Data processing method, system, product, device and storage medium

Abstract

The embodiment of the present application provides a data processing method, system, product, device and storage medium. The method includes: receiving a key creation request sent by a client; generating first key information according to the key creation request; sending the first key information to the regional management node, so that the regional management node stores the first key information in the first storage system through the application programming interface; after the regional management node receives the key acquisition request sent by the partition service node, it obtains the first key information from the first storage system through the application programming interface, and sends the first key information to the partition service node, so that the partition service node loads and processes the data of the partition assigned to the partition server in the relevant Hbase table according to the loaded first key information. The technical solution provided by the embodiment of the present application can load key information without restarting the cluster, which improves the user experience.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, system, product, device and storage medium. Background Art

[0002] In the Internet era, technology is developing rapidly, and the volume of data storage is growing explosively. Using databases, especially non-relational databases, to store data can make using and storing data more convenient, but it also comes with certain security risks. For example, data files on storage media are at risk of being illegally accessed. Once illegally accessed, illegal accessors can use some conventional technical means to reverse the format and content of data storage, resulting in data leakage.

[0003] In order to avoid data leakage, it is necessary to encrypt the data stored on the storage medium. At present, the existing database data encryption scheme has defects in key management and poor user experience. Summary of the invention

[0004] In view of the above problems, the present application is proposed to provide a data processing method, system, product, device and storage medium that solve the above problems or at least partially solve the above problems.

[0005] Therefore, the first aspect of the present application provides a data processing method, which is applicable to a global management node in an Hbase database cluster, wherein the Hbase database cluster includes the global management node, a regional management node, and a partition service node managed by the regional management node; the method includes:

[0006] Receive the key creation request sent by the client;

[0007] Generate first key information according to the key creation request;

[0008] Sending the first key information to the regional management node, so that the regional management node stores the first key information in a first storage system through an application programming interface;

[0009] After receiving the key acquisition request sent by the partition service node, the regional management node obtains the first key information from the first storage system through the application programming interface, and sends the first key information to the partition service node, so that the partition service node can load and process the data of the partition assigned to the partition service node in the relevant Hbase table according to the loaded first key information.

[0010] A second aspect of the present application provides a data processing method, which is applied to a partition service node in an Hbase database cluster, wherein the Hbase database cluster includes the partition service node, a regional management node that manages the partition service node, and a global management node; the method includes:

[0011] Sending a key acquisition request to the regional management node, so that the regional management node acquires first key information from the first storage system through an application programming interface;

[0012] Receiving the first key information returned by the regional management node;

[0013] Loading the first key information;

[0014] Processing data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information;

[0015] The regional management node receives the first key information generated by the global management node according to the key creation request of the client and stores the first key information in the first storage system through an application programming interface.

[0016] A third aspect of the present application provides a data processing method, which is applied to a regional management node in an Hbase database cluster, wherein the Hbase database cluster includes a global management node, the regional management node, and a partition service node managed by the regional management node; the method includes:

[0017] Receiving first key information generated by the global management node according to a key creation request of the client;

[0018] Storing the first key information in the first storage system through an application programming interface;

[0019] After receiving the key acquisition request sent by the partition service node, acquiring the first key information from the first storage system through an application programming interface;

[0020] Sending the first key information to the partition service node for loading by the partition service node;

[0021] The partition service node is used to process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

[0022] A fourth aspect of the present application provides a data processing system, comprising: a global management node, a regional management node, and a partition service node managed by the regional management node in an Hbase database cluster;

[0023] The global management node is configured to receive a key creation request sent by a client; generate first key information according to the key creation request; and send the first key information to the regional management node;

[0024] The regional management node is configured to receive the first key information; and store the first key information in a first storage system through an application programming interface;

[0025] The partition service node is used to send a key acquisition request to the regional management node;

[0026] The regional management node is further configured to receive the key acquisition request sent by the partition service node; obtain the first key information from the first storage system through an application programming interface; and return the first key information to the partition service node;

[0027] The partition service node is further used to receive the first key information returned by the regional management node; load the first key information; and process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

[0028] In a fifth aspect of the present application, an electronic device is provided. The electronic device comprises: a memory and a processor, wherein:

[0029] The memory is used to store programs;

[0030] The processor is coupled to the memory and is used to execute the program stored in the memory to implement the data processing method described above.

[0031] In a sixth aspect of the present application, a computer-readable storage medium storing a computer program is provided, and when the computer program is executed by a computer, it can implement any of the above-mentioned data processing methods.

