CN115150185A - Method and device for controlling user directory and authority based on multiple passwords - Google Patents

Method and device for controlling user directory and authority based on multiple passwords Download PDF

Info

Publication number
CN115150185A
CN115150185A CN202210879970.8A CN202210879970A CN115150185A CN 115150185 A CN115150185 A CN 115150185A CN 202210879970 A CN202210879970 A CN 202210879970A CN 115150185 A CN115150185 A CN 115150185A
Authority
CN
China
Prior art keywords
file system
user
password
client
server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202210879970.8A
Other languages
Chinese (zh)
Inventor
邵隆鹏
孙勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Eastcom Software Technology Co ltd
Original Assignee
Hangzhou Eastcom Software Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Eastcom Software Technology Co ltd filed Critical Hangzhou Eastcom Software Technology Co ltd
Priority to CN202210879970.8A priority Critical patent/CN115150185A/en
Publication of CN115150185A publication Critical patent/CN115150185A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0846Network architectures or network communication protocols for network security for authentication of entities using passwords using time-dependent-passwords, e.g. periodically changing passwords
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10File systems; File servers
    • G06F16/18File system types
    • G06F16/182Distributed file systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10File systems; File servers
    • G06F16/18File system types
    • G06F16/188Virtual file systems
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

The invention relates to a method and a device for controlling user directories and authorities based on multiple passwords, wherein the method comprises the following steps: the server receives user names and passwords sent from a client, and acquires root directories and authorities corresponding to the user name and password combinations from a database, wherein one user name corresponds to at least one password, different user name and password combinations correspond to different root directories and authorities, and the user name and password combinations have a Time To Live (TTL) value; the server side constructs a virtual file system according to the root directory and the authority, and establishes connection between the virtual file system and a distributed file system; the server maps the command received from the client from the virtual file system to the distributed file system for execution, and returns the execution result to the client.

