and comprise the data block; receiving the file blocks that correspond to the block information in the acquisition requests and are fed back by the network cache apparatus; and on the basis of the user key, performing encryption processing and decryption processing on the file blocks corresponding to the block information in the acquisition requests, so as to obtain the target file.

Description

File access control methods, devices, systems, media, and program products

[0001] Cross-reference to related applications

[0002] This application claims priority to Chinese Patent Application No. 202410933310.2, filed on July 11, 2024, entitled “File Access Control Method, Apparatus, System, Media and Program Product”, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application belongs to the field of data processing, and in particular relates to a file access control method, apparatus, system, medium and program product. Background Technology

[0004] With the continuous development of Big Data and Privacy Computing technologies, File Access Control Systems (FACCS) are becoming increasingly important, and file access security has become a key focus. Different users have different file access permissions, and some business services provide files that can only be accessed by authorized users. For example, certain report files can only be accessed by a specific group of users; or copyrighted video files can only be viewed by paying users. A large portion of the files with access control are large files, and the time required for these files to be transferred from the server providing the files to the user's end is relatively long, resulting in slower access speeds for users. Summary of the Invention

[0005] This application provides a file access control method, apparatus, system, medium, and program product that can balance file access security and user file retrieval speed.

[0006] In a first aspect, embodiments of this application provide a file access control method applied to a user terminal. The method includes: sequentially sending multiple acquisition requests to a network caching device for requesting access to a target file. Each acquisition request includes a user identifier and block information of a file block corresponding to a user key, enabling the network caching device to locate cached file blocks corresponding to the block information in the acquisition requests; and requesting a file service device for file blocks not cached by the network caching device that correspond to the block information in the acquisition requests. The user key and the block information of the file blocks corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block, which is obtained by partitioning the target file. The file blocks are obtained by partitioning the target file according to the user key, and each file block includes one data block or two or more consecutive data blocks; receiving file blocks corresponding to the block information in the acquisition requests from the network caching device; and encrypting and decrypting the file blocks corresponding to the block information in the acquisition requests based on the user key to obtain the target file.

[0007] Secondly, embodiments of this application provide a file access control method applied to a network caching device. The method includes: receiving multiple acquisition requests sequentially sent by a user terminal for requesting to acquire a target file. Each acquisition request includes a user identifier and block information of a file block corresponding to a user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by a file service device. The user key includes at least one data block, which is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key, and the file block includes one data block or two or more consecutive data blocks. The method also includes: searching for cached file blocks corresponding to the block information in the acquisition requests; requesting from the file service device file blocks not cached by the network caching device that correspond to the block information in the acquisition requests; and feeding back the obtained file blocks corresponding to the block information in the acquisition requests to the user terminal, so that the user terminal can perform encryption and decryption processing on the file blocks corresponding to the block information in the acquisition requests based on the user key to obtain the target file.

[0008] Thirdly, embodiments of this application provide a file access control method applied to a file service device. The method includes: receiving a request from a network caching device for a file block not cached by the network caching device that corresponds to block information in a retrieval request; the retrieval request is sent sequentially by a user terminal to the network caching device to request the retrieval of a target file; each retrieval request includes a user identifier and block information of a file block corresponding to a user key; the user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device; the user key includes at least one data block; the user key is used by the user terminal to encrypt and decrypt the file block corresponding to the block information in the retrieval request to obtain the target file; the data block is obtained by partitioning the target file; the file block is obtained by partitioning the target file according to the user key; and the file block includes one data block or two or more consecutive data blocks; and feeding back to the network caching device the file block not cached by the network caching device that corresponds to the block information in the retrieval request, causing the network caching device to cache the fed-back file block, so that upon receiving a retrieval request including block information of the fed-back file block, the cached file block is fed back to the user terminal.

[0009] Fourthly, embodiments of this application provide a user terminal, comprising: a sending module, configured to sequentially send multiple acquisition requests to a network caching device for requesting to acquire a target file, each acquisition request including a user identifier and block information of a file block corresponding to a user key, so that the network caching device can search for a cached file block corresponding to the block information in the acquisition request, and to request a file service device for a file block not cached by the network caching device that corresponds to the block information in the acquisition request, wherein the user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device, the user key including at least one data block, the data block being divided from the target file, and the file block being divided from the target file according to the user key, the file block including one data block or two or more consecutive data blocks; a receiving module, configured to receive the file block corresponding to the block information in the acquisition request fed back by the network caching device; and an encryption / decryption module, configured to encrypt and decrypt the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file.

[0010] Fifthly, embodiments of this application provide a network caching device, comprising: a receiving module, configured to receive multiple acquisition requests sequentially sent by a user terminal for requesting to acquire a target file, each acquisition request including a user identifier and block information of a file block corresponding to a user key, the user key and the block information of the file block corresponding to the user key being pre-issued to the user terminal by a file service device, the user key including at least one data block, the data block being partitioned from the target file, the file block being partitioned from the target file according to the user key, and the file block including one data block or two or more consecutive data blocks; a query module, configured to search for cached file blocks corresponding to the block information in the acquisition requests; and a sending module, configured to request from the file service device file blocks not cached by the network caching device corresponding to the block information in the acquisition requests, and to feed back the obtained file blocks corresponding to the block information in the acquisition requests to the user terminal, so that the user terminal performs encryption and decryption processing on the file blocks corresponding to the block information in the acquisition requests based on the user key to obtain the target file.

[0011] Sixthly, embodiments of this application provide a file service apparatus, comprising: a receiving module, configured to receive a request from a network caching device for a file block not cached by the network caching device that corresponds to the block information in the acquisition request; the acquisition request is sent sequentially by a user terminal to the network caching device to request the acquisition of a target file; each acquisition request includes a user identifier and block information of a file block corresponding to a user key; the user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service apparatus; the user key includes at least one data block; the user key is used by the user terminal to encrypt and decrypt the file block corresponding to the block information in the acquisition request to obtain the target file; the data block is obtained by dividing the target file; the file block is obtained by dividing the target file according to the user key; and the file block includes one data block or two or more consecutive data blocks; and a sending module, configured to send feedback to the network caching device of the file block not cached by the network caching device that corresponds to the block information in the acquisition request, so that the network caching device caches the feedback file block, and upon receiving an acquisition request including the block information of the feedback file block, sends the cached file block back to the user terminal.

[0012] In a seventh aspect, embodiments of this application provide a user terminal, including: a processor and a memory storing computer program instructions; the processor implements the file access control method of the first aspect when executing the computer program instructions.

[0013] Eighthly, embodiments of this application provide a network caching device, including: a processor and a memory storing computer program instructions; the processor implements the file access control method of the second aspect when executing the computer program instructions.

[0014] Ninthly, embodiments of this application provide a file service apparatus, including: a processor and a memory storing computer program instructions; the processor implements the file access control method of the third aspect when executing the computer program instructions.

[0015] In a tenth aspect, embodiments of this application provide a file access control system, including: a user terminal (seventh aspect); a network caching device (eighth aspect); and a file service device (ninth aspect).

[0016] Eleventhly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the file access control method of the first aspect, the file access control method of the second aspect, or the file access control method of the third aspect.

[0017] In a twelfth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements a file access control method of the first aspect, a file access control method of the second aspect, or a file access control method of the third aspect.

