WO2017028517A1

WO2017028517A1 - Method for managing data file in cloud, cloud management point, and system

Info

Publication number: WO2017028517A1
Application number: PCT/CN2016/074317
Authority: WO
Inventors: 翟征德; 申宇
Original assignee: 华为技术有限公司
Priority date: 2015-08-18
Filing date: 2016-02-23
Publication date: 2017-02-23
Also published as: CN106469281B; CN106469281A

Abstract

The present invention provides a method for managing a data file in cloud, a cloud management point, and a system. The method comprises: a first server calculates a file identifier of a data file to be processed currently, and sends the file identifier to a cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier; the first server receives the file protection policy returned by the cloud management point; the first server determines, according to the file protection policy, whether the data file allows the first server to execute processing; and if yes, the first server processes the data file to be processed currently. In the present invention, multiple duplicate files generated from a source data file adopt a file protection policy the same as that of the source data file, and therefore, when an unauthorized user in the prior art accesses a duplicate file, the access of the duplicate file is also protected by the file protection policy, thereby preventing data leakage.

Description

Method for managing data files in cloud, cloud management point and system

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method for managing data files in a cloud, a cloud management point, and a system.

Background technique

With the development of cloud computing technology, a large number of data files containing personally identifiable data (PII) are stored in the cloud system (referred to as the cloud). For the purpose of ensuring the user's data file availability, the cloud system usually copies the user's data file to generate multiple copies of the file, and saves the generated multiple copies of the file to different servers or different storage partitions of the same server.

At present, the protection of data files mainly uses an ACL (Access Control List). ACL is a part of the metadata of the data file, which defines different access rights (read, write, etc.) of different data users to the data file.

However, in the actual application process, ACL does not copy at the same time as the data file is copied, and multiple copies of the data file can not be protected by the same access policy of the source data file. For an unauthorized user, although it cannot directly access the data in the source data file, it can obtain data by accessing a copy file that is not protected by the ACL, resulting in data leakage. For example, the source data file F is initially stored on a server of the data center A and is readable only to the user U, and when the source data file F is copied to a server of the data center B, it is stored in the data center after being copied. The copy file E on a server of B loses the protection of the access policy of the source data file F, and the unauthorized user V can also access the data in the copy file E, thereby causing data leakage of the source data file F.

Summary of the invention

In view of this, the present invention provides a method for managing data files in a cloud, a cloud management point, and a system to solve the problem of data leakage in the prior art. The technical solutions are as follows:

A first aspect of the present invention discloses a method for managing a data file in a cloud, the method comprising:

The first server calculates a file identifier of the current data file to be processed, and sends the file identifier to the cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier;

Receiving, by the first server, the file protection policy returned by the cloud management point;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy;

If allowed, the first server processes the current data file to be processed.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the file identifier is a file hash hash value; and the file protection policy includes file flow range restriction information;

Before the first server calculates the file identifier of the data file to be processed, the method further includes:

The first server acquires an execution action of the first server on the data file;

When the performing action is to copy the data file to the second server, the first server calculating the file identifier of the current data file to be processed includes: the first server calculating a file Hash of the current data file to be copied value;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy, specifically:

Determining, by the first server, whether the current data file to be copied is allowed to be copied to the second server according to the file flow range restriction information in the file protection policy; wherein the file flow range restriction information includes an allow data file Copy the range of the flow.

In conjunction with the first possible implementation of the first aspect, in a second possible implementation manner of the first aspect, after the first server copies the current data file to be copied to the second server, The method further includes:

The second server calculates a file hash value of the copied data file;

Sending, by the second server, a file location update message to the cloud management point, where the file location update message includes a file hash value of the copied data file and address information of the second server, so that the cloud The management point searches for a file protection policy including the file hash value of the copied data file according to the file hash value of the copied data file, and further according to the second service The address information of the server updates the file location list information in the file protection policy including the file hash value of the copied data file; the file location list information includes location information stored in the data file.

With reference to the first aspect, in a third possible implementation manner of the first aspect, the file identifier is a file hash value; and the file protection policy includes file access restriction permission information;

When the performing action is that the third server is allowed to access the data file, the first server calculates the file identifier of the current data file to be processed, including: the first server calculates a file Hash of the current data file to be accessed. value;

Determining, by the first server, whether the current to-be-accessed data file is allowed to be accessed by the third server according to the file access restriction permission information in the file protection policy; wherein the file access restriction permission information includes allowing access to the data. The address information of the file.

With reference to the first aspect, in a fourth possible implementation manner of the first aspect, the file identifier is a file hash hash value, and the file protection policy includes file access restriction permission information.

When the performing action is to modify the content of the data file, the first server calculates a file identifier of the current data file to be processed, including: the first server calculates a file hash value of the current data file to be modified. ;

Determining, by the first server, whether the current data file to be modified is allowed to be modified by the first server according to the file access restriction permission information in the file protection policy; wherein the file access restriction permission information includes a data file access permission.

In conjunction with the fourth possible implementation of the first aspect, in a fifth possible implementation manner of the first aspect, when the current data file to be modified is allowed to be modified by the first server, the first server After the content of the current data file to be modified is modified, the method further includes:

The first server calculates a file hash value of the modified data file;

The first server sends a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the current data file to be modified and a file hash value of the modified data file, to And causing the cloud management point to associate the file hash value of the current data file to be modified and the file hash value of the modified data file to the same file protection policy according to the file hash value update message.

A second aspect of the present invention discloses another method for managing data files in a cloud, which is applied to a cloud management point, where the cloud management points are communicatively connected to different servers, and the cloud management points are stored with different data files. File protection policy; the method includes:

Receiving, by the cloud management point, a file identifier sent by the first server;

The cloud management point searches for a file protection policy including the file identifier according to the file identifier;

The cloud management point sends the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether the processing action to be performed by the first server is allowed to be executed.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the file identifier is a file hash hash value, and the method further includes:

Receiving, by the cloud management point, a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

The cloud management point searches for a file protection policy including a file hash value of the copied data file according to a file hash value of the copied data file;

The cloud management point updates the file location list information in the file protection policy including the file hash value of the copied data file according to the address information of the second server; the file location list information includes data file storage Location information.

With reference to the first possible implementation of the second aspect, the second possible implementation manner of the second aspect further includes:

Receiving, by the cloud management point, a file hash value of the data file to be deleted sent by the first server;

The cloud management point searches for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

Obtaining, by the cloud management point, file location list information of the data file to be deleted from a file protection policy of a file hash value of the data file to be deleted;

Sending, by the cloud management point, the deletion message to each server in the file location list information of the data file to be deleted according to the file location list information of the data file to be deleted, so that the servers are deleted according to the The message deletes the data file to be deleted.

With reference to the second aspect, in a third possible implementation manner of the second aspect, the file identifier is a file hash hash value, and the method further includes:

Receiving, by the cloud management point, a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before modification and a file hash value of the modified data file;

And the cloud management point associates the file hash value of the data file before the modification with the file hash value of the modified data file to the same file protection policy according to the file hash update message.

In conjunction with the third possible implementation of the second aspect, in a fourth possible implementation manner of the second aspect, the cloud management point updates the message according to the file hash value, and the data file before the modification The file hash value and the file hash value of the modified data file are associated with the same file protection policy including:

The cloud management point searches for a file protection policy including the file hash value of the data file before the modification according to the file hash value of the data file before the modification and the file hash value of the modified data file, respectively, and includes a file protection policy of the file hash value of the modified data file;

When it is found that there is at least one file protection policy, a file hash value of another data file is added to the hash value field in the at least one file protection policy.

