WO2022252449A1 - File access control method, file encryption method, and computing device - Google Patents

Abstract

Disclosed is a file access control method, implemented in a computing device and comprising the steps: receiving an access request for a file sent by a user on the basis of an access credential; obtaining one or more groups of value pairs on the basis of the access credential, each group of value pairs comprising a plurality of value pairs, and each group of value pairs respectively corresponding to one file directory; decrypting the corresponding file directory according to each group of value pairs, respectively, to obtain one or more decrypted file directories corresponding to the access credential of the user; and combining and mounting the one or more decrypted file directories to a predetermined directory, such that the user can access the one or more decrypted file directories under the predetermined directory. A corresponding file encryption method and the computing device are further disclosed. According to the solution of the present invention, access permissions of users of different identities to a file directory can be controlled, and user experience is better.

Description

File access control method, file encryption method and computing device technical field

The invention relates to the technical fields of computers and the Internet, in particular to a file access control method, a file encryption method and computing equipment.

Background technique

At present, in daily work, there are situations where users with different identities access files with different confidentiality levels. With the existing encryption technology, as long as the user holds the decryption key of the file, he can open and modify all the contents inside. This modification is not subject to User identity restrictions can easily lead to abuse of data.

In the prior art, in order to realize different folders accessed by different users on one machine, it is necessary to create different encrypted folders for users, so that each user can only access his own encrypted folder. In this file encryption scheme, since encrypted folders are scattered in different paths, unified management of files cannot be realized. Moreover, each user needs to save a copy of the same file, resulting in a waste of storage space. In addition, this scheme cannot limit the access rights of users with different identities.

There is also a scheme, by creating an encrypted directory and several subdirectories, the user holds the key of the encrypted directory and the token to prove the user's identity. When the user needs to view the file with the corresponding permission, the unlock operation is performed first, and then the token is passed to the encryption system, and the system displays the directory with the corresponding permission after confirming the user's identity. Although this scheme can realize the access rights of users with different identities, since each directory is not encrypted separately, as long as the user who enters the root directory can view and operate all files through technical means. It can be seen that even if permission restrictions are set in this scheme, data isolation between users with different identities cannot be achieved, resulting in unguaranteed data security.

Therefore, a file access control method is needed to solve the problems in the above technical solutions.

Contents of the invention

For this reason, the present invention provides a file access control method and a file encryption method in an attempt to solve or at least alleviate the above existing problems.

According to one aspect of the present invention, there is provided a file access control method, executed in a computing device, comprising the steps of: receiving a file access request sent by a user based on an access credential; obtaining one or more sets of values based on the access credential Yes, each set of value pairs includes multiple value pairs, and each set of value pairs corresponds to a file directory; according to each set of value pairs, the corresponding file directory is decrypted to obtain one or more corresponding to the user's access credentials. multiple decrypted file directories; and merging and mounting the one or more decrypted file directories to a predetermined directory, so that users can access the one or more decrypted file directories under the predetermined directory.

Optionally, in the file access control method according to the present invention, the step of merging and mounting the one or more decrypted file directories to a predetermined directory includes: mounting a stacked file system in the predetermined directory, so that based on the stacked file system, the One or more decrypted file directories are merged and mounted to a predetermined directory.

Optionally, in the file access control method according to the present invention, the step of decrypting the corresponding file directory according to each set of value pairs includes: respectively calculating each set of value pairs according to the Lagrangian interpolation algorithm to obtain A constant value corresponding to each set of value pairs is obtained; and a corresponding file directory is decrypted based on the constant value corresponding to each set of value pairs, so as to obtain a decrypted file directory corresponding to each set of value pairs.

Optionally, in the file access control method according to the present invention, before decrypting the corresponding file directory according to each set of value pairs, a step is included: verifying each set of value pairs.

Optionally, in the file access control method according to the present invention, each value pair corresponds to a user attribute; the user attribute includes department, position and rank.

