WO2017080381A1

WO2017080381A1 - Method for processing cross-domain data, first server and second server

Info

Publication number: WO2017080381A1
Application number: PCT/CN2016/104053
Authority: WO
Inventors: 何健飞
Original assignee: 华为技术有限公司
Priority date: 2015-11-10
Filing date: 2016-10-31
Publication date: 2017-05-18
Also published as: CN106685901B; CN106685901A

Abstract

Disclosed are a method for processing cross-domain data, a first server and a second server. The method comprises: a first server receiving a first data operation request sent by a user, and determining a target domain of the first data operation request as an autonomous domain of a second server according to a digital object identifier included in the first data operation request; the first server deleting a user token included in the first data operation request to obtain a second data operation request; and the first server sending the second data operation request to the second server. The present invention can achieve processing of data between users belonging to different service providers.

Description

Method for processing cross-domain data, first server and second server

This application claims priority on Chinese patent application filed on November 10, 2015, the Chinese Patent Office, application number CN201510760330.5, and the invention titled "Method for processing cross-domain data, first server and second server" The entire content of which is incorporated herein by reference.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method for processing cross-domain data, a first server, and a second server.

Background technique

Currently, information obtained by users through the Internet or published data belongs to private data that other users cannot obtain. Users can share data through some service providers that provide information distribution. In other words, the data generated by the user is controlled by the service provider that is capable of data sharing. The service provider uses the control of the data or information published by the user to form the autonomous domain of the service provider. Inter-access is prohibited between the autonomous domains of different service providers, that is, users belonging to the first service provider cannot access data of other users in the autonomous domain of the second service provider.

Summary of the invention

The present invention provides a method for processing cross-domain data, a first server, and a second server, which are capable of processing data between users belonging to different service providers.

A first aspect provides a method for processing cross-domain data, the method comprising: receiving, by a first server, a first data operation request sent by a user, where the first server is configured to provide an access service to a user, where The first data operation request is for requesting processing of the digital object, the first data operation request including the token of the user and the identifier of the digital object; the first server operates according to the first data operation request Determining the identifier of the digital object, determining that the target domain of the first data operation request is an autonomous domain of the second server; the first server deleting the first number Obtaining a second data operation request according to the token of the user included in the operation request, the second data operation request includes an identifier of the digital object; and the first server sends the second data operation to a second server request.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the first data operation request further includes an identifier of the user, the method further includes: the first server operating according to the first data Determining an identifier of the digital object that is included, determining that a target domain of the first data operation request is an autonomous domain of the first server; the first server according to a correspondence, a token of the user, and the user And determining that the user has passed the authentication, where the correspondence includes the token of the user and the identifier of the user; the first server obtains the operation authority of the digital object according to the identifier of the user, the number The object operation authority is an operation authority of the first server to a digital object related to the user; the first server processes the digital object according to the digital object operation authority and the identifier of the digital object.

With reference to the first aspect, or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, before the first server receives the first data operation request sent by the user, the method The method further includes: the first server receiving an access request sent by the user, the access request is used to request to obtain a token, and the access request includes an identifier of the user; Determining, by the user, the user belongs to an autonomous domain of the first server; the first server authenticates the user; and the first server determines that the user sends an authentication to the user after passing the authentication The token of the user corresponding to the identifier of the user.

The first server authenticates the user, and the authentication method can be, but is not limited to, decrypting the user's digital signature through the user's public key to complete the authentication.

With reference to the first aspect, or the first possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, before the first server receives the first data operation request sent by the user, the method The method further includes: the first server receiving an access request sent by the user, the access request is used to request to obtain a token, and the access request includes an identifier of the user; An identifier of the user, determining that the user does not belong to an autonomous domain of the first server; the first server requests a third server to authenticate the user; the first server determines After the user authenticates by the third server, the user sends a token of the user corresponding to the identifier of the user to the user.

With reference to the first aspect to any one of the possible implementations of the third possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the digital object is stored in the fourth server The virtual digital object, the first server processing the digital object according to the digital object operation authority and the identifier of the digital object, comprising: the first server acquiring a location pointer according to the identifier of the digital object The location pointer is used to indicate that the fourth server stores an address of the digital object; the first server acquires the digital object from the fourth server according to the location pointer; the first server is configured according to the The digital object operates the authority to process the digital object.

The digital object can be a virtual digital object stored on the fourth server.

The virtual digital object has a unique identifier. The content of the virtual digital object is not actually stored in the first server, but is a location pointer for indicating that the first server obtains the address of the content of the virtual digital object.

With reference to any one of the possible implementation manners of the second aspect of the first aspect, the fourth possible implementation manner of the first aspect, in the fifth possible implementation manner of the first aspect, the identifier of the digital object The digital server includes the digital object group identifier; the first server processes the digital object according to the digital object operation authority and the identifier of the digital object, including: the first server operating authority and the The digital object group identifier is processed for each member of the digital object group identifier.

In a second aspect, a method for processing cross-domain data is provided, the method comprising: receiving, by a second server, a data operation request sent by a first server, the data operation request for requesting processing of a digital object, The data operation request includes an identifier of the digital object and an identifier of the user, the autonomous domain of the second server is a target domain of the data operation request, and the second server requests the third server to authenticate the user; After the second server determines that the user is authenticated by the third server, obtains a digital object operation authority according to the identifier of the user in the data operation request, where the digital object operation authority is the second server. Pair with the user An operation authority of the associated digital object; the second server processes the digital object according to the digital object operation authority and the identifier of the digital object.

The third server is a server for authenticating the user, and the third server is a domain corresponding to the user, and is a domain in which the user can obtain the user identifier by registering, that is, the registration domain allocates the user identifier to the user. The second server obtains the registration domain of the user according to the identifier of the user, and obtains the address of the third server corresponding to the registration domain, for example, the IP address of the third server. The second server may request the third server to authenticate the user.

With reference to the second aspect, in a first possible implementation manner of the second aspect, after the second server requests the third server to authenticate the user, the method further includes: the second server determining After the user authenticates by the third server, the user sends a token of the user corresponding to the identifier of the user to the user.

In conjunction with the second aspect or the first possible implementation of the second aspect, in a second possible implementation of the second aspect, the digital object is a virtual digital object stored in a fourth server, the second Processing, by the server, the digital object according to the digital object operation authority and the identifier of the digital object, the second server acquiring a location pointer according to the identifier of the digital object, where the location pointer is used to represent the location The fourth server stores an address of the digital object; the second server acquires the digital object from the fourth server according to the location pointer; and the second server operates the authority according to the digital object The digital object is processed.