[0018] This application provides a file access control method, apparatus, system, medium, and program product. The file service device pre-distributes a user key and block information of the file blocks corresponding to that user key to the user terminal. The file blocks are divided according to the user key, and at least some file blocks cached in a network caching device are shared by multiple users accessing the same target file. When a user terminal requests to obtain a target file, it can sequentially send an acquisition request to the network caching device. The acquisition request includes a user identifier and block information of the file blocks corresponding to the user key. The network caching device can search for the cached file blocks corresponding to the block information in the acquisition request and return the found cached file blocks to the user terminal. The file blocks cached in the network caching device have a fast transmission speed, thereby improving the speed at which users obtain the target file. Moreover, different users have different user keys. Encrypting and decrypting the obtained file blocks using the user key to obtain the target file also ensures the security of user file access, thus achieving a balance between file access security and user file acquisition speed. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 is a schematic diagram of the structure of a file access control system provided in an embodiment of this application;

[0021] Figure 2 is a flowchart of a file access control method provided in an embodiment of the first aspect of this application;

[0022] Figure 3 is a schematic diagram of an example of a user key and file block provided in an embodiment of this application;

[0023] Figure 4 is a flowchart of a file access control method provided in another embodiment of the first aspect of this application;

[0024] Figure 5 is a flowchart of a file access control method provided in an embodiment of the second aspect of this application;

[0025] Figure 6 is a flowchart of a file access control method provided in an embodiment of the third aspect of this application;

[0026] Figure 7 is a flowchart of a file access control method provided in another embodiment of the third aspect of this application;

[0027] Figure 8 is a schematic diagram of the structure of a user terminal provided in an embodiment of the fourth aspect of this application;

[0028] Figure 9 is a schematic diagram of the structure of a network caching device provided in an embodiment of the fifth aspect of this application;

[0029] Figure 10 is a schematic diagram of the structure of a document service device provided in an embodiment of the sixth aspect of this application;

[0030] Figure 11 is a schematic diagram of the structure of a user terminal provided in an embodiment of the seventh aspect of this application. Detailed Implementation

[0031] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples. It should be noted that the acquisition, storage, use, and processing of information and data in the embodiments of this application are all authorized by users or relevant organizations and comply with the relevant provisions of national laws and regulations.

[0032] With the continuous development of big data and privacy computing technologies, file access control systems are becoming increasingly important, and file access security has become a key focus. Different users have different file access permissions, and some business services provide files that can only be accessed by authorized users. For example, certain report files can only be accessed by a specific group of users; or copyrighted video files can only be viewed by paying users. Many files with access control are large in size, and the time required for these files to be transferred from the server providing the files to the user's end is relatively long, resulting in slower access speeds for users.

[0033] In some related technologies, symmetric keys can be used to encrypt files. Different users with file access permissions receive the same encrypted file, and network caching can be used to speed up the transmission of encrypted files. Users with file access permissions can then decrypt the encrypted file using the symmetric key to obtain the plaintext content. However, since different users with file access permissions use the same symmetric key, if the symmetric key is leaked, it poses a significant security risk to file access. To mitigate this security vulnerability, asymmetric keys can be used for encryption and decryption to improve the security of file access control. Asymmetric keys are pairs of public and private keys, and different users with file access permissions have different public and private key pairs. Correspondingly, different users with file access permissions can access the same file, but the encrypted files are different each time, thus preventing the use of network caching to speed up the transmission of encrypted files. Therefore, in the field of file access control technology, it is difficult to simultaneously achieve file access security and user file access speed.

[0034] This application provides a file access control method, apparatus, system, medium, and program product. The user key used to encrypt a file requested by a user is obtained based on data blocks of the file. Different user keys are assigned to different users, and the file can be divided into multiple file blocks according to the user key. During the process of a user requesting to obtain a target file, these file blocks are cached in a network caching device. At least a portion of the file blocks cached in the network caching device can be used as shared file blocks for other users requesting to obtain files. The shared file blocks are transmitted using the network cache, which improves the speed at which users obtain files. Furthermore, since different users have different user keys, the leakage of one user's user key will not affect the user keys of other users, thus ensuring the security of file access and achieving a balance between file access security and user file acquisition speed.

[0035] For ease of understanding, the file access control system involved in the embodiments of this application will be described first. Figure 1 is a schematic diagram of the structure of a file access control system provided in an embodiment of this application. As shown in Figure 1, the file access control system includes a user terminal 11, a network caching device 12, and a file service device 13.

[0036] User terminal 11 includes a terminal device used by the user, which can be a mobile phone, desktop computer, tablet computer, smartwatch, smart bracelet, etc., and is not limited thereto. User terminal 11 may have a client installed to implement file access control functions. User terminal 11 can communicate and interact with network caching device 12, and user terminal 11 can also communicate and interact with file service device 13.

[0037] The network caching device 12 is located at the network edge, closer to the user, and can quickly transmit data to the user's terminal 11. In some examples, the network caching device 12 can be implemented as a Content Delivery Network (CDN). The network caching device 12 can communicate and interact with the file service device 13. The network caching device 12 can be implemented as a cloud device, but is not limited thereto.

[0038] The file service device 13 stores the files that the user needs to access. In this embodiment, the file service device 13 can generate a user key assigned to the user, and can also store file blocks obtained by dividing the file, user identifiers of registered users, and the correspondence between user identifiers and user keys. The file service device 13 can be implemented as a cloud device, but is not limited thereto.

[0039] When user terminal 11 requests to obtain a file, it can first send a request to network caching device 12, which will then perform a cache lookup. If the data requested by user terminal 11 exists in network caching device 12, the corresponding data will be directly returned to user terminal 11. If the data requested by user terminal 11 does not exist in network caching device 12, network caching device 12 will send a request to file service device 13 to obtain the corresponding data, and after obtaining the data, it will cache the data in network caching device 12.

[0040] The document access control methods, devices, systems, media, and program products provided in this application are described below.

[0041] The first aspect of this application provides a file access control method that can be applied to a user terminal, i.e., the file access control method can be executed by the user terminal. Figure 2 is a flowchart of a file access control method provided in an embodiment of the first aspect of this application. As shown in Figure 2, the file access control method may include steps S201 to S203.

[0042] In step S201, multiple acquisition requests for requesting to acquire target files are sent sequentially to the network caching device, so that the network caching device can find the file blocks cached that correspond to the block information in the acquisition requests, and request the file service device to acquire file blocks that are not cached by the network caching device that correspond to the block information in the acquisition requests.

[0043] Each retrieval request includes a user identifier and block information of the file block corresponding to the user key. The user identifier is used to identify the user and can be implemented as a user ID or other information that can identify the user. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block, which is obtained by dividing the target file. Specifically, the user key may consist of one data block, or the user key may consist of two or more different data blocks. For example, the target file i can be divided into n data blocks, where n is an integer greater than 1, and ik represents the k-th data block of the target file i. The user key may include one data block, such as data block i3, or user key i5, which is not limited here; the user key may include two or more different data blocks, such as data block i3 and data block i7, or user key i4, data block i9, and data block i15, which is not limited here. When the target file is divided into n data blocks, any combination of x data blocks from the n data blocks can be determined as a user key. Correspondingly, theoretically, the file service device can generate 2 n - Two different user keys. However, in order to generate file blocks that can be accessed by multiple users and cached in the network caching device, user keys that do not include the first and / or last data blocks should be assigned to users first.