According to one aspect of the present invention, a file encryption method is provided, which is executed in a computing device, comprising the steps of: for each file directory, generating a polynomial based on a random algorithm, and encrypting the file directory based on a constant value of the polynomial ; Randomly generate a set of value pairs corresponding to the file directory according to the polynomial, and each set of value pairs includes a plurality of value pairs; determine one or more file directories that the user has permission to access according to the user identity, based on a or multiple sets of value pairs corresponding to multiple file directories to generate access credentials corresponding to user identities; and send the access credentials to the user, so that the user can access the corresponding one or more File Directory.

Optionally, in the file encryption method according to the present invention, the step of randomly generating a set of value pairs corresponding to the file directory according to the polynomial includes: randomly generating a plurality of random numbers; The polynomial computes corresponding value pairs to obtain a plurality of value pairs corresponding to the plurality of random numbers.

Optionally, in the file encryption method according to the present invention, the step of generating an access credential corresponding to the user identity includes: combining one or more sets of value pairs corresponding to one or more file directories based on a predetermined format , generate a corresponding data value, and use the data value as an access credential.

Optionally, in the file encryption method according to the present invention, encrypting the file directory based on the constant value of the polynomial includes: calculating the constant value of the polynomial, and calculating the hash value based on the hash calculation of the constant value Encrypt the file directory.

Optionally, in the file encryption method according to the present invention, each value pair corresponds to a user attribute; the user attribute includes department, position and rank.

According to an aspect of the present invention, there is provided a computing device, comprising: at least one processor; and a memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, the The above-mentioned program instructions include instructions for executing the above-mentioned file access control method.

According to one aspect of the present invention, a readable storage medium storing program instructions is provided, and when the program instructions are read and executed by a computing device, the computing device is made to execute the method described above.

According to the technical solution of the present invention, a file encryption method and a file access control method are provided, wherein each file directory is encrypted according to the file encryption method, and a corresponding set of value pairs is generated for each file directory , value pairs related to user attributes. According to one or more file directories that the user has permission to access, the user is distributed access credentials with corresponding permissions, and the access credentials include one or more sets of value pairs corresponding to the one or more file directories that the user has permission to access. In this way, by executing the file access control method, the user can decrypt one or more file directories based on the corresponding access credentials, thereby being able to access one or more file directories matching the user's identity. It can be seen that, according to the technical solution of the present invention, it is possible to control the access permissions of users with different identities to the file directory, and to realize data isolation between users with different identities.

In addition, by merging and mounting one or more file directories that users have permission to access to the same predetermined directory, users can view and modify files in all file directories corresponding to their identities in the same directory operation without switching to different directories to view files in different file directories. In this way, the effect of sorting out all file directories with permission for users with different identities is realized, which is conducive to improving the efficiency of users' viewing and operation of files, and the user experience is better.

Description of drawings

To the accomplishment of the foregoing and related ends, certain illustrative aspects are herein described, taken in conjunction with the following description and drawings, which are indicative of the various ways in which the principles disclosed herein may be practiced, and all aspects and their equivalents are intended to fall within the scope of within the scope of the claimed subject matter. The above and other objects, features and advantages of the present disclosure will become more apparent by reading the following detailed description in conjunction with the accompanying drawings. Like reference numerals generally refer to like parts or elements throughout this disclosure.

FIG. 1 shows a schematic diagram of a computing device 100 according to one embodiment of the present invention;

FIG. 2 shows a flowchart of a file encryption method 200 according to an embodiment of the present invention;

FIG. 3 shows a flowchart of a file access control method 300 according to an embodiment of the present invention; and

FIG. 4 and FIG. 5 respectively show schematic diagrams of data formats of access credentials according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

According to the technical solution of the present invention, each file directory is encrypted according to the file encryption method, and corresponding access credentials are distributed to users according to user identities. Furthermore, by executing the file access control method, the user can decrypt one or more file directories based on corresponding access credentials, so as to access one or more file directories matching the user's identity.

FIG. 1 is a schematic block diagram of an example computing device 100 .