In a third aspect, a first server is provided, where the first server is configured to provide an access service to a user, and the first server includes: a receiving unit, configured to receive a first data operation request sent by a user, where a first data operation request for requesting processing of the digital object, the first data operation request including the token of the user and an identifier of the digital object; and a determining unit, configured to include, according to the first data operation request The identifier of the digital object, the target domain of the first data operation request is determined to be an autonomous domain of the second server, and the execution unit is configured to delete the token of the user included in the first data operation request, and obtain a second data operation request, the second data operation request includes an identifier of the digital object, and a sending unit, configured to send the second data operation request to the second server.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the first data operation request further includes an identifier of the user, and the determining unit is further configured to be included according to the first data operation request Determining, by the identifier of the digital object, that the target domain of the first data operation request is an autonomous domain of the first server; the first server further includes: an obtaining unit, configured to use, according to the correspondence, the user's order a card and an identifier of the user, after determining that the user has passed the authentication, obtaining a digital object operation authority according to the identifier of the user, where the correspondence includes the token of the user and the identifier of the user, the number The object operation authority is an operation authority of the first server to the digital object related to the user; the execution unit is further configured to: according to the digital object operation authority and the identifier of the digital object, the digital object Process it.

With the third aspect or the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the receiving unit is further configured to receive an access request sent by the user, where The access request is used to request to obtain a token, and the access request includes an identifier of the user, and the determining unit is further configured to determine, according to the identifier of the user, that the user belongs to the first server. The execution unit is further configured to authenticate the user, and the sending unit is further configured to: after the user passes the authentication, send the user that is corresponding to the identifier of the user to the user. Token.

With the third aspect or the first possible implementation manner of the third aspect, in a third possible implementation manner of the third aspect, the receiving unit is further configured to receive an access request sent by the user, where The access request is used to request to obtain a token, and the access request includes an identifier of the user, and the determining unit is further configured to determine, according to the identifier of the user, that the user does not belong to the first server. An execution unit, configured to request a third server to authenticate the user, where the sending unit is further configured to: after determining that the user is authenticated by the third server, send the user to the user The token of the user corresponding to the identifier of the user.

With reference to any one of the possible implementations of the third aspect to the third possible implementation of the third aspect, in a fourth possible implementation of the third aspect, the digital object is stored in the fourth server a virtual digital object; the execution unit, specifically configured to acquire a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores the number An address of the object; acquiring the digital object from the fourth server according to the location pointer; processing the digital object according to the digital object operation authority.

With reference to any one of the possible implementation manners of the fourth to third aspects of the third aspect, in a fifth possible implementation manner of the third aspect, the identifier of the digital object The digital object group identifier is included; and the executing unit is configured to process each member in the digital object group identifier according to the digital object operation authority and the digital object group identifier.

According to a fourth aspect, a second server is provided, the second server includes: a receiving unit, configured to receive a data operation request sent by the first server, where the data operation request is used to request processing of the digital object, The data operation request includes an identifier of the digital object, and an identifier of the user, the autonomous domain of the second server is a target domain of the data operation request, and an execution unit is configured to request the third server to authenticate the user; a obtaining unit, configured to determine, after the user is authenticated by the third server, obtain a digital object operation authority according to the identifier of the user in the digital operation request, where the digital object operation authority is the second server pair The operation authority of the digital object related to the user; the execution unit is further configured to process the digital object according to the digital object operation authority and the identifier of the digital object.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the second server further includes: a sending unit, configured to determine, after the user is authenticated by the third server, the user Sending a token of the user corresponding to the identity of the user.

With reference to the fourth aspect, or the first possible implementation manner of the fourth aspect, in a second possible implementation manner of the fourth aspect, the digital object is a virtual digital object stored in a fourth server, the execution unit Specifically, the method is configured to obtain a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object, and obtain, according to the location pointer, a location from the fourth server. a digital object; processing the digital object according to the digital object operation authority.

A fifth aspect provides a first server, where the first server is configured to provide an access service to a user, where the first server includes: an interface, a processor, and a memory storing the program code. The processor reads the instruction corresponding to the program code from the memory, and performs the following operations according to the read instruction:

Receiving, by the interface, a first data operation request sent by a user, the first data operation request for requesting processing of a digital object, the first data operation request including the user's token and the digital object Identification

Determining, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the second server; deleting the user of the first data operation request a token, obtaining a second data operation request, the second data operation request including an identifier of the digital object;

And transmitting, by the interface, the second data operation request to the second server.

In conjunction with the fifth aspect, in a first possible implementation manner of the fifth aspect, the processor is further configured to:

Determining, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the first server;

Determining, according to the correspondence, the token of the user, and the identifier of the user, that the user has obtained the digital object operation authority according to the identifier of the user after the user has passed the authentication, where the correspondence includes the token of the user and The identifier of the user, the digital object operation authority is an operation authority of the first server to a digital object related to the user;

The digital object is processed according to the digital object operation authority and the identifier of the digital object.

With reference to the fifth aspect, or the first possible implementation manner of the fifth aspect, in a second possible implementation manner of the fifth aspect, the processor is further configured to:

Receiving, by the interface, an access request sent by the user, where the access request is used to request to obtain a token, where the access request includes an identifier of the user; and determining the user according to the identifier of the user An autonomous domain that belongs to the first server; authenticates the user; and after determining that the user passes the authentication, sends the token of the user corresponding to the identifier of the user to the user through the interface.

With reference to the fifth aspect, or the first possible implementation manner of the fifth aspect, in a third possible implementation manner of the fifth aspect, the processor is further configured to:

Receiving, by the interface, an access request sent by the user, where the access request is used to request to obtain a token, where the access request includes an identifier of the user; and determining the user according to the identifier of the user An autonomous domain that does not belong to the first server;

Requesting a third server to authenticate the user;

After the user is authenticated by the third server, the token of the user corresponding to the identifier of the user is sent to the user through the interface.

With reference to any one of the fifth possible implementation manners of the fifth aspect to the fifth aspect, in a fourth possible implementation manner of the fifth aspect, the digital object is stored in the fourth server Virtual digital object;

The processor is configured to acquire a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object, and according to the location pointer, from the The four servers acquire the digital object; the digital object is processed according to the digital object operation authority.

With reference to any one of the possible implementation manners of the fourth to fifth aspects of the fifth aspect, in a fifth possible implementation manner of the fifth aspect, the identifier of the digital object The digital object group identifier is included; the processor is specifically configured to process, by the first server, each member in the digital object group identifier according to the digital object operation authority and the digital object group identifier.