[0044] File blocks are obtained by partitioning the target file based on the user key. A file block consists of one data block or two or more consecutive data blocks. Partitioning can be performed at data blocks in the target file that match the data blocks in the user key, thus obtaining file blocks. The data blocks serving as the beginning and / or the data blocks serving as the end of a file block must match the data blocks in the user key. Each data block in the user key appears an even number of times in all file blocks, while each data block not in the user key appears an odd number of times in all file blocks. For example, Figure 3 is a schematic diagram of an example of a user key and file blocks provided in an embodiment of this application. As shown in Figure 3, the target file i can be divided into n data blocks, where ik represents the k-th data block of target file i. The user key consists of the 4th data block i4 and the 9th data block i9 of the target file. Correspondingly, the file service device can segment the target file from the 4th data block i4 and the 9th data block i9 to obtain file block 1, file block 2, and file block 3. File block 1 includes data blocks i1 to i4, file block 2 includes data blocks i4 to i9, and file block 3 includes data blocks i9 to i1. Data block i4 serves as the end of file block 1 and the beginning of file block 2, and data block i9 serves as the end of file block 2 and the beginning of file block 3. Data blocks i4 and i9 appear twice in all file blocks, while other data blocks appear once in all file blocks. Block information can indicate file blocks, and in some examples, block information may include, but is not limited to, file block identifiers. It should be noted that different target files are divided into different data blocks, and the corresponding user keys generated are also different. The file blocks obtained from different target files are also different.

[0045] In this embodiment of the application, each retrieval request can be used to request a file block of the target file, and the file blocks corresponding to multiple retrieval requests sent sequentially by the user terminal to the network caching device can be combined into the target file.

[0046] After receiving a retrieval request, the network caching device searches its own cache for the file block indicated in the request, based on the block information. If the file block is cached, the network caching device sends it back to the user terminal. If it is not cached, the network caching device requests the corresponding uncached file block from the file service device and caches it. In other words, the uncached file block requested from the file service device is cached in the network caching device. Although different users have different user keys, their user keys may contain one or more identical data blocks. In this case, the file blocks corresponding to different users' user keys may contain some identical blocks. These identical blocks, cached in the network caching device, can be retrieved by multiple users, resulting in faster transmission and thus improving the speed at which users retrieve the entire target file.

[0047] For example, target file i can be divided into n data blocks, where ik represents the k-th data block of target file i. User 1 obtains the user key for target file i, which includes data block i4 and data block i9. During the process of user 1 requesting target file i, the file blocks cached in the network caching device include file blocks i1i2i3i4, i4i5i6i7i8i9, and i9…in. User 2 obtains the user key for target file i, which includes data blocks i4, i7, and i9. The file blocks that user 2 needs to request include file blocks i1i2i3i4, i4i5i6i7, i7i8i9, and i9…in. When user 2 requests the above file blocks, file blocks i4i5i6i7 and i7i8i9 still need to be obtained from the file service device by the network caching device, but file blocks i1i2i3i4 and i9…in can be obtained directly from the network caching device, which greatly improves the speed at which user 2 obtains target file i. In this embodiment of the application, some file blocks requested by users are cached in a network caching device to accelerate the speed at which other users obtain files.

[0048] In step S202, the file block corresponding to the block information in the acquisition request is received from the network caching device.

[0049] The network caching device can feed back the cached file blocks corresponding to the block information in the retrieval request and / or the file blocks corresponding to the block information in the retrieval request obtained from the file service device to the user terminal.

[0050] In step S203, the file block corresponding to the block information in the acquisition request is encrypted and decrypted based on the user key to obtain the target file.

[0051] The user terminal receives fragmented file blocks, which have not yet been assembled into the target file. These file blocks are divided based on a user key. Encrypting these blocks using the user key allows the ciphertext of the target file to be obtained, and also enables the fragmented file blocks to be reassembled. After obtaining the ciphertext of the target file, the user key can be used to decrypt it, thus obtaining the target file.

[0052] In this embodiment, the file service device pre-sends the user key and the block information of the file blocks corresponding to the user key to the user terminal. The file blocks are divided according to the user key, and at least some file blocks cached in the network caching device can be shared by multiple users accessing the same target file. When a user terminal requests to obtain a target file, the user terminal can send an acquisition request to the network caching device sequentially. The acquisition request includes a user identifier and the block information of the file blocks corresponding to the user key. The network caching device can search for the cached file blocks corresponding to the block information in the acquisition request and return the found cached file blocks to the user terminal. The file blocks cached in the network caching device have a fast transmission speed, thereby improving the speed at which the user obtains the target file. Moreover, different users have different user keys. Encrypting and decrypting the obtained file blocks using the user key to obtain the target file can also ensure the security of the user's file access, thus achieving both file access security and user file acquisition speed.

[0053] In some embodiments, step S203 can be further refined as follows: encrypting the file block corresponding to the block information in the acquisition request according to the user key to obtain the target ciphertext, the target ciphertext being the ciphertext of the target file; decrypting the target ciphertext according to the user key to obtain the target file.

[0054] Encrypting all file blocks related to the target file obtained by the user terminal using the user key allows the file blocks to be combined to obtain the target ciphertext. The specific encryption algorithm is not limited here; any algorithm capable of combining file blocks through encryption to obtain the ciphertext of the entire target file is within the protection scope of this application's embodiments. In some examples, the data block at the beginning and / or the data block at the end of the file block is consistent with the data block in the user key. The end of the block can be concatenated with a file block whose beginning is the same data block in the user key, and an XOR operation can be performed on the data block at the concatenation point to obtain the target ciphertext. For example, target file i is divided into n data blocks, where ik represents the k-th data block of target file i. The user key consists of the 4th data block i4 and the 9th data block i9 of the target file. The file block division is shown in Figure 3. The user terminal receives file block 1, file block 2, and file block 3. The concatenation of file block 1 and file block 2 includes the end of file block 1 (i.e., data block i4 in file block 1) and the beginning of file block 2 (i.e., data block i4 in file block 2). The concatenation of file block 2 and file block 3 includes the end of file block 2 (i.e., data block i9 in file block 2) and the beginning of file block 3 (i.e., data block i9 in file block 3). The target ciphertext can be represented as... The XOR operator is used to encode data. Therefore, the XOR operation can not only achieve the effect of encryption, but also concatenate file blocks to form a complete file (ciphertext form).

[0055] The target file requested by the user ultimately needs to be presented in plaintext. This requires decrypting the target ciphertext to recover the original target text. The decryption algorithm corresponds to the encryption algorithm and is not limited here. In some examples, the encryption algorithm uses an XOR operation. The data block at the beginning and / or end of the file block matches the data block in the user key. An XOR operation can be performed between the data block in the user key and the corresponding data block at the concatenation point of the file block to obtain the target file. An XOR operation followed by another XOR operation will restore the data to its original form. For example, in the previous example, the target file i is divided into n data blocks, ik represents the k-th data block of target file i, and the user key consists of the 4th data block i4 and the 9th data block i9 of the target file. The file block division is shown in Figure 3, and the target ciphertext is represented as follows. By XORing the concatenation points of the target ciphertext using data blocks i4 and i9 from the user key, we can obtain... That is, the target file is restored.

[0056] In some embodiments, the file service device generates multiple different user keys and file blocks corresponding to each user key. When a user terminal requests a target file from the file service device, the file service device can send the user key and block information of the corresponding file block to the user terminal. Figure 4 is a flowchart of a file access control method provided in another embodiment of the first aspect of this application. The difference between Figure 4 and Figure 2 is that the file access control method shown in Figure 4 may further include steps S204 and S205.