[0032] In a seventh aspect of the present application, a computer program product is provided, which includes: a computer program; when the computer program is executed by a computer, it can implement any of the data processing methods described above.

[0033] In another embodiment of the present application, a computer-readable storage medium storing a computer program is provided, wherein the computer program can implement any of the above-mentioned data processing methods when executed by a computer.

[0034] In the technical solution provided by the embodiment of the present application, after the global management node in the Hbase database cluster receives the key creation request sent by the client, it generates the first key information and synchronizes the first key information to the regional management node in the cluster, so that the regional management node can store the first key information in the first storage system through the application programming interface. When the partition service node in the cluster wants to load the first key information, it can request the regional management node to obtain it from the first storage system through the application programming interface. In other words, in the technical solution provided by the embodiment of the present application, the first key information is stored in the first storage system that supports hot loading, so that it can be obtained and loaded through the application programming interface without restarting the cluster, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 A schematic diagram of the structure of a data processing system provided in one embodiment of the present application;

[0037] Figure 2a A flowchart of a data processing method provided in one embodiment of the present application;

[0038] Figure 2b A schematic diagram of a key creation process provided in an embodiment of the present application;

[0039] Figure 3a A flowchart of a data processing method provided in one embodiment of the present application;

[0040] Figure 3b A schematic diagram of a key rotation process provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the internal storage format of Hfile provided in one embodiment of the present application;

[0042] Figure 5a A schematic diagram of the data encryption process of Hfile provided in an embodiment of the present application;

[0043] Figure 5b A schematic diagram of a data processing flow of a cluster provided in an embodiment of the present application;

[0044] Figure 6a A schematic diagram of a log storage process provided in an embodiment of the present application;

[0045] Figure 6b A schematic diagram of a first data decryption process provided by an embodiment of the present application;

[0046] Figure 6c A schematic diagram of a second data decryption process provided by an embodiment of the present application;

[0047] Figure 7 A flowchart of a data processing method provided in one embodiment of the present application;

[0048] Figure 8 A schematic diagram of the structure of a data processing device provided in one embodiment of the present application;

[0049] Fig. 9 A schematic diagram of the structure of a data processing device provided in one embodiment of the present application;

[0050] Fig.10 A schematic diagram of the structure of a data processing device provided in one embodiment of the present application;

[0051] Fig.11 A structural block diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0052] At present, the data encryption scheme based on the open source Hbase database is: the partition service node (RegionServer) in the database cluster saves the key through the local disk file, uses the symmetric encryption AES (Advanced Encryption Standard, Advanced Encryption Standard) algorithm, and encrypts the storage file (Hfile) to achieve static data encryption. Specifically, when it is turned on, it is first necessary to obtain the SSH (Secure Shell) login permission of all partition service nodes, and at the same time modify the local configuration file hbase-site.xml in one of the RegionServers, that is, to add key configuration information in the local configuration file, such as the key algorithm, the key file storage address, and the plaintext password for managing the key file. Then, through the script provided by the configuration file, a key file is generated, and the key file is saved in the above-mentioned key file storage address, and distributed to the host machine where other RegionServers are located. After that, the entire database cluster needs to be restarted to make the encryption effective. Among them, the key file saves CMK (Customer master key), which is a 16-bit or 32-bit key for AES symmetric encryption. For an existing Hbase table, set the table encryption property to open, and the table uses AES encryption by default. When files are flushed or compacted, that is, when new files are generated, encryption operations are performed. The encryption process is as follows: Before files are flushed or compacted, the AES key is obtained from the loaded key file, and the initial vector and data encryption key DEK (Data Encryption Key) required for AES encryption are generated at the same time; then, the file blocks are encrypted one by one according to the DEK and the initial vector. Before encrypting the file block, the data in the block is encoded and compressed. First, the data block in the file block is encrypted, and then the index block in it is encrypted. Finally, the encrypted DEK is stored in the encrypted file, that is, envelope encryption. In this scheme, when the key information needs to be replaced, a backup CMK needs to be configured in the hbase-site.xml of each regionserver. The generation and management methods can refer to the corresponding content about CNK above; then, after restarting all regionservers, a major compaction (major compaction) of the Hbase table needs to be performed. After the major compaction is completed, the new file is encrypted with the backup CMK.

[0053] After analysis, the above existing solutions have the following disadvantages:

[0054] 1. You need to modify the configuration file hbase-site.xml of each regionserver and restart the cluster for the key configuration to take effect.