Description

Method and device for controlling user directory and authority based on multiple passwords
Technical Field
The invention relates to the field of user authority management, in particular to a method and a device for controlling a user directory and authority based on multiple passwords.
Background
The account system of the existing FTP/SFTP (File Transfer Protocol, SSH File Transfer Protocol) server mostly adopts one of the following two methods: one is binding with a user and a password of an operating system, and the other is setting a fixed virtual account number. Both of these methods have a number of disadvantages, including: the password is not supported to be automatically expired; the coexistence of multiple passwords is not supported, the smooth transition cannot be supported by modifying the passwords, the immediate effectiveness of new passwords and the expiration and invalidation of old passwords cannot be met; the directory and authority isolation of the user is not realized through multiple passwords; if the account needs to be added, deleted or the password needs to be modified one by one, the account passwords of all FTP/SFTP servers are not supported to be modified by one key and take effect in real time.
Disclosure of Invention
The invention aims to provide a method and a device for controlling a user directory and authority based on multiple passwords, and aims to meet the requirements that the user needs multiple passwords of the same account number, the user can isolate the directory and the authority through the passwords, the passwords are smoothly modified and transited, all server passwords are modified by one key and take effect in real time, and the like.
In a first aspect, a method for controlling user directories and permissions based on multiple passwords is provided, and is applied to a user file system, where the user file system includes a client, a server, a virtual file system, a distributed file system, and a database, and the method includes:
the server receives user names and passwords sent from a client, and acquires root directories and authorities corresponding to the user name and password combinations from a database, wherein one user name corresponds to at least one password, different user name and password combinations correspond to different root directories and authorities, and the user name and password combinations have a Time To Live (TTL) value;
the server side constructs a virtual file system according to the root directory and the authority, and establishes connection between the virtual file system and a distributed file system;
the server maps the command received from the client from the virtual file system to the distributed file system for execution, and returns the execution result to the client.
In a possible implementation, the server is an FTP or SFTP server.
In one possible implementation, at least 2 FTP or SFTP servers are reverse-proxied using a Nginx server and virtual IP technology.
In a possible embodiment, the cryptographic encryption is stored in the database.
In one possible embodiment, the encrypted storage uses the MD5 or RSA encryption algorithm.
In one possible embodiment, the database is a Redis database.
In one possible embodiment, the distributed file system is a Hadoop distributed file system or a simple storage service S3.
In a second aspect, an apparatus for controlling user directories and permissions based on multiple passwords is provided, including:
the receiving unit is used for receiving user names and passwords sent from a client side, and acquiring root directories and authorities corresponding to combinations of the user names and the passwords in a database, wherein one user name corresponds to at least one password, different user name and password combinations correspond to different root directories and authorities, and the user name and password combinations have Time To Live (TTL) values;
the system construction unit is used for constructing a virtual file system according to the root directory and the authority and establishing the connection between the virtual file system and the distributed file system;
and the execution unit is used for mapping the command received from the client to the distributed file system from the virtual file system for execution and returning an execution result to the client.
The method and the device for controlling the user directory and the user right based on the multi-password have the following advantages that: 1. automatic expiration of the password: each password may be set with TTL (Time To Live value) until the Time expires automatically. 2. Coexistence of multiple passwords: one user can take effect a plurality of passwords at the same time, and each password may be provided with a validity period. When the password needs to be modified, a validity period can be set for the old password, the old password is automatically expired, and the new password is immediately valid. 3. Password-based directory and rights isolation: each password can be provided with different directories and permissions so as to achieve the purpose of isolating the directories and the permissions through a plurality of passwords under one account. 4. The account password modification key takes effect: the account password is modified by one key, and all FTP/SFTP servers take effect in real time.
Drawings
FIG. 1 is a flowchart of a method for controlling user directories and permissions based on multiple passwords according to an embodiment of the present invention;
FIG. 2 is a diagram of a system architecture according to an embodiment of the present invention;
FIG. 3 is a timing diagram of one embodiment of the present disclosure;
fig. 4 is a schematic block diagram of an apparatus for controlling user directories and permissions based on multiple passwords according to an embodiment of the present invention.
Detailed Description
The technical solution of the present invention is further described in detail by the accompanying drawings and embodiments.
Fig. 1 is a flowchart of a method for controlling user directories and permissions based on multiple passwords according to an embodiment of the present invention.
In step S101, after the user inputs a user name and a password through the FTP/SFTP protocol at the client, the server receives the user name and the password sent from the client, and dynamically obtains a root directory and a right corresponding to a combination of the user name and the password in the database. If the acquisition is successful, the login is successful; if the corresponding information is not acquired or is expired, the login fails.
In step S102, after the root directory and the authority of the user are obtained, the server builds a virtual file system according to the root directory and the authority, and establishes a connection between the virtual file system and the distributed file system.
Specifically, the distributed File System may be an HDFS (Hadoop distributed File System) or an S3 (Simple Storage Service proposed by amazon cloud). The Virtual File System is similar to a VFS (Virtual File System) of the Linux System, and can operate different distributed File systems using a uniform File interface. The system also has a path mapping function for mapping operations at the virtual file system to a specified path of a different distributed system. And a JAVA file system interface is used as the specification of the virtual file system to realize the adaptation of the HDFS and S3 of the distributed file system.
In step S103, the server maps the command received from the client from the virtual file system to the distributed file system for execution, and returns the execution result to the client.