As shown in FIG. 1 , in a basic configuration 102 , computing device 100 typically includes system memory 106 and one or more processors 104 . A memory bus 108 may be used for communication between the processor 104 and the system memory 106 .

Depending on the desired configuration, processor 104 may be any type of processing including, but not limited to, a microprocessor (UP), microcontroller (UC), digital information processor (DSP), or any combination thereof. Processor 104 may include one or more levels of cache such as L1 cache 110 and L2 cache 112 , processor core 114 and registers 116 . Exemplary processor core 114 may include an arithmetic logic unit (ALU), a floating point unit (FPU), a digital signal processing core (DSP core), or any combination thereof. An example memory controller 118 may be used with the processor 104 or, in some implementations, the memory controller 118 may be an internal part of the processor 104 .

Depending on the desired configuration, system memory 106 may be any type of memory including, but not limited to: volatile memory (such as RAM), non-volatile memory (such as ROM, flash memory, etc.), or any combination thereof. System memory 106 may include an operating system 120 , one or more applications 122 , and program data 124 . In some implementations, applications 122 may be arranged to execute instructions on an operating system with program data 124 by one or more processors 104 .

Computing device 100 also includes storage device 132 , which includes removable storage 136 and non-removable storage 138 .

Computing device 100 may also include storage interface bus 134 . Storage interface bus 134 enables communication from storage devices 132 (eg, removable storage 136 and non-removable storage 138 ) to base configuration 102 via bus/interface controller 130 . Operating system 120, applications 122, and at least a portion of data 124 may be stored on removable storage 136 and/or non-removable storage 138, and when computing device 100 is powered on or when applications 122 are about to be executed, the storage interface bus 134 into system memory 106 and executed by one or more processors 104 .

Computing device 100 may also include interface bus 140 to facilitate communication from various interface devices (eg, output devices 142 , peripheral interfaces 144 , and communication devices 146 ) to base configuration 102 via bus/interface controller 130 . Example output devices 142 include a graphics processing unit 148 and an audio processing unit 150 . They may be configured to facilitate communication with various external devices such as a display or speakers via one or more A/V ports 152 . Example peripherals interfaces 144 may include serial interface controller 154 and parallel interface controller 156, which may be configured to facilitate communication via one or more I/O ports 158 and input devices such as (e.g., keyboard, mouse, pen) , voice input device, touch input device) or other peripherals (such as printers, scanners, etc.) to communicate with external devices such as. An example communication device 146 may include a network controller 160, which may be arranged to facilitate communication with one or more other computing devices 162 over a network communication link via one or more communication ports 164.

A network communication link may be one example of a communication medium. Communication media typically embodies computer readable instructions, data structures, program modules in a modulated data signal such as a carrier wave or other transport mechanism and may include any information delivery media. A "modulated data signal" may be a signal in which one or more of its data sets or alterations thereof may be made in such a manner as to encode information in the signal. By way of non-limiting example, communication media may include wired media such as a wired or dedicated-line network, and various wireless media such as acoustic, radio frequency (RF), microwave, infrared (IR) or other wireless media. The term computer readable media as used herein may include both storage media and communication media.

Computing device 100 may be implemented as a personal computer including desktop and notebook computer configurations. Of course, the computing device 100 can also be implemented as part of a small-sized portable (or mobile) electronic device, such as a cellular phone, a digital camera, a personal digital assistant (PDA), a personal media player device, a wireless network browsing device, etc. , personal headsets, application-specific devices, or hybrid devices that can include any of the above. It can even be implemented as a server, such as a file server, database server, application program server, and WEB server. The embodiments of the present invention do not limit this.

In an embodiment according to the present invention, the computing device 100 is configured to execute the file encryption method 200 and/or the file access control method 300 according to the present invention. Wherein, the application 122 of the computing device 100 contains a plurality of program instructions for executing the file encryption method 200 and/or the file access control method 300 of the present invention, and these program instructions can be read and executed by the computing device 100, so that the computing device 100 executes the file encryption method 200 and the file access control method 300 according to the present invention.