A third aspect of the invention discloses a server comprising:

a first calculating unit, configured to calculate a file identifier of the current data file to be processed;

a file identifier sending unit, configured to send the file identifier to a cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier;

a file protection policy receiving unit, configured to receive the file protection policy returned by the cloud management point;

a determining unit, configured to determine, according to the file protection policy, whether the data file allows the server to perform processing;

The processing unit is configured to process the current data file to be processed when the determining unit determines that the data file allows the server to perform processing.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the file identifier is a file hash hash value; the file protection policy includes file flow range restriction information; and the server further includes:

a first execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is configured to: when the execution action acquired by the first execution action acquiring unit is to copy the data file to the second server, calculate a file hash value of the current data file to be copied;

The determining unit is configured to determine, according to the file flow range limitation information in the file protection policy, whether the current data file to be copied is allowed to be copied to the second server, where the file flow range limitation information includes Allows the scope of data file replication to flow.

With reference to the third aspect, in a second possible implementation manner of the third aspect, the file identifier is a file hash value; the file protection policy includes file access restriction permission information; and the server further includes:

a second execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is specifically configured to: when the execution action acquired by the second execution action acquiring unit is to allow the third server to access the data file, calculate a file hash value of the data file to be accessed currently;

The determining unit is configured to determine, according to the file access restriction permission information in the file protection policy, whether the current to-be-accessed data file is allowed to be accessed by the third server, where the file access restriction permission information includes Allow access to the address information of the data file.

With reference to the third aspect, in a third possible implementation manner of the third aspect, the file identifier is a file hash hash value; the file protection policy includes file access restriction permission information; and the server further includes:

a third execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is specifically configured to: when the execution action acquired by the third execution action acquiring unit is to modify the content of the data file, the file hash value of the data file to be modified currently;

The determining unit is configured to determine, according to the file access restriction permission information in the file protection policy, whether the current data file to be modified is allowed to be modified by the first server, where the file access restriction permission information includes Access to data files.

In conjunction with the third possible implementation of the third aspect, in a second possible implementation manner of the third aspect, the method further includes:

a second calculating unit, configured to calculate a file hash value of the modified data file;

An update message sending unit, configured to send a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the current data file to be modified and a file hash value of the modified data file So that the cloud management point updates the message according to the file hash value, and associates the file hash value of the current data file to be modified with the file hash value of the modified data file to the same file protection policy.

A fourth aspect of the present invention discloses a cloud management point, where the cloud management point is in communication with a different server, and the cloud management point stores a file protection policy for different data files; the cloud management point includes:

a first receiving unit, configured to receive a file identifier sent by the first server;

a first searching unit, configured to search for a file protection policy including the file identifier according to the file identifier;

a first sending unit, configured to send the file protection policy to the first server, so that The first server determines, according to the file protection policy, whether a corresponding processing action to be performed by the first server is allowed to be executed.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the file identifier is a file hash hash value, and the cloud management point further includes:

a second receiving unit, configured to receive a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

a second searching unit, configured to search, according to the file hash value of the copied data file, a file protection policy that includes a file hash value of the copied data file;

And an updating unit, configured to update, according to address information of the second server, file location list information in a file protection policy that includes a file hash value of the copied data file; the file location list information includes data file storage Location information.

In conjunction with the first possible implementation of the fourth aspect, in a second possible implementation manner of the fourth aspect, the method further includes:

a third receiving unit, configured to receive a file hash value of the data file to be deleted sent by the first server;

a third search unit, configured to search for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

An information obtaining unit, configured to acquire file location list information of a data file to be deleted from a file protection policy of a file hash value of the data file to be deleted;

a second sending unit, configured to send, according to the file location list information of the data file to be deleted, a deletion message to each server in the file location list information of the data file to be deleted, so that the servers are The delete message deletes the data file to be deleted.

With reference to the fourth possible implementation of the fourth aspect, the file identifier refers to a file hash hash value, and the cloud management point further includes:

a fourth receiving unit, configured to receive a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before the modification and a file hash value of the modified data file;

a Hash value update unit, configured to update the message according to the file hash value, and the number before the modification The file hash value of the file and the file hash value of the modified data file are associated with the same file protection policy.

With reference to the fourth aspect, in a third possible implementation manner of the fourth aspect, the Hash value update unit includes:

a first search subunit, configured to search, according to the file hash value of the data file before the modification, a file protection policy including a file hash value of the data file before the modification;

a second search subunit, configured to search, according to the file hash value of the modified data file, a file protection policy including a file hash value of the modified data file;

a hash value adding subunit, configured to add a file hash value of another data file to the first lookup subunit and/or the second lookup subunit when it finds that at least one file protection policy exists At least one file protection policy in the hash value field.

A fifth aspect of the invention discloses a cloud system comprising a client, a server as described above, and a cloud management point as described above.

According to the above technical solution of the present invention, in the method for managing data files in the cloud provided by the present invention, the first server first calculates a file identifier of the current data file to be processed before performing corresponding processing on the current data file to be processed, and further And receiving, by the file protection policy, a file protection policy corresponding to the file identifier returned by the cloud management point, determining, according to the file protection policy, whether the current data file to be processed is allowed to perform corresponding processing, and if allowed, the first server is further configured to the current data to be processed. The file is processed accordingly. The invention uses the same file protection policy as the source data file in the multiple copy files generated by the source data file, so that the unauthorized users in the prior art are also protected by the file protection policy when accessing the copy file. To prevent data leakage.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can obtain other drawings according to the provided drawings without any creative work.

FIG. 1 is a flowchart of a method for managing a data file in a cloud according to the present invention;

2 is another flow chart of a method for managing data files in the cloud according to the present invention;

FIG. 3 is still another flowchart of a method for managing data files in a cloud according to the present invention; FIG.

FIG. 4 is still another flowchart of a method for managing data files in a cloud according to the present invention; FIG.

FIG. 5 is still another flowchart of a method for managing data files in a cloud according to the present invention;

FIG. 6 is still another flowchart of a method for managing data files in a cloud according to the present invention;

FIG. 7 is still another flowchart of a method for managing data files in a cloud according to the present invention;

FIG. 8 is a schematic structural diagram of a server according to the present invention; FIG.

FIG. 9 is a schematic structural diagram of a cloud management point according to the present invention; FIG.

FIG. 10 is a schematic structural diagram of another server according to the present invention; FIG.

11 is another schematic structural diagram of a cloud management point according to the present invention;

FIG. 12 is a schematic structural diagram of a cloud system according to the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The application scenario of the present invention is a cloud system, which includes a client, a server, and a cloud management point. Cloud systems are also commonly referred to as clouds, or cloud data centers. The data file is stored in the server, and the data file may be a source data file or a copy file. The cloud management point stores a file protection policy for the source data file and the copy file. When performing operations on a certain data file, such as copying, accessing, and modifying, the server in the present invention needs to view a file protection policy corresponding to a certain data file stored in the cloud management point, only when the file protection policy is recorded. When the content allows the server to perform operations on such a data file, such as copying, accessing, modifying, etc., the server can continue to perform subsequent operations.

Before the technical solution of the present invention is specifically introduced, the present invention firstly requires the client, the server, and the cloud management point to cooperate in advance to complete the setting of the data file, and the method includes:

In step 001, the client sends the data file to the server.

In step 002, the server receives the data file and saves it.

Step 003, the server calculates a file hash value of the data file, and the file is hashed The value and address information of the server are sent to the cloud management point.

In step 004, the cloud management point receives and saves the file hash value and the address information of the server.

Step 005: The client sets a file protection policy of the data file on the cloud management point, where the file protection policy includes a file hash value and address information of the server.

In the present invention, the present invention uses a file hash value as an identification of a data file to mark different data files. If the contents of the data file are consistent, the file hash value obtained by calculating the contents of the same data file using the same hash algorithm is also the same. Therefore, the present invention can determine that the contents of the two data files are the same as long as the file hash values of the two data files are the same, that is, the two data files are determined to be derived (that is, one is a source data file, and one is a copy file). , or both are duplicate files). At the same time, multiple data files with the same hash value in the present invention will correspond to the same file protection policy on the cloud management point, and are protected by the file protection policy.

More specifically, the file protection policy in the present invention may include file access restriction permission information, file circulation range restriction information, file location list information, and file hash value. The file access restriction permission information includes address information and access rights that allow access to the data file; the file flow range restriction information includes a range that allows the data file to be copied, and the file location list information includes location information of the data file. Its specific storage method can be as follows:

Hash: 123A;

File access restriction allows information Acess:Li read,10.11.*.*;

File circulation range restriction information restrictions:Germany;

File location list information Locations: A.

Among them, Hash: 123A indicates that the data file has a hash value of 123A; Acess:Li, 10.11.*.* indicates that the user Li and the server whose server address range is 10.11.*.* can access the data file, where Li Read indicates that user Li reads the data file; Restrictions: Germany indicates that the data file can be streamed in servers and data centers in Germany; Locations: A indicates that the data file is stored on server A.

The following inventors will introduce a specific implementation method for managing a data file in the cloud provided by the present invention. As shown in FIG. 1, the method includes:

Step 101: The first server calculates a file identifier of the current data file to be processed, and sends the file identifier to the cloud management point, so that the cloud management point searches for the file according to the file identifier. File protection policy for data files.

Optionally, the file identifier is specifically a file hash value.

In this embodiment, when the first server receives an operation instruction sent by the client, where the operation instruction includes performing a copy, access, or modify control instruction on the data file A, the first server first calculates the data file. A file identifier and send the file ID to the cloud management point. At this time, the cloud management point searches for the file protection policy a including the file identifier according to the file identifier, and returns the file protection policy a to the first server.

Step 102: The first server receives the file protection policy returned by the cloud management point.

Step 103: The first server determines, according to the file protection policy, whether the current data file to be processed allows the first server to perform processing. If so, step 104 is performed, and if not, step 105 is performed.

Step 104: The first server processes the current data file to be processed.

In step 105, the first server rejects the processing.

Optionally, after step 105, step 105 may further include the step 106: the first server returns a reject message to the client, to notify the client that the first server does not allow the client to perform the operation requested by the client.

Therefore, in the method for managing data files in the cloud provided by the present invention, before performing the corresponding processing on the data file to be processed, the first server first calculates the file identifier of the current data file to be processed, and then receives the returned by the cloud management point. The file protection policy corresponding to the file identifier determines whether the current data file to be processed is allowed to perform corresponding processing according to the file protection policy. If allowed, the first server performs corresponding processing on the current data file to be processed. The invention uses the same file protection policy as the source data file in the multiple copy files generated by the source data file, so that the unauthorized users in the prior art are also protected by the file protection policy when accessing the copy file. To prevent data leakage.

In order to explain the technical solution of the present invention more clearly, the present invention will be specifically described in the application scenario in which the server wants to perform replication, access, modification, and the like.

First, for an application scenario in which the first server wants to copy the current data file to be copied to the second server, the method is as shown in FIG. 2, including:

Step 201: The first server acquires an action performed by the first server on the data file.

Step 202: When the performing action is to copy the data file to the second server, the first server calculates a file hash value of the current data file to be copied.

Specifically, for example, when the client initiates the copying of the data file A to be copied on the first server 10.11.1.2 to the second server 10.11.2.2 to the first server 10.11.1.2, the first server first calculates the current to be copied. The file Hash value of data file A is 123A.

Step 203: The first server sends the file hash value to the cloud management point.

After receiving the file hash value 123A, the cloud management point searches for the file protection policy a including the file hash value 123A, and returns the file protection policy a to the first server 10.11.1.2.

Step 204: The first server determines, according to the file distribution range restriction information in the file protection policy, whether the current data file to be copied is allowed to be copied to the second server. If so, step 205 is performed, and if not, step 206 is performed.

Step 205: The first server copies the current data file to be copied to the second server.

Step 206: The first server refuses to copy the current data file to be copied to the second server.

In the present embodiment, the file circulation range restriction information includes a range in which the data file copy is allowed to flow. Assuming that the current file circulation range restriction information is restrictions: Germany, the first server 10.11.1.2 determines whether the second server 10.11.2.2 belongs to the address range of Germany. If yes, go to step 205, the first server 10.11.1.2 copies the data file A to the second server 10.11.2.2, if not, proceeds to step 206, the first server 10.11.1.2 rejects the data file to be copied. A is copied to the second server 10.11.2.2.

Optionally, in this embodiment, after the first server 10.11.1.2 copies the data file A to the second server 10.11.2.2, the method may further include the step 207: the first server returns a confirmation message to the client. After the first server 10.11.1.2 refuses to copy the data file A to be copied to the second server 10.11.2.2, the method may further include step 208: the first server returns to the client. A rejection message tells the client that the copy operation is not allowed.

In addition, in this embodiment, if the first server copies the data file to be copied to the second server, the method may further include:

Step 209: The second server calculates a file hash value of the copied data file.

After the data file A is successfully copied to the second server, the second server calculates the file hash value of the data file A.

Step 210: The second server sends a file location update message to the cloud management point, where the file location update message includes a file hash value of the copied data file and address information of the second server, so that the The cloud management point searches for a file protection policy including the file hash value of the copied data file according to the file hash value of the copied data file, and further updates the information according to the address information of the second server. File location list information in a file protection policy of a file hash value of the copied data file; the file location list information includes location information stored in the data file.

In this embodiment, since the same data file A is copied to the second server, correspondingly, the fact that the data file A is copied to the second server should be recorded on the cloud management point. Therefore, the second server in the present invention actively calculates the file hash value of the data file A, and sends the file hash value of the data file A together with the address information of the second server to the cloud management point. The address information of the second server may be the IP address information of the second server or the like.

After receiving the file hash value of the data file A and the address information of the second server, the cloud management point finds the file protection policy a including the file hash value 123A according to the file hash value 123A of the data file A, and in the file protection policy. The address information of the second server is added to the Locations field of the file location list information in a.

Further, for the application scenario that the first server receives the access request information sent by the third server, the method is as shown in FIG. 3, including:

Step 301: The first server acquires an action performed by the first server on the data file.

Step 302: When the performing action is that the third server is allowed to access the data file, the first server calculates a file hash value of the data file to be accessed currently.

Generally, in the actual application process, the third server actively initiates access request information to the first server, where the access request information includes the address information of the third server and the current data file to be accessed.

In this embodiment, when the third server 10.17.3.4 sends the access request information to the first server 10.11.1.2, the access request information includes the address information 10.17.3.4 of the third server and the current to be accessed. Data file B. The first server 10.11.1.2 also calculates the file hash value of the data file B currently to be accessed. For example, the file Hash value of data file B is 234B.

Step 303: The first server sends the file hash value to the cloud management point.

After receiving the file hash value 234B, the cloud management point searches for the file protection policy b including the file hash value 234B, and returns the file protection policy b to the first server 10.11.1.2.

Step 304: The first server determines, according to the file access restriction permission information in the file protection policy, whether the current data file to be accessed is allowed to be accessed by the third server. If so, step 305 is performed, and if not, step 306 is performed.

In step 305, the first server allows the third server to access the data file.

Step 306, the first server rejects the third server to access the data file.

In the present embodiment, the file access restriction permission information includes address information that allows access to the data file. Assuming that the current file access restriction permission information is Acess:Li, 10.11.*.*, the first server 10.11.1.2 determines whether the third server 10.17.3.4 belongs to the range of Li or 10.11.*.*. If yes, step 305 is performed, the first server 10.11.1.2 allows the third server 10.17.3.4 to access the data file B, and if not, executes step 306, the first server 10.11.1.2 rejects the third server 10.17.3.4 access data File B.

In the present embodiment, it is obvious that the third server 10.17.3.4 does not belong to the range of Li or 10.11.*.*, so the first server 10.11.1.2 rejects the third server 10.17.3.4 to access the data file B.

Optionally, in this embodiment, after the first server 10.11.1.2 rejects the third server 10.17.3.4 to access the data file B, the method may further include the step 307: the first server returns a reject message to the third server. , telling the third server that the access operation is not allowed.

Further, in practical applications, sometimes the content of a data file (which may be a source data file or a copy file) may be modified. For example, if the content of the data file before the modification is the height parameter of the recorded user Jack, for example, the height is 174 cm, then the subsequent content may involve adding the weight parameter of the user Jack, for example, the weight is 120KG. Since the modified data file is a new data file derived from the data file before the modification, the modified data file should also be subjected to the same file protection policy as the data file before the modification, and will be modified before The data file and the modified data file are associated with the same file protection policy. Based on this, as the first service in the present invention For an application scenario in which the data file to be modified is to be modified, the method is as shown in FIG. 4, including:

Step 401: The first server acquires an action performed by the first server on the data file.

Step 402: When the performing action is to modify the content of the data file, the first server calculates a file hash value of the current data file to be modified.

In this embodiment, for example, when the client wants to modify a certain data file C on the first server, that is, when the first server wants to modify the content of the data file C, the first server still calculates the current waiting. The file hash value of the modified data file C. For example, the file Hash value of data file C is 345C.

Step 403: The first server sends the file hash value to the cloud management point.

After receiving the file hash value 345C, the cloud management point searches for the file protection policy c including the file hash value 345C, and returns the file protection policy c to the first server.

Step 404: The first server determines, according to the file access restriction permission information in the file protection policy, whether the current data file to be modified is allowed to be modified by the first server. If so, step 405 is performed, and if not, step 408 is performed.

Step 405: The first server modifies the content of the current data file to be modified.

In this embodiment, the file access restriction permission information includes access rights of the data file, and the access rights include read, read, write, and the like. Assuming that the file access restriction permission information in the current file protection policy c is write, then the first server can modify the content of the data file C at this time. If the file access restriction in the file protection policy c allows the information to be read-only, the first server cannot modify the content of the data file C.

After the first server completes the modification of the content of the data file C, the present invention further includes:

Step 406: The first server calculates a file hash value of the modified data file.

In this embodiment, after the first server modifies the content of the data file C, the modified data file C is marked as the data file D, and the first server recalculates the file hash value of the data file D. For example, the file Hash value of data file D is 356D.

Step 407: The first server sends a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the data file before the modification and a file hash value of the modified data file, to And causing the cloud management point to associate the file hash value of the data file before the modification with the file hash value of the modified data file according to the file hash update message. The same file protection strategy.

In this embodiment, the first server sends the file hash value 345C of the data file before the modification and the file hash value 356D of the modified data file to the cloud management point. After receiving the file hash value 345C of the data file before the modification and the file hash value 356D of the modified data file, the cloud management point searches for the file protection policy c including the file hash value 345C, and includes the file. Hash value 356D file protection policy d.

When the cloud management point finds the file protection policy c including the file hash value 345C, the file hash value 356D of the modified data file is added in the Hash field of the file protection policy c. Similarly, when the cloud management point finds the file protection policy d including the file hash value 356D, the file hash value 345C of the data file before the modification is added in the Hash field of the file protection policy d. If the cloud management point finds the file protection policy c including the file hash value 345C and the file protection policy d including the file hash value 356D, the modified version is also added in the Hash field of the file protection policy c. The file Hash value 356D of the data file, and the file hash value 345C of the data file before the modification are added in the Hash field of the file protection policy d.

Specifically, for example, the content of the data file C stored on the first server is “Jack.height=174 cm”, and the file protection policy c corresponding to the saved on the cloud management point is in the form of:

"Hash: 345C;

Access: Li;

Restrictions:Germany;

Locations: C".

If the current first server needs to modify the content of the data file C, specifically, it is necessary to add "Jack.weight=120KG" information to the content of the record, because the modified data file D is based on the original data file. If C is performed, then the modified data file D should be subject to the same file protection policy as the original data file C.

At this time, the first server first needs to calculate the hash value 345C of the data file C before the modification, and modify the data file C to obtain the modified data file D, and calculate the hash value 356D of the modified data file D. Further, the first server simultaneously sends the hash value 345C of the data file C before modification and the hash value 356D of the modified data file D to the cloud management point.

The cloud management point searches for the matching file protection policy based on the hash value 345C and the hash value 356D. slightly. When the cloud management point finds that only the file protection policy c including the hash value 345C exists, it is determined that the file protection policy c is a file protection policy for simultaneously protecting the data file C and the data file D. At this time, the cloud management point adds the hash value 356D of the data file D in the Hash field of the file protection policy c. At this time, the file protection policy c is stored in the following manner:

"Hash: 345C, 356D;

Access: Li;

Restrictions:Germany;

Locations: C".

Of course, this embodiment also includes another application scenario, that is, when the data file C is copied from the first server C to the second server E, and the second server E needs to modify the copy file E, the implementation process of the copy and The implementation of the modification is the same as the previous method. If the foregoing is still taken as an example, the storage mode of the file protection policy c is:

"Hash: 345C, 356D;

Access: Li;

Restrictions:Germany;

Locations: C, E".

The cloud management point also needs to update the location information of the data file in real time.

Step 408: The first server does not allow modification of the content of the current data file to be modified.

Optionally, in this embodiment, after the first server does not allow the content of the data file to be modified to be modified, the method may further include the step 408: the first server returns a reject message to the client, to notify The client does not allow this modification.

Therefore, in the above-mentioned technical solution of the present invention, in the method for managing data files in the cloud provided by the present invention, the first server first calculates the file hash value of the current data file to be processed before performing corresponding processing on the current data file to be processed. And receiving a file protection policy corresponding to the file hash value returned by the cloud management point, determining, according to the file protection policy, whether the current to-be-processed data file is allowed to perform corresponding processing, and if allowed, the first server is still waiting for the current process. The processed data files are processed accordingly. The invention uses the same file protection policy as the source data file in the multiple copy files generated by the source data file, so that the unauthorized users in the prior art are also protected by the file protection policy when accessing the copy file. To prevent data leakage.

Based on the above embodiments, the present invention may also have a case where a data file corresponds to multiple file protection policies. For example, the user defines a plurality of file protection policies corresponding to a certain data file in advance on the cloud management point; or, the data file A corresponds to the file protection policy a on the cloud management point, and the data file B corresponds to the file on the cloud management point. Protection strategy b, and when the content of the data file B is modified, the content of the modified data file B happens to be the same as the content of the data file A, then the file hash value of the modified data file B should be the same as the data file. A file Hash value is the same, then there are two file protection policies a and file protection policies b corresponding to the same file hash value stored on the cloud management point. Then, in the case that the above one data file corresponds to multiple file protection policies, the present invention can still be processed by the same processing method as the above embodiment.

Specifically, when the first server calculates a file hash value of the current data file to be processed, and sends the file hash value to the cloud management point, the cloud management point finds multiple file protection policies including the file hash value. And sending the multiple file protection policies to the first server together.

The first server receives the multiple file protection policies, and then determines, according to each file protection policy, whether the current data file to be processed is allowed to be processed by the first server. If the plurality of file protection policies allow, the first server processes the current data file to be processed; and if at least one of the plurality of file protection policies does not allow the first server to perform processing, the first The server refused to process.

More specifically, for example, in the foregoing embodiment, when the first server wants to copy the current data file to be copied to the application scenario on the second server, if the first server receives multiple file protections returned by the cloud management point, a policy, and the file distribution range restriction information in the at least one file protection policy of the plurality of file protection policies does not allow the first server to copy the current data file to be copied to the second server, and the first server rejects the current The data file to be copied is copied to the second server.

Similarly, in the foregoing embodiment, when the first server receives the application scenario of the access request information sent by the third server, if the first server receives multiple file protection policies returned by the cloud management point, the multiple The file access restriction in at least one of the file protection policies allows the third server to access the data file, and the first server denies the third server access to the data file.

Similarly, in the above embodiment, when the first server wants to modify the current data file to be modified, if the first server receives multiple file protection policies returned by the cloud management point, the multiple The file access restriction in the at least one file protection policy in the file protection policy allows the first server to modify the content of the data file, and the first server cannot modify the content of the current data file to be modified.

Based on the foregoing method for managing data files in the cloud provided by the present invention, the present invention further provides a method for managing data files in a cloud, where the method applies a cloud management point, and the cloud management points are connected to different servers, and A file protection policy for different data files is stored on the cloud management point; the method includes, as shown in FIG. 5:

Step 501: The cloud management point receives the file identifier sent by the first server.

Step 502: The cloud management point searches for a file protection policy including the file identifier according to the file identifier.

Optionally, in the present invention, the file identifier is specifically a file hash value. Specifically, the cloud management point stores a file protection policy for different data files, where each file protection policy includes a file hash value, and the cloud management point implements file protection including the file hash value according to the file hash value. Strategy.

Step 503: The cloud management point sends the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether the processing action to be performed by the first server is allowed to be executed.

In the present invention, when the first server wants to perform some processing operation on a certain data file, the first server sends the file identifier of the data file to the cloud management point to the file protection policy of the data file, and then the cloud management Determining, according to the file identifier, a file protection policy including the file identifier, and returning the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether the processing action to be performed by the first server is allowed to be executed. .

In addition, in the present invention, a plurality of file protection policies including the same file identifier may be stored on the cloud management point. In this case, the cloud management point sends the found multiple file protection policies including the file identifier to the first a server, so that the first server determines, according to the multiple file protection policies, whether the processing action to be performed by the first server is allowed to be executed.

Wherein, when at least one of the plurality of file protection policies does not allow the first server to perform processing, the first server rejects the processing.

Optionally, the present invention further describes that the file identifier is specifically a file hash value. On the basis of the foregoing embodiment, the method further includes:

Step 504: The cloud management point receives the file location update message sent by the second server. The file location update message includes a file hash value of the copied data file and address information of the second server.

In this embodiment, if the processing action to be performed by the first server is to copy the data file to the second server, after the first server finishes copying the data file to the second server, the second server sends the data file to the cloud management point. a file location update message, the file location update message including a file hash value of the copied data file and address information of the second server.

Step 505: The cloud management point searches for a file protection policy including a file hash value of the copied data file according to the file hash value of the copied data file.

Step 506: The cloud management point updates the file location list information in the file protection policy that includes the file hash value of the copied data file according to the address information of the second server. The file location list information includes location information stored in the data file.

In this embodiment, whenever the data file is copied to another server, the cloud management point records the address information of the server to which the data file is copied, so as to record the location information of the same data file. .

Therefore, the present invention records the address information of all data files through the cloud management point, and can clearly know the storage location of each data file.

Based on the above embodiments, the cloud management point in the present invention may also involve an application scenario for deleting data files.

In the prior art, when deleting the source data file and the copy file, the cloud system needs to know the storage location of the source data file and all the copy files, and since the cloud system cannot recognize the derivative relationship between the source data file and the copy file, the cloud system also The location of the different copy files of the source data file cannot be known, and it is impossible to uniformly delete all the files, which makes the data file deletion difficult.

According to the present invention, since the address information of all the data files recorded in the cloud management point can be clearly Knowing the storage location of each data file, the present invention can easily find the storage location of the data file (including the source data file and the copy file) when deleting the source data file and the copy file, thereby instructing the corresponding server to delete the data file. The specific method is shown in Figure 6, including:

Step 601: The cloud management point receives a file hash value of the data file to be deleted sent by the first server.

Step 602: The cloud management point searches for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted.

Step 603: The cloud management point acquires file location list information of the data file to be deleted from the file protection policy of the file hash value of the data file to be deleted.

Step 604: The cloud management point sends, according to the file location list information of the data file to be deleted, a deletion message to each server in the file location list information of the data file to be deleted, so that the servers are according to the Delete message deletes the data file to be deleted.

In this embodiment, the file location list information in the file protection policy is used to record all the storage location information of the data file, and the cloud management point sequentially searches all the servers storing the data file according to the file location list information, and The all servers send a delete message such that all of the servers delete the data file in accordance with the delete message.

Therefore, when the source data file and the copy file are deleted, the cloud management point only needs to find the file protection policy of the data file to be deleted, and searches according to the file location list information in the file protection policy. Each server storing the data file to be deleted is sent to each server to complete the deletion of the data file on each server. The invention realizes the function of uniformly deleting data files, and ensures the thoroughness of data deletion.

It should be noted that, in this embodiment, if the cloud management point finds multiple file protection policies including the file hash value of the data file to be deleted, the cloud management point is from the data file to be deleted. The file location list information of the data file to be deleted is sequentially obtained in multiple file protection policies of the file hash value, and then the file location list information in all the file protection policies obtained is collected and combined to obtain the data file to be deleted. Address information for each server.

In addition, as shown in FIG. 7, it also shows another flowchart of a method for managing data files in the cloud provided by the present invention, including:

Step 701: The cloud management point receives a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before the modification and a file hash value of the modified data file.

Step 702: The cloud management point associates the file hash value of the data file before the modification with the file hash value of the modified data file to the same file protection policy according to the file hash update message.

Specifically, the cloud management point searches for a file protection policy including the file hash value of the data file before the modification according to the file hash value of the data file before the modification and the file hash value of the modified data file, respectively. A file protection policy including a file hash value of the modified data file.

For example, the cloud management point searches for the file protection policy a of the file hash value 123A of the data file before the modification according to the file hash value 123A of the data file before the modification, and simultaneously according to the file Hash of the modified data file. The value 134B is to find whether or not the file protection policy b of the file hash value 134B of the data file before the modification is included.

When the cloud management point finds the file protection policy a according to the file hash value 123A and does not find the file protection policy b including the hash value 134B, the cloud management point adds the hash value 134B to the hash value field in the file protection policy a. , that is, "Hash: 123A, 134B".

Similarly, if the cloud management point finds the file protection policy b according to the file hash value 134B and does not find the file protection policy a including the hash value 123A, the cloud management point adds the hash value 123A to the hash in the file protection policy b. In the value field, "Hash: 134B, 123A".

Of course, if the cloud management point finds both the file protection policy a and the file protection policy b, the cloud management point will still add the hash value 134B to the hash value field in the file protection policy a, that is, "Hash: 123A, 134B". At the same time, the hash value 123A is added to the hash value field in the file protection policy b, that is, "Hash: 134B, 123A".

The present invention further provides a server, as shown in FIG. 8, comprising: a first computing unit 10, a file identifier sending unit 20, and a file protection policy receiving unit 30. , the determining unit 40 and the processing unit 50. among them,

The first calculating unit 10 is configured to calculate a file identifier of the current data file to be processed;

a file identifier sending unit 20, configured to send the file identifier to a cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier;

The file protection policy receiving unit 30 is configured to receive the file protection policy returned by the cloud management point;

The determining unit 40 is configured to determine, according to the file protection policy, whether the data file allows the server to perform processing;

The processing unit 50 is configured to process the current data file to be processed when the determining unit 40 determines that the data file allows the server to perform processing.

Optionally, the file identifier is a file hash value, and the file protection policy includes file flow range restriction information. The server further includes: a first execution action obtaining unit 60. among them,

a first execution action obtaining unit 60, configured to acquire an execution action of the server on the data file;

The first calculating unit 10 is specifically configured to: when the execution action acquired by the first execution action acquiring unit 60 is to copy the data file to the second server, calculate a file hash value of the current data file to be copied;

The determining unit 40 is configured to determine, according to the file flow range limitation information in the file protection policy, whether the current data file to be copied is allowed to be copied to the second server; wherein the file flow range limitation information Includes a range that allows data file replication to flow.

Optionally, the file identifier refers to a file hash value; the file protection policy includes file access restriction permission information; and the server further includes: a first execution action obtaining unit 70. among them,

The second execution action obtaining unit 70 is configured to acquire an execution action of the server on the data file.

The first calculating unit 10 is specifically configured to: when the execution action acquired by the second execution action acquiring unit 70 is to allow the third server to access the data file, calculate a file hash value of the data file to be accessed currently;

The determining unit 40 is configured to determine, according to the file access restriction permission information in the file protection policy, whether the current to-be-accessed data file is allowed to be accessed by the third server, where the file access restriction permission information is Includes address information that allows access to data files.

Optionally, the file identifier refers to a file hash value; the file protection policy includes file access restriction permission information; and the server further includes: a third execution action obtaining unit 80. among them,

The third execution action obtaining unit 80 is configured to acquire an execution action of the server on the data file.

The first calculating unit 10 is specifically configured to: when the execution action acquired by the third execution action acquiring unit 80 is to modify the content of the data file, the file hash value of the data file to be modified currently;

The determining unit 40 is specifically configured to: determine, according to the file access restriction permission information in the file protection policy, whether the current data file to be modified is allowed to be modified by the first server; wherein the file access restriction permission information Includes access to data files.

In addition, the invention further includes:

a second calculating unit 91, configured to calculate a file hash value of the modified data file;

The update message sending unit 92 is configured to send a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the current data file to be modified and a file hash of the modified data file. The value is such that the cloud management point updates the message according to the file hash value, and associates the file hash value of the current data file to be modified with the file hash value of the modified data file to the same file protection policy.

The present invention further provides a cloud management point, as shown in FIG. 9, the cloud management point is communicatively connected to different servers, and the cloud management point is File protection policies for different data files are stored. The cloud management point includes: a first receiving unit 100, a first searching unit 200, and a first sending unit 300. among them,

The first receiving unit 100 is configured to receive a file identifier sent by the first server.

The first searching unit 200 is configured to search for a file protection policy including the file identifier according to the file identifier.

The first sending unit 300 is configured to send the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether a corresponding processing action to be performed by the first server is allowed. carried out.

Optionally, the file identifier refers to a file hash value, and the cloud management point further includes:

a second receiving unit 400, configured to receive a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

The second searching unit 500 is configured to search, according to the file hash value of the copied data file, a file protection policy that includes a file hash value of the copied data file;

The updating unit 600 is configured to update the file location list information in the file protection policy including the file hash value of the copied data file according to the address information of the second server; the file location list information includes a data file Stored location information.

Optionally, it also includes:

The third receiving unit 700 is configured to receive a file hash value of the data file to be deleted sent by the first server;

The third searching unit 800 is configured to search for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

The information obtaining unit 900 is configured to obtain file location list information of the data file to be deleted from a file protection policy of the file hash value of the data file to be deleted;

The second sending unit 1000 is configured to send, according to the file location list information of the data file to be deleted, a deletion message to each server in the file location list information of the data file to be deleted, so that the servers are based on The delete message deletes the data file to be deleted.

The fourth receiving unit 1100 is configured to receive a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before modification and a file hash value of the modified data file;

The Hash value updating unit 1200 is configured to associate the file hash value of the data file before the modification and the file hash value of the modified data file to the same file protection policy according to the file hash update message.

The hash value update unit 1200 further includes:

The first search sub-unit 1201 is configured to search, according to the file hash value of the data file before the modification, a file protection policy that includes a file hash value of the data file before the modification;

a second search subunit 1202, configured to search, according to the file hash value of the modified data file, a file protection policy that includes a file hash value of the modified data file;

The Hash value adding sub-unit 1203 is configured to add a file hash value of another data file to the first lookup subunit and/or the second lookup subunit when it finds that at least one file protection policy exists The hash value field in at least one file protection policy.

Based on the foregoing, the present invention further provides a server, which may be a host server including computing power, or a personal computer PC, or a portable computer or terminal, etc., and the specific embodiment of the present invention is not correct. The specific implementation of the server is limited.

FIG. 10 is another schematic structural diagram of a server provided by the present invention. As shown in FIG. 10, the server 10000 includes:

A first processor 11100, a first communication interface 11200, a first memory 11300, and a first bus 11400.

The first processor 11100, the first communication interface 11200, and the first memory 11300 complete communication with each other through the first bus 11400.

The first processor 11100 is configured to execute the first program 11110.

In particular, the first program 11110 can include program code, the program code including computer operating instructions.

The first processor 11100 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

The first memory 11300 is configured to store the first program 11110. The first memory 11300 may include a high speed RAM memory and may also include a non-volatile memory such as at least one disk memory. The first program 11110 may specifically include: calculating a file identifier of the current data file to be processed, and sending the file identifier to the cloud management point, so that the cloud management point searches for the file of the data file according to the file identifier. Protection strategy;

Receiving the file protection policy returned by the cloud management point;

Determining, according to the file protection policy, whether the data file allows the server to perform processing;

If allowed, the current data file to be processed is processed.

Optionally, the file identifier refers to a file hash value; and the file protection policy includes file flow range restriction information;

The method further includes: acquiring an execution action of the data file by the server; and when the performing action is to copy the data file to the second server, calculating a file hash value of the current data file to be copied;

Determining, according to the file circulation range restriction information in the file protection policy, whether the current data file to be copied is allowed to be copied to the second server; wherein the file distribution range restriction information includes a range of allowing the data file to be copied and transferred.

Optionally, the file identifier refers to a file hash value; and the file protection policy includes file access restriction permission information;

The method further includes: acquiring an execution action of the data file by the server; and when the performing action is to allow the third server to access the data file, calculating a file hash value of the current data file to be accessed;

Determining, according to the file access restriction permission information in the file protection policy, whether the current to-be-accessed data file is allowed to be accessed by the third server; wherein the file access restriction permission information includes address information that allows access to the data file.

Optionally, the file identifier refers to a file hash hash value; and the file protection policy includes file access restriction permission information;

The method further includes: acquiring an execution action of the data file by the server; and when the performing action is to modify the content of the data file, calculating a file hash value of the current data file to be modified;

Determining, according to the file access restriction permission information in the file protection policy, whether the current data file to be modified is allowed to be modified by the first server; wherein the file access restriction permission information includes an access right of the data file.

Optionally, the method further includes: calculating a file hash value of the modified data file;

Sending a file hash value update message to the cloud management point, the file hash value update message including a file hash value of the current data file to be modified and a file hash value of the modified data file, so that the cloud management point updates the message according to the file hash value, and the file of the current data file to be modified is The hash value and the file hash value of the modified data file are associated with the same file protection policy.

FIG. 11 is another schematic structural diagram of a cloud management point provided by the present invention. As shown in FIG. 11, the cloud management point 20000 includes:

A second processor (processor) 21100, a second communication interface (Communications Interface) 21200, a second memory (memory) 21300, and a second bus 21400.

The second processor 21100, the second communication interface 21200, and the second memory 21300 complete communication with each other through the second bus 21400.

The second processor 21100 is configured to execute the second program 21110.

In particular, the second program 21110 can include program code, the program code including computer operating instructions.

The second processor 21100 may be a central processing unit CPU, or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

The second memory 21300 is configured to store the second program 21110. The second memory 21300 may include a high speed RAM memory and may also include a non-volatile memory such as at least one disk memory. The second program 21110 may specifically include: receiving a file identifier sent by the first server;

Searching for a file protection policy including the file identifier according to the file identifier;

Sending the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether the processing action to be performed by the first server is allowed to be executed.

Optionally, the file identifier refers to a file hash value;

The method further includes receiving a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

Searching for a file protection policy including a file hash value of the copied data file according to the file hash value of the copied data file;

And updating the file location list information in the file protection policy including the file hash value of the copied data file according to the address information of the second server; the file location list information includes location information stored in the data file.

The method further includes receiving a file hash value of the data file to be deleted sent by the first server;

Searching for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

Obtaining, from a file protection policy of a file hash value of the data file to be deleted, file location list information of the data file to be deleted;

And sending, according to the file location list information of the data file to be deleted, a deletion message to each server in the file location list information of the data file to be deleted, so that each server deletes the desire according to the deletion message. Deleted data file.

Optionally, the file identifier refers to a file hash value;

The method further includes receiving a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before the modification and a file hash value of the modified data file;

And according to the file hash value update message, the file hash value of the modified data file and the file hash value of the modified data file are associated with the same file protection policy.

And further comprising: searching for a file protection policy including the file hash value of the data file before the modification according to the file hash value of the data file before the modification and the file hash value of the modified data file, respectively, and including the file protection policy a file protection policy for the file hash value of the modified data file;

Based on the foregoing, the present invention also provides a cloud system, as shown in FIG. 12, including a client, a server, and a cloud management point.

It should be noted that each embodiment in the specification is described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the embodiments are referred to each other. can. For the device type embodiment, since it is basically similar to the method embodiment, The description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the term "comprises" or "comprises" or "comprises" or any other variations thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a plurality of elements includes not only those elements but also Other elements, or elements that are inherent to such a process, method, item, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The method for managing data files in the cloud, the cloud management point and the system provided by the present invention are described in detail above. The principles and implementation manners of the present invention are described in the specific examples. The description of the above embodiments is only The method for understanding the present invention and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in specific embodiments and application scopes. The description should not be construed as limiting the invention.

Claims

A method for managing data files in a cloud, comprising:

The first server calculates a file identifier of the current data file to be processed, and sends the file identifier to the cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier;

Receiving, by the first server, the file protection policy returned by the cloud management point;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy;

If allowed, the first server processes the current data file to be processed.
The management method according to claim 1, wherein the file identifier refers to a file hash hash value; and the file protection policy includes file stream range restriction information;

Before the first server calculates the file identifier of the data file to be processed, the method further includes:

The first server acquires an execution action of the first server on the data file;

When the performing action is to copy the data file to the second server, the first server calculating the file identifier of the current data file to be processed includes: the first server calculating a file Hash of the current data file to be copied value;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy, specifically:

Determining, by the first server, whether the current data file to be copied is allowed to be copied to the second server according to the file flow range restriction information in the file protection policy; wherein the file flow range restriction information includes an allow data file Copy the range of the flow.
The management method according to claim 2, wherein after the first server copies the data file to be copied to the second server, the method further includes:

The second server calculates a file hash value of the copied data file;

Sending, by the second server, a file location update message to the cloud management point, where the file location update message includes a file hash value of the copied data file and address information of the second server, so that the cloud The management point searches for a file protection policy including the file hash value of the copied data file according to the file hash value of the copied data file, further according to the The address information of the second server updates the file location list information in the file protection policy including the file hash value of the copied data file; the file location list information includes location information stored in the data file.
The management method according to claim 1, wherein the file identifier refers to a file hash value; and the file protection policy includes file access restriction permission information;

Before the first server calculates the file identifier of the data file to be processed, the method further includes:

The first server acquires an execution action of the first server on the data file;

When the performing action is that the third server is allowed to access the data file, the first server calculates the file identifier of the current data file to be processed, including: the first server calculates a file Hash of the current data file to be accessed. value;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy, specifically:

Determining, by the first server, whether the current to-be-accessed data file is allowed to be accessed by the third server according to the file access restriction permission information in the file protection policy; wherein the file access restriction permission information includes allowing access to the data. The address information of the file.
The management method according to claim 1, wherein the file identifier refers to a file hash hash value; and the file protection policy includes file access restriction permission information;

Before the first server calculates the file identifier of the data file to be processed, the method further includes:

The first server acquires an execution action of the first server on the data file;

When the performing action is to modify the content of the data file, the first server calculates a file identifier of the current data file to be processed, including: the first server calculates a file hash value of the current data file to be modified. ;

Determining, by the first server, whether the data file allows the first server to perform processing according to the file protection policy, specifically:

Determining, by the first server, whether the current data file to be modified is allowed to be modified by the first server according to the file access restriction permission information in the file protection policy; wherein the file access restriction permission information includes a data file access permission.
The management method according to claim 5, wherein when the data file to be modified is allowed to be modified by the first server, the first server modifies the content of the current data file to be modified. Thereafter, the method further includes:

The first server calculates a file hash value of the modified data file;

The first server sends a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the current data file to be modified and a file hash value of the modified data file, to And causing the cloud management point to associate the file hash value of the current data file to be modified and the file hash value of the modified data file to the same file protection policy according to the file hash value update message.
A method for managing data files in a cloud is characterized in that it is applied to a cloud management point, the cloud management point is communicatively connected to different servers, and a file protection policy for different data files is stored on the cloud management point; The methods include:

Receiving, by the cloud management point, a file identifier sent by the first server;

The cloud management point searches for a file protection policy including the file identifier according to the file identifier;

The cloud management point sends the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether the processing action to be performed by the first server is allowed to be executed.
The management method according to claim 7, wherein the file identifier is a file hash hash value, and the method further comprises:

Receiving, by the cloud management point, a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

The cloud management point searches for a file protection policy including a file hash value of the copied data file according to a file hash value of the copied data file;

The cloud management point updates the file location list information in the file protection policy including the file hash value of the copied data file according to the address information of the second server; the file location list information includes data file storage Location information.
The management method according to claim 8, further comprising:

Receiving, by the cloud management point, a file hash value of the data file to be deleted sent by the first server;

The cloud management point searches for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

Obtaining, by the cloud management point, file location list information of the data file to be deleted from a file protection policy of a file hash value of the data file to be deleted;

Sending, by the cloud management point, the deletion message to each server in the file location list information of the data file to be deleted according to the file location list information of the data file to be deleted, so that the servers are deleted according to the The message deletes the data file to be deleted.
The management method according to claim 7, wherein the file identifier is a file hash hash value, and the method further comprises:

Receiving, by the cloud management point, a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before modification and a file hash value of the modified data file;

And the cloud management point associates the file hash value of the data file before the modification with the file hash value of the modified data file to the same file protection policy according to the file hash update message.
The management method according to claim 10, wherein the cloud management point updates the message of the file before the modification and the file of the modified data file according to the file hash update message. Hash values associated with the same file protection policy include:

The cloud management point searches for a file protection policy including the file hash value of the data file before the modification according to the file hash value of the data file before the modification and the file hash value of the modified data file, respectively, and includes a file protection policy of the file hash value of the modified data file;

When it is found that there is at least one file protection policy, a file hash value of another data file is added to the hash value field in the at least one file protection policy.
A server, comprising:

a first calculating unit, configured to calculate a file identifier of the current data file to be processed;

a file identifier sending unit, configured to send the file identifier to a cloud management point, so that the cloud management point searches for a file protection policy of the data file according to the file identifier;

a file protection policy receiving unit, configured to receive the file protection policy returned by the cloud management point;

a determining unit, configured to determine, according to the file protection policy, whether the data file allows the server to perform processing;

The processing unit is configured to process the current data file to be processed when the determining unit determines that the data file allows the server to perform processing.
The server according to claim 12, wherein the file identifier refers to a file hash hash value; the file protection policy includes file flow range restriction information; and the server further includes:

a first execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is configured to: when the execution action acquired by the first execution action acquiring unit is to copy the data file to the second server, calculate a file hash value of the current data file to be copied;

The determining unit is configured to determine, according to the file flow range limitation information in the file protection policy, whether the current data file to be copied is allowed to be copied to the second server, where the file flow range limitation information includes Allows the scope of data file replication to flow.
The server according to claim 12, wherein the file identifier refers to a file hash value; the file protection policy includes file access restriction permission information; and the server further includes:

a second execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is configured to: when the execution action acquired by the second execution action acquiring unit is to allow the third server to access the data file, calculate a file hash value of the data file to be accessed currently;

The determining unit is configured to determine, according to the file access restriction permission information in the file protection policy, whether the current to-be-accessed data file is allowed to be accessed by the third server, where the file access restriction permission information includes Allow access to the address information of the data file.
The server according to claim 12, wherein the file identifier refers to a file hash hash value; the file protection policy includes file access restriction permission information; and the server further comprises:

a third execution action obtaining unit, configured to acquire an execution action of the server on the data file;

The first calculating unit is specifically configured to: when the execution action acquired by the third execution action acquiring unit is to modify the content of the data file, the file Hash value of the data file to be modified currently;

The determining unit is configured to determine, according to the file access restriction permission information in the file protection policy, whether the current data file to be modified is allowed to be modified by the first server, where the file access restriction permission information includes Access to data files.
The server according to claim 15, further comprising:

a second calculating unit, configured to calculate a file hash value of the modified data file;

An update message sending unit, configured to send a file hash update message to the cloud management point, where the file hash update message includes a file hash value of the current data file to be modified and a file hash value of the modified data file So that the cloud management point updates the message according to the file hash value, and associates the file hash value of the current data file to be modified with the file hash value of the modified data file to the same file protection policy.
A cloud management point, wherein the cloud management point is in communication with a different server, and the cloud management point stores a file protection policy for different data files; the cloud management point includes:

a first receiving unit, configured to receive a file identifier sent by the first server;

a first searching unit, configured to search for a file protection policy including the file identifier according to the file identifier;

a first sending unit, configured to send the file protection policy to the first server, so that the first server determines, according to the file protection policy, whether a corresponding processing action to be performed by the first server is allowed to be executed .
The cloud management point according to claim 17, wherein the file identifier is a file hash hash value, and the cloud management point further includes:

a second receiving unit, configured to receive a file location update message sent by the second server, where the file location update message includes a file hash value of the copied data file and address information of the second server;

a second searching unit, configured to search, according to the file hash value of the copied data file, a file protection policy that includes a file hash value of the copied data file;

And an updating unit, configured to update, according to address information of the second server, file location list information in a file protection policy that includes a file hash value of the copied data file; the file location list information includes data file storage Location information.
The cloud management point according to claim 18, further comprising:

a third receiving unit, configured to receive a file hash value of the data file to be deleted sent by the first server;

a third search unit, configured to search for a file protection policy including a file hash value of the data file to be deleted according to the file hash value of the data file to be deleted;

An information obtaining unit, configured to acquire file location list information of a data file to be deleted from a file protection policy of a file hash value of the data file to be deleted;

a second sending unit, configured to send, according to the file location list information of the data file to be deleted, a deletion message to each server in the file location list information of the data file to be deleted, so that the servers are The delete message deletes the data file to be deleted.
The cloud management point according to claim 17, wherein the file identifier is a file hash hash value, and the cloud management point further includes:

a fourth receiving unit, configured to receive a file hash update message sent by the first server, where the file hash update message includes a file hash value of the data file before the modification and a file hash value of the modified data file;

The Hash value update unit is configured to associate the file hash value of the data file before the modification and the file hash value of the modified data file to the same file protection policy according to the file hash update message.
The cloud management point according to claim 20, wherein the hash value update unit comprises:

a first search subunit, configured to search, according to the file hash value of the data file before the modification, a file protection policy including a file hash value of the data file before the modification;

a second search subunit, configured to search, according to the file hash value of the modified data file, a file protection policy including a file hash value of the modified data file;

a hash value adding subunit, configured to add a file hash value of another data file to the first lookup subunit and/or the second lookup subunit when it finds that at least one file protection policy exists At least one file protection policy in the hash value field.
A cloud system, comprising a client, the server of any of claims 12-16, and the cloud management point of any of the preceding claims 17-21.