[0057] In step S204, a file retrieval request is sent to the file service device.

[0058] A file retrieval request is used to request the retrieval of a target file. The file retrieval request may include a user identifier.

[0059] In step S205, file retrieval response information is received from the file service device.

[0060] Upon receiving a file retrieval request, the file service device assigns a pre-generated user key based on the target file and block information of the file block corresponding to the user key to the user indicated by the user identifier, and generates file retrieval response information which is sent to the user terminal. The file retrieval response information includes the user key corresponding to the user identifier and the block information of the file block corresponding to the user key. After obtaining the user's user key and the block information of the file block corresponding to the user key, the user terminal can execute steps S201 to S203 in the above embodiments.

[0061] After the file service device assigns a user key to a user, it stores the correspondence between the user identifier and the user key so that the user and the user key can be traced in the event of a user key leak.

[0062] The file service device can pre-initialize and generate user keys; for example, the file service device can generate 2 for target file i. n Two distinct user keys form a key set, which stores unassigned user keys. Each time the file service device receives a file retrieval request from a user requesting target file i, it assigns a user key to that user, removes the assigned key from the key set, and records the correspondence between the user identifier and the user key. In some examples, the file service device's two... nA portion of the two distinct user keys are assigned to users, with each user receiving a different key. In other words, the file service device does not distribute all user keys; instead, it retains a certain number. On one hand, these reserved keys can be used for user key updates. For example, if a user's key is leaked and a new key needs to be assigned, the reserved, unassigned keys can be used as the updated key to ensure the security of file access. On the other hand, user keys that are less likely to generate file blocks that multiple users can share can be reserved, while user keys that are more likely to generate such blocks are prioritized, further improving the speed at which users can retrieve files.

[0063] In some embodiments, the correspondence between user identifiers and user keys can be used to trace leaked user keys. If there is no correspondence between the user identifier in the acquisition request and the user key corresponding to the block information, the user indicated by the user identifier is an illegitimate user, and the original legitimate user's user key is updated. The updated user key for the original legitimate user is the previously unassigned user key. The original legitimate user includes the user indicated by the user identifier that has a correspondence with the user key corresponding to the block information in the acquisition request.

[0064] If there is no correspondence between the user identifier and the user key corresponding to the block information, it means that the user key has not been assigned to the user indicated by the user identifier. Therefore, the user indicated by the user identifier can be identified as an unauthorized user, where an unauthorized user refers to a user using another user's user key. In this case, the file service device can combine the correspondence between the user key and the user identifier, determine the original legitimate user based on the user key, and reassign a user key to the original legitimate user to ensure the security of user access to files.

[0065] The file access control method provided in this application can both utilize network caching to cache multiple user-shared file blocks to improve the speed at which users obtain files, and utilize the unique user key of authorized users to ensure user access to files, thereby achieving both file access security and file retrieval speed.

[0066] A second aspect of this application provides a file access control method applied to a network caching device, i.e., the file access control method can be executed by the network caching device. Figure 5 is a flowchart of a file access control method provided in an embodiment of the second aspect of this application. As shown in Figure 5, the file access control method may include steps S301 to S303.

[0067] In step S301, multiple acquisition requests for obtaining target files are received sequentially sent by the user terminal.

[0068] Each retrieval request includes a user identifier and block information for the file block corresponding to the user key. The user key and the block information for the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The data block is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks.

[0069] In step S302, the cached file block corresponding to the block information in the retrieval request is searched, and the file service device is requested to retrieve the file block that is not cached by the network caching device and corresponds to the block information in the retrieval request.

[0070] In step S303, the file block corresponding to the block information in the acquisition request is fed back to the user terminal, so that the user terminal can perform encryption and decryption processing on the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file.

[0071] In this embodiment, the file service device pre-sends the user key and the block information of the file blocks corresponding to the user key to the user terminal. The file blocks are divided according to the user key, and at least some file blocks cached in the network caching device can be shared by multiple users accessing the same target file. When a user terminal requests to obtain a target file, the user terminal can send an acquisition request to the network caching device sequentially. The acquisition request includes a user identifier and the block information of the file blocks corresponding to the user key. The network caching device can search for the cached file blocks corresponding to the block information in the acquisition request and return the found cached file blocks to the user terminal. The file blocks cached in the network caching device have a fast transmission speed, thereby improving the speed at which the user obtains the target file. Moreover, different users have different user keys. Encrypting and decrypting the obtained file blocks using the user key to obtain the target file can also ensure the security of the user's file access, thus achieving both file access security and user file acquisition speed.

[0072] In some embodiments, the file block corresponding to the block information in the request is encrypted using a user key to obtain the target ciphertext, which is the ciphertext of the target file. The target ciphertext is then decrypted using the user key to obtain the target file.

[0073] In some examples, the target ciphertext is obtained by concatenating a file block whose end and beginning are the same data block in the user key, and then XORing the data block at the file concatenation point. Alternatively, the target ciphertext is obtained by XORing the data block in the user key with the corresponding data block at the file block concatenation point.

[0074] In some embodiments, the file service device generates multiple different user keys and file blocks corresponding to each user key. Before receiving multiple acquisition requests from a user terminal for requesting to acquire a target file, the user terminal and the file service device exchange file acquisition request and file acquisition response information, enabling the user terminal to acquire the user key and the block information of the file block corresponding to the user key. The file acquisition request includes a user identifier. The file acquisition response information includes the user key corresponding to the user identifier and the block information of the file block corresponding to the user key. The file service device stores the correspondence between the user identifier and the user key.

[0075] In some embodiments, the step S302 above, requesting the file block that the network caching device has not cached and that corresponds to the block information in the retrieval request, can be further refined as follows: if there is no file block in the cached file block that corresponds to the block information in the retrieval request, a file block retrieval request is sent to the file service device. The file block retrieval request includes uncached block information, and the uncached block information corresponds to the file block that the network caching device has not cached and that corresponds to the block information in the retrieval request; the file block that corresponds to the uncached block information is received from the file service device and cached.

[0076] In some examples, the target file is divided into n data blocks, and the file service device generates 2 n - Two distinct user keys, where n is an integer greater than 1.

[0077] Document service device 2 n - Part of the two different user keys are assigned to users, and different users are assigned different user keys.

[0078] In some embodiments, if the user identifier in the acquisition request and the user key corresponding to the block information do not have a corresponding relationship, the user indicated by the user identifier is an illegal user, the user key of the original legitimate user is updated, and the updated user key of the original legitimate user is the user key that was not previously assigned. The original legitimate user includes the user indicated by the user identifier that has a corresponding relationship with the user key corresponding to the block information in the acquisition request.

[0079] For details of the second aspect of this application, please refer to the relevant descriptions in the first aspect of the above-mentioned embodiments, and they can achieve the same technical effects, so they will not be repeated here.

[0080] A third aspect of this application provides a file access control method, which can be applied to a file service device, i.e., the file access control method can be executed by the file service device. Figure 6 is a flowchart of a file access control method provided in an embodiment of the third aspect of this application. As shown in Figure 6, the file access control method may include steps S401 and S402.

[0081] In step S401, a request is received from the network caching device for a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request.

[0082] The user terminal sends a request sequentially to the network caching device to request the target file. Each request includes a user identifier and block information of the file block corresponding to the user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The user terminal uses the user key to encrypt and decrypt the file block corresponding to the block information in the request to obtain the target file. The data block is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks.