Specifically, the server sets a path of the root path corresponding to the actual file system according to directory information of a user, sets and generates a permission directory tree according to permission information of the user, the user sees the virtual file system after logging in, and after submitting operation executed by the user to the FTP/SFTP server, the user judges permission according to the directory tree and then operates according to the corresponding path in the actual file system.
If the actual directories corresponding to the root directories set by different passwords are different, after login is performed by using different passwords, the contents seen are different even if the virtual file system enters the same directory, and the directory corresponds to different directories in the actual file system, so that directory isolation is realized.
If the actual directories corresponding to the root directories are set to be the same by different passwords but different authorities are set, after each password is used for logging in, the authorities of the directories such as entering, uploading and downloading can be set to be different, and therefore authority isolation is achieved.
The whole system records key operation information of user login, logout, upload, download and other operations, transmits the key operation information to the database, and then uniformly collects the key operation information of the user, thereby effectively monitoring and managing the user behavior and analyzing the user behavior.
Fig. 2 is a system architecture diagram according to an embodiment of the present invention.
The user management module is used for maintaining user name and password information, encrypting and storing the passwords, wherein each user name and each password have a corresponding directory and authority, and the directory of a certain actual distributed file system is set as a root directory. Different combinations of the user name and the password correspond to different root directories and authorities, and TTL is set to maintain the validity period of the user name and the password.
Specifically, the encryption algorithm for the password may be an MD5, RSA, or like encryption algorithm.
When the database stores, the combination of each user name and the password is used as a record, so that the same user name can correspond to a plurality of passwords.
Specifically, the database uses Redis as a storage medium, a user name and an encrypted password combination are used as a key, a root path and authority are combined into one JSON to be stored as a value in Redis, and TTL is set.
In an example, when a user creates a new combination of a user name and a password, the system will combine the user name and the encrypted password into a key, combine a JSON with a root path and authority set by the user as values, store the key-value pair in Redis, and set TTL, for example, to 3 days. Within 3 days, the user can log in the system by using the user name and the password, enter the corresponding file path, have the corresponding authority and execute the command. After 3 days, redis will automatically clear the key, after clearing, the FTP/SFTP server will not inquire the key corresponding to the combination of the user name and the password, and when the user tries to log in again by using the group of the user name and the password, the system will prompt that the login fails.
In another example, when a user creates a new user name and password combination, the system will combine the user name and the encrypted password into a key, combine a root path and authority correspondingly set by the user into a JSON as a value, store the key-value pair into Redis, and query and verify all FTP/SFTP servers by using the user name and password, thereby implementing one-key account addition. After the user deletes the key from Redis, all FTP/SFTP servers cannot inquire the user name and the password and cannot log in, so that the account can be deleted by one key. And the user deletes the old key from the Redis, adds the new key consisting of the old user name and the new password and the corresponding value of the directory and the authority, so that all FTP/SFTP servers cannot inquire the old password and can immediately inquire the new password, thereby realizing the password modification by one key.
And a high-performance and high-availability proxy scheme is used for proxying a plurality of FTP/SFTP servers, and the user can realize the non-aware login of the FTP/SFTP multi-server, wherein the FTP protocol only proxies the control port.
Specifically, a Nginx server and virtual IP technology are used for acting, virtual IP can automatically fail over among a plurality of servers, and a user uses a client to specify proxy ports of FTP/SFTP servers on the virtual IP and the Nginx for login, logout and other operations.
The virtual file system is a similar concept to the VFS of the Linux system, and can operate different distributed file systems using a uniform file interface.
The high performance high consistency distributed file system may select either HDFS or S3.
FIG. 3 is a timing diagram of one embodiment of the present disclosure.
After a user inputs a user name and a password at an FTP/SFTP client, the user name and the password are sent to an FTP/SFTP server, the FTP/SFTP server forms a key by the user name and the encrypted password, a corresponding value is inquired in a Redis database, and after the inquiry is successful, a corresponding root directory and an authority list are returned.
And the FTP/SFTP server side constructs a virtual file system according to the root directory and the authority list, is connected with the distributed file system, and returns login success information to the FTP/SFTP client side after the connection is successful.
The user sends a command to be executed at the FTP/SFTP client, here, the ls command is taken as an example, to query the file list information. And after receiving the ls command, the FTP/SFTP server end executes the ls command in the virtual file system, and after combining the root path and the user path, the virtual file system executes the ls command in the corresponding distributed file system. The distributed file system returns the file list information to the virtual file system, and then the file list information is returned to the FTP/SFTP client by the FTP/SFTP server, and the command execution is finished.
The user sends a log-out command at the FTP/SFTP client, the FTP/SFTP server sends a closing command to the virtual file system after receiving the log-out command, and the virtual file system disconnects the connection between the virtual file system and the distributed file system and returns closing completion information to the FTP/SFTP server. And after receiving the information, the FTP/SFTP server returns login success information to the FTP/SFTP client, and the login is successful.
Fig. 4 is a schematic block diagram of an apparatus for controlling user directories and permissions based on multiple passwords according to an embodiment of the present invention. The apparatus 400 comprises a receiving unit 401, a system construction unit 402 and an execution unit 403.
The receiving unit 401 receives user names and passwords sent from a client, and obtains root directories and permissions corresponding to combinations of the user names and the passwords from a database, wherein one user name corresponds to at least one password, different combinations of the user names and the passwords correspond to different root directories and permissions, and the combinations of the user names and the passwords have a Time To Live (TTL);
the system construction unit 402 constructs a virtual file system according to the root directory and the authority, and establishes a connection between the virtual file system and a distributed file system;
the execution unit 403 maps the command received from the client from the virtual file system to the distributed file system for execution, and returns the execution result to the client.
The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only examples of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.