In a sixth aspect, a second server is provided, the second server includes an interface, a processor, and a memory storing the program code, and the processor reads an instruction corresponding to the program code from the memory, and performs the following operations:

Receiving, by the interface, receiving, by the first server, a data operation request, where the data operation request is for processing a digital object, where the data operation request includes an identifier of the digital object and an identifier of the user, where the The autonomous domain of the second server is the target domain of the data operation request;

Requesting a third server to authenticate the user;

Determining, after the user is authenticated by the third server, obtaining a digital object operation authority according to the identifier of the user in the data operation request, where the digital object operation authority is related to the second server pair The operation authority of the digital object;

With reference to the sixth aspect, in a first possible implementation manner of the sixth aspect, the processor is further configured to determine, after the user is authenticated by the third server, Sending a token of the user corresponding to the identity of the user.

With reference to the sixth aspect, or the first possible implementation manner of the sixth aspect, in a second possible implementation manner of the sixth aspect, the digital object is a virtual digital object stored in a fourth server, where the processor Specifically, the method is configured to obtain a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object, and obtain, according to the location pointer, a location from the fourth server. The digital object processes the digital object according to the digital object operation authority.

The first server receives the first data operation request sent by the user, and determines that the target domain of the first data operation request is the autonomous domain of the second server according to the identifier of the digital object included in the first data operation request. A server deletes the token of the user included in the first data operation request, obtains a second data operation request, and the first server sends a second data operation request to the second server. After determining that the user requesting data processing is not the server in the autonomous domain of the first server, the first server sends an operation request to the second server corresponding to the target domain of the user, and the operation request of the second server to the user By processing, it is possible to process data between users belonging to different service providers.

DRAWINGS

FIG. 1 is a flowchart of a method for processing cross-domain data according to Embodiment 1 of the present invention.

FIG. 2 is a schematic structural diagram of a digital object according to Embodiment 1 of the present invention.

FIG. 3 is a flowchart of a method for processing cross-domain data according to Embodiment 1 of the present invention.

4 is a flowchart of a method for processing cross-domain data according to Embodiment 2 of the present invention.

FIG. 5 is a schematic diagram of a first server according to Embodiment 3 of the present invention.

FIG. 6 is a schematic diagram of a second server according to Embodiment 3 of the present invention.

FIG. 7 is a schematic diagram of a first server according to Embodiment 3 of the present invention.

FIG. 8 is a schematic diagram of a second server according to Embodiment 3 of the present invention.

detailed description

For the problem that mutual access is prohibited between the autonomous domains of different service providers that are normally existed, that is, the users belonging to the first service provider cannot access the data of other users in the autonomous domain of the second service provider, and the technical solution proposed by the present invention is Receiving, by the server, the first data operation request sent by the user, determining, according to the identifier of the digital object included in the first data operation request, the target domain of the first data operation request is an autonomous domain of the second server, and the first server deletes the first data operation The token of the included user is requested to obtain a second data operation request, and the first server sends a second data operation request to the second server. After determining that the user requesting data processing is not the server in the autonomous domain of the first server, the first server sends the operation request to the second server corresponding to the target domain of the user, and the second server processes the operation request of the user. It is possible to process data between users belonging to different service providers.

The main implementation principles, specific implementation manners, and the corresponding beneficial effects that can be achieved by the technical solutions of the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

In the technical solution proposed by the embodiments of the present invention, according to the implementation manner of the data storage and the data operation, the domain is divided into different domains, including an access domain, a registration domain, a target domain, and a forwarding domain. The access domain is the first domain connected when the user accesses the digital object. If the user does not have roaming access, the access domain and the registration domain of the user are the same domain. If the roaming access occurs, the roaming access can be obtained through the obtained access domain. User experience. The registration domain is the domain in which the user can obtain the user ID by registering, that is, the registration domain assigns the user ID to the user. The process of creating and exiting a user in a domain, determined by each domain The implementation may be created or exited, for example, by a web portal of a different service provider, or by a client program of the domain or the like. When a user creates a success in a certain domain, a digital object corresponding to the user is generated in the domain, and the digital object may include some information used by the user for authentication, for example, but may include, but not limited to, a public key. The target domain refers to the target involved in an operation, that is, the domain in which the digital object to be operated is located, for example, a server that stores the digital object to be operated. Forwarding a domain means that when an operation request is received, the domain is neither an access domain nor a target domain. It is only used to send the received data operation request to the target domain, or forward the received access request to the registration domain.

In the embodiment provided by the present invention, the data operation request may be any operation for requesting creation, deletion, modification, and reading of the digital object, which is not exemplified herein.

The various types of domains described above are logical classifications that are distinguished from a single operational perspective of a single user. In a specific implementation, the functions of the various types of domains described above are implemented simultaneously to implement various operations on different digital objects for different users.

Embodiment 1

A first embodiment of the present invention provides a method for processing cross-domain data. As shown in FIG. 1 , the specific processing flow of the method is as follows:

11. The user sends a first data operation request.

The first data operation request is used to request processing of the digital object, and the first data operation request includes the token of the user and the identifier of the digital object.

The processing of digital objects can be, but is not limited to, including operations such as creating, deleting, and reading digital objects. As shown in FIG. 2, it is a schematic diagram of a digital object composition according to an embodiment of the present invention. The digital object includes an identifier of the digital object, and an attribute of the digital object corresponding to the identifier of the digital object. The identification of the digital object uniquely identifies the digital object. Each digital object can have one or more attributes, and the attributes of the digital object can be constructed by a key-value pair. In the properties of a digital object, the functional type of the key can be used to represent various permissions of the digital object, which can be the size of the digital object. Wherein, if the key is a variety of permissions for representing the digital object, the permission may be an access right, a processing right, or the like. Each data operation request for a digital object corresponds to A permission. In the attribute of the digital object, the value may be a user identifier that identifies the user's authority to perform a corresponding operation on the digital object. As an example, a detailed description assumes that the identifier of the digital object is AAAA, and the key-value pair corresponding to AAAA is the access right-user A, and the user whose user identifier is user A can access the digital object. Correspondingly, in the attributes of the digital object, the value can also be an operation right, such as reading, deleting, or modifying permissions.

In the attribute of the digital object, the attribute corresponding to the identifier of the digital object may also be the size of the digital object corresponding to the identifier of the digital object, and the size of the digital object may be identified by a key. For example, if a key is a size and the corresponding value is 1024 (the default is byte), the size of the digital object corresponding to the identifier of the digital object is 1024 bytes.

In the attribute of the digital object, the value of the key in the attribute corresponding to the identifier of the digital object may also be the identifier of another digital object. For example, the identifier of the digital object is AAAA, and its corresponding value is BBBB. In the technical solution proposed by the embodiments of the present invention, some of the keys corresponding to the identifiers of the digital objects may be set to be unique, so as to avoid the problem of misunderstanding when interworking between different service domains. Some of the keys can be set to be generic, and some of the keys can be set to be defined by a specific application. This key- and value-based approach defines the properties of the digital object, providing flexibility and extensibility.

