Data processing method and device

Abstract

The embodiments of the present specification provide a data processing method and device, wherein the data processing method includes receiving a data processing request, wherein the data processing request carries encrypted target data; decrypting the encrypted target data, and determining a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; when it is determined that a first cache unit does not exist for the target index node, and the first cache unit reaches a preset cache threshold, determining an adjustment index node in the first cache unit based on a preset strategy; deleting the adjustment index node in the first cache unit, and writing the target index node to the first cache unit to implement data processing of the target data.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and more particularly to a data processing method. One or more embodiments of this specification also relate to a data processing apparatus, a computing device, and a computer-readable storage medium. Background Art

[0002] The cloud platform has a sound security protection capability, which can ensure that the data stored in the database will not be leaked due to external attacks. However, since the data is visible to the cloud platform, users still have concerns about the security of their data, worrying that internal operation and maintenance personnel will unauthorized access to the data or steal user data. Based on these user concerns, some databases use data encryption to store data.

[0003] Currently, encrypted databases directly store ciphertexts with keywords as the granularity in the index. Each time a query is to perform a comparison operation, the index node corresponding to the keyword needs to be loaded into the memory, and then the elements in the index node and the keyword to be queried are placed in the Enclave (a trusted memory area in SGX where the code and data will not be leaked or maliciously tampered with) for decryption and comparison, and then the comparison result is returned. Frequent Enclave interactions will bring large additional overhead.

[0004] Therefore, there is an urgent need to provide a data processing method that can reduce the interaction overhead between Enclave and other memories during the execution of operations. Summary of the invention

[0005] In view of this, the present specification provides a data processing method. One or more embodiments of the present specification also relate to a data processing device, a computing device, and a computer-readable storage medium to solve the technical defects existing in the prior art.

[0006] According to a first aspect of an embodiment of this specification, a data processing method is provided, including:

[0007] receiving a data processing request, wherein the data processing request carries encrypted target data;

[0008] Decrypting the encrypted target data, and determining a target index node corresponding to the target data based on a keyword of the target data obtained after decryption;

[0009] When it is determined that the target index node does not have a first cache unit and the first cache unit reaches a preset cache threshold, determining an adjustment index node in the first cache unit based on a preset strategy;

[0010] The adjustment index node in the first cache unit is deleted, and the target index node is written into the first cache unit to implement data processing of the target data.

[0011] According to a second aspect of an embodiment of this specification, there is provided a data processing device, including:

[0012] A request receiving module, configured to receive a data processing request, wherein the data processing request carries encrypted target data;

[0013] a target index node obtaining module, configured to decrypt the encrypted target data, and determine a target index node corresponding to the target data based on a keyword of the target data obtained after decryption;

[0014] an adjustment index node determination module, configured to determine an adjustment index node in the first cache unit based on a preset strategy when it is determined that the target index node does not exist in the first cache unit and the first cache unit reaches a preset cache threshold;

[0015] The data processing module is configured to delete the adjustment index node in the first cache unit and write the target index node into the first cache unit to implement data processing of the target data.

[0016] According to a third aspect of an embodiment of this specification, an encrypted database is provided, wherein the database adopts a B+tree encrypted index, and the B+tree encrypted index includes an EBuffer layer, the EBuffer layer includes a first cache unit, and each slot of the first cache unit includes a plaintext index node, wherein:

[0017] The encrypted database receives a data processing request carrying encrypted target data, decrypts the encrypted target data, and determines a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; when it is determined that a first cache unit does not exist for the target index node and the first cache unit reaches a preset cache threshold, determines an adjustment index node in the first cache unit based on a preset strategy; deletes the adjustment index node in the first cache unit, and writes the target index node into the first cache unit to implement data processing of the target data.

[0018] According to a fourth aspect of an embodiment of this specification, a computing device is provided, including:

[0019] Memory and processor;

[0020] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the data processing method are implemented.

[0021] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and the computer-executable instructions can implement the steps of the data processing method when executed by a processor.

[0022] An embodiment of the present specification implements a data processing method and device, wherein the data processing method includes receiving a data processing request, wherein the data processing request carries encrypted target data; decrypting the encrypted target data, and determining the target index node corresponding to the target data based on the keyword of the target data obtained after decryption; determining the adjustment index node in the first cache unit based on a preset strategy when it is determined that the target index node does not exist in the first cache unit and the first cache unit reaches a preset cache threshold; deleting the adjustment index node in the first cache unit, and writing the target index node into the first cache unit to realize data processing of the target data. Specifically, the data processing method deletes the index node with a less number of historical accesses in the first cache unit through a preset strategy each time a data processing request is received and the target index node is accessed, and then the target index node is written into the first cache unit. Based on the above method, the index node with a more frequent historical access can be retained in the first cache unit. When the next data processing request is made, the target index node can be accessed directly from the first cache unit, reducing the interaction overhead in the data processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is a flow chart of a data processing method provided by an embodiment of this specification;

[0024] Figure 2 is a schematic diagram of the structure of an index node in a data processing method provided by an embodiment of this specification;

[0025] Figure 3 It is a schematic diagram of an application architecture of a data processing method provided by an embodiment of this specification;

[0026] Figure 4 is a structural schematic diagram of a data processing device provided by an embodiment of this specification;

[0027] Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0028] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0029] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0030] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0031] First, the terms involved in one or more embodiments of this specification are explained.

[0032] TEE: Trusted Execution Environment. It provides a secure execution environment isolated from the outside world to protect internal code and data from being leaked or maliciously tampered with.

[0033] SGX: Software Guard Extensions, a set of security instruction sets provided by Intel CPU, which can provide a secure isolated execution environment for applications and is a technical implementation of TEE.

[0034] Enclave: A trusted memory area in SGX where code and data cannot be leaked or maliciously tampered with.

[0035] B+tree: It is a variant of B-tree. The non-leaf nodes of this tree only store key value information. There is a link pointer between all leaf nodes, and data records are stored in the leaf nodes.

[0036] LRU strategy: The LRU algorithm refers to the least recently used algorithm, which means that LRU believes that the data that has been used recently will have a high probability of being accessed in the future, and the data that has not been accessed recently means that the probability of being accessed in the future is low.

[0037] In order to ensure the security of data, a fully encrypted database can be used to implement database query. That is, the fully encrypted database is designed to eliminate the risk of data leakage during database operation, ensure that the data exists in encrypted form throughout the server, and have complete database query capabilities.

[0038] At present, in order to achieve the minimum change on the traditional basis, some encrypted databases support encrypted database query capabilities by implementing operation operators in TEE. B+tree is the default index of encrypted databases. The keywords in the nodes are stored in ciphertext. Each time a comparison is required to query the keywords, the corresponding nodes are loaded into the memory, and then the elements in the nodes and the keywords to be queried are put into the Enclave for decryption and comparison, and then the comparison results are returned. Frequent Enclave interactions bring large additional overhead. At the same time, this encryption method with keyword granularity has large storage amplification and security risks. Although the elements in each node are stored in ciphertext, a large amount of metadata needs to be maintained. At the same time, the size relationship between nodes (the pointers of the upper nodes are not encrypted) and the size relationship of the elements in the nodes will be leaked.

[0039] Based on this, in this specification, a data processing method is provided. This specification also involves a data processing device, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0040] See also Figure 1 , Figure 1 A flow chart of a data processing method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0041] Step 102: Receive a data processing request, wherein the data processing request carries encrypted target data.

[0042] In a specific implementation, the data processing method is an encryption index method based on Enclave-Native B+tree, and its index structure is a logical structure of B+tree.

[0043] Specifically, the data processing request includes but is not limited to a data read request, a data write request, etc., and both the data read request and the data write request need to access the target index node of the target data to implement the reading and writing of the data.

[0044] In practical applications, the data processing method is described in detail with the database engine as the execution subject, so receiving a data processing request can be understood as the database engine receiving a data read / write request, and the data read / write request carries encrypted target data, wherein the target data can be data of any format and any type, such as student grades, employee information, etc. This specification does not make any limitation to this.

[0045] In addition, the data processing request may also be a data processing request in any form, such as a data processing request in SQL language.

[0046] In an embodiment of the present specification, before receiving a data processing request, the data processing method implements data storage based on the index structure of Enclave-Native's B+tree, including a three-layer storage architecture: a first cache unit, a second cache unit, and a third storage unit, wherein the first cache unit is a cache manager in the Enclave, used to manage node-granular data transmission between an unprotected host memory and a protected Enclave memory, and each cache slot of the first cache unit contains a plaintext index node; the second cache unit is a cache manager in the unprotected host memory, used to manage data transmission between the unprotected host memory and external storage in units of data pages, and each cache slot of the second cache unit contains a data page, and each data page contains multiple encrypted index nodes; the third storage unit is a persistent storage disk, used to save index data and support continued use of the index after reloading.

[0047] Specifically, the difference between the first cache unit and the second cache unit lies in the encryption state, location and size of the index node. For example, the first cache unit manages the index node of the plaintext in the limited enclave memory, while the second cache unit manages the data page in the large-capacity unprotected host memory. The first cache unit and the second cache unit have the same structure.

[0048] For example, if you want to write a piece of data: student number 1 = 90 points in mathematics, after the database engine receives the encrypted data, it will decrypt the encrypted data, and then find the corresponding index node according to Key: student number 1; if the index is empty at this time, an index node is created in the first cache unit as the root node, and then the data is inserted into the index node. When the data to be written is increasing, the capacity of the first cache unit is limited. If the capacity of the first cache unit is exceeded, some index nodes can be encrypted and moved to the data page of the second cache unit, and if the capacity of the second cache unit is exceeded, some data pages can be encrypted and moved to the third storage unit. Among them, the data page of the second cache unit is composed of multiple encrypted index nodes.

[0049] Step 104: decrypt the encrypted target data, and determine a target index node corresponding to the target data based on a keyword of the target data obtained after decryption.

[0050] Specifically, after receiving a data processing request, the database engine loads the encrypted target data carried in the data processing request into the Enclave created by SGX for decryption, and determines the target index node corresponding to the target data based on the keyword of the target data obtained after decryption.

[0051] For example, if the target data is: student number 1 = 90 points in mathematics, then the keyword in the target data is "student number 1". At this time, the target index node corresponding to the target data is determined based on "student number 1".

[0052] In a specific implementation, the first cache unit includes a cache pool storing index nodes, a cache description layer storing index node metadata, and a hash mapping layer;

[0053] Correspondingly, after determining the target index node corresponding to the target data based on the keyword of the target data obtained after decryption, the method further includes:

[0054] In the case where it is determined that the target index node exists in the cache pool of the first cache unit, determining, based on the hash map layer of the first cache unit, a position of the target index node in the cache description layer of the first cache unit;

[0055] Based on the position of the target index node in the cache description layer of the first cache unit, metadata of the target index node is acquired, and data processing of the target data is implemented based on the metadata of the target index node.

[0056] Among them, the cache pool is a simple array, and each slot of the cache pool stores an index node in the first cache unit. The cache description layer is an array that stores metadata. Each slot in the cache description layer corresponds one-to-one to each slot in the cache pool, and stores the metadata of the corresponding index node. The metadata includes a bidirectional pointer to maintain the logical order of each slot to form a bidirectional linked list, thereby supporting the following LRU replacement strategy. The hash mapping layer is a hash table used to determine whether the index node to be accessed is in the cache pool. In addition, address conversion is required between adjacent layers of the first cache unit, the second cache unit, and the third storage unit in the storage architecture, so as to convert the upper layer representation into the lower layer identifier, that is, convert the node identifier of the index node into the page identifier and offset of the data page, and convert the page identifier of the data page into a physical address.

[0057] Specifically, when it is determined based on the hash mapping layer of the first cache unit that the target index node exists in the cache pool of the first cache unit, the position of the target index node in the cache description layer of the first cache unit is determined based on the hash mapping layer of the first cache unit, and then based on the position of the target index node in the cache description layer of the first cache unit, the metadata of the target index node is obtained, and finally data processing of the target data is implemented based on the metadata of the target index node.

[0058] See also Figure 2 , Figure 2 A schematic diagram of the structure of an index node in a data processing method provided according to an embodiment of the present specification is shown.

[0059] pass Figure 2 It can be seen that the index node in the first cache unit is composed of metadata, keywords, branches / values, where the metadata includes the current node unique identifier, parent node identifier, previous node identifier, next node identifier, type, and number of keywords; keyword: the key of the data; branch: the id of the node where the key is located within a certain range, which exists in the middle node; value: exists in the leaf node, that is, the value corresponding to the keyword; identifier: the index node id; type: middle node or leaf node (last layer).

[0060] In specific implementation, after obtaining metadata of the target index node, such as the key and value of the target index node, the target data is read or written based on the key and value of the target index node.

[0061] In the embodiment of the present specification, when it is determined that the target index node exists in the first cache unit, the target index node can be directly found in the first cache unit, and data reading and writing of the target data can be implemented based on the target index node, without the need for data interaction with the second cache unit and / or the third cache unit, thereby saving data processing flow.

[0062] Step 106: When it is determined that the target index node does not have a first cache unit and the first cache unit reaches a preset cache threshold, determine an adjustment index node in the first cache unit based on a preset strategy.

[0063] Among them, the preset cache threshold can be set according to the actual application, and no limitation is made here. For example, if the first cache unit is 4k, then the preset cache threshold can be set to 4k. Then, when it is determined that the target index node is not in the first cache unit and the first cache unit has reached 4k, in order to ensure that the target index node can be written to the first cache unit for data processing, it is necessary to determine the adjustment index node in the first cache unit based on the preset strategy to realize the subsequent deletion of the adjustment index node, so as to prepare for the target index node to be written to the first cache unit.

[0064] Specifically, determining the adjustment index node in the first cache unit based on a preset strategy includes:

[0065] Based on the historical access records of the index nodes in the first cache unit, an adjustment index node in the first cache unit is determined.

[0066] The historical access records include but are not limited to the historical access times, historical access times, etc.; and the preset strategy may be an LRU replacement strategy.

[0067] Taking the historical access record as the historical access count as an example, when determining the adjustment index node in the first cache unit, the adjustment index node in the first cache unit is determined based on the historical access count of each index node in the first cache unit; or the adjustment index node in the first cache unit is determined based on the historical access time of each index node in the first cache unit. For example, the index node with a small number of historical accesses in the first cache unit is used as the adjustment index node, or the index node with a long historical access time in the first cache unit is used as the adjustment index node, etc.

[0068] In an embodiment of the present specification, index nodes in the first cache unit that have fewer historical access times or have a long historical access time are deleted as adjustment index nodes to make room for write space for the target index node. In this way, the index nodes in the first cache unit can all be index nodes that are accessed more frequently. Then, when a data access request is received next time, it is very likely that the corresponding target index node is in the first cache unit. At this time, the target index node can be accessed directly from the first cache unit to implement data processing and avoid frequent interactions with other layers.

[0069] Step 108: Delete the adjusted index node in the first cache unit, and write the target index node into the first cache unit to implement data processing of the target data.

[0070] Specifically, after determining the adjustment index node in the first cache unit, the adjustment index node in the first cache unit is deleted, and then the target index node is written into the first cache unit, so as to read or write the target data based on the target index node.

[0071] In a specific implementation, writing the target index node into the first cache unit includes:

[0072] In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit;

[0073] The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

[0074] Specifically, since each data page in the second cache unit includes multiple index nodes in the first cache unit, the index node in each data page of the second cache unit needs to consider the offset of the index node in the data page when corresponding to the index node in the first cache unit. For example, each data page in the second cache unit includes 4 index nodes in the first cache unit, and the node identifier (i.e., nodeid) of the target index node in the first cache unit is 10, then its page identifier (i.e., pageid) in the data page of the second cache unit is 10 / 4, which is rounded down to 2. At this time, the offset refers to the number of the target index node in the data page of the corresponding second cache unit.

[0075] In actual applications, the offset and identifier numbers both start from 0. The page identifier of the data page of the second cache unit is 0, and the index nodes of the first cache unit contained in the data page are 0, 1, 2, and 3; the page identifier of the data page is 1, and the index nodes of the first cache unit contained in the data page are 4, 5, 6, and 7; the page identifier of the data page is 2, and the index nodes of the first cache unit contained in the data page are 8, 9, 10, and 11. Therefore, it can be determined that when the node identifier of the target index node in the first cache unit is 10, the page identifier of the target index node in the data page of the second cache unit is 2, and the offset is the second data page of the target index node in the second cache unit with the page identifier of 2. That is, the page with pageid=2 contains node ids 8, 9, 10, and 11, respectively, and the offsets of these four nodes are 0, 1, 2, and 3, respectively. The pageid and offset are calculated by nodeid to know which data page and which position in the second cache unit to find this node.

[0076] In a specific implementation, if the target index node is determined to be in the second cache unit based on the node identifier of the target index node, the page identifier and offset of the data page corresponding to the target index node in the second cache unit are calculated based on the node identifier of the target index node, and then the encrypted stored target index node is obtained in the second cache unit based on the page identifier and offset, and finally the encrypted stored target index node is decrypted and loaded into the first cache unit.

[0077] In the embodiments of this specification, all index nodes that need to be accessed need to be taken to the first cache unit and decrypted into plain text for access. If the target index node to be accessed is in the first cache unit, it can be accessed directly. If the target index node to be accessed is in the second cache unit, it needs to be loaded from the second cache unit to the first cache unit based on the node identifier of the target index node and decrypted into plain text for access, thereby making full use of the limited memory of the Enclave to implement access to the index nodes and saving interaction overhead.

[0078] In a specific implementation, the second cache unit includes a cache pool for storing data pages, a cache description layer for storing data page metadata, and a hash mapping layer;

[0079] Accordingly, determining the page identifier and offset of the data page of the target index node in the second cache unit based on the node identifier of the target index node includes:

[0080] Based on the node identifier of the target index node and the hash map layer of the second cache unit, a page identifier and an offset of a data page of the target index node in the cache pool of the second cache unit are determined.

[0081] In practical applications, the first cache unit and the second cache unit have the same structure, both including a cache pool, a cache description layer and a hash map layer. The difference is that the cache pool, cache description layer and hash map layer of the first cache unit store different contents from those of the cache pool, cache description layer and hash map layer of the second cache unit. Specifically, in the second cache unit, the cache pool is also a simple array, and each slot of the cache pool stores a data page in the second cache unit. The cache description layer is an array storing metadata, and each slot in the cache description layer corresponds to each slot in the cache pool one by one, and stores metadata of the corresponding data page, and the metadata includes a bidirectional pointer to maintain the logical order of each slot to form a bidirectional linked list, thereby supporting the following LRU replacement strategy. The hash map layer is a hash table used to determine whether the data page to be accessed is in the cache pool. In addition, address conversion is required between adjacent layers of the first cache unit, the second cache unit and the third storage unit in the storage architecture, so as to convert the upper layer representation into the lower layer identifier, that is, convert the node identifier of the index node into the page identifier and offset of the data page, and convert the page identifier of the data page into a physical address.

[0082] Specifically, when it is determined that the target index node exists in the cache pool of the second cache unit based on the node identifier of the target index node, the page identifier and offset of the data page of the target index node in the cache pool of the second cache unit are determined based on the node identifier of the target index node and the hash mapping layer of the second cache unit.

[0083] In the embodiment of the present specification, since the hash mapping layer of the second cache unit records the address conversion information between the first cache unit and the second cache unit, the page identifier and offset of the data page corresponding to the node identifier of the target index node can be quickly and accurately obtained based on the hash mapping layer of the second cache unit and the node identifier of the target index node.

[0084] In addition, the step of acquiring the encrypted stored target index node in the second cache unit based on the page identifier and the offset of the data page, and decrypting the encrypted stored target index node and writing it into the first cache unit includes:

[0085] Based on the page identifier and the offset of the data page, acquiring the target index node stored in an encrypted manner in the cache pool of the second cache unit;

[0086] Determine a position of the encrypted and stored target index node in a cache description layer of the second cache unit;

[0087] Based on the position of the encrypted stored target index node in the cache description layer of the second cache unit, acquiring metadata of the encrypted stored target index node;

[0088] The encrypted and stored target index node is decrypted, and based on metadata of the decrypted target index node, the decrypted target index node is written into the first cache unit.

[0089] Among them, since the second cache unit is an untrusted memory, the index nodes stored in the second cache unit are all encrypted index nodes.

[0090] In a specific implementation, after obtaining the page identifier and offset of the data page of the target index node in the cache pool of the second cache unit, the encrypted stored target index node is obtained from the cache pool of the second cache unit based on the page identifier and offset of the data page, and the position of the encrypted stored target index node in the cache description layer of the second cache unit is determined based on the correspondence between the cache pool and the cache description layer; then the metadata of the encrypted stored target index node is obtained from the position; finally, the encrypted stored target index node and the metadata are decrypted, and based on the encrypted metadata of the target index node (such as the identifier of the parent node, the key and value data in the target index node, etc.), the decrypted target index node is written into the first cache unit. For example, the decrypted target index node is written into the first cache unit as the parent node through the parent node identifier in the decrypted metadata of the target index node.

[0091] In an embodiment of the present specification, when it is determined that the target index node is in the second cache unit, the target index node is obtained from the data page of the second cache unit, and then the target index node is decrypted and loaded into the first cache unit, so that the target index node is accessed in plain text in the first cache unit, avoiding the operational complexity of accessing the target index node.

[0092] In another embodiment of the present specification, writing the target index node into the first cache unit includes:

[0093] In the case where it is determined that the target index node exists in a third storage unit, determining a data page of the target index node containing encrypted storage from the third storage unit;

[0094] Writing the data page of the target index node containing the encrypted storage into the second cache unit;

[0095] In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit;

[0096] The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

[0097] In actual applications, the third storage unit is a persistent storage disk, which is used to save the encrypted index data in the data page. When it is determined that the target index node exists in the third storage unit based on the node identifier of the target index node, the data page containing the encrypted stored target index node is determined from the third storage unit, and then the data page is written into the second cache unit. Then, based on the node identifier of the target index node, the page identifier and offset of the data page of the target index node in the second cache unit are determined; finally, based on the page identifier and offset of the data page, the encrypted stored target index node is obtained in the second cache unit, and the encrypted stored target index node is decrypted and loaded into the first cache unit.

[0098] In specific implementation, if the target index node to be accessed is in the third storage unit, it is necessary to first load the data page where the target index node is located into the second cache unit, and then load the target index node from the second cache unit into the first cache unit, so that the plaintext target index node can be obtained, thereby achieving access to the target index node.

[0099] In actual applications, when receiving a data processing request and executing the access to the target index node, there are three situations: First: the target index node to be accessed has been stored in the first cache unit, and the location of the metadata of the target index node in the cache description layer is directly calculated through the hash mapping layer of the first cache unit, and the metadata information of the target index node is updated, such as adding 1 to the historical access times of the target index node, and updating the value data of the target index node based on the target data in the data processing request. Second: the target index node to be accessed is in the second cache unit but not in the first cache unit, then a slot is added in the first cache unit to accommodate the target index node to be accessed, and the page identifier and offset of the data page where the target index node is located are calculated based on the node identifier of the target index node, the target index node is found in the second cache unit through the calculated page identifier and offset, and decrypted and written to the newly added slot of the first cache unit, and the metadata of the data page corresponding to the target index node in the second cache unit is updated, and then the first situation is executed to access the target index node. Third: the target index node to be accessed is in the third storage unit, not in the second cache unit and the first cache unit. First, a new slot is added in the second cache unit to accommodate the data page containing the target index node, and the data page is loaded from the third storage unit to the newly added slot of the second cache unit, and then the second situation mentioned above is executed to access the target index node.

[0100] In actual applications, the main execution logic of the first cache unit, the second cache unit and the third storage unit are all in the Enclave to reduce the interaction overhead between the Enclave and other untrusted memories. When executing an index node query, traverse from the B+tree root node (first cache unit) to the corresponding leaf node (third storage unit). When any index node is not in the Enclave, it needs to load the index node from the second cache unit or from the third storage unit through OCall.

[0101] In specific implementation, an index node may be kicked out from the first cache unit to make room for other index nodes. The kicked out index node is the above-mentioned adjustment index node. When the adjustment index node is removed from the first cache unit, in order to avoid the loss of the index node, the adjustment index node needs to be written back to the second cache unit. The specific implementation method is as follows:

[0102] After deleting the adjustment index node in the first cache unit, the method further includes:

[0103] Determine whether the adjustment index node is modified,

[0104] If so, if the data page of the second cache unit corresponding to the adjustment index node exists, the adjustment index node is encrypted and written back to the data page of the second cache unit corresponding to the adjustment index node, and the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

[0105] If not, the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

[0106] Specifically, due to the limited space of the first cache unit, when the slots of the cache pool of the first cache unit are full and the target index node is not in the first cache unit, an index node that is not currently accessed is selected as an adjustment index node through the LRU strategy and deleted from the first cache unit. If the adjustment index node has not been modified, the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated, for example, the adjustment index node is directly deleted from the first cache unit and the access count of the data page where the adjustment index node is located in the second cache unit is reduced by 1; if the adjustment index node has been modified, then if the data page corresponding to the adjustment index node exists in the second cache unit, the adjustment index node is encrypted and written back to the data page corresponding to the adjustment index node, and the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

[0107] If the data page corresponding to the adjustment index node does not exist in the second cache unit, there are two situations: one is that the data page corresponding to the adjustment index node exists in the third storage unit, and the other is that the data page corresponding to the adjustment index node does not exist, and a new data page needs to be created. The specific implementation method is as follows:

[0108] After determining that the adjustment index node is modified, the method further includes:

[0109] When the adjustment index node is a newly added index node and the adjustment index node does not have a corresponding data page of the second cache unit, the data page of the second cache unit corresponding to the adjustment index node obtained from the third storage unit is loaded into the second cache unit;

[0110] The adjusted index node is encrypted and written back to the data page of the second cache unit corresponding to the adjusted index node, and the historical access count of the data page of the second cache unit corresponding to the adjusted index node is updated.

[0111] Specifically, when it is determined that the adjustment index node is a newly added index node, but the data page of the second cache unit corresponding to the adjustment index node does not exist in the second cache unit but exists in the third storage unit, the data page corresponding to the adjustment index node is obtained from the third storage unit, and the data page is written to the second cache unit, and then the adjustment index node is encrypted and written back to the data page of the second cache unit.

[0112] In actual applications, the page identifier of the corresponding data page can be calculated by adjusting the node identifier of the index node, and then the page identifier of the data page is compared with the largest page identifier in the third storage unit. If the page identifier of the data page is less than or equal to the largest page identifier, it can be determined that the data page is in the third storage unit. If the page identifier of the data page is less than the largest page identifier, it can be determined that the data page is not in the third storage unit.

[0113] In an embodiment of the present specification, after the adjustment index node in the first cache unit is deleted, in order to avoid the loss of the adjustment index node, if the data page of the adjustment index node does not exist in the second cache unit, the data page will be loaded from the third storage unit, and then the adjustment index node will be encrypted and written back to the data page of the second cache unit, thereby implementing the update of the index node in the data page based on the adjustment index node.

[0114] In addition, after determining that the adjustment index node is modified, the method further includes:

[0115] When the adjusted index node is a newly added index node and the data page corresponding to the adjusted index node does not exist in the second cache unit and the third storage unit, a new data page corresponding to the adjusted index node is created in the second cache unit;

[0116] The adjusted index node is encrypted and written into a newly created data page, and the historical access count of the newly created data page is updated.

[0117] In specific implementation, based on the above method, if it is determined that the adjusted index node is a newly added index node, but the data page of the second cache unit corresponding to the adjusted index node does not exist in the second cache unit, and there is no third storage unit, a new data page corresponding to the adjusted index node is created in the second cache unit, and the adjusted index node is encrypted and written to the newly created data page, and the historical access count of the newly created data page is updated. For example, the historical access count of the newly created data page is updated from 0 times to 1 time.

[0118] In actual applications, if the index node to be adjusted has been modified or is a new index node, in order to avoid the loss of the index node, it is necessary to encrypt and write it back to the data page of the second cache unit. For example, if the index node is an existing index node, its corresponding data page must be in the second cache unit. In this case, it is only necessary to simply write the index node back to the corresponding data page and mark the data page as updated. If the index node is a new node and has not been written back to the data page of the second cache unit before, there are two situations. One situation is that if the data page where the index node is located is in the second cache unit, then it is sufficient to directly write back to the data page and mark the data page as updated. The other situation is that if the data page where the index node is located is not in the second cache unit, but in the third storage unit, then it is necessary to load the data page from the third storage unit to the second cache unit to avoid losing other nodes on the data page. If the index node is not in the second cache unit or the third storage unit, a new data page is created, and then the logic of the first situation is executed to write the index node back to the data page of the second cache unit.

[0119] In the embodiments of the present specification, each time the data processing method receives a data processing request and accesses the target index node, it deletes the index nodes with fewer historical access times in the first cache unit through a preset strategy, and then writes the target index node into the first cache unit. Based on the above method, it is possible to retain the index nodes with more frequent historical access times in the first cache unit. When the next data processing request is made, the target index node can be accessed directly from the first cache unit, thereby reducing the interaction overhead in the data processing process.

[0120] See also Figure 3, Figure 3 A schematic diagram of the structure of an encrypted database provided according to an embodiment of the present specification is shown.

[0121] Specifically, the database adopts the B+tree encryption index of Enclave-Native, and the B+tree encryption index of Enclave-Native includes a three-layer storage architecture of an EBuffer layer, an MBuffer layer, and an External storage layer, wherein the EBuffer layer includes a first cache unit, and each slot of the first cache unit includes a plaintext index node. Specifically,

[0122] The encrypted database receives a data processing request carrying encrypted target data, decrypts the encrypted target data, and determines a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; when it is determined that a first cache unit does not exist for the target index node and the first cache unit reaches a preset cache threshold, determines an adjustment index node in the first cache unit based on a preset strategy; deletes the adjustment index node in the first cache unit, and writes the target index node into the first cache unit to implement data processing of the target data.

[0123] In addition, the B+tree encrypted index further includes an MBuffer layer, the MBuffer layer includes a second cache unit, each slot of the second cache unit includes a data page, each data page is composed of a plurality of encrypted index nodes in the EBuffer layer, wherein,

[0124] When it is determined that the target index node exists in a second cache unit, the encrypted database determines the page identifier and offset of the data page of the target index node in the second cache unit based on the node identifier of the target index node; based on the page identifier and offset of the data page, the encrypted stored target index node is obtained in the second cache unit, and the encrypted stored target index node is decrypted and written into the first cache unit.

[0125] Optionally, the B+tree encrypted index further includes an External storage layer, the External storage layer includes a third cache unit, the third cache unit includes data pages in the MBuffer layer, wherein:

[0126] When it is determined that the target index node exists in a third storage unit, the encrypted database determines the data page containing the encrypted stored target index node from the third storage unit; writes the data page containing the encrypted stored target index node into the second cache unit; when it is determined that the target index node exists in a second cache unit, based on the node identifier of the target index node, determines the page identifier and offset of the data page of the target index node in the second cache unit; based on the page identifier and offset of the data page, obtains the encrypted stored target index node in the second cache unit, and decrypts the encrypted stored target index node and writes it into the first cache unit.

[0127] In actual applications, the EBuffer layer is the cache manager of the Enclave, which is configured to manage data transmission between unprotected host memory and protected Enclave memory at the granularity of index nodes, and the EBuffer layer includes a first cache unit, each slot of which includes a plaintext index node.

[0128] The MBuffer layer is a cache manager for unprotected host memory, configured to manage data transmission in units of data pages between the host memory and the External storage layer, and the MBuffer layer includes a second cache unit, each slot of the second cache unit includes a data page, and each data page is composed of multiple encrypted index nodes in the EBuffer layer.

[0129] The External storage layer is a persistent storage disk, which is configured to store index data of the data pages of the MBuffer layer, supports obtaining and using the index data from the External storage layer after reloading, and the External storage layer includes a third cache unit, which includes the data pages in the MBuffer layer.

[0130] In specific implementation, the data processing method is applied to the encrypted database, and the Enclave-Native B+tree encrypted index of the encrypted data adopts a three-layer storage architecture: an EBuffer layer including a first cache unit, an MBuffer layer including a second cache unit, and an External storage layer including a third storage unit, wherein the EBuffer layer is a cache manager in the Enclave, used to manage data transmission between an unprotected host memory and a protected Enclave memory with index nodes as the granularity, and each slot thereof contains a plaintext index node; the MBuffer layer is a cache manager in the unprotected host memory, used to manage data transmission between the host memory and the external storage with data pages as the unit, and each slot thereof contains a data page, and this data page is composed of multiple encrypted index nodes; the external storage layer is a persistent storage disk, used to save index data, and supports continued use of the index after reloading.

[0131] The difference between the EBuffer layer and the MBuffer layer lies in the encryption state, location, and size. For example, the EBuffer layer manages plaintext index nodes in the limited enclave memory, while the MBuffer layer manages encrypted data pages in the large host memory. Other than that, the two cache managers (i.e., the EBuffer layer and the MBuffer layer) have the same structure. Each cache manager consists of three components:

[0132] Bufferpool: The buffer pool is a simple array, each slot stores an index node in the EBuffer layer and a data page in the MBuffer layer;

[0133] Buffer descriptors: The cache descriptors are an array that stores metadata. Each slot corresponds to a slot in the buffer pool and stores the metadata of the corresponding index node / data page. The metadata includes a bidirectional pointer to maintain the logical order of each slot, forming a bidirectional linked list to support the LRU replacement strategy.

[0134] Hash map layer: The hash map layer is a hash table used to determine whether the index node / data page to be accessed is in the cache pool.

[0135] In addition, address conversion is required between adjacent layers in the storage architecture to convert the upper layer representation into the lower layer representation, that is, the node nodeID is converted into the pageID and offset of the data page, and the pageID is converted into the physical address.

[0136] And the main execution logic of B+tree, EBuffer and MBuffer are all implemented in Enclave to reduce the interaction between Enclave and other unprotected hosts and save interaction overhead. When executing index query, traverse from the root node of B+tree to the corresponding leaf node.

[0137] Specifically, when the database engine receives a data query request, it executes the query request, and accesses the index node corresponding to the keyword of the target data in the data processing request. If the index node to be accessed is already stored in the EBuffer layer: directly calculate the location of the metadata of the index node in the cache description layer through the hash mapping layer, and update the metadata information of the index node; if the accessed node is in the MBuffer layer but not in the EBuffer layer: add a slot in the EBuffer layer to accommodate the index node to be accessed, and calculate the pageID and its offset of the data page where the index node is located; find the index node in the MBuffer layer through this information and decrypt and write it to the allocated slot in the EBuffer layer, update the metadata information of the data page of the index node in the MBuffer layer, and then execute the above steps to access the index node; if the accessed node is in the external storage layer but not in the MBuffer layer and the EBuffer layer: add a slot in the MBuffer layer to accommodate the data page containing the required index node, and obtain the data page from the external storage layer. The page is loaded into MBuffer in the storage layer, and then the above steps are executed to access the index node; finally, the target data is queried by accessing the index node and the query result is returned.

[0138] The encrypted database provided in the embodiment of the present specification reduces the interaction overhead of the Enclave during the execution of the operation through the Enclave-native B+tree encrypted index method, and performs encryption and decryption at the granularity of the index node, thereby ensuring security while reducing the space overhead. Since the metadata of the index node will also be encrypted, the leakage of the metadata of the index node is greatly prevented; at the same time, the design of the cache manager (first cache unit) in the Enclave reduces the leakage of the index node query path information to a certain extent, that is, it supports multi-layer memory cache management, fully utilizes the limited memory of the Enclave to store frequently accessed index nodes, and avoids the leakage of node query path information.

[0139] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 4 FIG. 1 is a schematic diagram showing the structure of a data processing device provided by an embodiment of the present specification. Figure 4As shown, the device comprises:

[0140] The request receiving module 402 is configured to receive a data processing request, wherein the data processing request carries encrypted target data;

[0141] The target index node obtaining module 404 is configured to decrypt the encrypted target data and determine the target index node corresponding to the target data based on the keyword of the target data obtained after decryption;

[0142] The adjustment index node determination module 406 is configured to determine the adjustment index node in the first cache unit based on a preset strategy when it is determined that the target index node does not exist in the first cache unit and the first cache unit reaches a preset cache threshold;

[0143] The first data processing module 408 is configured to delete the adjustment index node in the first cache unit and write the target index node into the first cache unit to implement data processing on the target data.

[0144] Optionally, the first cache unit includes a cache pool storing index nodes, a cache description layer storing index node metadata, and a hash mapping layer;

[0145] Accordingly, the device further comprises:

[0146] The second data processing module is configured to:

[0147] In the case where it is determined that the target index node exists in the cache pool of the first cache unit, determining the position of the target index node in the cache description layer of the first cache unit based on the hash map layer of the first cache unit;

[0148] Based on the position of the target index node in the cache description layer of the first cache unit, metadata of the target index node is acquired, and data processing of the target data is implemented based on the metadata of the target index node.

[0149] Optionally, the first data processing module 408 is further configured to:

[0150] In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit;

[0151] The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

[0152] Optionally, the second cache unit includes a cache pool for storing data pages, a cache description layer for storing data page metadata, and a hash mapping layer;

[0153] Accordingly, the first data processing module 408 is further configured to:

[0154] Based on the node identifier of the target index node and the hash map layer of the second cache unit, a page identifier and an offset of a data page of the target index node in the cache pool of the second cache unit are determined.

[0155] Optionally, the first data processing module 408 is further configured to:

[0156] Based on the page identifier and the offset of the data page, acquiring the target index node stored in an encrypted manner in the cache pool of the second cache unit;

[0157] Determine a position of the encrypted and stored target index node in a cache description layer of the second cache unit;

[0158] Based on the position of the encrypted stored target index node in the cache description layer of the second cache unit, acquiring metadata of the encrypted stored target index node;

[0159] The encrypted and stored target index node is decrypted, and based on metadata of the decrypted target index node, the decrypted target index node is written into the first cache unit.

[0160] Optionally, the first data processing module 408 is further configured to:

[0161] In the case where it is determined that the target index node exists in a third storage unit, determining a data page of the target index node containing encrypted storage from the third storage unit;

[0162] Writing the data page of the target index node containing the encrypted storage into the second cache unit;

[0163] In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit;

[0164] The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

[0165] Optionally, the device further includes:

[0166] The judgment module is configured as follows:

[0167] Determine whether the adjustment index node is modified,

[0168] If so, if the data page of the second cache unit corresponding to the adjustment index node exists, the adjustment index node is encrypted and written back to the data page of the second cache unit corresponding to the adjustment index node, and the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

[0169] If not, the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

[0170] Optionally, the device further includes:

[0171] The first node write-back module is configured as follows:

[0172] When the adjustment index node is a newly added index node and the adjustment index node does not have a corresponding data page of the second cache unit, the data page of the second cache unit corresponding to the adjustment index node obtained from the third storage unit is loaded into the second cache unit;

[0173] The adjusted index node is encrypted and written back to the data page of the second cache unit corresponding to the adjusted index node, and the historical access count of the data page of the second cache unit corresponding to the adjusted index node is updated.

[0174] Optionally, the device further includes:

[0175] The second node write-back module is configured as follows:

[0176] When the adjusted index node is a newly added index node and the data page corresponding to the adjusted index node does not exist in the second cache unit and the third storage unit, a new data page corresponding to the adjusted index node is created in the second cache unit;

[0177] The adjusted index node is encrypted and written into a newly created data page, and the historical access count of the newly created data page is updated.

[0178] Optionally, the adjustment index node determination module 406 is further configured to:

[0179] Based on the historical access records of the index nodes in the first cache unit, an adjustment index node in the first cache unit is determined.

[0180] The data processing device provided in the embodiment of the present specification, each time receiving a data processing request and accessing the target index node, deletes the index nodes with fewer historical access times in the first cache unit through a preset strategy, and then writes the target index node into the first cache unit. Based on the above method, it is possible to retain the index nodes with more frequent historical access times in the first cache unit. When the next data processing request is made, the target index node can be accessed directly from the first cache unit, thereby reducing the interaction overhead in the data processing process.

[0181] The above is a schematic scheme of a data processing device of this embodiment. It should be noted that the technical scheme of the data processing device and the technical scheme of the above data processing method belong to the same concept, and the details of the technical scheme of the data processing device that are not described in detail can be referred to the description of the technical scheme of the above data processing method.

[0182] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0183] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0184] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0185] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 500 may also be a mobile or stationary server.

[0186] The processor 520 is used to execute the following computer executable instructions, where the processor is used to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement the steps of the data processing method.

[0187] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above data processing method.

[0188] An embodiment of the present specification further provides a computer-readable storage medium storing computer instructions, which implement the steps of the data processing method when the computer-executable instructions are executed by a processor.

[0189] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above data processing method.

[0190] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0191] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0192] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0193] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0194] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data processing method, comprising: receiving a data processing request, wherein the data processing request carries encrypted target data; Decrypting the encrypted target data, and determining a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; When it is determined that the target index node does not have a first cache unit and the first cache unit reaches a preset cache threshold, determining an adjustment index node in the first cache unit based on a preset strategy; The adjustment index node in the first cache unit is deleted, and the target index node is written into the first cache unit to realize data processing of the target data, wherein the target index node written into the first cache unit is a decrypted index node, and the adjustment index node is written into the second cache unit after encryption.

2. The data processing method according to claim 1, wherein the first cache unit comprises a cache pool storing index nodes, a cache description layer storing index node metadata, and a hash mapping layer; Correspondingly, after determining the target index node corresponding to the target data based on the keyword of the target data obtained after decryption, the method further includes: In the case where it is determined that the target index node exists in the cache pool of the first cache unit, determining the position of the target index node in the cache description layer of the first cache unit based on the hash map layer of the first cache unit; Based on the position of the target index node in the cache description layer of the first cache unit, metadata of the target index node is acquired, and data processing of the target data is implemented based on the metadata of the target index node.

3. The data processing method according to claim 1, wherein writing the target index node into the first cache unit comprises: In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit; The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

4. The data processing method according to claim 3, wherein the second cache unit comprises a cache pool for storing data pages, a cache description layer for storing data page metadata, and a hash mapping layer; Accordingly, determining the page identifier and offset of the data page of the target index node in the second cache unit based on the node identifier of the target index node includes: Based on the node identifier of the target index node and the hash map layer of the second cache unit, a page identifier and an offset of a data page of the target index node in the cache pool of the second cache unit are determined.

5. The data processing method according to claim 4, wherein the step of acquiring the encrypted stored target index node in the second cache unit based on the page identifier and offset of the data page, and decrypting the encrypted stored target index node and writing it into the first cache unit comprises: Based on the page identifier and the offset of the data page, acquiring the target index node stored in an encrypted manner in the cache pool of the second cache unit; Determine a position of the encrypted and stored target index node in a cache description layer of the second cache unit; Based on the position of the encrypted stored target index node in the cache description layer of the second cache unit, acquiring metadata of the encrypted stored target index node; The encrypted and stored target index node is decrypted, and based on metadata of the decrypted target index node, the decrypted target index node is written into the first cache unit.

6. The data processing method according to claim 1, wherein writing the target index node into the first cache unit comprises: In the case where it is determined that the target index node exists in a third storage unit, determining a data page of the target index node containing encrypted storage from the third storage unit; Writing the data page of the target index node containing the encrypted storage into the second cache unit; In the case where it is determined that the target index node has a second cache unit, based on the node identifier of the target index node, determining a page identifier and an offset of a data page of the target index node in the second cache unit; The encrypted stored target index node is obtained in the second cache unit based on the page identifier and the offset of the data page, and the encrypted stored target index node is decrypted and then written into the first cache unit.

7. The data processing method according to claim 6, after deleting the adjustment index node in the first cache unit, further comprising: Determine whether the adjustment index node is modified, If so, if the data page of the second cache unit corresponding to the adjustment index node exists, the adjustment index node is encrypted and written back to the data page of the second cache unit corresponding to the adjustment index node, and the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated. If not, the historical access count of the data page of the second cache unit corresponding to the adjustment index node is updated.

8. The data processing method according to claim 7, after determining that the adjustment index node is modified, further comprising: When the adjustment index node is a newly added index node and the adjustment index node does not have a corresponding data page of the second cache unit, the data page of the second cache unit corresponding to the adjustment index node obtained from the third storage unit is loaded into the second cache unit; The adjusted index node is encrypted and written back to the data page of the second cache unit corresponding to the adjusted index node, and the historical access count of the data page of the second cache unit corresponding to the adjusted index node is updated.

9. The data processing method according to claim 8, after determining that the adjustment index node is modified, further comprising: When the adjusted index node is a newly added index node and the data page corresponding to the adjusted index node does not exist in the second cache unit and the third storage unit, a new data page corresponding to the adjusted index node is created in the second cache unit; The adjusted index node is encrypted and written into a newly created data page, and the historical access count of the newly created data page is updated.

10. The data processing method according to any one of claims 1 to 9, wherein determining the adjustment index node in the first cache unit based on a preset strategy comprises: Based on the historical access records of the index nodes in the first cache unit, an adjustment index node in the first cache unit is determined.

11. A data processing device, comprising: A request receiving module, configured to receive a data processing request, wherein the data processing request carries encrypted target data; a target index node obtaining module, configured to decrypt the encrypted target data, and determine a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; an adjustment index node determination module, configured to determine an adjustment index node in the first cache unit based on a preset strategy when it is determined that the target index node does not exist in the first cache unit and the first cache unit reaches a preset cache threshold; A data processing module is configured to delete the adjusted index node in the first cache unit and write the target index node into the first cache unit to realize data processing of the target data, wherein the target index node written into the first cache unit is a decrypted index node, and the adjusted index node is written into the second cache unit after encryption.

12. An encrypted database, wherein the database adopts a B+tree encrypted index, and the B+tree encrypted index includes an EBuffer layer, the EBuffer layer includes a first cache unit, and each slot of the first cache unit includes a plaintext index node, wherein: The encryption database receives a data processing request carrying encrypted target data, decrypts the encrypted target data, and determines a target index node corresponding to the target data based on a keyword of the target data obtained after decryption; When it is determined that the target index node does not exist in the first cache unit and the first cache unit reaches a preset cache threshold, an adjustment index node in the first cache unit is determined based on a preset strategy; the adjustment index node in the first cache unit is deleted, and the target index node is written into the first cache unit to realize data processing of the target data, wherein the target index node written into the first cache unit is a decrypted index node, and the adjustment index node is written into the second cache unit after encryption.

13. The encrypted database according to claim 12, comprising: The B+tree encrypted index further includes an MBuffer layer, the MBuffer layer includes a second cache unit, each slot of the second cache unit includes a data page, and each data page is composed of a plurality of encrypted index nodes in the EBuffer layer, wherein: When it is determined that the target index node exists in a second cache unit, the encrypted database determines the page identifier and offset of the data page of the target index node in the second cache unit based on the node identifier of the target index node; based on the page identifier and offset of the data page, the encrypted stored target index node is obtained in the second cache unit, and the encrypted stored target index node is decrypted and written into the first cache unit.

14. The encrypted database according to claim 13, comprising: The B+tree encrypted index further includes an External storage layer, the External storage layer includes a third storage unit, the third storage unit includes data pages in the MBuffer layer, wherein: When it is determined that the target index node exists in a third storage unit, the encrypted database determines the data page containing the encrypted stored target index node from the third storage unit; writes the data page containing the encrypted stored target index node into the second cache unit; when it is determined that the target index node exists in a second cache unit, based on the node identifier of the target index node, determines the page identifier and offset of the data page of the target index node in the second cache unit; based on the page identifier and offset of the data page, obtains the encrypted stored target index node in the second cache unit, and decrypts the encrypted stored target index node and writes it into the first cache unit.

15. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the data processing method according to any one of claims 1 to 10 are implemented.

16. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 10.

Images