[0083] In step S402, the network caching device is fed back the file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, so that the network caching device caches the fed-back file block, so that when an acquisition request including the block information of the fed-back file block is received, the cached file block is fed back to the user terminal.

[0084] In this embodiment, the file service device pre-sends the user key and the block information of the file blocks corresponding to the user key to the user terminal. The file blocks are divided according to the user key, and at least some file blocks cached in the network caching device can be shared by multiple users accessing the same target file. When a user terminal requests to obtain a target file, the user terminal can send an acquisition request to the network caching device sequentially. The acquisition request includes a user identifier and the block information of the file blocks corresponding to the user key. The network caching device can search for the cached file blocks corresponding to the block information in the acquisition request and return the found cached file blocks to the user terminal. The file blocks cached in the network caching device have a fast transmission speed, thereby improving the speed at which the user obtains the target file. Moreover, different users have different user keys. Encrypting and decrypting the obtained file blocks using the user key to obtain the target file can also ensure the security of the user's file access, thus achieving both file access security and user file acquisition speed.

[0085] In some embodiments, the file block corresponding to the block information in the request is encrypted using a user key to obtain the target ciphertext, which is the ciphertext of the target file. The target ciphertext is then decrypted using the user key to obtain the target file.

[0086] In some examples, the target ciphertext is obtained by concatenating a file block whose end and beginning are the same data block in the user key, and then XORing the data block at the file concatenation point. Alternatively, the target ciphertext is obtained by XORing the data block in the user key with the corresponding data block at the file block concatenation point.

[0087] In some embodiments, the file service device generates multiple different user keys and file blocks corresponding to each user key, and stores the correspondence between user identifiers and user keys. Figure 7 is a flowchart of a file access control method provided in another embodiment of the third aspect of this application. The difference between Figure 7 and Figure 6 is that the file access control method shown in Figure 7 may further include steps S403 to S405.

[0088] In step S403, a file retrieval request sent by the user terminal is received.

[0089] The file retrieval request includes a user identifier.

[0090] In step S404, based on the correspondence between user identifier and user key, the user key corresponding to the user identifier in the file acquisition request and the block information of the file block corresponding to the user key are determined;

[0091] In step S405, file retrieval response information is sent back to the file service device.

[0092] The file retrieval response information includes the user key corresponding to the user identifier in the file retrieval request and the block information of the file block corresponding to the user key.

[0093] In some examples, the target file is divided into n data blocks, and 2 is generated based on the n data blocks. n - Two distinct user keys, where n is an integer greater than 1. (The last part, "2," appears to be a typo and can be omitted.) n - A portion of the two different user keys is assigned to the user who requested the user key, and different users are assigned different user keys.

[0094] In some embodiments, if there is no correspondence between the user identifier in the acquisition request and the user key corresponding to the block information, the file service device determines that the user indicated by the user identifier is an illegitimate user; the file service device updates the user key of the original legitimate user using a previously unassigned user key. The updated user key of the original legitimate user is one of the previously unassigned user keys. The original legitimate user includes the user indicated by the user identifier that has a correspondence with the user key corresponding to the block information in the acquisition request.

[0095] For details of the third aspect of this application, please refer to the relevant descriptions in the first aspect of the above-mentioned embodiments, and they can achieve the same technical effects, so they will not be repeated here.

[0096] For ease of understanding, examples are given here for the registration scenario, the scenario where the file block requested by the user does not match the file block cached by the network caching device, the scenario where the file block requested by the user does not match the file block cached by the network caching device, and the scenario of file block encryption / decryption.

[0097] (1) Registration scenario

[0098] This scenario may include steps a1 and a2.

[0099] In step a1, the user terminal sends a registration message to the file service device, the registration message including the user identifier.

[0100] In step a2, the file service device saves the user identifier in the registered user information table, thus completing the user registration.

[0101] (2) Scenario where the file block requested by the user does not match the file block cached by the network caching device.

[0102] This scenario may include steps b1 through b6.

[0103] In step b1, the user terminal sends a file retrieval request to the file service device.

[0104] In step b2, the file service device assigns a pre-generated user key and the block information of the file block corresponding to the user key to the user indicated by the user identifier in the file acquisition request, and feeds back the above information to the user terminal.

[0105] In step b3, the user terminal sends an acquisition request to the network caching device.

[0106] In step b4, if the network caching device does not have the file block corresponding to the block information in the retrieval request, the network caching device sends a file block retrieval request to the file service device.

[0107] In step b5, the file service device sends the file block corresponding to the uncached block information in the file block retrieval request back to the network caching device.

[0108] In step b6, the network caching device caches the file block returned by the file service device and returns the file block to the user terminal.

[0109] (3) Scenario where the file block requested by the user does not match the file block cached by the network caching device.

[0110] This scenario may include steps c1 through c4.

[0111] In step c1, the user terminal sends a file retrieval request to the file service device.

[0112] In step c2, the file service device assigns a pre-generated user key and the block information of the file block corresponding to the user key to the user indicated by the user identifier in the file acquisition request, and feeds back the above information to the user terminal.

[0113] In step c3, the user terminal sends an acquisition request to the network caching device.

[0114] In step c4, if the network caching device has cached the file block corresponding to the block information in the retrieval request, the network caching device will send the file block back to the user terminal.

[0115] It should be noted that if some of the file blocks corresponding to the block information in the multiple acquisition information sent by the user terminal are cached in the network caching device and some are not cached in the network caching device, then the file blocks cached in the network caching device can be processed according to steps b4 to b6, and the file blocks not cached in the network caching device can be processed according to step c4.

[0116] (4) File block encryption and decryption scenarios

[0117] File block encryption / decryption scenarios may include steps d1 to d3.

[0118] In step d1, the user terminal obtains multiple file blocks of the target file.

[0119] In step d2, the file block whose end is the same data block in the user key is concatenated with the file block whose beginning is the same data block, and an XOR operation is performed on the data block at the concatenation point to obtain the target ciphertext.

[0120] In step d3, the target file is obtained by XORing the data block in the user key with the data block at the concatenation point of the corresponding file block.

[0121] The specific details of steps a1 to a2, b1 to b6, c1 to c4, and d1 to d3 above can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0122] This application provides a user terminal in a fourth aspect. Figure 8 is a schematic diagram of the structure of a user terminal provided in an embodiment of the fourth aspect of this application. As shown in Figure 8, the user terminal 500 may include a sending module 501, a receiving module 502, and an encryption / decryption module 503.

[0123] The sending module 501 can be used to sequentially send multiple acquisition requests to the network caching device for requesting to acquire target files, so that the network caching device can find the cached file blocks corresponding to the block information in the acquisition requests, and request the file service device for file blocks that are not cached by the network caching device and correspond to the block information in the acquisition requests.

[0124] Each retrieval request includes a user identifier and block information for the file block corresponding to the user key. The user key and the block information for the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The data block is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks.

[0125] The receiving module 502 can be used to receive file blocks corresponding to the block information in the acquisition request, fed back by the network caching device.

[0126] The encryption / decryption module 503 can be used to encrypt and decrypt the file blocks corresponding to the block information in the acquisition request based on the user key, so as to obtain the target file.

[0127] In some embodiments, the encryption / decryption module 503 can be used to: encrypt the file block corresponding to the block information in the acquisition request according to the user key to obtain the target ciphertext, wherein the target ciphertext is the ciphertext of the target file; and decrypt the target ciphertext according to the user key to obtain the target file.