Fig. 2 shows a flowchart of a file encryption method 200 according to an embodiment of the present invention. The method 200 is suitable for execution in a computing device, such as the aforementioned computing device 200 . It should be noted that, according to the technical solution of the present invention, each file directory is encrypted separately based on the file encryption method 200 .

As shown in FIG. 2 , the method 200 begins with step S210.

In step S210, for each file directory, when encrypting the file directory, a polynomial is generated based on a random algorithm, and the file directory is encrypted based on a constant value of the polynomial.

Here, the polynomial can be expressed as f(x), where f(x)=ax ^(n-1) +bx ^(n-2) ...+c. The constant value of the polynomial is the value of the polynomial when x=0, that is, the constant value f(0). In one embodiment, after the polynomial is randomly generated and the constant value f(0) of the random polynomial is calculated, the constant value f(0) can be hashed based on a hash function to obtain a hash value, and based on the constant The hash value corresponding to the value f(0) is used as the encryption key of the file directory to encrypt the file directory.

Subsequently, in step S220, a set of value pairs corresponding to the file directory is randomly generated according to the polynomial, and each set of value pairs includes a plurality of value pairs. It should be noted that each file directory corresponds to a set of value pairs, that is, each file directory corresponds to multiple value pairs. Different file directories correspond to different value pair groups, so that the file directory is encrypted based on the corresponding group of value pairs. Here, the present invention does not limit the number of value pairs included in each set of value pairs.

In one embodiment, multiple random numbers are randomly generated, and corresponding value pairs are obtained by calculating each random number with a polynomial. Specifically, the value of the polynomial f(x) is calculated by substituting each random number into the polynomial, and the value pair corresponding to the random number is obtained by combining the random number with the value of the corresponding polynomial. For example, if one of the random numbers is a, then the value pair corresponding to the random number a can be expressed as {a,f(a)}. In this way, a plurality of value pairs corresponding to a plurality of random numbers can be finally calculated, wherein each random number corresponds to a value pair.

Subsequently, in step S230, one or more file directories that the user has permission to access are determined according to the user identity. By determining a set of value pairs corresponding to each file directory, an access credential corresponding to the user identity is generated based on one or more sets of value pairs corresponding to one or more file directories that the user has permission to access.

It should be pointed out that, according to the technical solution of the present invention, the access credentials (one or more sets of value pairs) corresponding to each user are determined according to the user identity, and the access credentials also determine one or more authorized access credentials according to the user identity. File Directory. Therefore, one or more sets of value pairs in the user's access credentials are related to the user's identity and can prove the user's identity.

In an embodiment, each value pair corresponds to a user attribute, and the user attribute is an attribute that can be related to the user identity. It should be noted that, according to the technical solution of the present invention, the user identity can be determined by one or more user attributes, or in other words, the user identity is related to one or more user attributes. For example, the user attributes related to the user identity may include the user's department, position, rank, etc., but are not limited thereto.

It should be understood that when the attributes used to determine the user identity include the user's department, position, and rank, the user identity is related to the three user attributes of department, position, and rank. When generating access credentials corresponding to user identities, each user attribute is represented by a corresponding value pair, and access credentials are generated based on multiple value pairs corresponding to multiple user attributes, where each value pair represents a user attribute. In this way, the access credentials generated based on multiple value pairs are also access credentials related to user identities.

It can be understood that the number of value pairs included in each group of value pairs is equal to the number of types of user attributes related to the user identity. For example, when the user identity is related to the three user attributes of department, position and rank, a set of value pairs corresponding to each file directory is composed of three value pairs.

According to an embodiment, when generating an access credential corresponding to a user based on one or more sets of value pairs, one or more sets of value pairs corresponding to one or more file directories may be assembled and combined based on a predetermined format, to generate the corresponding data value, and use the data value as the access credential. Here, the present invention does not limit the specific data format of the data value corresponding to the access credential, which can be set by those skilled in the art according to actual needs.

FIG. 4 and FIG. 5 respectively show schematic diagrams of data formats of access credentials according to an embodiment of the present invention.