The identifier of the digital object can be represented by a domain name, and the domain name to which the digital object belongs can be determined by the domain name. For example, if the identifier of the digital object is: URI: AAAAA.com/pic1, it can be determined that the registration domain of the digital object pic1 is AAAAA.com.

In the technical solution proposed in the first embodiment of the present invention, the first data operation request is used to delete the digital object for the user as an example. This example will continue to be used later.

The user sends a first data operation request to the first server, the first data operation request for requesting deletion of the digital object whose digital object is identified as AAAA.

12. The first server receives the first data operation request sent by the user.

The first server is configured to provide an access service to the user, and the first server corresponds to the access domain.

13. The first server determines, according to the identifier of the digital object included in the first data operation request, whether the target domain of the first data operation request is an autonomous domain of the first server, and if the determination result is no, Execute 14, if the judgment result is yes, execute 17.

The first server obtains an identifier of the digital object in the first data operation request, and determines, according to the identifier of the digital object, whether the target domain of the first data operation request is an autonomous domain of the first server.

The first server obtains the identifier of the digital object as AAAA, and determines, according to the AAAA, whether the target domain of the first data operation request is an autonomous domain of the first server.

The first server determines, according to the identifier of the digital object included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the second server, and the first server obtains the identifier of the digital object in the first data operation request. And determining, according to the identifier of the digital object, that the target domain of the received first data operation request is an autonomous domain of the second server, and executing 15.

In the above 14, the first server determines that the digital object AAAA is stored in the autonomous domain of the second server based on the identifier AAAA of the digital object.

15. The first server deletes the token of the user included in the first data operation request, and obtains a second data operation request.

The second data manipulation request includes an identification of the digital object. For example, the second data operation request includes AAAA.

The first server deletes the token of the user included in the first data operation request, and can better protect the privacy data between the user and the user, thereby improving the security of the data access.

Optionally, the second data operation request may further include an identifier of the user, where the identifier of the user corresponds to the token of the user.

For example, if the identity of the user is BBB, the second data operation request includes AAAA-BBB.

16. The first server sends a second data operation request to the second server.

The first server receives the first data operation request, and when the first server sends the second data operation request to the second server, may maintain an upstream (ie, the first) based on the session ID defined in the handle system protocol. Server) The correspondence between the session ID and the downstream (ie, the second server) session ID. After receiving the response message from the downstream, it can be forwarded to the corresponding upstream until it is returned to the user who sent the first data operation request.

The first server determines, according to the identifier of the digital object included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the first server, and the first server is based on the correspondence, the token of the user, and the identifier of the user. , to determine that the user has passed the certification.

The correspondence includes the token of the authenticated user and the identity of the authenticated user. The first server determines that the correspondence includes the user's token and the user's identity, and determines that the user has passed the authentication.

When the user first registers, the user is provided with a registered server, for example, the server is the first server, and the first server corresponds to the registration domain, and the first server allocates the identity and user of the authenticated user to the registered user. The token, correspondingly, stores the correspondence between the identity of the authenticated user and the token of the user in the registration domain. Subsequently, when determining whether the user is a user who passes the authentication, the first server according to the correspondence between the identifier of the user obtained in the first data operation request and the token of the user, and the identifier of the authenticated user and the user of the user are maintained. The correspondence between the tokens is compared. If the comparison results are consistent, it is determined that the user passes the authentication. Otherwise, it is determined that the user has not passed the authentication.

18. The first server obtains the operation authority of the digital object according to the identifier of the user.

The digital object operation authority is the operation authority of the first server to the digital object related to the user.

19. The first server processes the digital object according to the digital object operation authority and the identifier of the digital object.

In the above 17 to 19, the target domain of the first data operation request is an autonomous domain of the first server, and the first server acquires the token in the received first data operation request, according to the stored token and the user identifier. Corresponding relationship, after obtaining the token and the identifier of the user, determining that the user has passed the authentication, and then obtaining the operation authority of the user corresponding to the identifier of the user according to the identifier of the user. If the user has rights to the digital object corresponding to the first data operation request, the first server processes the digital object according to the first data operation request. On the other hand, if the user does not have the right corresponding to the first data operation request for the digital object, the first server refuses to process the digital object according to the first data operation request.

Alternatively, the digital object may also be a virtual digital object stored at the fourth server.

The virtual digital object has a unique identifier. The content of the virtual digital object is not actually stored in the first server, but is a location pointer indicating where the first server can obtain the content of the virtual digital object. The virtual digital object may be the address of any one of the servers, and the address of the server may be an IP address, a MAC address, or the like. The first server processes the digital object according to the digital object operation authority and the identifier of the digital object, including:

The first server acquires a location pointer according to the identifier of the digital object, and the first server acquires the digital object from the fourth server according to the location pointer, and the first server processes the digital object according to the operation authority of the digital object. Wherein, the location pointer is used to indicate that the fourth server stores the address of the digital object.

Optionally, before the first server receives the first data operation request sent by the user, as shown in FIG. 3, the method may further include:

30. The user sends an access request.

The user can send an access request through a web portal or a client program, and the access request is used to request to obtain a token, and the access request includes the identifier of the user. The access request is described as an example of a login request, and the login request will continue to be used later. The login request contains the ID of the user. The ID of the user is exemplified by the user ID.

In the handle protocol, add a new operator (Op_Code): OC_Login, and the corresponding response character (ResponseCode): RC_Login. When a user sends a Login request, the Login request carries the operator OC_Login, and the Login request body carries the user ID.

31. The first server receives an access request sent by the user.

32. The first server determines, according to the identifier of the user, whether the user belongs to the autonomous domain of the first server. If the determination result is yes, execute 33, and if the determination result is negative, perform 35.

The first server determines, according to the user ID, whether the user is an autonomous domain belonging to the first server, for example, when the user ID of the autonomous domain of the first server is represented by a domain name, for example, URI: AAAAA.com/jeffrey, The domain of the user jeffrey is determined to be AAAAA.com.

33. The first server determines, according to the identifier of the user, that the user belongs to an autonomous domain of the first server, and the first server authenticates the user.

The first server authenticates the user, and the authentication method can be, but is not limited to, decrypting the user's digital signature through the user's public key to complete the authentication. For example, the user can be authenticated using the procedure defined in RFC3651. The processing flow is as follows: the first server sends a challenge to the user; the user receives the challenge; the client-side client program or other program for access The user's private key encrypts the challenge to form a digital signature and returns it to the first server. The first server receives the digital signature sent by the user side. The first server decrypts the received digital signature by using the user's public key, and compares the decrypted challenge with the transmitted challenge. If they are consistent, the user is considered to be authenticated, and vice versa, the user does not pass the authentication.