[0128] In some examples, the data block at the beginning and / or the data block at the end of the file block is identical to the data block in the user key. The encryption / decryption module 503 can specifically be used to: concatenate the file block whose end is the same as the data block in the user key, and perform an XOR operation on the data block at the concatenation point to obtain the target ciphertext. The encryption / decryption module 503 can also specifically be used to: perform an XOR operation on the data block in the user key and the corresponding data block at the concatenation point to obtain the target file.

[0129] In some embodiments, the file service device generates multiple different user keys and file blocks corresponding to each user key.

[0130] The sending module 501 can also be used to send a file retrieval request to the file service device, the file retrieval request including a user identifier.

[0131] The receiving module 502 can also be used to: receive file acquisition response information fed back by the file service device, the file acquisition response information including the user key corresponding to the user identifier and the block information of the file block corresponding to the user key, and the file service device storing the correspondence between the user identifier and the user key.

[0132] In some embodiments, an uncached file block corresponding to the block information in the retrieval request, which is requested from the file service device, is cached in the network caching device.

[0133] In some examples, the target file is divided into n data blocks, and the file service device generates 2 n- Two distinct user keys, where n is an integer greater than 1. The file service device has 2... n - Part of the two different user keys are assigned to users, and different users are assigned different user keys.

[0134] In some embodiments, if there is no correspondence between the user identifier in the acquisition request and the user key corresponding to the block information, the user indicated by the user identifier is an illegitimate user, and the original legitimate user's user key is updated. The updated user key for the original legitimate user is the user key that was not previously assigned. The original legitimate user includes the user indicated by the user identifier that has a correspondence with the user key corresponding to the block information in the acquisition request.

[0135] It should be noted that the user terminal 500 is a device corresponding to the file access control method in the first aspect embodiment above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0136] The fifth aspect of this application provides a network caching device. Figure 9 is a schematic diagram of the structure of a network caching device provided in an embodiment of the fifth aspect of this application. As shown in Figure 9, the network caching device 600 may include a receiving module 601, a querying module 602, and a sending module 603.

[0137] The receiving module 601 can be used to receive multiple acquisition requests sent sequentially by the user terminal for requesting to obtain the target file.

[0138] Each retrieval request includes a user identifier and block information for the file block corresponding to the user key. The user key and the block information for the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The data block is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks.

[0139] The query module 602 can be used to find the cached file blocks that correspond to the block information in the retrieval request.

[0140] The sending module 603 can be used to request a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, and to feed back the obtained file block corresponding to the block information in the acquisition request to the user terminal, so that the user terminal can perform encryption and decryption processing on the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file.

[0141] In some embodiments, the file block corresponding to the block information in the request is encrypted using a user key to obtain the target ciphertext, which is the ciphertext of the target file. The target ciphertext is then decrypted using the user key to obtain the target file.

[0142] In some examples, the target ciphertext is obtained by concatenating a file block whose end and beginning are the same data block in the user key, and then XORing the data block at the file concatenation point. Alternatively, the target ciphertext is obtained by XORing the data block in the user key with the corresponding data block at the file block concatenation point.

[0143] In some embodiments, the file service device generates multiple different user keys and file blocks corresponding to each user key. Before receiving multiple acquisition requests from a user terminal for requesting to acquire a target file, the user terminal and the file service device exchange file acquisition request and file acquisition response information, enabling the user terminal to acquire the user key and the block information of the file block corresponding to the user key. The file acquisition request includes a user identifier. The file acquisition response information includes the user key corresponding to the user identifier and the block information of the file block corresponding to the user key. The file service device stores the correspondence between the user identifier and the user key.

[0144] In some embodiments, the sending module 603 may be used to: send a file block retrieval request to the file service device if the cached file blocks do not contain the file block corresponding to the block information in the retrieval request. The file block retrieval request includes uncached block information. The uncached block information corresponds to the file blocks that are not cached by the network caching device and correspond to the block information in the retrieval request.

[0145] The receiving module 601 can be used to: receive file blocks corresponding to uncached block information fed back by the file service device and cache them.

[0146] In some examples, the target file is divided into n data blocks, and the file service device generates 2 n - Two distinct user keys, where n is an integer greater than 1. The file service device has 2... n - Part of the two different user keys are assigned to users, and different users are assigned different user keys.

[0147] In some embodiments, if there is no correspondence between the user identifier in the acquisition request and the user key corresponding to the block information, the user indicated by the user identifier is an illegitimate user, and the original legitimate user's user key is updated. The updated user key for the original legitimate user is the user key that was not previously assigned. The original legitimate user includes the user indicated by the user identifier that has a correspondence with the user key corresponding to the block information in the acquisition request.

[0148] It should be noted that the network caching device 600 is the device corresponding to the file access control method in the second aspect embodiment above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0149] The sixth aspect of this application provides a document service apparatus. Figure 10 is a schematic diagram of the structure of a document service apparatus provided in an embodiment of the sixth aspect of this application. As shown in Figure 10, the document service apparatus 700 may include a receiving module 701 and a sending module 702.

[0150] The receiving module 701 can be used to receive requests from the network caching device for file blocks that are not cached by the network caching device and correspond to the block information in the acquisition request.

[0151] The user terminal sends a request sequentially to the network caching device to request the target file. Each request includes a user identifier and block information of the file block corresponding to the user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The user terminal uses the user key to encrypt and decrypt the file block corresponding to the block information in the request to obtain the target file. The data block is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks.

[0152] The sending module 702 can be used to send back to the network caching device a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, so that the network caching device caches the file block sent back, so that when an acquisition request including the block information of the file block sent back is received, the cached file block is sent back to the user terminal.

[0153] In some embodiments, the file block corresponding to the block information in the request is encrypted using a user key to obtain the target ciphertext, which is the ciphertext of the target file. The target ciphertext is then decrypted using the user key to obtain the target file.

[0154] In some examples, the target ciphertext is obtained by concatenating a file block whose end and beginning are the same data block in the user key, and then XORing the data block at the file concatenation point. Alternatively, the target ciphertext is obtained by XORing the data block in the user key with the corresponding data block at the file block concatenation point.

[0155] In some embodiments, the file service device generates multiple different user keys and a file block corresponding to each user key, and stores the correspondence between user identifiers and user keys. The file service device 700 may also include an information determination module.

[0156] The receiving module 701 can be used to receive a file retrieval request sent by a user terminal, the file retrieval request including a user identifier.

[0157] The information determination module can be used to: determine the user key corresponding to the user identifier in the file acquisition request, and the block information of the file block corresponding to the user key, based on the correspondence between the user identifier and the user key.

[0158] The sending module 702 can be used to send file retrieval response information back to the file service device. The file retrieval response information includes the user key corresponding to the user identifier in the file retrieval request and the block information of the file block corresponding to the user key.

[0159] In some embodiments, the file service apparatus 700 may further include a key generation module and a key distribution module.

[0160] The key generation module can be used to: divide a target file into n data blocks, and generate a key based on the n data blocks. n - Two distinct user keys, where n is an integer greater than 1.

[0161] The key distribution module can be used to: distribute 2 n - A portion of the two different user keys is assigned to the user who requested the user key, and different users are assigned different user keys.

[0162] In some embodiments, the file service apparatus 700 may further include an illegal user identification module and a key update module.