In one embodiment, generating access credentials based on one or more sets of value pairs may be performed according to the following method:

As shown in Figure 4, the first 4 bytes of the data are used to store the length of the random number x, followed by the value of the random number x, followed by the length of the corresponding polynomial f(x) value, in The polynomial f(x) value is stored after the length of the f(x) value. Each value pair is processed according to this rule, so that each value pair is combined until all value pairs corresponding to a polynomial (that is, a set of value pairs corresponding to a file directory) are processed, and the final value is set to 0. After all pairs of values corresponding to a polynomial are processed, hash calculation is performed on the data before the 0 value to obtain a hash value, and the hash value (Hash) is stored behind the 0 value for the key value Correctness verification and anti-brute force cracking.

As shown in Figure 5, for the combination of multiple sets of value pairs to generate access credentials, since the length of the Hash value is fixed, when a set of value pairs is processed, only the position of the fixed length can be determined to determine the next The starting position of the group-value pairs, and assemble and combine each group of value pairs according to the above method until all the value-pair groups are processed, and finally, based on the combination of multiple groups of value pairs, an access credential in a predetermined data format is obtained.

Finally, in step S240, the access credential is sent to the user, so that the user can access the corresponding one or more file directories based on the access credential. Here, the one or more file directories that can be accessed based on the access credentials are the one or more file directories that the user matching the user identity has permission to access.

Fig. 3 shows a flowchart of a file access control method 300 according to an embodiment of the present invention. Method 300 may be performed in computing device 100 .

It should be noted that by executing the file access control method 300 , the user may have access to one or more file directories corresponding to the user identity based on the access credentials obtained in the aforementioned method 200 . In this way, it is possible to control the access rights of users with different identities to the file directory.

As shown in FIG. 3 , the method 300 starts at step S310.

In step S310, the file access request sent by the user based on the access credential is received. Here, the access credential is the access credential distributed to the user based on the aforementioned method 200 and corresponding to the user identity, and the access credential is a data value obtained by combining one or more sets of value pairs.

In step S320, one or more sets of value pairs are obtained based on the access credentials. As mentioned above, each set of value pairs includes multiple value pairs, and each set of value pairs corresponds to a file directory that a user has permission to access.

According to one embodiment, corresponding to the method and data format of the access credentials generated based on multiple value pairs described above, when one or more sets of value pairs are obtained based on the access credentials, according to the reservation of the data value corresponding to the access credentials Format, starting from the starting position of the data value corresponding to the access credential, first obtain the predetermined byte as the length value of x, and then obtain the value of x stored after the length value, and then obtain the f stored after the value of x (x) value, so that the first set of value pairs is obtained. Furthermore, a second set of value pairs located after the first set of value pairs is acquired. By analogy, finally, multiple value pairs included in multiple sets of value pairs can be obtained from the data value corresponding to the access credential.

Subsequently, in step S330, the corresponding file directory is decrypted according to each set of value pairs, so as to obtain one or more decrypted file directories corresponding to the user's access credentials. It should be understood that the decrypted file directory is the file directory that the user has permission to access.

According to one embodiment, after one or more sets of value pairs are acquired, before the corresponding file directory is decrypted according to each set of value pairs, each set of value pairs is also verified, so as to determine the value of each set of value pairs. effectiveness. Specifically, according to the method and data format of the access credentials generated based on multiple value pairs described above, when verifying the access credentials, based on the hash function, the 0 value and the data in front of the 0 value (a group of value pairs) multiple value pairs) to get the H value by hash calculation, and then compare the H value calculated here with the hash value in the access credential data value, if the two are equal, the verification is passed, according to the value pair Multiple value pairs in the group perform decryption processing on the corresponding file directory.

According to one embodiment, when decrypting the corresponding file directory according to each set of value pairs, firstly calculate each set of value pairs according to the Lagrangian interpolation algorithm to obtain the constant value corresponding to each set of value pairs f(0). Furthermore, the corresponding file directory is decrypted based on the constant value f(0) corresponding to each group of value pairs, so as to obtain the decrypted file directory corresponding to each group of value pairs. In this way, the user can access the decrypted one or more file directories based on the access credentials.