34. The first server determines, after the user passes the authentication, sends a token of the user corresponding to the identifier of the user to the user.

If the authentication is passed, the first server sends a token bound to the user to the user, and the message sent by the user carrying the token will be trusted by the first server as a message from the user.

A specific embodiment is an extended handle system protocol: a new response symbol (ResponseCode): RC_Login, in the body of the message, carrying a token (Token), the token can be a fixed-length random string. At the same time, in the first server, the correspondence between the identifier of a user and the token is maintained.

35. The first server determines, according to the identifier of the user, that the user does not belong to the autonomous domain of the first server, and the first server requests the third server to authenticate the user.

36. The third server receives the authentication request sent by the first server.

37. The third server authenticates the user.

The third server is a server for authenticating the user, and the third server corresponds to the registration domain of the user, and is a domain in which the user can obtain the user identifier by registering, that is, the registration domain allocates the user identifier to the user. The first server determines, according to the identifier of the user, that the user does not belong to the autonomous domain of the first server, and the first server obtains the registration domain of the user according to the user ID (user ID), and obtains the address of the third server corresponding to the registration domain, for example, Three server IP addresses, etc.

The first server requests the third server to authenticate the user, wherein an embodiment of the third server authenticating the user may be an extension implementation based on the RFC3652 handle protocol. The specific processing flow is as follows: The third server sends a challenge challenge to the user. The user receives the challenge. The client side client program or other program for access encrypts the challenge using the user's private key to form a digital signature and returns it to the third server. For example, the extended handle system protocol is based on the challenge-response verification-request and challenge-response verification-response processes defined in Section 3.5.3 of RFC3652. The message operator OC_Code: challenge-response auth-request is added, except in the message body. In addition to the challenge and Challenge Response (user's digital signature) of the current challenge-response verification-request operation, the user ID is carried and sent to the third server through the handle protocol. The third server receives the digital signature sent by the user side. The third server decrypts the received digital signature by using the user's public key, and compares the decrypted challenge with the transmitted challenge. If they are consistent, the user is considered to be authenticated, and vice versa, the user does not pass the authentication.

38. The third server sends the authentication result to the first server.

The third server carries the authentication result to the first server by using the newly added message operator OC_Code: challenge-response auth-response.

39. The first server receives the authentication result sent by the third server.

40. The first server determines, after the user authenticates by the third server, sends a token of the user corresponding to the identifier of the user to the user.

The first server sends a token bound to the user to the user, and the subsequent message sent by the user carries the token, and the first server may use the token in the message carrying the token and the message carrying the token. The identity of the user in the user to authenticate the user.

In the above technical solution, the digital object may be a single digital object or a group digital object. Wherein, when the digital object is a digital object group, the digital object group has a unique ID, and the digital object group includes a member list, which may be specific data in the member list, or may be an identifier of another one or more digital objects.

In the technical solution proposed by the second embodiment of the present invention, the operations on the digital object include various operations on the content of the digital object itself and the attributes of the digital object, which may include, but are not limited to, operations of creating, deleting, and reading digital objects. . For digital objects of database type, for digital objects Row operations include the user performing operations on the records in the digital object, such as adding, deleting, modifying, and viewing.

When the first server processes the digital object according to the digital object operation authority and the identifier of the digital object, if the user involved is the user group, the first server performs the identifier of the user in each of the received first data operation requests. It is identified that, if it is the identifier of the user group, the first server obtains the IDs of all member users in the user group and corresponding information, such as the communication address of the member, and sends an authentication message to each member user. When the first server processes the digital object according to the digital object operation authority and the identifier of the digital object, if the digital object involved is a digital object group, all operations on the digital object group are implemented to the digital object group. Among the members. For example, if a group of digital objects is being read, the first server will read each member of the group of digital objects. Give an example to elaborate on the above:

Assume that the identity of the user group is BBB, and the members of the user group include B1, B2, and B3. The first server processes the digital object according to the digital object operation authority and the identifier of the digital object. If the user involved is a user group, in this case, the first server pair needs to separately belong to the members B1, B2, and B3 of the user group. The authentication is performed and the authentication messages are sent to B1, B2, and B3, respectively. It is assumed that B1 and B2 are authenticated and B3 is not authenticated. When the member of the user group contains the member B3 that fails the authentication, the user group corresponding to the BBB of the user group is not authenticated. Otherwise, all members of the user group B1. When both B2 and B3 pass the authentication, it is determined that the user group passes the authentication, which can better improve the security of the system. In an embodiment, when the authentication of the members of the user group is completed, it is assumed that B1 and B2 are authenticated, and B3 is not authenticated, and the digital objects may be processed by the authenticated B1 and B2.

Assume that the identity of the digital object group is CCCC and the members of the digital object group include C1, C2, and C3. The first server processes the digital object according to the digital object operation authority and the identifier of the digital object. If the digital object involved is the digital object group CCCC, all operations on the digital object group are implemented to the digital object group. Among the members. For example, if the CCCC is read, the first server will read C1, C2, and C3, respectively.

Embodiment 2

The second embodiment of the present invention provides a method for processing cross-domain data. For convenience of description, in the technical solution proposed by the second embodiment of the present invention, the server distinguishes, as shown in FIG. 4, the processing flow is as follows:

40. The first server sends a data operation request.

41. The second server receives a data operation request sent by the first server.

Wherein, in the above 40 to 41, the data operation request is for requesting processing of the digital object, and the data operation request includes the identifier of the digital object and the identifier of the user. The autonomous domain of the second server is the target domain of the data operation request.

42, the second server obtains the identity of the user in the data operation request.

43. The second server requests the third server to authenticate the user.

44. The third server receives a request sent by the second server to authenticate the user.

45. The third server authenticates the user.

The third server is a server for authenticating the user, and the third server corresponds to the registration domain of the user, and is a domain in which the user can obtain the user identifier by registering, that is, the registration domain allocates the user identifier to the user.

Specific method of authentication: Extension based on the RFC3652 handle protocol. The second server receives the data operation request, and uses the user ID of the user in the data operation request to obtain the registration domain to which the user's identity belongs, thereby obtaining the information of the third server, such as the IP address of the third server. . Specifically, the second server uses the handle system protocol to complete the following process: the second server returns a challenge to the user. The user side encrypts the challenge using the user's private key to form a digital signature, and sends the constructed digital signature to the second server. The second server receives the digital signature. The second server sends the received digital signature to the third server. Among them, the extended handle system protocol, based on the challenge-response verification-request and challenge-response verification-response processes defined by RFC3652, newly added the message operator OC_Code: challenge-response auth-request, except for the current challenge-response verification- in the message body In addition to the challenge and ChallengeResponse of the request operation, the user ID and the App ID (optional) are passed through the handle protocol. Send to the third server. The third server receives the digital signature. The third server decrypts the received digital signature with the public key of the user, and checks with the challenge.