Claims (8)

1. A method for controlling user directories and permissions based on multiple passwords is applied to a user file system, wherein the user file system comprises a client, a server, a virtual file system, a distributed file system and a database, and the method is characterized by comprising the following steps:
the method comprises the steps that a server receives user names and passwords sent from a client, and root directories and authorities corresponding to combinations of the user names and the passwords are obtained in a database, wherein one user name corresponds to at least one password, different user name and password combinations correspond to different root directories and authorities, and the user name and password combinations have a Time To Live (TTL) value;
the server side constructs a virtual file system according to the root directory and the authority, and establishes connection between the virtual file system and a distributed file system;
the server maps the command received from the client from the virtual file system to the distributed file system for execution, and returns the execution result to the client.
2. The method of claim 1, wherein the server is an FTP or SFTP server.
3. The method of claim 2, wherein at least 2 FTP or SFTP servers are reverse-proxied using a Nginx server and a virtual IP technology.
4. The method of claim 1, wherein the cryptographic encryption is stored in the database.
5. The method of claim 4, wherein the encrypted storage uses an MD5 or RSA encryption algorithm.
6. The method of claim 1, wherein the database is a Redis database.
7. The method of claim 1, wherein the distributed file system is a Hadoop distributed file system or a Simple Storage Service (Simple Storage Service).
8. An apparatus for controlling user directories and permissions based on multiple passwords, comprising:
the receiving unit is used for receiving user names and passwords sent from a client side, and acquiring root directories and authorities corresponding to combinations of the user names and the passwords in a database, wherein one user name corresponds to at least one password, different user name and password combinations correspond to different root directories and authorities, and the user name and password combinations have Time To Live (TTL) values;
the system construction unit is used for constructing a virtual file system according to the root directory and the authority and establishing the connection between the virtual file system and the distributed file system;
and the execution unit is used for mapping the command received from the client into the distributed file system from the virtual file system for execution and returning an execution result to the client.
CN202210879970.8A 2022-07-25 2022-07-25 Method and device for controlling user directory and authority based on multiple passwords Pending CN115150185A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210879970.8A CN115150185A (en) 2022-07-25 2022-07-25 Method and device for controlling user directory and authority based on multiple passwords

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210879970.8A CN115150185A (en) 2022-07-25 2022-07-25 Method and device for controlling user directory and authority based on multiple passwords

Publications (1)

Publication Number Publication Date
CN115150185A true CN115150185A (en) 2022-10-04

Family

ID=83414655

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210879970.8A Pending CN115150185A (en) 2022-07-25 2022-07-25 Method and device for controlling user directory and authority based on multiple passwords

Country Status (1)

Country Link
CN (1) CN115150185A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116866335A (en) * 2023-08-21 2023-10-10 北京和德宇航技术有限公司 Data transmission system and method

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101187930A (en) * 2007-12-04 2008-05-28 浙江大学 Distribution type file system dummy directory and name space implementing method
CN103400067A (en) * 2013-03-29 2013-11-20 青岛海信电器股份有限公司 Access control method, system and server
CN103581196A (en) * 2013-11-13 2014-02-12 上海众人网络安全技术有限公司 Distributed file transparent encryption method and transparent decryption method
CN107870734A (en) * 2016-09-27 2018-04-03 苏宁云商集团股份有限公司 The exchange method and device of a kind of distributed file system
CN110401529A (en) * 2019-07-23 2019-11-01 南瑞集团有限公司 A kind of cipher management method
US20190392053A1 (en) * 2018-06-22 2019-12-26 Microsoft Technology Licensing, Llc Hierarchical namespace with strong consistency and horizontal scalability
CN111740822A (en) * 2020-06-17 2020-10-02 中国银行股份有限公司 Batch updating method and device for user passwords of distributed system
US20200356557A1 (en) * 2019-05-08 2020-11-12 Atlassian Pty Ltd External data repository file integration using a virtual file system
CN112068780A (en) * 2020-09-10 2020-12-11 国家卫星气象中心(国家空间天气监测预警中心) Data unified management system based on heterogeneous storage
US20210294778A1 (en) * 2020-03-19 2021-09-23 Sun Yat-Sen University Small-file storage optimization system based on virtual file system in kubernetes user-mode application
CN114117376A (en) * 2022-01-28 2022-03-01 蘑菇物联技术(深圳)有限公司 Identity authentication method, method for distributing dynamic password and corresponding equipment

