Data authentication processing method and server for object storage server, and electronic device

Abstract

Provided in the present disclosure are a data authentication processing method and server for an object storage server and an electronic device. The method comprises: by means of a secure channel, receiving target request data that needs to be authenticated, the target request data carrying a channel parameter and being used for requesting an operation of a target object, the channel parameter being a parameter required for the secure channel to transmit the target request data, and the secure channel being created after a client of the target request data is authenticated by means of an authentication service; on the basis of the channel parameter of the secure channel, determining whether the channel parameter is valid; and, if the channel parameter is valid, determining that the target request data has passed authentication. The embodiments of the present disclosure can improve the efficiency of data request authentication of object storage servers, reduce interaction with authentication services, and improve the stability of object storage.

Description

Data authentication processing method, server and electronic equipment of object storage service end

[0001] The present disclosure claims priority to Chinese Patent Application No. 202410982746.0, filed on July 22, 2024, with the Chinese Patent Office, entitled "Data authentication processing method, server and electronic equipment of object storage service end", the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of data storage, and particularly relates to a data authentication processing method, server and electronic equipment of an object storage service end. BACKGROUND

[0003] The object storage service end is a kind of cloud storage service, mainly taking service Internet (public network) as the main, so that each data request of the client considers the security risk and carries out security authentication, and the IAM (Identity and Access Management, identity recognition and access management) service is adopted for authentication and authorization.

[0004] And with more and more clients and applications supported by the object storage service end, especially when supporting the internal network access of the cloud computing service, each data request will bring additional performance overhead. Based on the public network request, there will be a public network protocol (HTTPS) unpacking, unpacking, and then based on the IAM service to extract identity information and access authorization information, which will affect the performance. And each data request will depend on the authentication service, thereby causing the stability of the object storage to be restricted by external services.

[0005] Therefore, when the related technology carries out data authentication, the data authentication efficiency is low, which leads to low system performance and poor stability. SUMMARY

[0006] Embodiments of the present disclosure provide a data authentication processing method, server and electronic equipment of an object storage service end to solve one or more technical problems described above.

[0007] In a first aspect, the embodiments of the present disclosure provide a data authentication processing method of an object storage server, comprising: receiving target request data requiring authentication through a secure channel, wherein the target request data carries a channel parameter, the channel parameter is required for the secure channel to transmit the target request data, and the secure channel is created after a client of the target request data is authenticated by an authentication service; determining whether the channel parameter is legal according to the channel parameter of the secure channel; and determining that the target request data passes authentication in a case where the channel parameter is legal.

[0008] In a second aspect, the embodiments of the present disclosure provide a data authentication processing method of an object storage client, comprising: obtaining a channel parameter of a secure channel for secure data transmission, wherein the channel parameter is required for the secure channel to transmit data, and the secure channel is created after an object storage server for storing data is authenticated by an authentication service; binding the channel parameter with target request data requiring authentication and then being sent, wherein the target request data is used to request the object storage server to operate on a target object; and sending the target request data carrying the channel parameter to the object storage server through the secure channel, wherein the object storage server determines whether the target request data passes authentication by authenticating whether the channel parameter is legal.

[0009] In a third aspect, the embodiments of the present disclosure provide a data authentication processing server of an object storage server, comprising: a receiving module, configured to receive target request data requiring authentication through a secure channel, wherein the target request data carries a channel parameter, the channel parameter is required for the secure channel to transmit the target request data, and the secure channel is created after a client of the target request data is authenticated by an authentication service; a comparison module, configured to determine whether the channel parameter is legal according to the channel parameter of the secure channel; and an authentication module, configured to determine that the target request data passes authentication in a case where the channel parameter is legal.

[0010] In a fourth aspect, the embodiments of the present disclosure provide an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements the method of any one of the above aspects when executing the computer program.

[0011] In a fifth aspect, the embodiments of the present disclosure provide a computer program product, comprising computer programs / instructions,

[0012] characterized in that the computer programs / instructions are executed by a processor to implement the method of any one of the above aspects.

[0013] Compared with the related art, the present disclosure has the following advantages:

[0014] According to the data authentication processing method of the object storage service end provided in the embodiment of the present disclosure, the target request data is authenticated by the authentication service in advance, and then a secure channel is created. The target request data that needs to be authenticated is received based on the secure channel, and the operation of the target object is requested. It can be ensured that the request data within the effective period of the secure channel can be directly authenticated according to the channel parameters, without the need to send each request data to the authentication service for authentication, thereby improving the efficiency of request data authentication, effectively avoiding the disassembly package, information extraction and other operations required for each request data authentication, thereby improving the system performance of the object storage service end and improving the running stability.

[0015] The above-mentioned target request data carries a channel parameter, and the channel parameter is a parameter required for the secure channel to transmit the target request data. The channel parameter is compared with the channel parameter of the secure channel to determine whether the channel parameter is legal. In the case where the channel parameter is legal, it is determined that the target request data passes the authentication. That is, by comparing the channel parameter with the secure channel, it can be quickly and conveniently determined whether the target request data is legal, thereby improving the efficiency and accuracy of request data authentication. Thus, the problem of low authentication efficiency of the object storage service end in the related art is solved.

[0016] The above description is only a summary of the technical solutions of the present disclosure. In order to more clearly understand the technical means of the present disclosure, the present disclosure can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the specific embodiments of the present disclosure are described below. BRIEF DESCRIPTION OF DRAWINGS

[0017] In the drawings, identical reference numerals designate the same or similar parts throughout the several views. The drawings are not necessarily to scale. It should be understood that the drawings only depict some embodiments in accordance with the present disclosure and should not be considered as limiting the scope of the present disclosure.