46. The third server sends the authentication result to the second server.

The third server carries the authentication result by the newly added message operator OC_Code: challenge-response auth-response and sends it to the second server.

47. The second server receives the authentication result sent by the third server.

In order to improve the efficiency of the authentication, the second server may obtain the public key of the user by querying the identifier of the user for the next use, but if the digital signature after the decryption of the public key is invalid, the user key may be changed. The second server still needs to authenticate the user through the third server.

48. The second server determines that the user obtains the digital object operation authority according to the identifier of the user after the third server is authenticated.

The digital object operation authority is an operation authority of the second server to the digital object related to the user.

49. The second server processes the digital object according to the digital object operation authority and the identifier of the digital object.

In the above method flow, as shown in the schematic diagram of the digital object shown in FIG. 2, the digital object includes an identifier of the digital object, and an attribute of the digital object corresponding to the identifier of the digital object. The identification of the digital object uniquely identifies the digital object. Each digital object can have one or more attributes, and the attributes of the digital object can be constructed by a key-value pair.

Further, in the key-value pair of the digital object, the extended field may also be used to represent the approved user, and the value in the extended field may be the identifier of one or more approved users. The identifier of the approval user is used to indicate that when the digital object needs to be operated, the approval user permission corresponding to the identifier of the approval user is required. After the user passes the authentication, the second server obtains the operation authority of the digital object, that is, checks the permission control attribute of the digital object, checks whether the user has the authority to perform the operation, and if the second object obtains the digital object operation authority, the user has performed the operation. Permission, but requires the consent of some users, that is, approval, the second server will send an approval application message before the operation of the digital object, and carry the corresponding in the approval application message. The operation request information, for example, the identifier of the user who applied for the operation, the approval application message may be sent to the extension field of the digital object, and the identification of the approval user corresponds to the approval user. If the user has the right to operate the digital object and obtain the approval of the approval user, the second server obtains the approval consent message sent by the approval user, and the second server determines the operation authority of the digital object and the identifier of the digital object. Digital objects are processed. If the user does not have permission to perform the operation, or does not get the consent of the approved user, the second server refuses to operate on the digital object. Give an example to elaborate:

It is assumed that the identifier of the first user is UE1, the identifier of the second user is UE2, and the identifier of the digital object is AAAA. In the extension field of the key-value pair of the digital object AAAA, the UE2 is included, and the UE1 sends a request to modify the digital object AAAA. The data operation request, Z, when the UE1 authentication is passed, the second server determines that the UE1 can modify the digital object AAAA, but the precondition for modifying the digital object AAAA needs to obtain the approval of the UE2, that is, after obtaining the permission of the UE2, The digital object AAAA can be modified. At this time, the second server sends an approval application message for requesting the approval of the UE2. The approval application message may include the identifier UE1 of the first user, and when the second user receives the approval application message, the first user is allowed to use the number. When the object is modified, the approval approval message is returned, and the second server performs modification on the digital object AAAA when receiving the approval consent message.

Optionally, after the foregoing second server requests the third server to authenticate the user, the method further includes:

After determining the user's authentication by the third server, the second server sends a token of the user corresponding to the identifier of the user to the user.

The digital object may be a virtual digital object stored in the fourth server, and the second server processes the digital object according to the digital object operation authority and the identifier of the digital object, including: the second server acquires the location pointer according to the identifier of the digital object, The second server acquires the digital object from the fourth server according to the location pointer, and the second server processes the digital object according to the digital object operation authority.

The location pointer is used to indicate that the fourth server stores the address of the digital object.

In the above technical solution, the digital object may be a single digital object or a group digital object. The digital object group has a unique ID, and the digital object group has a member list, and the member list may be specific data or an identifier of another digital object.

In the technical solution proposed by the second embodiment of the present invention, the operation of the digital object includes various operations on the content of the digital object itself and the attributes of the digital object, and may include, but is not limited to, operations such as creating, deleting, and reading the digital object. For numeric objects of the database type, operations on the digital object include the user performing operations on the records in the digital object, such as adding, deleting, modifying, and viewing.

When the second server processes the digital object according to the digital object operation authority and the identifier of the digital object, if the user involved is the user group, the second server identifies the identifier of the user in each data operation request received, If it is the identifier of the user group, the second server obtains the ID of all member users in the user group and corresponding information, such as the communication address of the member, and sends an authentication message to each member user. When the second server processes the digital object according to the digital object operation authority and the identifier of the digital object, if the digital object involved is a digital object group, all operations on the digital object group are implemented to the digital object group. Among the members. For example, if a group of digital objects is being read, the second server will read each member of the group of digital objects.

Embodiment 3

The third server of the present invention provides a first server. As shown in FIG. 5, the first server is configured to provide an access service to a user, where the first server includes:

The receiving unit 501 is configured to receive a first data operation request sent by the user, where the first data operation request is used to request processing on the digital object, where the first data operation request includes the user's token and the number The identity of the object.

The determining unit 502 is configured to determine, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the second server.

The executing unit 503 is configured to delete the token of the user included in the first data operation request, and obtain a second data operation request, where the second data operation request includes an identifier of the digital object.

The sending unit 504 is configured to send the second data operation request to the second server.

The first data operation request further includes an identifier of the user, and the determining unit is further configured to determine a target domain of the first data operation request according to the identifier of the digital object included in the first data operation request. Is the autonomous domain of the first server.

The first server further includes: an obtaining unit, configured to determine, according to the correspondence, the token of the user, and the identifier of the user, that the user has obtained the digital object operation authority according to the identifier of the user after the user has passed the authentication, The correspondence relationship includes a token of the user and an identifier of the user, and the digital object operation authority is an operation authority of the first server to a digital object related to the user.

The execution unit is further configured to process the digital object according to the digital object operation authority and the identifier of the digital object.

The receiving unit 501 is further configured to receive an access request sent by the user, where the access request is used to request to obtain a token, and the access request includes an identifier of the user; the determining unit 502, And is further configured to determine, according to the identifier of the user, that the user belongs to an autonomous domain of the first server; the executing unit 503 is further configured to perform authentication on the user; and the sending unit is further configured to determine After the user passes the authentication, the user's token corresponding to the identifier of the user is sent to the user.