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101187930A (en) * 2007-12-04 2008-05-28 浙江大学 Distribution type file system dummy directory and name space implementing method
CN103400067A (en) * 2013-03-29 2013-11-20 青岛海信电器股份有限公司 Access control method, system and server
CN103581196A (en) * 2013-11-13 2014-02-12 上海众人网络安全技术有限公司 Distributed file transparent encryption method and transparent decryption method
CN107870734A (en) * 2016-09-27 2018-04-03 苏宁云商集团股份有限公司 The exchange method and device of a kind of distributed file system
US20190392053A1 (en) * 2018-06-22 2019-12-26 Microsoft Technology Licensing, Llc Hierarchical namespace with strong consistency and horizontal scalability
US20200356557A1 (en) * 2019-05-08 2020-11-12 Atlassian Pty Ltd External data repository file integration using a virtual file system
CN110401529A (en) * 2019-07-23 2019-11-01 南瑞集团有限公司 A kind of cipher management method
US20210294778A1 (en) * 2020-03-19 2021-09-23 Sun Yat-Sen University Small-file storage optimization system based on virtual file system in kubernetes user-mode application
CN111740822A (en) * 2020-06-17 2020-10-02 中国银行股份有限公司 Batch updating method and device for user passwords of distributed system
CN112068780A (en) * 2020-09-10 2020-12-11 国家卫星气象中心(国家空间天气监测预警中心) Data unified management system based on heterogeneous storage
CN114117376A (en) * 2022-01-28 2022-03-01 蘑菇物联技术(深圳)有限公司 Identity authentication method, method for distributing dynamic password and corresponding equipment

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
李嘉丽等: "一种应用系统的FTP账户密码保护方法", 《科技信息》, no. 33, 30 November 2011 (2011-11-30), pages 106 - 108 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116866335A (en) * 2023-08-21 2023-10-10 北京和德宇航技术有限公司 Data transmission system and method
CN116866335B (en) * 2023-08-21 2024-04-16 北京和德宇航技术有限公司 Data transmission system and method

Similar Documents

Publication Publication Date Title
US11449596B2 (en) Event-based user state synchronization in a local cloud of a cloud storage system
US9596233B1 (en) Management and authentication in hosted directory service
WO2018095416A1 (en) Information processing method, device and system
US20170286695A1 (en) Methods for Improving Performance and Security in a Cloud Computing System
EP1926245B1 (en) Method and system for obtaining ssh host key of managed device
US20020023126A1 (en) Systems and methods for application service provision
US9887978B2 (en) System and method for centralized configuration and authentication
WO2019074474A1 (en) Domain join
JP7280260B2 (en) Propagation of information by network nodes
WO2012129468A1 (en) System and method for sharing data from a local network to a remote device
CN106844489A (en) A kind of file operation method, device and system
CN115150185A (en) Method and device for controlling user directory and authority based on multiple passwords
CN105183402B (en) Date storage method
CN106713300A (en) WEBDAV (Web-based Distributed Authoring and Versioning) based general file sharing system and method
CN114238879A (en) Data processing method and device
KR101395830B1 (en) Session checking system via proxy and checkhing method thereof
CN112818401A (en) Block chain health file management system
KR102146914B1 (en) Blockchain-based firmware management system
Presley et al. Hydra--A Federated Data Repository over NDN
CN112039910B (en) Method, system, equipment and medium for unified management of authentication and authority
US20130111004A1 (en) File manager having an HTTP-based user interface
CN114650144B (en) File sharing method and system based on blockchain, electronic equipment and storage medium
CN205430310U (en) Data storage device
Biondo et al. IBM DS8880 and Z/OS DFSMS: Transparent Cloud Tiering
CN113381915B (en) Method, device, equipment and medium for interconnection of internal and external networks of campus

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination