CN110363026B - File manipulation method, apparatus, device, system, and computer-readable storage medium - Google Patents

Abstract

The invention relates to the technical field of financial technology, and discloses a file operation method, device, device, system and computer-readable storage medium. The file operation method includes: when a file operation request is received, obtaining user information, a target file storage path and a target operation according to the file operation request; and based on the user information, the target file storage path and the target operation pair The user performs identity verification and operation authority verification; when both the identity verification and the operation authority verification pass, the target remote file service is determined according to the target file storage path and the preset rule; superuser authority is obtained through the target remote file service, and The target operation method corresponding to the target operation is invoked based on the superuser authority, and the target operation is performed on the target file corresponding to the target file storage path. The invention can improve the controllability of user authority management and the security of file system operation access.

Description

File manipulation method, apparatus, device, system, and computer-readable storage medium

technical field

The present invention relates to the technical field of financial technology (Fintech), and in particular, to a file operation method, apparatus, device, system and computer-readable storage medium.

Background technique

With the development of computer technology, more and more technologies (big data, distributed, blockchain, artificial intelligence, etc.) are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology (Fintech). The security and real-time requirements of the industry also put forward higher requirements for technology.

In a computer, a file system is a system for naming files and placing files for logical storage and recovery. At present, many services of financial institutions such as banks need to access each file system to perform related file operations. Correspondingly, each file system provides a corresponding API (Application Programming Interface) for users to perform file-related operations. Operations, such as adding, deleting, reading and writing, etc. At present, the APIs provided by file systems such as the local file system and HDFS (Hadoop Distributed File System, distributed file system) generally only allow users to access and operate their own files, but cannot access and operate all users' files in one process service. To access and operate files, unless the service is started with super user rights, it can have the rights of all files. However, enabling super user rights for each user, even if each user has the operation rights of all files, will lead to the inability of user rights. less secure access to control and file system operations.

SUMMARY OF THE INVENTION

The main purpose of the present invention is to provide a file operation method, apparatus, device, system and computer-readable storage medium, aiming at improving the controllability of user rights management and the security of file system operation access.

In order to achieve the above object, the present invention provides a file operation method, the file operation method includes:

When receiving a file operation request, obtain user information, target file storage path and target operation according to the file operation request;

Perform identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

When both the identity verification and the operation authority verification pass, determine the target remote file service according to the target file storage path and the preset rule;

Obtain superuser authority through the target remote file service, and call a target operation method corresponding to the target operation based on the superuser authority, and execute the target operation on the target file corresponding to the target file storage path.

Optionally, the user information includes user account information, token information and Internet Protocol IP information, and the user is authenticated and operated based on the user information, the target file storage path and the target operation. The verification steps include:

Obtain a verification Token corresponding to the user account information, compare the Token information with the verification Token, and detect whether the IP information is in a preset IP whitelist, so as to authenticate the user;

The operation authority information of the user is acquired according to the user account information, and operation authority verification is performed on the user according to the target file storage path, the target operation and the operation authority information.

Optionally, the step of determining the target remote file service according to the target file storage path and the preset rule includes:

Determine the target file system according to the target file storage path, and obtain the number of requests under each activated remote file service corresponding to the target file system, which is recorded as the first number of requests;

The remote file service corresponding to the smallest value in the first request quantity is determined as the target remote file service.

Optionally, the file operation method further includes:

Periodically obtain the current number of requests under each remote file service that has been started, and record it as the number of second requests;

Detecting whether each value in the second request quantity is greater than a first preset threshold;

If each value in the second number of requests is greater than the first preset threshold, a new remote file service is started.

Optionally, after the step of regularly obtaining the current number of requests under each remote file service that has been started, and denoting it as the second number of requests, it also includes:

Detecting whether there is a value smaller than a second preset threshold in the second request quantity;

If there is, stop the remote file service corresponding to the existing value smaller than the second preset threshold.

Optionally, the file operation method further includes:

After the operation execution is completed, a corresponding operation execution result is generated and returned to the client corresponding to the file operation request.

In addition, in order to achieve the above object, the present invention also provides a file operation device, the file operation device includes:

a first obtaining module, configured to obtain user information, a target file storage path and a target operation according to the file operation request when receiving a file operation request;

a user verification module, configured to perform identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

a service determination module, configured to determine the target remote file service according to the target file storage path and preset rules when both the identity verification and the operation authority verification pass;

The operation execution module is used to obtain super user authority through the target remote file service, and based on the super user authority, call the target operation method corresponding to the target operation, and execute the target file corresponding to the target file storage path. the target operation.

In addition, in order to achieve the above object, the present invention also provides a file operation device, the file operation device includes: a memory, a processor and a file operation program stored in the memory and running on the processor, When the file operation program is executed by the processor, the steps of the file operation method as described above are realized.

In addition, in order to achieve the above object, the present invention also provides a file operating system, the file operating system includes a file operating device and a user terminal; wherein,

The file operating device is the file operating device as described above;

The user terminal is configured to receive a file system object query request triggered by a user, and obtain the file system type and proxy user information carried in the file system object query request; obtain the file system type and the proxy user information according to the file system type and the proxy user information. The proxy file system object is displayed, and the file operation request triggered by the user based on the proxy file system object is received, and the file operation request is sent to the file operation device.

In addition, in order to achieve the above object, the present invention also provides a computer-readable storage medium, where a file operation program is stored on the computer-readable storage medium, and when the file operation program is executed by a processor, the above-mentioned file operation is realized steps of the method.

The present invention provides a file operation method, device, device, system and computer-readable storage medium. When receiving a file operation request sent by a user terminal, the user information, target file storage path and target operation are obtained according to the file operation request, Then, based on the obtained user information, target file storage path and target operation, the user is authenticated and the operation authority is verified; when both the identity verification and the operation authority verification pass, the target is first determined according to the target file storage path and preset rules. The remote file service then obtains the superuser authority through the target remote file service, and calls the target operation method corresponding to the target operation based on the superuser authority, and executes the target operation on the target file corresponding to the target file storage path. Through the above method, the present invention only needs to perform identity verification and operation authority verification on the user. After both the identity verification and the operation authority verification are passed, the superuser authority can be obtained to operate the files of the proxy user (ie, other users). Compared with the prior art, the present invention does not need to enable super user authority for each user, can realize complete control of user authority management, and can improve the security of operation and access of different file systems.

Description of drawings

1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention;

2 is a schematic flowchart of a first embodiment of a file operation method of the present invention;

FIG. 3 is a schematic diagram of functional modules of the first embodiment of the file operating device of the present invention.

The realization, functional characteristics and advantages of the present invention will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

Referring to FIG. 1 , FIG. 1 is a schematic diagram of a device structure of a hardware operating environment involved in an embodiment of the present invention.

The file operation device in the embodiment of the present invention may be a smart phone, or may be a terminal device such as a PC (Personal Computer, personal computer), a tablet computer, and a portable computer.

As shown in FIG. 1 , the file operation device may include: a processor 1001 , such as a CPU, a communication bus 1002 , a user interface 1003 , a network interface 1004 , and a memory 1005 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (eg, a Wi-Fi interface). The memory 1005 may be high-speed RAM memory, or may be non-volatile memory, such as disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure of the file operating device shown in FIG. 1 does not constitute a limitation on the file operating device, and may include more or less components than the one shown, or combine some components, or different components layout.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module and a file operation program.

In the terminal shown in FIG. 1 , the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the user interface 1003 is mainly used to connect to the client and perform data communication with the client; and the processor 1001 can be used for The file operation program stored in the memory 1005 is called, and the following operations are performed:

When receiving a file operation request, obtain user information, target file storage path and target operation according to the file operation request;

Perform identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

When both the identity verification and the operation authority verification pass, determine the target remote file service according to the target file storage path and the preset rule;

Obtain superuser authority through the target remote file service, and call a target operation method corresponding to the target operation based on the superuser authority, and execute the target operation on the target file corresponding to the target file storage path.

Further, the user information includes user account information, token Token information and Internet Protocol IP information, the processor 1001 can call the file operation program stored in the memory 1005, and also perform the following operations:

Obtain a verification Token corresponding to the user account information, compare the Token information with the verification Token, and detect whether the IP information is in a preset IP whitelist, so as to authenticate the user;

The operation authority information of the user is acquired according to the user account information, and operation authority verification is performed on the user according to the target file storage path, the target operation and the operation authority information.

Further, the processor 1001 can call the file operation program stored in the memory 1005, and also perform the following operations:

Determine the target file system according to the target file storage path, and obtain the number of requests under each activated remote file service corresponding to the target file system, which is recorded as the first number of requests;

The remote file service corresponding to the smallest value in the first request quantity is determined as the target remote file service.

Further, the processor 1001 can call the file operation program stored in the memory 1005, and also perform the following operations:

Periodically obtain the current number of requests under each remote file service that has been started, and record it as the number of second requests;

Detecting whether each value in the second request quantity is greater than a first preset threshold;

If each value in the second number of requests is greater than the first preset threshold, a new remote file service is started.

Further, the processor 1001 can call the file operation program stored in the memory 1005, and also perform the following operations:

Detecting whether there is a value smaller than a second preset threshold in the second request quantity;

If there is, stop the remote file service corresponding to the existing value smaller than the second preset threshold.

Further, the processor 1001 can call the file operation program stored in the memory 1005, and also perform the following operations:

After the operation execution is completed, a corresponding operation execution result is generated and returned to the client corresponding to the file operation request.

Based on the above hardware structure, various embodiments of the file operation method of the present invention are proposed.

The present invention provides a file operation method.

Referring to FIG. 2 , FIG. 2 is a schematic flowchart of a first embodiment of a file operation method of the present invention.

In this embodiment, the file operation method includes:

Step S10, when receiving the file operation request, obtain user information, target file storage path and target operation according to the file operation request;

The file operation method in this embodiment is implemented by a file operation device, and the device is described by taking a server as an example. Among them, the device is equipped with an engine manager service (IO-EM, Input/Output-Engine Mamager) and a remote file service (IO-Engine), and provides a compatible API (Application Programming Interface, application programming interface) to receive the client The file operation request sent, in which IO-EM is used to receive the file operation request triggered by the user, and obtain the user information, target file storage path and target operation according to the file operation request, and then authenticate the user and verify the operation authority. It is used to monitor the load of each remote file service IO-Engine, and then determine the target remote file service. It is also used to control the start and stop of the corresponding IO-Engine according to the load of the IO-Engine, and it is also used to receive operations sent by the IO-Engine. The execution result is returned to the client; the remote file service IO-Engine is used to obtain the superuser authority of the file system, and based on the superuser authority, the file operation method corresponding to the obtained target operation is called to the target on the target file system. The file is used for file operation, and is also used to generate the corresponding operation execution result and send it to IO-EM. It should be noted that IO-Engine corresponds to the type of file system. The file system may include local file system (local), distributed file system (HDFS) and other types of file systems. Each type of file system corresponds to The IO-Engine also includes multiple. Through the file operation device, remote access operations to various types of file systems can be realized.

In this embodiment, the server receives, through IO-EM, a file operation request remotely sent by the client through its compatible API interface, and when receiving the file operation request sent by the client through IO-EM, obtains the user according to the file operation request. Information, target file storage path, and target operation, where user information may include but not limited to account information, Token (token) information, and IP (Internet Protocol, Internet Protocol) information.

Step S20, performing identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

After obtaining the user information, target file storage path and target operation, IO-EM in the server verifies the user's identity and operation authority based on the user information, target file storage path and target operation, where the user information includes user account information , Token (token) information and IP (Internet Protocol, Internet Protocol) information, user account information is the user's account name, Token information can be a fixed Token code pre-assigned to the user, or it can be assigned to the user by A random Token code generated by the Token generating device in real time, the IP information is the IP address of the client, and step S20 includes:

Step a1: Obtain a verification Token corresponding to the user account information, compare the Token information with the verification Token, and detect whether the IP information is in a preset IP whitelist, so as to authenticate the user ;

For identity verification, the verification Token corresponding to the user's account information can be obtained first. Correspondingly, the verification Token can be a pre-saved fixed Token code assigned to the user, or a random Token code synchronously sent by the token generation device. Then, the Token information is compared with the verification Token, and whether the IP information is in the preset IP whitelist is detected, so as to authenticate the user. When the comparison result is that the Token information is the same as the verification Token, and the IP information is in the preset IP whitelist, the authentication is passed. When the comparison result is that the Token information is different from the verification Token, and/or the IP information is not in the preset IP whitelist, the authentication fails. It should be noted that, in a specific embodiment, the user may be authenticated based on only one of the Token information and the IP information. Of course, the user may also be authenticated based on other information.

Step a2: Obtain the user's operation authority information according to the user account information, and perform operation authority verification on the user according to the target file storage path, the target operation and the operation authority information.

For the verification of the operation authority, the user's operation authority information can be obtained first according to the user account information, wherein the operation authority information can include which file systems and which files (folders) the user owns to which other users (proxy users). Operation permission. Specifically, the mapping relationship between the user account information and the operation authority information can be preset, and then the user's operation authority can be obtained according to the user account information and the preset mapping relationship between the user account information and the operation authority information. information.

Then, according to the target file storage path, target operation and operation authority information, it is determined whether the user has the corresponding operation authority, so as to verify the operation authority of the user. Specifically, it can be detected whether the target file storage path and the target operation correspond to the operation authority information. within the scope of authority; if it is within the scope of authority, the operation authority verification passes; if it is not within the scope of authority, the operation authority verification fails. Among them, the target file storage path corresponds to the target proxy user, target file system and target file (folder), and the corresponding target proxy user, target file system and target file (folder) can be determined according to the target file storage path, and then according to The determined target file storage path, target operation and operation authority information determine whether the user has the corresponding operation authority. It should be noted that, in the actual application process, the type of information required to judge whether the user has the operation authority can be determined according to the information type specifically limited by the operation authority information. For example, if the operation authority information only limits the operation authority Proxy users, file systems, and files (folders), without limiting the target operation, can determine whether the user has the operation authority based on the target file storage path and operation authority information.

In addition, it should also be noted that, in the specific embodiment, the execution order of steps a1 and a2 is not specific. It is understandable that when any one of the steps a1 and a2 is executed, and the result is that the authentication fails, there is no need to perform another step. For example, when the authentication is performed first and the result is that the authentication fails, there is no need to continue the operation of the authorization. At this point, corresponding prompt information can be directly generated and sent to the client to prompt the user that the verification fails.

Of course, it is understandable that the administrator can also perform personalized configuration of the corresponding security verification rules according to actual needs, for example, only perform identity verification or operation authority verification, or adopt other security verification methods.

Step S30, when both the identity verification and the operation authority verification pass, determine the target remote file service according to the target file storage path and the preset rule;

When both the identity verification and the operation authority verification pass, the IO-EM in the server determines the target remote file service according to the target file storage path and preset rules. Specifically, the step "determine according to the target file storage path and preset rules" Target Remote File Services" includes:

Step b1, determine the target file system according to the target file storage path, and obtain the number of requests under each remote file service that has been started corresponding to the target file system, and record it as the first number of requests;

Step b2, determining the remote file service corresponding to the smallest value in the first request quantity as the target remote file service.

When there are multiple file system types, you can first determine the target file system according to the target file storage path, and obtain the number of requests under each activated remote file service corresponding to the target file system. The number of requests under each started remote file service IO-Engine corresponding to the target file system is recorded as the first number of requests. Since there are multiple IO-Engines, the corresponding number of first requests also includes multiple. Then, in order to achieve load balancing, the IO-Engine of the remote file service corresponding to the smallest value in the first request quantity may be determined as the target remote file service.

Step S40, obtaining super user authority through the target remote file service, and calling a target operation method corresponding to the target operation based on the super user authority, and executing the target file corresponding to the target file storage path. operate.

After it is determined that the target remote file service is obtained, the super user authority can be obtained through the target remote file service, and based on the super user authority, the target operation method corresponding to the target operation can be invoked, and the target operation can be performed on the target file corresponding to the target file storage path. . Specifically, from the bottom layer, after IO-EM determines that the target remote file service is obtained, the target IO-Engine can be started by the super user (that is, the target IO-Engine is started after logging in with the super user account), and the file operation request is sent to The target remote file service (target IO-Engine), so that the target IO-Engine obtains the superuser authority, and then the target IO-Engine can call the target operation method corresponding to the target operation based on the superuser authority, and store the path corresponding to the target file. The corresponding target file executes the target operation.

In the process of file operation of financial institutions such as banks, the present invention first performs identity verification and operation authority verification on the user after obtaining user information, target file storage path and target operation, and determines the target remote file service after the verification is passed. Then, obtain the superuser authority through the target remote file service, and call the target operation method corresponding to the target operation based on the superuser authority, and perform the target operation on the target file corresponding to the target file storage path, without enabling the superuser for each user of the enterprise. Permissions can achieve complete control over enterprise user permission management, that is, improve the controllability of enterprise user permissions, and at the same time, can also improve the security of file system operation access.

An embodiment of the present invention provides a file operation method. When a file operation request sent by a client is received, user information, a target file storage path and a target operation are obtained according to the file operation request, and then based on the obtained user information, target operation The file storage path and target operation authenticate the user and the operation authority; when both the authentication and operation authority verification are passed, the target remote file service is first determined according to the target file storage path and preset rules, and then the target remote file service is passed through the target remote file service. Obtain the superuser authority, and call the target operation method corresponding to the target operation based on the superuser authority, and execute the target operation on the target file corresponding to the target file storage path. In the above manner, in the embodiment of the present invention, only the identity verification and the operation authority verification are required for the user. After both the identity verification and the operation authority verification are passed, the superuser authority can be obtained to operate the files of the proxy user (that is, other users). , compared with the prior art, the embodiment of the present invention does not need to enable super user authority for each user, can realize complete control of user authority management, and can improve the security of operation access of different file systems.

Further, based on the first embodiment shown in FIG. 2 , a second embodiment of the file operation method of the present invention is proposed.

In this embodiment, the file operation method further includes:

Step A, regularly obtains the current number of requests under each remote file service that has been started, and is denoted as the second number of requests;

In this embodiment, the server can monitor the load situation of each remote file service (IO-Engine) through the engine manager (IO-EM), and control the start and stop of the IO-Engine according to the load situation, so as to achieve the purpose of load balancing. Specifically, IO-EM can periodically obtain the current number of requests under each activated remote file service. For the convenience of distinction and subsequent description, the obtained current number of requests under each activated remote file service can be recorded as the second number of requests. The current number of requests under the remote file service is the number of file operation requests to be processed under the remote file service. The period can be set to once every 3 hours, of course, it can also be set according to actual needs, which is not specifically limited here. Since there are multiple remote file services, correspondingly, the number of second requests also includes multiple.

Step B, detecting whether each value in the second request quantity is greater than a first preset threshold;

After acquiring the second number of requests, check whether each value in the second number of requests is greater than the first preset threshold, where the first preset threshold can be set to 10, of course, can also be set according to actual needs , which is not specifically limited here.

Step C, if each value in the second request quantity is greater than the first preset threshold, start a new remote file service.

If each value of the second number of requests is greater than the first preset threshold, it means that all IO-Engines are overloaded. In this case, a new remote file service IO-Engine is started.

It should be noted that since each remote file service IO-Engine corresponds to the type of file system, for example, the file system may include local file system (local), distributed file system (HDFS) and other types of file systems. There are also multiple IO-Engines corresponding to file systems of different types. Therefore, in a specific embodiment, it is also possible to obtain the current status of the started remote file service IO-Engine of each type of file system according to the type of the file system. The number of requests (respectively recorded as the number of third requests, the number of fourth requests, ... the number of Nth requests), and then respectively detect whether each value in the number of third requests, the number of fourth requests, ... the number of Nth requests is greater than The first preset threshold, if each value in a certain number of requests is greater than the first preset threshold, a new IO-Engine under the file system corresponding to the number of requests can be started. For example, the third request quantity corresponds to the local file system, and when it is detected that each value in the third request quantity is greater than the first preset threshold, a new IO-Engine corresponding to the local file system is started.

Further, after step A, the file operation method may also include:

Step D, detecting whether there is a value smaller than a second preset threshold in the second request quantity;

If it exists, perform step E: stop the remote file service corresponding to the existing value smaller than the second preset threshold.

In addition, after acquiring the second number of requests, it is also possible to detect whether there is a value in the second number of requests that is smaller than the second preset threshold, where the second preset threshold can be set to 0, of course, it can also be performed according to actual needs The setting is not specifically limited here. If it is detected that there is a value less than the second preset threshold in the second number of requests, it means that there is an idle remote file service. At this time, the remote file service corresponding to the existing value less than the second preset threshold is stopped, that is, Stop idle remote file services.

Of course, it should be noted that, in a specific embodiment, an external device, such as IR (Intelligent Routing, intelligent routing), can also be used to monitor the load status of each IO-Engine (ie, the current number of requests), that is, to periodically obtain through IR The current number of requests under each remote file service that has been started is denoted as the second number of requests; and then the relationship between each value in the second number of requests and the first preset threshold is detected by IR, and a corresponding number of requests is generated according to the detection result. The notification information is sent to the IO-EM, so that the IO-EM controls the start and stop of the corresponding IO-Engine according to the notification information. The specific detection method is the same as that in the above-mentioned embodiment, that is, to detect whether each value in the second request quantity is greater than the first preset threshold; if each value in the second request quantity is greater than the first If the preset threshold is set, the notification information for starting a new remote file service is generated and sent to IO-EM, so that IO-EM starts the corresponding new IO-Engine according to the notification information; at the same time, it is detected whether there is a second request number A value smaller than the second preset threshold, if there is a value smaller than the second preset threshold in the second number of requests, a notification message for stopping the remote file service is generated and sent to the IO-EM, so that the IO-EM is based on the notification message. Stop the corresponding idle IO-Engine.

It can be understood that, in the above-mentioned first embodiment, in the process of determining the target remote file service according to the target file storage path and preset rules, the first request quantity can be obtained by IR in addition to being directly obtained by IO-EM.

Further, based on the first embodiment shown in FIG. 2 , a third embodiment of the file operation method of the present invention is proposed.

In this embodiment, after step S40, the file operation method further includes:

After the operation execution is completed, a corresponding operation execution result is generated and returned to the client corresponding to the file operation request.

In this embodiment, in order to facilitate the user to understand the execution result of the operation, after the execution of the operation is completed, the corresponding operation execution result may be generated, and the operation execution result will be returned to the client corresponding to the file operation request. Wherein, the operation execution result includes operation execution success and operation execution failure, etc. When the operation execution fails, the corresponding failure reason may also be returned to facilitate the user to perform correction processing.

The present invention also provides a file operating system, which includes a file operating device and a user terminal. The file operation device is the file operation device shown in FIG. 1 , and is used to execute the steps in the above-mentioned embodiments of the file operation method. For specific functions and implementation processes, reference may be made to the above-mentioned embodiments, which will not be repeated here.

The user terminal is configured to receive a file system object query request triggered by a user, and obtain the file system type and proxy user information carried in the file system object query request; obtain the file system type and the proxy user information according to the file system type and the proxy user information. The proxy file system object is displayed, and the file operation request triggered by the user based on the proxy file system object is received, and the file operation request is sent to the file operation device.

In this embodiment, the client terminal may be a terminal such as a smart phone or a PC, which integrates an SDK (Software Development Kit, software development kit) encapsulated by multiple modules. Specifically, the sdk encapsulated by multiple modules may include three modules: FsFactory (file system factory), ProxyFS (proxy file system) and IO-Client (input/output). The file system type and proxy user information are obtained from the file system object query request; ProxyFS is used to receive the file system type (such as local file system, HDFS file system, etc.) and proxy user information transmitted by FsFactory, and to the file system type and proxy user information. The information is encapsulated in a preset manner to obtain the corresponding proxy file system object, wherein the proxy file system object includes the operation method of the file (folder) in the file system corresponding to the proxy user, for example, obtaining the file (folder) size , the operation methods of creating, deleting files (folders), reading and writing files, etc.; IO-Client is used to receive the file operation request triggered by the user, and send the file operation request to the file operation device through a compatible API interface; also It can be used to receive and display the operation execution result returned by the file operation device.

Specifically, when the user needs to perform a certain target operation on a file (folder) corresponding to the storage path of a certain target file, the user can first determine the type of the target file system and the target proxy user according to the storage path of the target file, and then use the user terminal to determine the type of the target file system and the target proxy user. The corresponding software or App (Application, application) in the input file system type (that is, the type of the target file system) and the proxy user information (that is, the information of the target proxy user, which can be the user name of the target proxy user), and the input is completed. The file system object query request can be triggered. At this time, when receiving the file system object query request triggered by the user, the client obtains the file system type and proxy user information carried in the file system object query request, where the file system type can be Including the local file system, the HDFS file system, etc., the proxy user information can be the username of other users (ie, proxy users) that need to be accessed. Then, the file system type and proxy user information are encapsulated to obtain the proxy file system object, which is displayed on the screen of the client, wherein the proxy file system object includes the operation method corresponding to the target operation. After the proxy file system object, the file of the proxy user can be operated. Specifically, the user can trigger the file operation request based on the operation method and target file storage path of the target operation in the proxy file system object. , when the user terminal receives the file operation request, it sends the file operation request to the file operation device, so that the file operation device processes the file operation request.

This embodiment provides a file operating system. The file operating system includes a file operating device and a user terminal. By constructing the above file operating system, it is convenient for a user to access a remote file system through the user terminal. At the same time, the file operating device can To achieve unified management of each file system, without the need to enable super user permissions for each user, to achieve complete control of user rights management, and to improve the security of access to different file systems.

The invention also provides a file operation device.

Referring to FIG. 3 , FIG. 3 is a schematic diagram of functional modules of the first embodiment of the file operating device of the present invention.

As shown in Figure 3, the file operation device includes:

The first obtaining module 10 is configured to obtain user information, target file storage path and target operation according to the file operation request when receiving a file operation request;

a user verification module 20, configured to perform identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

The service confirmation module 30 is used to determine the target remote file service according to the target file storage path and preset rules when both the identity verification and the operation authority verification pass;

The operation execution module 40 is configured to obtain super user authority through the target remote file service, and based on the super user authority, call the target operation method corresponding to the target operation, and execute the target file storage path corresponding to the target file based on the super user authority. Perform the target operation.

Further, the user information includes user account information, token Token information and Internet Protocol IP information, and the user verification module 20 includes:

an identity verification unit, configured to obtain a verification Token corresponding to the user account information, compare the Token information with the verification Token, and detect whether the IP information is in a preset IP whitelist, so as to verify the user to authenticate;

The authority verification unit is configured to obtain the user's operation authority information according to the user account information, and perform operation authority verification on the user according to the target file storage path, the target operation and the operation authority information.

Further, the service confirmation module 30 includes:

a first obtaining unit, configured to determine a target file system according to the target file storage path, and obtain the number of requests under each activated remote file service corresponding to the target file system, which is denoted as the first number of requests;

The first determining unit is configured to determine the remote file service corresponding to the smallest value in the first request quantity as the target remote file service.

Further, the file manipulation device also includes:

The second acquisition module is used to periodically acquire the current number of requests under each remote file service that has been started, and is recorded as the second number of requests;

a first detection module, configured to detect whether each value in the second request quantity is greater than a first preset threshold;

A service starting module, configured to start a new remote file service if each value in the second request quantity is greater than a first preset threshold.

Further, the file manipulation device also includes:

a second detection module, configured to detect whether there is a value smaller than a second preset threshold in the second request quantity;

A service stopping module, configured to stop the remote file service corresponding to the existing value smaller than the second preset threshold if it exists.

Further, the file manipulation device also includes:

The result returning module is used to generate a corresponding operation execution result after the operation is completed, and return it to the client corresponding to the file operation request.

The function implementation of each module in the above-mentioned file operation apparatus corresponds to each step in the above-mentioned file operation method embodiment, and the functions and implementation process thereof will not be repeated here.

The present invention also provides a computer-readable storage medium, on which a file operation program is stored, and when the file operation program is executed by a processor, implements the file operation method according to any one of the above embodiments. step.

The specific embodiments of the computer-readable storage medium of the present invention are basically the same as the above-mentioned embodiments of the file operation method, and are not repeated here.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as ROM/RAM) as described above. , magnetic disk, optical disk), including several instructions to make a terminal device (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the methods described in the various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (9)

1. A file operation method, characterized in that the file operation method comprises:

when a file operation request is received, acquiring user information, a target file storage path and target operation according to the file operation request;

performing identity verification and operation authority verification on the user based on the user information, the target file storage path and the target operation;

when the identity verification and the operation authority verification pass, determining target remote file service according to the target file storage path and a preset rule;

acquiring super user authority through the target remote file service, calling a target operation method corresponding to the target operation based on the super user authority, and executing the target operation on a target file corresponding to the target file storage path;

the step of determining the target remote file service according to the target file storage path and the preset rule comprises the following steps:

determining a target file system according to the target file storage path, acquiring the number of requests under each started remote file service corresponding to the target file system, and recording the number of the requests as a first request number;

and determining the remote file service corresponding to the minimum value in the first request quantity as a target remote file service.

2. The file operating method according to claim 1, wherein the user information includes user account information, Token information, and internet protocol IP information, and the step of performing authentication and operation authority authentication on the user based on the user information, the target file storage path, and the target operation includes:

acquiring a verification Token corresponding to the user account information, comparing the Token information with the verification Token, and detecting whether the IP information is in a preset IP white list or not so as to verify the identity of the user;

and acquiring the operation authority information of the user according to the user account information, and verifying the operation authority of the user according to the target file storage path, the target operation and the operation authority information.

3. The file operating method according to any one of claims 1 to 2, further comprising:

acquiring the current request quantity of each started remote file service at regular intervals, and recording the current request quantity as a second request quantity;

detecting whether each numerical value in the second request quantity is larger than a first preset threshold value;

and if all the numerical values in the second request quantity are greater than a first preset threshold value, starting a new remote file service.

4. The file manipulation method of claim 3 wherein said step of periodically obtaining a current number of requests for each initiated remote file service, denoted as a second number of requests, further comprises:

detecting whether a numerical value smaller than a second preset threshold value exists in the second request quantity;

and if so, stopping the remote file service corresponding to the numerical value smaller than the second preset threshold.

5. The file operating method according to any one of claims 1 to 2, further comprising:

and after the operation execution is finished, generating a corresponding operation execution result and returning the operation execution result to the user side corresponding to the file operation request.

6. A file operating apparatus, characterized in that the file operating apparatus comprises:

the first acquisition module is used for acquiring user information, a target file storage path and target operation according to a file operation request when the file operation request is received;

the user authentication module is used for carrying out identity authentication and operation authority authentication on the user based on the user information, the target file storage path and the target operation;

the service determining module is used for determining target remote file service according to the target file storage path and a preset rule when the identity verification and the operation authority verification pass;

the operation execution module is used for acquiring super user authority through the target remote file service, calling a target operation method corresponding to the target operation based on the super user authority and executing the target operation on a target file corresponding to the target file storage path;

the service determination module includes:

a first obtaining unit, configured to determine a target file system according to the target file storage path, and obtain a number of requests under each started remote file service corresponding to the target file system, which is recorded as a first number of requests;

and the first determining unit is used for determining the remote file service corresponding to the minimum numerical value in the first request quantity as the target remote file service.

7. A file operating apparatus, characterized in that the file operating apparatus comprises: memory, a processor and a file manipulation program stored on the memory and executable on the processor, the file manipulation program when executed by the processor implementing the steps of the file manipulation method according to any one of claims 1 to 5.

8. A file operating system is characterized in that the file operating system comprises a file operating device and a user side; wherein,

the file operating device is the file operating device according to claim 7;

the client is used for receiving a file system object query request triggered by a user and acquiring a file system type and agent user information carried in the file system object query request; obtaining a file system object of the agent according to the file system type and the agent user information, and displaying the file system object; and receiving a file operation request triggered by a user based on the file system object of the proxy, and sending the file operation request to the file operation equipment.

9. A computer-readable storage medium, on which a file operation program is stored, which when executed by a processor implements the steps of the file operation method according to any one of claims 1 to 5.

Images