It should also be pointed out that, corresponding to the method for encrypting the file directory described above, in step S330, when decrypting the corresponding file directory based on the corresponding constant value f(0) of each group of values, in fact , the constant value f(0) may be hashed based on a hash function to obtain a hash value, and then the file directory may be decrypted based on the hash value corresponding to the constant value f(0).

Finally, in step S340, the one or more decrypted file directories are merged and mounted to a predetermined directory, so that the user can access the one or more decrypted file directories under the predetermined directory. It should be pointed out that the present invention does not limit the predetermined directory for merging and mounting, as long as it is a file directory that is convenient for users to view. For example, the predetermined directory can be implemented as a user directory.

In one embodiment, by mounting the stack file system in the predetermined directory, one or more decrypted file directories can be combined and mounted to the predetermined directory based on the stack file system. Here, the stacked file system can be realized as AUFS, for example. However, the present invention does not limit the specific types of stacked file systems, and all stacked file systems in the prior art that can merge and mount multiple file directories into the same directory are within the protection scope of the present invention.

It should be noted that by merging and mounting one or more file directories that the user has access to under the same predetermined directory, the user can view the files in all file directories corresponding to his identity in the same directory. File modification operations without switching to different directories to view files in different file directories. In this way, the effect of sorting out all the file directories with permission for users with different identities is achieved, which is conducive to improving the efficiency of viewing and operating files by users, and the user experience is better.

In summary, according to the file encryption method 200 of the present invention, each file directory is encrypted separately, and a corresponding set of value pairs is generated for each file directory, and the value pairs are related to user attributes. According to one or more file directories that the user has permission to access, the user is distributed access credentials with corresponding permissions, and the access credentials include one or more sets of value pairs corresponding to the one or more file directories that the user has permission to access. In this way, by executing the file access control method 300 of the present invention, the user can decrypt one or more file directories based on the corresponding access credentials, so as to access one or more file directories matching the user's identity. It can be seen that, according to the technical solution of the present invention, it is possible to control the access permissions of users with different identities to the file directory, and to realize data isolation between users with different identities.

The various techniques described herein can be implemented in conjunction with hardware or software, or a combination thereof. Thus, the method and device of the present invention, or certain aspects or parts of the method and device of the present invention may be embedded in a tangible medium, such as a removable hard disk, USB flash drive, floppy disk, CD-ROM or any other machine-readable storage medium In the form of program code (ie, instructions) in a machine such as a computer, when the program is loaded into a machine such as a computer and executed by the machine, the machine becomes an apparatus for practicing the invention.

In the case of program code execution on a programmable computer, the computing device generally includes a processor, a storage medium readable by the processor (including volatile and non-volatile memory and/or storage elements), at least one input device, and at least one output device. Wherein, the memory is configured to store program code; the processor is configured to execute the method for identifying multilingual garbage text of the present invention according to instructions in the program code stored in the memory.

Readable media include, by way of example and not limitation, readable storage media and communication media. Readable storage media store information such as computer readable instructions, data structures, program modules or other data. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. Combinations of any of the above are also included within the scope of readable media.

In the description provided herein, the algorithms and displays are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used with examples of the invention. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will understand that the modules or units or components of the devices in the examples disclosed herein may be arranged in the device as described in this embodiment, or alternatively may be located in a different location than the device in this example. in one or more devices. The modules in the preceding examples may be combined into one module or furthermore may be divided into a plurality of sub-modules.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

Furthermore, some of the described embodiments are described herein as a method or combination of method elements that may be implemented by a processor of a computer system or by other means for performing the described function. Thus, a processor with the necessary instructions for carrying out the described method or element of a method forms a means for carrying out the method or element of a method. Furthermore, elements described herein of an apparatus embodiment are examples of means for carrying out the function performed by the element for the purpose of carrying out the invention.