[0163] The illegal user identification module can be used to determine that the user indicated by the user identifier is an illegal user when there is no corresponding relationship between the user identifier in the acquisition request and the user key corresponding to the block information.

[0164] The key update module can be used to update the user key of an existing legitimate user using a previously unassigned user key. The updated user key for the existing legitimate user is one of the previously unassigned user keys. The existing legitimate user includes the user indicated by the user identifier that corresponds to the user key corresponding to the block information in the retrieval request.

[0165] It should be noted that the file service device 700 is the device corresponding to the file access control method in the third aspect embodiment above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0166] The seventh aspect of this application also provides a user terminal. Figure 11 is a schematic diagram of the structure of a user terminal provided in an embodiment of the seventh aspect of this application. As shown in Figure 11, the user terminal 800 includes a memory 801, a processor 802, and a computer program stored in the memory 801 and executable on the processor 802.

[0167] In some examples, the processor 802 described above may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that may be configured to implement the embodiments of this application.

[0168] Memory 801 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the file access control method according to the first aspect embodiment of this application.

[0169] The processor 802 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 801, so as to implement the file access control method in the first aspect embodiment above.

[0170] In some examples, the user terminal 800 may also include a communication interface 803 and a bus 804. As shown in Figure 11, the memory 801, the processor 802, and the communication interface 803 are connected via the bus 804 and communicate with each other.

[0171] The communication interface 803 is mainly used to enable communication between various modules, devices, units, and / or equipment in the embodiments of this application. Input devices and / or output devices can also be connected through the communication interface 803.

[0172] Bus 804 includes hardware, software, or both, that couples components of user terminal 800 together. For example, and not limitingly, bus 804 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 804 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0173] An eighth aspect of this application provides a network caching device, which may include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0174] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the file access control method according to the second aspect of the present application.

[0175] The processor runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory, in order to implement the file access control method in the second aspect embodiment above.

[0176] In some examples, the network caching device may also include a communication interface and a bus, with the memory, processor, and communication interface connected via the bus to communicate with each other.

[0177] The connections between the memory, processor, communication interface, and bus in the network caching device, as well as the specific implementation methods, can be found in the relevant descriptions in the user terminal embodiments of the seventh aspect above, and will not be repeated here.

[0178] A ninth aspect of this application provides a document service apparatus, which may include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0179] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the file access control method according to the third aspect of the present application.

[0180] The processor runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory, in order to implement the file access control method in the third aspect embodiment above.

[0181] In some examples, the file service device may also include a communication interface and a bus, with the memory, processor, and communication interface connected via the bus to communicate with each other.

[0182] The connections between the memory, processor, communication interface, and bus in the network caching device, as well as the specific implementation methods, can be found in the relevant descriptions in the user terminal embodiments of the seventh aspect above, and will not be repeated here.

[0183] The tenth aspect of this application provides a file access control system. This file access control system includes a user terminal, a network caching device, and a file service device as described in the above embodiments. For details, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0184] The eleventh aspect of this application provides a computer-readable storage medium storing computer program instructions. When executed by a processor, these computer program instructions can implement the file access control methods described in the first, second, or third aspects of the above-described embodiment, achieving the same technical effects. To avoid repetition, these methods will not be described again here. The aforementioned computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, etc., and is not limited thereto.

[0185] The twelfth aspect of this application provides a computer program product, which may include a computer program. When the computer program is executed by a processor, it implements the file access control method in the first aspect embodiment, the file access control method in the second aspect embodiment, or the file access control method in the third aspect embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0186] It should be clarified that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. For user terminal embodiments, network caching device embodiments, file service device embodiments, system embodiments, computer-readable storage medium embodiments, and computer program product embodiments, relevant parts can be referred to the description section of the method embodiments. This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0187] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0188] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A file access control method, applied to a user terminal, the method comprising: Multiple retrieval requests for obtaining a target file are sequentially sent to a network caching device. Each retrieval request includes a user identifier and block information of a file block corresponding to a user key, so that the network caching device can find the cached file block corresponding to the block information in the retrieval request. Additionally, a file service device is requested to retrieve a file block that is not cached by the network caching device but corresponds to the block information in the retrieval request. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block, which is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key, and the file block includes one data block or two or more consecutive data blocks. Receive the file block corresponding to the block information in the acquisition request, fed back by the network caching device; Based on the user key, the file block corresponding to the block information in the acquisition request is encrypted and decrypted to obtain the target file.

2. The method according to claim 1, wherein, The process of encrypting and decrypting the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file includes: The file block corresponding to the block information in the acquisition request is encrypted according to the user key to obtain the target ciphertext, which is the ciphertext of the target file. The target ciphertext is decrypted using the user key to obtain the target file.

3. The method according to claim 2, wherein, The data block at the beginning of the file block and / or the data block at the end of the file block are consistent with the data block in the user key; The step of encrypting the file block corresponding to the block information in the acquisition request according to the user key to obtain the target ciphertext includes: The file block whose end and beginning are the same data block in the user key are concatenated, and the data block at the concatenation point is XORed to obtain the target ciphertext. The step of decrypting the target ciphertext according to the user key to obtain the target file includes: The target file is obtained by performing an XOR operation between the data block in the user key and the data block at the concatenation point of the corresponding file block.

4. The method according to claim 1, wherein, The file service device generates multiple different user keys and file blocks corresponding to each user key; Before sequentially sending multiple retrieval requests for the target file to the network caching device, the method further includes: Send a file retrieval request to the file service device, the file retrieval request including the user identifier; The file service device receives file retrieval response information, which includes the user key corresponding to the user identifier and the block information of the file block corresponding to the user key. The file service device stores the correspondence between the user identifier and the user key.

5. The method according to claim 1, wherein, The uncached file block corresponding to the block information in the retrieval request, which is requested from the file service device, is cached in the network caching device.

6. The method according to claim 1, wherein, The target file is divided into n data blocks, and the file service device generates 2 n - Two different user keys, where n is an integer greater than 1; The document service device 2 n - Two different user keys are assigned to users, and different users are assigned different user keys.

7. The method according to claim 1, wherein, If the user key corresponding to the user identifier and block information in the acquisition request does not have a corresponding relationship, the user indicated by the user identifier is an illegal user, and the user key of the original legitimate user is updated. The updated user key of the original legitimate user is the user key that was not previously assigned. The original legitimate user includes the user indicated by the user identifier that has a corresponding relationship with the user key corresponding to the block information in the acquisition request.

8. A file access control method applied to a network caching device, the method comprising: The system receives multiple acquisition requests sent sequentially by a user terminal to request the acquisition of a target file. Each acquisition request includes a user identifier and block information of a file block corresponding to a user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block, which is obtained by partitioning the target file. The file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks. The system retrieves the cached file block corresponding to the block information in the retrieval request, and requests the file service device for the file block that is not cached by the network caching device and corresponds to the block information in the retrieval request. The obtained file block corresponding to the block information in the acquisition request is fed back to the user terminal, so that the user terminal can perform encryption and decryption processing on the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file.

9. The method according to claim 8, wherein, The file block corresponding to the block information in the acquisition request is encrypted using the user key to obtain the target ciphertext, and the target ciphertext is the ciphertext of the target file. The target ciphertext is decrypted using the user key to obtain the target file.

10. The method according to claim 9, wherein, The target ciphertext is obtained by concatenating file blocks whose block tail and block head are the same data blocks in the user key, and performing an XOR operation on the data blocks at the file concatenation point; The target ciphertext is obtained by XORing the data block in the user key with the data block at the concatenation point of the corresponding file block.