[0018] FIG. 1 shows a schematic diagram of request authentication of an object storage service end in the related art;

[0019] FIG. 2 shows a flowchart of a data authentication processing method of an object storage service end according to an embodiment of the present disclosure;

[0020] FIG. 3 shows a flowchart of another data authentication processing method of an object storage service end according to an embodiment of the present disclosure;

[0021] FIG. 4 shows a schematic diagram of request authentication of an object storage service end according to an embodiment of the present disclosure;

[0022] FIG. 5 shows a schematic diagram of a basic architecture of a request authentication by an object storage service end of an embodiment of the present disclosure;

[0023] FIG. 6 shows a schematic diagram of a timing flow of a request authentication by an object storage service end of an embodiment of the present disclosure;

[0024] FIG. 7 shows a structural block diagram of a data authentication processing server of an object storage service end provided in an embodiment of the present disclosure;

[0025] FIG. 8 shows a structural block diagram of a data authentication processing apparatus of an object storage service end provided in an embodiment of the present disclosure;

[0026] FIG. 9 shows a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In the following, only certain exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the concept or scope of the present disclosure. Therefore, the drawings and the description are considered to be exemplary in nature, rather than limiting.

[0028] To facilitate understanding of the technical solutions of the embodiments of the present disclosure, the related technologies of the embodiments of the present disclosure are described below. The following related technologies can be combined with the technical solutions of the embodiments of the present disclosure in any manner as optional solutions, which all belong to the protection scope of the embodiments of the present disclosure.

[0029] In the cloud storage technology of the related technologies, object storage is a service for providing unstructured data storage for Internet applications. Object storage has the advantages of unlimited storage, support for high concurrency access, and lower cost. Since the object storage service end directly interfaces with the Internet, in order to ensure the security of the object storage service end, the request data of each access to the object storage service end needs to be securely authenticated.

[0030] Specifically, FIG. 1 shows a schematic diagram of a request authentication by an object storage service end of the related technologies, as shown in FIG. 1, the object storage service end of the (cloud) service end needs to authenticate each request data from the client, that is, send to the authentication and authorization service for authentication, and respond again in the case of authentication. However, in the case of many clients and / or applications, this authentication method is inefficient, and the authentication of each request data often needs to match the data processing method, for example, based on public network request, there will be public network protocol (HTTPS) unpacking, unpacking, and then based on IAM (identity and access management) to extract identity information and access authorization information.

[0031] Thus, each authentication of the requested data will consume additional resources, which not only leads to low authentication efficiency, but also occupies the system resources of the object storage server, thereby reducing the system performance and affecting other work of the system. Moreover, each requested data will depend on the authentication service, i.e., the authentication and authorization service in FIG. 1, and the working stability of the authentication service will directly affect the working stability of the object storage service, thereby causing the stability of the object storage to be restricted by external services.

[0032] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for the user to choose authorization or refusal.

[0033] The technical solutions of the present disclosure and how the technical solutions of the present disclosure solve the foregoing technical problems will be described in detail below with specific embodiments. The several specific embodiments listed can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0034] FIG. 2 shows a flowchart of a data authentication processing method of an object storage server according to an embodiment of the present disclosure. The embodiment of the present disclosure provides a data authentication processing method of an object storage server. As shown in FIG. 2, the flowchart of the data authentication processing method of the object storage server according to an embodiment of the present disclosure, the method can include the following steps:

[0035] In step S201, the target requested data requiring authentication is received through a secure channel, wherein the target requested data carries a channel parameter for requesting an operation of a target object, the channel parameter is a parameter required for the secure channel to transmit the target requested data, and the secure channel is created after the client of the target requested data is authenticated by the authentication service;

[0036] In step S202, it is determined whether the channel parameter of the secure channel is legal according to the channel parameter of the secure channel.

[0037] In step S203, it is determined that the target requested data passes the authentication in the case that the channel parameter is legal.

[0038] According to the data authentication processing method of the object storage service end in the embodiment, the target request data client is authenticated by the authentication service in advance, and a secure channel is created. The target request data requiring authentication is received based on the secure channel, and the operation of the target object is requested. It can be ensured that the request data within the effective period of the secure channel can be directly authenticated according to the channel parameters, without the need to send each request data to the authentication service for authentication, thereby improving the efficiency of request data authentication, effectively avoiding the disassembly package, information extraction and other operations required for each request data authentication, thereby improving the system performance of the object storage service end and improving the running stability.

[0039] The target request data carries the channel parameters, and the channel parameters are the parameters required for the secure channel to transmit the target request data. The channel parameters are compared with the channel parameters of the secure channel to determine whether the channel parameters are legal. In the case where the channel parameters are legal, it is determined that the target request data passes the authentication. That is, by comparing the channel parameters of the secure channel, it can be quickly and conveniently determined whether the target request data is legal, thereby improving the efficiency and accuracy of request data authentication. Thus, the problem of low authentication efficiency of the object storage service end in the related art is solved.

[0040] The execution subject of the above step can be a service end, specifically, an object storage service end of the service end, and further an access layer of the object storage service end. After receiving the target request data of the client, the access layer will directly send it to the authentication service for authentication, and after the authentication is passed, the target request data will be sent to the object storage service end for response. For example, the convergence layer, the core layer, etc. The authentication of the target request data in the access layer can feed back to the client according to the authentication result, thereby improving the security of the object storage service end and improving the efficiency of the target request data authentication.

[0041] In the above step S201, the secure channel is a stable communication channel established by the execution subject and the client through an application program interface (API). However, the secure channel is created after the authentication service authenticates the client of the target request data, which can ensure the security of the network information of the client and further ensure that the communication channel established between the client and the execution subject is safe and stable at the initial establishment. It is the basis for subsequent secure and stable communication of request data.

[0042] In actual implementation, the execution subject receives the target request data requiring authentication through the created secure channel. The target request data is transmitted through the secure channel after the secure channel is created, and the authentication process no longer depends on the authentication service, but is based on the channel parameters of the secure channel for authentication.