As used herein, unless otherwise specified, the use of ordinal numbers "first," "second," "third," etc. to describe generic objects merely means referring to different instances of similar objects and is not intended to imply such The described objects must have a given order temporally, spatially, sequentially or in any other way.

While the invention has been described in terms of a limited number of embodiments, it will be apparent to a person skilled in the art having the benefit of the above description that other embodiments are conceivable within the scope of the invention thus described. In addition, it should be noted that the language used in the specification has been chosen primarily for the purpose of readability and instruction rather than to explain or define the inventive subject matter. Accordingly, many modifications and alterations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the appended claims. With respect to the scope of the present invention, the disclosure of the present invention is intended to be illustrative rather than restrictive, and the scope of the present invention is defined by the appended claims.

Claims (12)

A file access control method, executed in a computing device, comprising the steps of: Receive the user's access request to the file based on the access credential; Obtain one or more sets of value pairs based on the access credentials, each set of value pairs includes a plurality of value pairs, and each set of value pairs corresponds to a file directory; Decrypt the corresponding file directory according to each set of value pairs to obtain one or more decrypted file directories corresponding to the user's access credentials; and Merge and mount the one or more decrypted file directories to a predetermined directory, so that the user can access the one or more decrypted file directories under the predetermined directory. The method according to claim 1, wherein the step of merging and mounting the one or more decrypted file directories to a predetermined directory comprises: Mount the stacked file system in a predetermined directory, so as to merge and mount one or more decrypted file directories to the predetermined directory based on the stacked file system. The method according to claim 1, wherein, according to each set of values, the step of decrypting the corresponding file directory comprises: Each set of value pairs is calculated separately according to the Lagrangian interpolation algorithm to obtain a constant value corresponding to each set of value pairs; The corresponding file directory is decrypted based on the constant value corresponding to each group of value pairs, so as to obtain the decrypted file directory corresponding to each group of value pairs. The method according to any one of claims 1-3, wherein, before decrypting the corresponding file directory according to each set of values, comprising the steps of: Validation is performed on each set of value pairs. The method according to any one of claims 1-3, wherein, Each value pair corresponds to a user attribute; The user attributes include one or more of department, position, and rank. A file encryption method, executed in a computing device, comprising the steps of: For each file directory, a polynomial is generated based on a random algorithm, and the file directory is encrypted based on a constant value of the polynomial; Randomly generate a set of value pairs corresponding to the file directory according to the polynomial, each set of value pairs includes a plurality of value pairs; Determine one or more file directories that the user has permission to access based on the user identity, and generate access credentials corresponding to the user identity based on one or more sets of value pairs corresponding to the one or more file directories; and Sending the access credential to the user, so that the user can access the corresponding one or more file directories based on the access credential. The method according to claim 6, wherein the step of randomly generating a set of value pairs corresponding to the file directory according to the polynomial comprises: Randomly generate multiple random numbers; A corresponding value pair is obtained based on each random number and the polynomial calculation, so as to obtain a plurality of value pairs corresponding to the plurality of random numbers. The method of claim 6, wherein the step of generating an access credential corresponding to a user identity comprises: Combining one or more sets of value pairs corresponding to one or more file directories based on a predetermined format to generate a corresponding data value, and using the data value as an access credential. The method according to any one of claims 6-8, wherein encrypting the file directory based on a polynomial constant value comprises: The constant value of the polynomial is calculated, and the file directory is encrypted based on the hash value obtained after performing hash calculation on the constant value. The method according to any one of claims 6-8, wherein, Each value pair corresponds to a user attribute; The user attributes include one or more of department, position, and rank. A computing device comprising: at least one processor; and A memory storing program instructions, wherein the program instructions are configured to be executed by the at least one processor, and the program instructions include instructions for performing any one of claims 1-5 and/or 6-10 Directives for the methods described in Item . A readable storage medium storing program instructions, when the program instructions are read and executed by a computing device, the computing device is made to execute any one of claims 1-5 and/or 6-10 method.

Images