[0055] 2. The password for managing the key is configured in plain text in hbase-site.xml. At the same time, the key file is also saved locally, which may cause the key to be lost.

[0056] In order to solve or partially solve the problems existing in the above-mentioned solutions, the embodiment of the present application provides a new data processing solution: obtaining the first key information stored in the first storage system, the first key information is obtained from the first storage system through the application programming interface; loading the first key information; processing the data according to the loaded first key information. That is, the first key information is stored in the first storage system that supports hot loading, so that the key can be obtained and loaded through the application programming interface without restarting the cluster, which improves the user experience.

[0057] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0058] In addition, some of the processes described in the specification, claims and the above-mentioned figures of the present application include multiple operations that appear in a specific order, and these operations may not be executed in the order in which they appear in this article or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0059] Figure 1 FIG. 1 shows a schematic diagram of the structure of a data processing system provided by an embodiment of the present application. Figure 1 As shown, the data processing system includes: a global management node 1, a regional management node 2 and a partition service node 3 managed by the regional management node in an Hbase database cluster;

[0060] The global management node 1 is used to receive a key creation request sent by a client; generate first key information according to the key creation request; and send the first key information to the regional management node 2;

[0061] The regional management node 2 is used to receive the first key information; and store the first key information in a first storage system through an application programming interface;

[0062] The partition service node 3 is used to send a key acquisition request to the regional management node 2;

[0063] The regional management node 2 is further configured to receive the key acquisition request sent by the partition service node 3; obtain the first key information from the first storage system through an application programming interface; and return the first key information to the partition service node 3;

[0064] The partition service node 3 is further used to receive the first key information returned by the regional management node 2; load the first key information; and process the data of the partition allocated to the partition service node in the relevant Hbase table according to the loaded first key information.

[0065] In actual application, in the above Hbase database cluster, there may be one global management node 1; there may be one or more regional management nodes 2; and there may be one or more partition service nodes managed by one regional management node.

[0066] It should be noted here that the data processing flow of each node in the embodiments of the present application and the interaction process between the nodes will be described in detail in the following embodiments.

[0067] Figure 2a The flowchart of the data processing method provided by an embodiment of the present application is shown. The method is applicable to the global management node in the Hbase database cluster, that is, the execution subject of the method is the global management node in the Hbase database cluster. Among them, the Hbase database is a non-relational database. Figure 2a As shown, the method includes:

[0068] 201. Receive a key creation request sent by a client.

[0069] 202. Generate first key information according to the key creation request.

[0070] 203. Send the first key information to the regional management node, so that the regional management node stores the first key information in a first storage system through an application programming interface.

[0071] Among them, after the regional management node receives the key acquisition request sent by the partition service node, it obtains the first key information from the first storage system through the application programming interface, and sends the first key information to the partition service node, so that the partition service node can load and process the data of the partition assigned to the partition service node in the relevant Hbase table according to the loaded first key information.

[0072] In the above 201, the client can send a key creation request to the global management node through a remote procedure call (RPC). That is, the key creation request is an RPC request, which is used to request to call the corresponding application programming interface (API) provided by the global management node to create the first key information.

[0073] In a specific example, the key creation request may be a shell command, which is essentially a call to an API interface.

[0074] In the above 202, in one example, a random key may be randomly generated according to the key creation request; and the first key information may be determined according to the random key.

[0075] In one example, an application programming interface may be called to generate the first key information according to the key creation request.

[0076] In the above 203, the global management node may synchronize the first key information to the regional management node, so that the regional management node stores the first key information in the first storage system through the application programming interface.

[0077] The first storage system can be understood as a storage system that supports dynamic loading, that is, data can be written to and read from the storage system through an application programming interface API. In this way, data written to the storage system can be immediately read out through the API without restarting the cluster.

[0078] Exemplarily, the first storage system may be a zookeeper-based storage system or a distributed file storage system DFS (Distributed File System), because the first storage system can be accessed through an application programming interface without restarting the cluster.

[0079] In actual application, the global management node can synchronize the first key information to all regional management nodes in the cluster, so that each regional management node can store the first key information in its corresponding first storage system through the application programming interface. Note: The first storage systems corresponding to different regional management nodes are not the same.

[0080] The data processing flow of the above-mentioned regional management node and partition service node and the interaction process between the two will be described in detail in the following embodiments.