11. The method according to claim 8, wherein, The file service device generates multiple different user keys and file blocks corresponding to each user key; Before receiving multiple acquisition requests for obtaining a target file sequentially sent by the user terminal, the user terminal and the file service device use file acquisition requests and file acquisition response information to enable the user terminal to obtain the user key and the block information of the file block corresponding to the user key. The file acquisition request includes the user identifier, and the file acquisition response information includes the user key corresponding to the user identifier and the block information of the file block corresponding to the user key. The file service device stores the correspondence between the user identifier and the user key.

12. The method according to claim 8, wherein, The step of requesting the file service device for a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request includes: If the cached file block does not contain the file block corresponding to the block information in the retrieval request, a file block retrieval request is sent to the file service device. The file block retrieval request includes uncached block information, which corresponds to the file block corresponding to the block information in the retrieval request that is not cached by the network caching device. The file service device receives the file block corresponding to the uncached block information and caches it.

13. The method according to claim 8, wherein, The target file is divided into n data blocks, and the file service device generates 2 n - Two different user keys, where n is an integer greater than 1; The document service device 2 n - Two different user keys are assigned to users, and different users are assigned different user keys.

14. The method according to claim 8, wherein, If the user key corresponding to the user identifier and block information in the acquisition request does not have a corresponding relationship, the user indicated by the user identifier is an illegal user, and the user key of the original legitimate user is updated. The updated user key of the original legitimate user is the user key that was not previously assigned. The original legitimate user includes the user indicated by the user identifier that has a corresponding relationship with the user key corresponding to the block information in the acquisition request.

15. A file access control method, applied to a file service device, the method comprising: The system receives requests from a network caching device for file blocks that are not cached by the network caching device and correspond to the block information in the retrieval request. The retrieval requests are sent sequentially by the user terminal to the network caching device to request the retrieval of a target file. Each retrieval request includes a user identifier and block information of the file block corresponding to a user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The user key is used by the user terminal to encrypt and decrypt the file block corresponding to the block information in the retrieval request to obtain the target file. The data block is obtained by dividing the target file. The file block is obtained by dividing the target file according to the user key. The file block includes one data block or two or more consecutive data blocks. The network caching device is fed back the file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, so that the network caching device caches the fed-back file block, so that when the acquisition request including the block information of the fed-back file block is received, the cached file block is fed back to the user terminal.

16. The method according to claim 15, wherein, The file block corresponding to the block information in the acquisition request is encrypted using the user key to obtain the target ciphertext, and the target ciphertext is the ciphertext of the target file. The target ciphertext is decrypted using the user key to obtain the target file.

17. The method according to claim 16, wherein, The target ciphertext is obtained by concatenating file blocks whose block tail and block head are the same data blocks in the user key, and performing an XOR operation on the data blocks at the file concatenation point; The target ciphertext is obtained by XORing the data block in the user key with the data block at the concatenation point of the corresponding file block.

18. The method according to claim 15, wherein, The file service device generates multiple different user keys and file blocks corresponding to each user key, and the file service device stores the correspondence between the user identifier and the user key; Before the user terminal sequentially sends multiple acquisition requests for obtaining the target file to the network caching device, the method further includes: Receive a file retrieval request sent by the user terminal, wherein the file retrieval request includes the user identifier; Based on the correspondence between the user identifier and the user key, determine the user key corresponding to the user identifier in the file acquisition request, and the block information of the file block corresponding to the user key; The file service device sends back file retrieval response information, which includes the user key corresponding to the user identifier in the file retrieval request and the block information of the file block corresponding to the user key.

19. The method of claim 15, further comprising: The target file is divided into n data blocks, and a 2... n - Two different user keys, where n is an integer greater than 1; 2 n - Two different user keys are assigned to users who applied for the user keys, and different users are assigned different user keys.

20. The method of claim 15, further comprising: If the user key corresponding to the user identifier and block information in the acquisition request does not have a corresponding relationship, the user indicated by the user identifier is determined to be an illegal user; The user key of the original legitimate user is updated using the previously unassigned user key. The updated user key of the original legitimate user is one of the previously unassigned user keys. The original legitimate user includes the user indicated by the user identifier that has a corresponding relationship with the user key corresponding to the block information in the acquisition request.

21. A user terminal, comprising: The sending module is configured to sequentially send multiple acquisition requests to the network caching device for requesting to acquire a target file. Each acquisition request includes a user identifier and block information of a file block corresponding to a user key, so that the network caching device can find the cached file block corresponding to the block information in the acquisition request, and request the file service device for a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block, the data block is obtained by partitioning the target file, and the file block is obtained by partitioning the target file according to the user key. The file block includes one data block or two or more consecutive data blocks. The receiving module is used to receive the file block corresponding to the block information in the acquisition request, fed back by the network caching device; The encryption / decryption module is used to encrypt and decrypt the file blocks corresponding to the block information in the acquisition request based on the user key, so as to obtain the target file.

22. A network caching device, comprising: The receiving module is used to receive multiple acquisition requests sent sequentially by the user terminal for requesting to obtain a target file. Each acquisition request includes a user identifier and block information of a file block corresponding to a user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The data block is obtained by dividing the target file. The file block is obtained by dividing the target file according to the user key. The file block includes one data block or two or more consecutive data blocks. The query module is used to find the cached file blocks that correspond to the block information in the retrieval request; The sending module is configured to request from the file service device a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, and to feed back the obtained file block corresponding to the block information in the acquisition request to the user terminal, so that the user terminal can perform encryption and decryption processing on the file block corresponding to the block information in the acquisition request based on the user key to obtain the target file.

23. A document service apparatus, comprising: A receiving module is used to receive requests from a network caching device for file blocks that are not cached by the network caching device and correspond to the block information in the acquisition request. The acquisition requests are sent sequentially by the user terminal to the network caching device to request the acquisition of a target file. Each acquisition request includes a user identifier and block information of the file block corresponding to a user key. The user key and the block information of the file block corresponding to the user key are pre-issued to the user terminal by the file service device. The user key includes at least one data block. The user key is used by the user terminal to encrypt and decrypt the file block corresponding to the block information in the acquisition request to obtain the target file. The data block is obtained by dividing the target file. The file block is obtained by dividing the target file according to the user key. The file block includes one data block or two or more consecutive data blocks. The sending module is used to send back to the network caching device a file block that is not cached by the network caching device and corresponds to the block information in the acquisition request, so that the network caching device caches the file block sent back, so that when the acquisition request including the block information of the file block sent back is received, the cached file block is sent back to the user terminal.

24. A user terminal, comprising: Processor and memory storing computer program instructions; When the processor executes the computer program instructions, it implements the file access control method as described in any one of claims 1 to 7.

25. A network caching device, comprising: Processor and memory storing computer program instructions; When the processor executes the computer program instructions, it implements the file access control method as described in any one of claims 8 to 14.

26. A document service apparatus, comprising: Processor and memory storing computer program instructions; When the processor executes the computer program instructions, it implements the file access control method as described in any one of claims 15 to 20.

27. A file access control system, comprising: The user terminal as described in claim 24; The network caching device as described in claim 25; The document service apparatus as described in claim 26.

28. A computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the file access control method as described in any one of claims 1 to 20.

29. A computer program product comprising a computer program that, when executed by a processor, implements the file access control method according to any one of claims 1 to 20.

Images