The receiving unit 501 is further configured to receive an access request sent by the user, where the access request is used to request to obtain a token, and the access request includes an identifier of the user; the determining unit 502 And determining, according to the identifier of the user, that the user does not belong to the autonomous domain of the first server; the executing unit 503 is further configured to request the third server to authenticate the user; And determining, after the user is authenticated by the third server, sending a token of the user corresponding to the identifier of the user to the user.

Specifically, the digital object is a virtual digital object stored in the fourth server; the executing unit 503 is specifically configured to acquire a location pointer according to the identifier of the digital object, where the location pointer is used to represent the fourth The server stores an address of the digital object; the digital object is acquired from the fourth server according to the location pointer; and the number is determined according to the digital object operation authority Word objects are processed.

Specifically, the identifier of the digital object includes a digital object group identifier; the executing unit 503 is specifically configured to: each of the digital object group identifiers according to the digital object operation authority and the digital object group identifier Members handle it.

In the third embodiment of the present invention, each unit component included in the first server may be separately disposed in different devices, or may be collectively disposed in the same device, and the first server includes a receiving unit, a determining unit, an executing unit, and For a specific implementation principle of the sending unit, refer to the detailed description of the method for processing the cross-domain data in the foregoing Embodiment 1, and the third embodiment of the present invention is not described again.

The third embodiment of the present invention further provides a second server. As shown in FIG. 6, the second server includes:

The receiving unit 601 is configured to receive a data operation request sent by the first server, where the data operation request is used to request processing on the digital object, where the data operation request includes an identifier of the digital object, and an identifier of the user, The autonomous domain of the second server is the target domain of the data operation request.

The executing unit 603 is configured to request the third server to authenticate the user.

The obtaining unit 602 is configured to determine, after the user is authenticated by the third server, the digital object operation authority according to the identifier of the user in the operation request, where the digital object operation authority is the second server pair The operational authority of the user-related digital object.

The executing unit 603 is further configured to process the digital object according to the digital object operation authority and the identifier of the digital object.

The device further includes: a sending unit, configured to: after the user is authenticated by the third server, send a token of the user corresponding to the identifier of the user to the user.

The digital object is a virtual digital object stored in a fourth server, and the execution unit is configured to acquire a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores the An address of the digital object; acquiring the digital object from the fourth server according to the location pointer; processing the digital object according to the digital object operation authority.

In the third embodiment of the present invention, the units included in the second server may be separately disposed in different devices, or may be collectively disposed in the same device. For the specific implementation principles of the receiving unit, the obtaining unit, the executing unit, and the sending unit, the second embodiment of the present invention is not described in detail in the third embodiment of the present invention.

The embodiment of the present invention further provides a first server, as shown in FIG. 7, whose structural composition is as follows:

The first server includes an interface 701, a memory 702, and a processor 703. The interface 701, the memory 702, and the processor 703 are connected by a bus and transmit data through the bus. The processor 703 reads an instruction from the program stored in the memory 702 and performs the following operations:

Receiving, by the interface 701, a first data operation request sent by a user, where the first server is configured to provide an access service to the user, and the first data operation request is used to request processing of the digital object, where the first The data operation request includes the token of the user and an identifier of the digital object;

Determining, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the second server;

Deleting the token of the user included in the first data operation request, obtaining a second data operation request, where the second data operation request includes an identifier of the digital object;

The second data operation request is sent to the second server through the interface 701.

In the structural composition of the first server, the interface 701 is configured to perform the function of transmitting the first data operation request in 11 and 12 in the first embodiment. The processor 703 is configured to perform all the functions in the above-mentioned 13 to 19. Specifically, the specific implementation principles of the interface 701 and the processor 703 in the first server are described in detail in the foregoing Embodiment 1, and details are not described herein again.

The third embodiment of the present invention also proposes a second server, such as the structure shown in FIG. The second server includes an interface 801, a memory 802, and a processor 803. The processor 803 included in the second server can read out an instruction from a program stored in the memory 802, and performs the following operations:

Receiving, by the interface 801, a data operation request sent by the first server, where the data operation request is used to request processing, the data operation request includes an identifier of the digital object and an identifier of the user, The autonomous domain of the second server is the target domain of the data operation request;

Requesting a third server to authenticate the user;

After determining that the user is authenticated by the third server, obtaining a digital object operation authority according to the identifier of the user in the operation request, where the digital object operation authority is a number related to the user by the second server The operation authority of the object;

In the above-mentioned first server and second server proposed in the third embodiment of the present invention, the interface may be one or more of the following: a network interface controller (NIC) providing a wired interface, such as an Ethernet NIC, The Ethernet NIC can provide a copper wire and/or fiber interface; a NIC that provides a wireless interface, such as a wireless local area network (WLAN) NIC.

The memory may be a volatile memory such as a random-access memory (RAM) or a non-volatile memory such as a flash memory or a hard disk ( Hard disk drive (HDD) or solid-state drive (SSD); or a combination of the above types of memory

The processor can be a central processing unit (CPU) or a combination of a CPU and a hardware chip. The signal processor can also be a network processor (NP). Either a combination of CPU and NP, or a combination of NP and hardware chips.

The hardware chip may be a combination of one or more of the following: an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), and a complex programmable logic device (complex) Programmable logic device, CPLD).

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, apparatus (device), or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, read-only optical disks, optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus, and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Finally, it should be noted that the above embodiments are only used to exemplify the technical solutions of the present invention, and are not limited thereto; although the beneficial effects brought by the present invention and the present invention are described in detail with reference to the foregoing embodiments, the field It should be understood by those skilled in the art that the technical solutions described in the foregoing embodiments may be modified or equivalently replaced with some of the technical features; and such modifications or substitutions do not deviate from the essence of the corresponding technical solutions. The scope of the claims.

Claims

A method for processing cross-domain data, the method comprising:

The first server receives a first data operation request sent by the user, the first server is configured to provide an access service to the user, and the first data operation request is used to request processing of the digital object, the first data operation request Including a token of the user and an identification of the digital object;

Determining, by the first server, the target domain of the first data operation request as an autonomous domain of the second server according to the identifier of the digital object that is included in the first data operation request;

The first server deletes the token of the user included in the first data operation request, and obtains a second data operation request, where the second data operation request includes an identifier of the digital object;

The first server sends the second data operation request to the second server.
The method of claim 1, wherein the first data operation request further comprises an identifier of the user, the method further comprising:

Determining, by the first server, the target domain of the first data operation request as an autonomous domain of the first server according to the identifier of the digital object that is included in the first data operation request;

Determining, by the first server, that the user has passed the authentication according to the correspondence, the token of the user, and the identifier of the user, where the correspondence includes the token of the user and the identifier of the user;

The first server obtains a digital object operation authority according to the identifier of the user, and the digital object operation authority is an operation authority of the first server to a digital object related to the user;

The first server processes the digital object according to the digital object operation authority and the identifier of the digital object.
The method according to claim 1 or 2, wherein before the first server receives the first data operation request sent by the user, the method further includes:

Receiving, by the first server, an access request sent by the user, where the access request is used to request to obtain a token, where the access request includes an identifier of the user;

Determining, by the first server, that the user belongs to an autonomous domain of the first server according to the identifier of the user;

The first server authenticates the user;

After the first server determines that the user passes the authentication, the first server sends a token of the user corresponding to the identifier of the user to the user.
The method according to claim 1 or 2, wherein before the first server receives the first data operation request sent by the user, the method further includes:

Receiving, by the first server, an access request sent by the user, where the access request is used to request to obtain a token, where the access request includes an identifier of the user;

Determining, by the first server, that the user does not belong to an autonomous domain of the first server according to the identifier of the user;

The first server requests the third server to authenticate the user;

After the first server determines that the user is authenticated by the third server, the first server sends a token of the user corresponding to the identifier of the user to the user.
The method according to any one of claims 1 to 4, wherein said digital object is a virtual digital object stored in a fourth server, said first server operating authority according to said digital object and said digital object Identifying, processing the digital object includes:

Determining, by the first server, a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object;

The first server acquires the digital object from the fourth server according to the location pointer;

The first server processes the digital object according to the digital object operation authority.
The method according to any one of claims 2 to 5, wherein the identifier of the digital object comprises a digital object group identifier;

The first server processes the digital object according to the digital object operation authority and the identifier of the digital object, including:

The first server is configured according to the digital object operation authority and the digital object group identifier, Each member of the digital object group identification is processed.
A method for processing cross-domain data, the method comprising:

The second server receives a data operation request sent by the first server, where the data operation request is used to request processing of the digital object, where the data operation request includes an identifier of the digital object and an identifier of the user, where the second server The autonomous domain is the target domain of the data operation request;

The second server requests the third server to authenticate the user;

After the second server determines that the user is authenticated by the third server, obtains a digital object operation authority according to the identifier of the user in the data operation request, where the digital object operation authority is the second server. Operational authority to a digital object associated with the user;

The second server processes the digital object according to the digital object operation authority and the identifier of the digital object.
The method according to claim 7, wherein after the second server requests the third server to authenticate the user, the method further includes:

After the second server determines that the user is authenticated by the third server, the second server sends a token of the user corresponding to the identifier of the user to the user.
The method according to claim 7 or 8, wherein the digital object is a virtual digital object stored in a fourth server, and the second server is based on the digital object operation authority and the identifier of the digital object. Processing the digital object includes:

The second server acquires a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object;

The second server acquires the digital object from the fourth server according to the location pointer;

The second server processes the digital object according to the digital object operation authority.
A first server, wherein the first server is configured to provide an access service to a user, and the first server includes:

a receiving unit, configured to receive a first data operation request sent by a user, where the first data operation request is used to request processing on a digital object, where the first data operation request includes the user The token and the identifier of the digital object;

a determining unit, configured to determine, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the second server;

An execution unit, configured to delete a token of the user included in the first data operation request, to obtain a second data operation request, where the second data operation request includes an identifier of the digital object;

And a sending unit, configured to send the second data operation request to the second server.
The first server according to claim 10, wherein the first data operation request further comprises an identifier of the user;

The determining unit is further configured to determine, according to the identifier of the digital object that is included in the first data operation request, that the target domain of the first data operation request is an autonomous domain of the first server;

The first server further includes:

a obtaining unit, configured to obtain, according to the correspondence, the token of the user, and the identifier of the user, that the user has obtained the digital object operation authority according to the identifier of the user after the user has passed the authentication, where the correspondence includes the a token of the user and an identifier of the user, the digital object operation authority being an operation authority of the first server to a digital object related to the user;

The execution unit is further configured to process the digital object according to the digital object operation authority and the identifier of the digital object.
The first server according to claim 10 or 11, wherein the receiving unit is further configured to receive an access request sent by the user, where the access request is used to request to obtain a token, and the receiving The incoming request includes the identity of the user;

The determining unit is further configured to determine, according to the identifier of the user, that the user belongs to an autonomous domain of the first server;

The execution unit is further configured to authenticate the user;

The sending unit is further configured to: after the user passes the authentication, send the token of the user corresponding to the identifier of the user to the user.
The first server according to claim 10 or 11, wherein the receiving unit is further configured to receive an access request sent by the user, where the access request is used to request to obtain a token, The access request includes an identifier of the user;

The determining unit is further configured to determine, according to the identifier of the user, that the user does not belong to an autonomous domain of the first server;

The execution unit is further configured to request the third server to authenticate the user;

The sending unit is further configured to: after determining that the user is authenticated by the third server, send a token of the user corresponding to the identifier of the user to the user.
The first server according to any one of claims 10 to 13, wherein the digital object is a virtual digital object stored in a fourth server;

The execution unit is configured to acquire a location pointer according to the identifier of the digital object, where the location pointer is used to indicate that the fourth server stores an address of the digital object, and according to the location pointer, from the The four servers acquire the digital object; the digital object is processed according to the digital object operation authority.
The first server according to any one of claims 11 to 14, wherein the identifier of the digital object comprises a digital object group identifier;

The execution unit is specifically configured to process each member in the digital object group identifier according to the digital object operation authority and the digital object group identifier.
A second server, wherein the second server comprises:

a receiving unit, configured to receive a data operation request sent by the first server, where the data operation request is used to request processing on the digital object, where the data operation request includes an identifier of the digital object and an identifier of the user, and the second The autonomous domain of the server is the target domain of the data operation request;

An execution unit, configured to request the third server to authenticate the user;

a obtaining unit, configured to determine, after the user is authenticated by the third server, obtain a digital object operation authority according to the identifier of the user in the data operation request, where the digital object operation authority is the second server pair The operation authority of the digital object related to the user;

The execution unit is further configured to process the digital object according to the digital object operation authority and the identifier of the digital object.
A second server according to claim 16 wherein said second server is further include:

And a sending unit, configured to: after the user is authenticated by the third server, send a token of the user corresponding to the identifier of the user to the user.
The second server according to claim 16 or 17, wherein the digital object is a virtual digital object stored in a fourth server, and the executing unit is configured to acquire a location according to the identifier of the digital object. a pointer, the location pointer is used to indicate that the fourth server stores an address of the digital object; according to the location pointer, the digital object is obtained from the fourth server; according to the digital object operation authority, The digital object is processed.