[0043] Therefore, after the secure channel is created, the aforementioned execution entity sends the channel parameters to the client. When the client subsequently sends request data to the aforementioned execution entity, it will include the channel parameters in the request data; that is, the target request data carries the channel parameters. Only after successful authentication based on the channel parameters will the client respond to the target request data and perform operations on the target object.

[0044] The target object mentioned above can be a data object stored in the object storage service client. The operations on the target object can include storing, deleting, querying, and other operations on the target object.

[0045] In step S202 above, when authenticating the target request data based on the channel parameters of the secure channel, the channel parameters can be compared with the pre-stored channel parameters of the secure channel to determine whether the channel parameters are valid. If the channel parameters carried by the target request data match the channel parameters of the corresponding secure channel, then the target request data is valid. Conversely, if the channel parameters carried by the target request data do not match the channel parameters of the corresponding secure channel, then the target request data is invalid.

[0046] The channel parameters of the security channel can be pre-stored in the channel table, which is a table dynamically maintained by the aforementioned execution entity to record the relevant parameters of different security channels.

[0047] If the target request data has valid channel parameters, it can be considered secure and authenticated, and can be sent to the deeper network layer of the executing entity for a response. If the target request data has invalid channel parameters, it can be considered insecure and fails authentication, and the authentication result can be returned to the client to notify the client of the authentication result.

[0048] It's important to note that once the target request data is authenticated, a response can be sent directly to the client. Only if the target request data fails authentication is a failure result returned to the client, prompting the client to adjust its authentication strategy and method. If authentication is successful, there's no need to return the authentication result to the client; a direct response is sent, and the client receives the result directly. This reduces the interaction burden between the client and the aforementioned execution entity, thereby improving interaction efficiency.

[0049] In a possible implementation, before receiving the target request data requiring authentication through the secure channel, the method further includes: receiving network information of the client, sending the network information to the authentication service for authentication; in a case where the network information passes the authentication, creating a secure channel for the client; and storing channel parameters of the secure channel. For example, the channel parameters of the secure channel are recorded in the channel table and are sent to the client, where the client binds the channel parameters of the secure channel to the data requiring authentication and then transmits the data requiring authentication.

[0050] Before the secure channel normally transmits data, the network information of the client needs to be sent to the authentication service. In a case where the network information passes the authentication, the secure channel is created, and the channel parameters of the secure channel are returned to the client, so that the secure channel is used for subsequent request data authentication.

[0051] It should be noted that the network information of the client can be network information sent by the client actively. For example, the client needs to establish a secure channel and can send an initialization request to the server, where the network information is carried in the initialization request. The network information can also be obtained by the execution subject actively, for example, the server actively obtains the network information of the client from the client according to a requirement, to build a secure channel for transmitting request data of the client.

[0052] In a case where the network information passes the authentication of the authentication service, it is indicated that the communication network between the client and the execution subject is safe and reliable. The secure channel of the client can be created. Conversely, in a case where the network information does not pass the authentication of the authentication service, it is indicated that the communication network between the client and the execution subject is not safe, and the authentication result is returned to the client to notify the client to make a corresponding operation.

[0053] After the secure channel is created, the secure channel is recorded in the channel table to update the channel table, so that the channel table is used for subsequent authentication of request data carried by the channel parameters.

[0054] The information items recorded in the channel table can form single-layer or multi-layer authentication of the request data of the client, to ensure the accuracy of the request data authentication. Moreover, the secure channel can be recorded comprehensively and effectively, to facilitate subsequent tracing.

[0055] The embodiment selects part of the parameters in the related parameters of the secure channel as the channel parameters. For example, the channel identifier and the valid time. The data amount is small, and it is not easy to make mistakes, it is convenient to request data carrying, and it can avoid excessive occupation of the storage space of the client.

[0056] After the related data of the secure channel is stored locally, the corresponding information item can be selected as the channel parameter, and the channel parameter of the secure channel is sent to the client. The client stores locally after receiving the channel parameter. And in the subsequent data transmission, the channel parameter is bound with the data to be authenticated and transmitted. In order to facilitate the server and other execution subjects to perform subsequent rapid and efficient authentication.

[0057] In a possible implementation, the network information of the client is received and sent to the authentication service for authentication, including: receiving the network information of the client through an initialization channel, wherein the initialization channel communicates with the client through a preset application program interface, and the network information includes at least one of the following: virtual private cloud information of the client, network address information, and domain name information; sending the network information to the authentication service, wherein the authentication service is configured to authenticate the network information, and returns the authentication result after the authentication is completed; receiving the authentication result of the authentication service, and determining whether the network information passes the authentication according to the authentication result.

[0058] The above initialization channel is a communication channel between the set application program interface and the client, which is similar to the secure channel. Only the initialization channel is not authenticated, and still needs to rely on the authentication service for authentication.

[0059] The network information of the client is received through the initialization channel, and the network information includes at least one of the following: virtual private cloud information of the client, network address information, and domain name information. The network information is sent to the authentication service for authentication, and the final authentication result is obtained. The authentication service returns the authentication result after the authentication is completed. The above execution subject receives the authentication result of the authentication service, and determines whether the network information passes the authentication according to the authentication result.

[0060] In a possible implementation, in the case that the network information passes the authentication, a secure channel is created, including: in the case that the network information passes the authentication, determining the channel parameter of the secure channel according to the network information and a preset channel function to create the secure channel, wherein the input of the channel function is at least one information in the network information, and the output of the channel function is the channel parameter.

[0061] The network information can determine the communication network security between the client and the execution subject through authentication when creating the secure channel. The channel parameters of the secure channel can be determined according to the network information and a preset channel function, so as to create the secure channel. The channel function is a communication function of an application program interface (API).

[0062] The input of the channel function is at least one item of the network information, for example, the requested VPC information, the source IP information, and the domain name information. The output of the channel function is the channel parameter, for example, the tunnel ID identifier and the tunnel validity time.

[0063] In a possible implementation, the channel parameter of the secure channel is stored and sent to the client, including: obtaining the network information and the channel parameter corresponding to the secure channel, and recording in a channel table. The channel table is used to record the related parameters of different secure channels. The channel table includes a plurality of information items of the secure channel, the plurality of information items including at least one item of the network information and the channel parameter. The channel parameter is returned to the client through an initialization channel. After receiving the channel parameter, the client stores the channel parameter.

[0064] The channel table mainly includes a plurality of information items of the secure channel, specifically including but not limited to the following contents: the channel identifier Tunnel-ID, the validity time Expire, the creation time StartTime, and the channel parameters, and the virtual private cloud network VPC information VPCInfo of the client, the accessed DNS domain name, the IP addresses SendInfo and RecvInfo of the sending end and the receiving end, and the access key AccessKey of the network information.

[0065] The channel identifier Tunnel-ID, the virtual private cloud network VPC information VPCInfo of the client, the access key AccessKey, the creation time StartTime, and the validity time Expire field can be used as the channel parameter, and used for verifying the requested data.

[0066] Specifically, when authenticating the request data of the client, first, in the tunnel table, it is inquired whether the tunnel identifier Tunnel-ID and the virtual private cloud network VPC information VPCInfo of the client exist. If not, it means that the secure tunnel has not been authenticated, and the request is rejected. If yes, it means that the secure tunnel has been authenticated, and then it is checked whether the access key AccessKey is a legal value. If not, it means that there is a misaccess or attack behavior, and the request is rejected. If yes, it means that there is no misaccess or attack behavior, and finally, the creation time StartTime and the valid time Expire are checked to confirm that the request data is within a reasonable time range. If the request data is not within a reasonable time range, the request is rejected, and the client is invited to reapply. If the request data is within a reasonable time range, the request data is responded to.

[0067] The tunnel parameter can be one or more of the above-mentioned necessary information items to quickly authenticate the request data transmitted by the secure tunnel. Preferably, the tunnel identifier Tunnel-ID and the valid time Expire are selected as the tunnel parameter in the embodiment. After the tunnel parameter is determined, the tunnel parameter is returned to the client through the initialization tunnel, wherein the client stores the tunnel parameter after receiving the tunnel parameter, so as to bind the subsequently sent request data.

[0068] In a possible implementation, the tunnel parameter includes the tunnel identifier and the valid time. According to the tunnel parameter of the secure tunnel, it is determined whether the tunnel parameter is legal, including: according to the tunnel identifier in the tunnel parameter, searching for the corresponding secure tunnel in the tunnel table; in the case of searching for the corresponding identifier in the tunnel table, according to the valid time in the tunnel parameter, determining whether the transmission of the target request data is within the valid period of the secure tunnel; in the case that the transmission time of the target request data is within the valid period of the secure tunnel, determining that the tunnel parameter is legal.

[0069] In the case of searching for the corresponding identifier in the tunnel table, it means that the secure tunnel has been authenticated, and the secure tunnel is safe and reliable. Conversely, in the case of not searching for the corresponding identifier in the tunnel table, it means that the secure tunnel has not been authenticated, and the secure tunnel is not safe and reliable.

[0070] In the case of proving the security channel to be reliable, it is then determined, according to the valid time in the channel parameter, whether the transmission of the target request data is within the valid period of the security channel. In the case that the transmission time of the target request data is within the valid period of the security channel, it is indicated that the security channel is transmitting the request data within the valid period, and the security and reliability of the request data can be ensured, and thus it can be determined that the channel parameter is legal. In the case that the transmission time of the target request data is outside the valid period of the security channel, it is indicated that the security channel is transmitting the request data at an expired time, and the security and reliability of the request data cannot be ensured, and thus it can be determined that the channel parameter is illegal.

[0071] In a possible implementation, the channel parameter further includes key information of the authentication service, and before determining, according to the valid time in the channel parameter, whether the transmission of the target request data is within the valid period of the security channel in the case that the corresponding identifier is found in the channel table, the method further includes: determining, according to the key information of the channel parameter, whether the transmission of the target request data has an illegal exception. The illegal exception includes at least one of the following: misaccess and attack behavior. In the case that the transmission of the target request data does not have an illegal exception, the step of determining, according to the valid time in the channel parameter, whether the transmission of the target request data is within the valid period of the security channel is performed.

[0072] Before determining, according to the valid time in the channel parameter, whether the transmission of the target request data is within the valid period of the security channel in the case of proving the security channel to be reliable, the key information of the channel parameter can also be used to determine whether the transmission of the target request data has an illegal exception.

[0073] If it is determined that the transmission of the target request data has an illegal exception, for example, misaccess or attack behavior, it is indicated that the request data is not safe and has risks, and thus the response should be rejected. If it is determined that the transmission of the target request data does not have an illegal exception, it is then determined, according to the valid time in the channel parameter, whether the transmission of the target request data is within the valid period of the security channel. In this way, the security and reliability of the request data are ensured.

[0074] In a possible implementation, the method further includes: after the valid time of the security channel expires, updating the network information of the channel receiving client, wherein the channel is updated through a preset application program interface and communicates with the client; sending the network information to the authentication service, wherein the authentication service is configured to authenticate the network information and return an authentication result after the authentication is completed; and receiving the authentication result of the authentication service, and updating the valid time of the security channel in the case that the authentication result indicates that the network information passes the authentication.

[0075] After the validity time of the secure channel expires, the secure channel can be extended through re-authentication. After the re-authentication is passed, the corresponding validity time is updated, thereby extending the use time of the secure channel. Moreover, there is no need to re-establish a new secure channel, less maintenance resources are occupied, and the practicability is stronger.

[0076] In a possible implementation, in the case that the secure channel is in a non-use state, the method further includes: receiving a deletion instruction of the channel from the client, and deleting the related information of the secure channel in response to the deletion instruction; or receiving an information calling instruction of the channel from the client, and sending the related information of the secure channel to the client through the channel in response to the information calling instruction.

[0077] In the case that the secure channel is in a non-use state, the secure channel in the channel table can be deleted through the deletion channel. The related information of the secure channel in the channel table can also be obtained through the description channel. The deletion channel and the description channel are similar to the initialization channel and the secure channel, that is, the communication channel established by the execution subject through the application program interface (API) and the client, and the difference lies in that different application program interfaces (APIs) are used, and the data response modes of the communication channels are different.

[0078] FIG. 3 shows a flowchart of a data authentication processing method of an object storage client provided in an embodiment of the present disclosure. The present disclosure also provides a data authentication processing method of an object storage client. As shown in FIG. 3, the flowchart of the data authentication processing method of the object storage client in an embodiment of the present disclosure can include the following steps:

[0079] In step S301, a channel parameter of a secure channel for securely transmitting data is obtained, wherein the channel parameter is a parameter required for the secure channel to transmit data, and the secure channel is created by an object storage server after authentication through an authentication service;

[0080] In step S302, the channel parameter is bound to target request data that needs to be sent after authentication, wherein the target request data is used to request the object storage server to operate on a target object;

[0081] In step S303, the target request data carrying the channel parameter is sent to the object storage server through the secure channel, wherein the object storage server determines whether the target request data passes the authentication by authenticating whether the channel parameter is legal.

[0082] According to the data authentication processing method of the object storage service end in the embodiment, after the target request data client is authenticated by the authentication service in advance, a secure channel is created, the target request data requiring authentication is received based on the secure channel, and the operation of the target object is requested. It can be ensured that the request data within the effective period of the secure channel can be directly authenticated according to the channel parameters, without the need to send each request data to the authentication service for authentication, thereby improving the efficiency of request data authentication, effectively avoiding the disassembly package, information extraction and other operations required for each request data authentication, thereby improving the system performance of the object storage service end and improving the running stability.

[0083] The target request data carries the channel parameters, and the channel parameters are parameters required for the secure channel to transmit the target request data. The channel parameters are compared with the channel parameters of the secure channel to determine whether the channel parameters are legal. In the case where the channel parameters are legal, it is determined that the target request data passes the authentication. That is, by comparing the channel parameters of the secure channel, it can be quickly and conveniently determined whether the target request data is legal, thereby improving the efficiency and accuracy of request data authentication. Thus, the problem of low authentication efficiency of the object storage service end in the related art is solved.

[0084] The execution subject of the above step can be the client. When authentication is performed, the channel parameters of the secure channel for secure data transmission are directly obtained, and the channel parameters are bound with the target request data requiring authentication and sent to the object storage service end through the secure channel. The object storage service end determines whether the target request data passes the authentication by authenticating whether the channel parameters are legal.

[0085] The channel parameters are parameters required for the secure channel to transmit data and are stored in the local in advance. The secure channel is created by the object storage service end for storing data after authentication by the authentication service. After the object storage service end creates the secure channel, the channel parameters are sent to the client, which stores the received channel parameters. In the subsequent authentication request, the channel parameters are bound to facilitate fast authentication by the object storage service end.

[0086] In a possible implementation, before the channel parameter of the secure channel for securely transmitting data is acquired, the method further includes: sending network information requiring authentication to the object storage server side, wherein the object storage server side, after receiving the network information, authenticates the network information through an authentication service and sends an authentication result; receiving the authentication result of the network information by the service side, wherein the authentication result includes authentication success and authentication failure; in the case that the authentication result is authentication success, receiving and storing the channel parameter, wherein the target object server side, in the case that the network information passes authentication, creates a secure channel of the client and sends the channel parameter of the secure channel; and acquiring the channel parameter of the secure channel for securely transmitting data, including: acquiring the channel parameter stored by the client.

[0087] It should be noted that the embodiment also provides an optional implementation, which proposes a method and device for implementing efficient authentication and authorization by object storage channel technology. In the related art, all object storages use the access mechanism of object storage S3, that is, each request data for accessing the object storage service needs to be authenticated.

[0088] In the computing service and database service of the cloud service industry, there is an authentication mode, the management and control path (for example, the creation, deletion and query operation of a computing instance, and the creation, deletion and query operation of a database instance) needs to go through the process of an authentication system (for example, an IAM service and a RAM service), and the data path (for example, a computing operation inside a cloud server and an access disk operation, and a SQL operation inside a database) does not need to go through the authentication system, so that the performance can be improved, and the stability can be improved by reducing the dependence on the authentication system.

[0089] The embodiment combines online analysis, and can optimize the authentication mechanism when accessing the intranet of the computing service and container service of the cloud, without depending on the authentication service for each request.

[0090] The core idea of the embodiment is to initialize a secure channel when accessing the intranet, return the tunnel and expire information of the channel through the “VPC and access domain name” of the client, so that the two ends of the secure channel do not need to interact with the authentication service in subsequent request data, thereby reducing the dependence on the authentication service and improving the request performance.

[0091] FIG. 4 shows a schematic diagram of request authentication by the object storage server side in the embodiment of the disclosure, as shown in FIG. 4, the request data represented by the solid line is the initialization of the secure channel (which needs to interact with the authentication service), and the subsequent request data (represented by the dashed line) no longer needs to interact; after the tunnel returned by the request data expires, the request after the reapplication is successful also does not need to interact with the authentication service.

[0092] Figure 5 shows a schematic diagram of the basic architecture of the object storage service end for request authentication according to the embodiment of the present disclosure. As shown in Figure 5, a typical object storage authentication function architecture includes a client, a front-end, an authentication and authorization service, the client sends a request to the front-end, and the front-end interacts with the "authentication and authorization service" to authenticate the identity and confirm the access. The embodiment adds two important modules, "tunnel channel table" and "management task" module, to the front-end.

[0093] The "tunnel channel table" of the embodiment mainly includes the channel information for efficient access of the client, including but not limited to the following fields:

[0094] • Tunnel-ID, a unique context identification ID for efficient authentication.

[0095] • VPCInfo, VPC network information of the client request source.

[0096] • DNS, domain name to be accessed by the client request.

[0097] • SendInfo, IP address of the sending end.

[0098] • RecvInfo, IP address of the object storage receiving end.

[0099] • AccessKey, access key carried.

[0100] • StartTime, initialization time of the efficient and secure authentication channel.

[0101] • Expire, expiration time of the efficient and secure authentication channel. When the value is not zero, the secure authentication channel is allowed to be used; after the value expires, the value becomes zero, and the secure authentication channel is not allowed to be used, unless the management request is called to update the value.

[0102] As shown in Table 1, Table 1 is an example of a tunnel channel table.

[0103] Table 1 Example of tunnel channel table

[0104] The "management task" of the embodiment mainly provides application program interface API calling and management tasks, and the main APIs are:

[0105] • InitTunnel (initialize channel, confirm that the client and the object storage service end establish a trusted channel).

[0106] • RefreshTunnel (update channel parameters).

[0107] • DeleteTunnel (delete tunnel).

[0108] • DescribeTunnel (return information related to the tunnel).

[0109] FIG. 6 shows a schematic diagram of the timing flow of request authentication of the object storage service end according to an embodiment of the present disclosure. As shown in FIG. 6, the main interaction timing of the initialization tunnel InitTunnel and the update tunnel RefreshTunnel is as follows:

[0110] The access layer of the object storage service end initializes the authentication security tunnel through the initialization tunnel InitTunnel interface, receives the network information such as VPC, IP, and domain name of the client, performs authentication through the “authentication service” in the AK / SK (Access Key id / Secret Access Key, access key) authentication mode, generates a secure tunnel after the network information AK / SK authentication is passed, inserts a record into the “tunnel table”, updates the content in the “management task”, and then returns the request success and provides the tunnel parameters of the security tunnel, including the tunnel and expire key parameters.

[0111] The input parameters of the initialization tunnel InitTunnel interface function are “requested VPC information, source IP information, and domain name information” (mainly 3 parameters), and the output is the Tunnel value and the Expire value. The basic principle is to authenticate the legality of the request, and if the authentication is passed, a record is added to the “tunnel table” and the corresponding value is set.

[0112] Subsequent requests will carry tunnel parameters of tunnel and expire in addition to the conventional request parameters. At this time, the object storage access layer no longer confirms with the “authentication service”, thereby improving performance and stability by reducing external dependencies. After the expiration of the valid time Expire parameter value, the authentication security tunnel can be updated through the update tunnel RefreshTunnel interface to obtain a new valid time Expire value.

[0113] The input parameters of the update tunnel RefreshTunnel interface function are “the tunnel parameter Tunnel value of the security tunnel (previously applied successfully) and the new valid time Expire value” (mainly 2 parameters), and the output is the tunnel parameter Tunnel value and the valid time Expire value of the security tunnel after the setting is successful. The basic principle is that the corresponding security tunnel Tunnel exists in the tunnel table, and the field of the record in the tunnel table is updated, mainly the value of Expire.

[0114] When the client no longer uses the secure channel, the DeleteTunnel interface can be called for deletion. The input parameter of the interface function of DeleteTunnel is the tunnel parameter Tunnel value (previously applied successfully) of the secure channel, and the output is OK after successful setting. The basic principle is that the corresponding secure channel Tunnel exists in the tunnel table, and the record is deleted in the tunnel table.

[0115] If it is necessary to query the use of the secure channel, the DescribeTunnel interface can be called.

[0116] Through the "tunnel channel table" and "management task" modules of the embodiment, the client can create a secure authentication context and obtain an efficient authentication channel parameter, including an expiration time (expire). Subsequent requests can be implemented without interaction with the authentication and authorization server by carrying the tunnel and expire parameters, thereby improving performance and stability.

[0117] In the object storage request of the embodiment, an efficient secure authentication channel mechanism is designed, and a channel parameter is added in the API, including a tunnel and an expire field. Therefore, in the request in which the field is effectively specified, the original complex authentication check does not need to be performed, and the performance and stability are improved. In the process of creating an efficient secure authentication channel (generating a tunnel and an expire), in addition to the original AK parameter, VPCInfo, DNS, SendInfo (sending IP), and RecvInfo fields are added, thereby improving the protection of the efficient secure authentication channel, and the protection is performed through the limited access range even if the information is leaked.

[0118] In the InitTunnel initialization channel of the embodiment, the "authentication and authorization service" is interacted with, the Access Key ID and Access Key Secret provided by RAM and the signature algorithm are compared, and the security when the channel is created is confirmed. In the runtime, the safety of the secure channel is ensured through the start time StartTime and the effective time Expire, and the channel needs to be re-applied if the time is exceeded. By comparing the Tunnel-ID, VPCInfo, and AccessKey information provided when the secure channel is established (the information is provided by the underlying network and is difficult to tamper), and comparing the client information carried in the data request, it is ensured that the request is confirmed to come from the authenticated client.

[0119] FIG. 7 shows a structural block diagram of a data authentication processing server of an object storage service end provided in an embodiment of the present disclosure. Corresponding to the application scenario and method of the method provided in the embodiment of the present disclosure, the embodiment of the present disclosure further provides a data authentication processing server of an object storage service end. As shown in FIG. 7, the data authentication processing server of the object storage service end in an embodiment of the present disclosure can include a receiving module 71, a comparing module 72, and an authentication module 73, which are described in detail below.

[0120] The receiving module 71 is configured to receive target request data requiring authentication through a secure channel, wherein the target request data carries a channel parameter, the channel parameter is required for the secure channel to transmit the target request data, and the secure channel is created after the client of the target request data is authenticated by an authentication service. The comparing module 72 is connected to the receiving module 71 and is configured to determine whether the channel parameter is legal according to the channel parameter of the secure channel. The authentication module 73 is connected to the comparing module 72 and is configured to determine that the target request data passes authentication in the case that the channel parameter is legal.

[0121] According to the data authentication processing server of the object storage service end described above in the embodiment, the secure channel is created after the client of the target request data is authenticated by the authentication service in advance, the target request data requiring authentication is received based on the secure channel, and the operation of the target object is requested. It can be ensured that the request data within the effective period of the secure channel can be directly authenticated according to the channel parameter, without the need to send each request data to the authentication service for authentication, thereby improving the efficiency of request data authentication, effectively avoiding the disassembly package, information extraction and other operations required for each request data authentication, and further improving the system performance of the object storage service end and the operation stability.

[0122] The target request data carries the channel parameter, the channel parameter is required for the secure channel to transmit the target request data, and the channel parameter is compared with the channel parameter of the secure channel to determine whether the channel parameter is legal. In the case that the channel parameter is legal, it is determined that the target request data passes authentication. That is, the channel parameter is compared with the secure channel to quickly and conveniently determine whether the target request data is legal, thereby improving the efficiency and accuracy of request data authentication. Thus, the problem of low authentication efficiency of the data authentication of the object storage service end in the related art is solved.

[0123] FIG. 8 shows a structural block diagram of a data authentication processing apparatus of an object storage client provided in an embodiment of the present disclosure. Corresponding to the application scenario and method of the method provided in the embodiment of the present disclosure, the embodiment of the present disclosure further provides a data authentication processing apparatus of an object storage client. As shown in FIG. 8, the structural block diagram of the data authentication processing apparatus of the object storage client in an embodiment of the present disclosure can include an obtaining module 81, a binding module 82, and a sending module 83, which are described in detail as follows.

[0124] The obtaining module 81 is configured to obtain a channel parameter of a secure channel, wherein the channel parameter is a parameter required for data transmission of the secure channel, and the secure channel is created by an authentication service after an authentication of an object storage server for storing data; the binding module 82 is connected to the obtaining module 81 and is configured to bind the channel parameter with target request data that needs to be sent after authentication, wherein the target request data is used to request the object storage server to perform an operation on a target object; and the sending module 83 is connected to the binding module 82 and is configured to send the target request data carrying the channel parameter to the object storage server through the secure channel, wherein the object storage server determines whether the target request data passes the authentication by authenticating whether the channel parameter is legal.

[0125] According to the data authentication processing apparatus of the object storage server, the client of the target request data is authenticated by the authentication service in advance, and then the secure channel is created. The target request data that needs to be authenticated is received based on the secure channel, and an operation on the target object is requested. It can be ensured that the request data within the effective period of the secure channel can be directly authenticated according to the channel parameter, without the need to send each request data to the authentication service for authentication. The efficiency of the request data authentication is improved, and the system performance of the object storage server is improved, and the running stability is improved.

[0126] The target request data carries the channel parameter, and the channel parameter is a parameter required for the secure channel to transmit the target request data. The channel parameter is compared with the channel parameter of the secure channel to determine whether the channel parameter is legal. In the case where the channel parameter is legal, it is determined that the target request data passes the authentication. That is, the channel parameter is compared with the secure channel to quickly and conveniently determine whether the target request data is legal, thereby improving the efficiency and accuracy of the request data authentication. Thus, the problem of low authentication efficiency of the object storage server in the related art is solved.

[0127] The functions of each module in each apparatus in the embodiments of the present disclosure can be referred to the corresponding description in the above method, and have the corresponding beneficial effects, which will not be described here again.

[0128] Figure 9 is a block diagram of an electronic device used to implement embodiments of the present disclosure. As shown in Figure 9, the electronic device includes a memory 901 and a processor 902. The memory 901 stores a computer program that can run on the processor 902. When the processor 902 executes the computer program, it implements the methods described in the above embodiments. The number of memories 901 and processors 902 can be one or more.

[0129] The electronic device also includes:

[0130] The communication interface 903 is used to communicate with external devices and exchange and transmit data.

[0131] If the memory 901, processor 902, and communication interface 903 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used in Figure 9, but this does not indicate that there is only one bus or one type of bus.

[0132] Optionally, in a specific implementation, if the memory 901, processor 902, and communication interface 903 are integrated on a single chip, then the memory 901, processor 902, and communication interface 903 can communicate with each other through an internal interface.

[0133] This disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods provided in this disclosure.

[0134] This disclosure also provides a chip including a processor for calling and executing instructions stored in a memory, causing a communication device on which the chip is installed to perform the methods provided in this disclosure.

[0135] This disclosure also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.

[0136] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting Advanced Reduced Instruction Set Machines (ARM) architecture.

[0137] Further, optionally, the aforementioned memory may include read-only memory and random access memory. The memory may be volatile memory or non-volatile memory, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available. Examples include Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DR RAM).

[0138] In the above embodiments, implementation can be achieved, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0139] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this disclosure. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0140] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means two or more, unless otherwise explicitly specified.

[0141] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0142] The logic and / or steps described in the flowchart or otherwise herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0143] It should be understood that various parts of this disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.

[0144] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0145] The above description is merely an exemplary embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope described in this disclosure, and these should all be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

A data authentication processing method of an object storage service end, comprising: receiving target request data requiring authentication through a secure channel, wherein the target request data carries a channel parameter, the channel parameter is required for the secure channel to transmit the target request data, and the secure channel is created after a client of the target request data is authenticated by an authentication service; determining whether the channel parameter is legal according to the channel parameter of the secure channel; in the case that the channel parameter is legal, determining that the target request data passes authentication. The method of claim 1, wherein, Before receiving the target request data requiring authentication through the secure channel, the method further comprises: receiving network information of the client and sending the network information to the authentication service for authentication; in the case that the network information passes the authentication, creating a secure channel of the client; storing the channel parameter of the secure channel and sending the channel parameter to the client, wherein the client binds the channel parameter of the secure channel with data requiring authentication and then transmits the data when performing subsequent data transmission after receiving the channel parameter of the secure channel. The method of claim 2, wherein, receiving network information of the client and sending the network information to the authentication service for authentication comprises: receiving the network information of the client through an initialization channel, wherein the initialization channel communicates with the client through a preset application programming interface, and the network information comprises at least one of the following: virtual private cloud information, network address information, and domain name information of the client; sending the network information to the authentication service, wherein the authentication service is configured to authenticate the network information and return an authentication result after authentication is completed; receiving the authentication result of the authentication service and determining whether the network information passes authentication according to the authentication result. The method according to claim 2 or 3, wherein in the case that the network information passes the authentication, creating the secure channel comprises: in the case that the network information passes the authentication, determining the channel parameter of the secure channel according to the network information and a preset channel function to create the secure channel, wherein the input of the channel function is at least one item of information in the network information, and the output of the channel function is the channel parameter. The method of any one of claims 2 to 4, wherein, storing the channel parameter of the secure channel and sending the channel parameter to the client comprises: acquiring network information and a channel parameter corresponding to the secure channel and recording in a channel table, wherein the channel table is configured to record related parameters of different secure channels, the channel table comprises a plurality of information items of the secure channel, the plurality of information items comprise at least one item of the network information and the channel parameter of the secure channel, and the channel parameter of the secure channel is returned to the client through the initialization channel, wherein the client stores the channel parameter of the secure channel after receiving the channel parameter. the channel parameter comprises a channel identifier and a valid time, and determining whether the channel parameter is legal according to the channel parameter of the secure channel comprises: The method of any one of claims 1 to 5, wherein, finding the corresponding secure channel in the channel table according to the channel identifier in the channel parameter; ​ In the case of finding the corresponding identifier in the channel table, according to the valid time in the channel parameter, it is determined whether the transmission of the target request data is within the valid period of the secure channel; In the case that the transmission time of the target request data is within the valid period of the secure channel, it is determined that the channel parameter is legal. The method of claim 6, wherein, The channel parameter further includes key information of the authentication service, and in the case that the corresponding identifier is found in the channel table, before determining whether the transmission of the target request data is within the valid period of the secure channel according to the valid time in the channel parameter, the method further comprises: According to the key information of the channel parameter, it is determined whether the transmission of the target request data has illegal exception, wherein the illegal exception includes at least one of the following: misaccess, attack behavior; In the case that the transmission of the target request data does not have illegal exception, the step of determining whether the transmission of the target request data is within the valid period of the secure channel according to the valid time in the channel parameter is executed. The method of any one of claims 1 to 7, wherein, The method further comprises: After the valid time of the secure channel expires, the network information of the client is received through an update channel, wherein the update channel communicates with the client through a preset application programming interface; The network information is sent to the authentication service, wherein the authentication service is used to authenticate the network information, and the authentication result is returned after authentication is completed; The authentication result of the authentication service is received, and in the case that the authentication result represents that the network information passes the authentication, the valid time of the secure channel is updated. The method of any one of claims 1 to 8, wherein, In the case that the secure channel is in a non-use state, the method further comprises: Through deleting channel, the deletion instruction of the client is received, and in response to the deletion instruction, the related information of the secure channel is deleted; Or, Through the description channel, the information calling instruction of the client is received, and in response to the information calling instruction, the related information of the secure channel is sent to the client through the description channel. A data authentication processing method of an object storage client, comprising: Obtaining channel parameters of a secure channel for secure data transmission, wherein the channel parameters are parameters required for data transmission of the secure channel, and the secure channel is created by an object storage server after authentication by an authentication service; Binding the channel parameters with target request data that needs to be sent after authentication, wherein the target request data is used to request the object storage server to operate on a target object; Sending the target request data carrying the channel parameters to the object storage server through the secure channel, wherein the object storage server determines whether the target request data passes the authentication by authenticating whether the channel parameters are legal. The method of claim 10, wherein, Before obtaining the channel parameters of the secure channel for secure data transmission, the method further comprises: Send the network information needing authentication to the object storage service end, wherein the object storage service end receives the network information, authenticates the network information through an authentication service, and sends an authentication result; Receive the authentication result of the network information by the service end, wherein the authentication result includes authentication success and authentication failure; In the case of authentication success, receive and store the channel parameter, wherein the target object service end creates a secure channel for the client in the case that the network information passes the authentication, and sends the channel parameter of the secure channel; Obtain the channel parameter of the secure channel for secure data transmission, including: Obtain the channel parameter stored by the client. A data authentication processing server of an object storage service end, comprising: A receiving module for receiving target request data needing authentication through a secure channel, wherein the target request data carries a channel parameter, which is used to request the operation of a target object, and the channel parameter is required for the secure channel to transmit the target request data, and the secure channel is created after the authentication service authenticates the client of the target request data; A comparison module for determining whether the channel parameter is legal according to the channel parameter of the secure channel; An authentication module for determining that the target request data passes the authentication in the case that the channel parameter is legal. An electronic device comprising a memory, a processor, and a computer program stored on the memory, wherein the processor implements the method of any one of claims 1-11 when executing the computer program. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions are executed by the processor to implement the method of any one of claims 1-11.

Images