[0081] In the technical solution provided by the embodiment of the present application, after the global management node in the Hbase database cluster receives the key creation request sent by the client, it generates the first key information and synchronizes the first key information to the regional management node in the cluster, so that the regional management node can store the first key information in the first storage system through the application programming interface. When the partition service node in the cluster wants to load the first key information, it can request the regional management node to obtain it from the first storage system through the application programming interface. In other words, in the technical solution provided by the embodiment of the present application, the first key information is stored in the first storage system that supports hot loading, so that it can be obtained and loaded through the application programming interface without restarting the cluster, thereby improving the user experience.

[0082] Optionally, the above method may further include:

[0083] 203. Store the first key information in a second storage system through an application programming interface.

[0084] The second storage system is also a storage system that supports hot loading. Exemplarily, the first storage system may be a zookeeper-based storage system or a distributed file storage system DFS (Distributed File System).

[0085] The first storage system and the second storage system are two different storage systems. The first key information is stored in the second storage system for backup and disaster recovery, to ensure that after the first key information in the first storage system is damaged, the first key information can be obtained and loaded from the second storage system.

[0086] Furthermore, the step of “generating first key information according to the key creation request” in 202 may include the following steps:

[0087] 2021. Generate a first plaintext key according to the key creation request.

[0088] 2022. Encrypt the first plaintext key according to the plaintext password to obtain a first ciphertext key.

[0089] 2023. Encrypt the plaintext password according to a preset cryptographic algorithm to obtain a ciphertext password.

[0090] In the above 2021, in one feasible solution, the first plaintext key can be randomly generated. In another feasible solution, the first plaintext key can be generated according to a preset rule. This embodiment of the present application does not specifically limit this.

[0091] In the above 2022, the above plain text password may be generated by the global management node; or may be sent by the client after receiving the plain text password input by the user.

[0092] The first plaintext key is encrypted according to the plaintext password to obtain a first ciphertext key.

[0093] In the above 2023, in actual application, the above preset key algorithm is pre-configured on the global management node and the regional management node. Of course, the above preset key algorithm can also be configured on the partition service node. In one embodiment, the preset cryptographic algorithm can be a shift cryptographic algorithm.

[0094] The first key information includes the first ciphertext key and the ciphertext password.

[0095] That is to say, the regional management node stores the first ciphertext key and ciphertext password in the first storage system. In this way, even if there is a data leak in the first storage system in the future, since the ciphertext password is stored, the illegal access personnel cannot decrypt the first ciphertext key through the ciphertext password, and cannot obtain the first plaintext key, and further cannot use the first plaintext key to decrypt the user data, thereby improving the security of user data.

[0096] In one example, the above method may further include:

[0097] 204. Store the first key information in a second storage system through an application programming interface.

[0098] The global management node stores the first key information in the second storage system for backup. When the first key information in the first storage system on the regional management node is lost, the regional management node can dynamically load the first key information from the second storage system to the first storage system without restarting the cluster.

[0099] Figure 2b The key creation flow chart provided in the embodiment of the present application is shown. Figure 2bAs shown, the client Client4 generates the first key information by remotely calling the API interface or shell interface on the global management node GlobalMaster1, and the first key information includes the ciphertext CMK. The global management node GlobalMaster stores the first key information in its corresponding zookeeper, and synchronizes the first key information to all regional management nodes LocalMaster2, and the regional management node LocalMaster2 stores the first key information in its corresponding zookeeper.

[0100] Figure 3a A flow chart of a data processing method provided by an embodiment of the present application is shown. The method is applied to a partition service node in an Hbase database cluster, that is, the execution subject of the method is a partition service node in an Hbase database cluster. The Hbase database is a non-relational database. The Hbase database cluster includes the partition service node, a regional management node that manages the partition service node, and a global management node. In one example, the Hbase database can specifically be a key-value non-relational database. Figure 3a As shown, the method includes:

[0101] 301. Send a key acquisition request to the regional management node, so that the regional management node acquires first key information from the first storage system through an application programming interface.

[0102] 302. Receive the first key information returned by the regional management node.

[0103] 303. Load the first key information.

[0104] 304. Process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

[0105] The regional management node receives the first key information generated by the global management node according to the key creation request of the client and stores the first key information in the first storage system through an application programming interface.

[0106] In the above 301, the partition service node may send a key acquisition request to the regional management node when the first key information needs to be used. In one example, the partition service node may send a key acquisition request to the regional management node after receiving a key loading request sent by the client. Specifically, it also includes:

[0107] 104. After receiving the key loading request sent by the client, trigger the step of sending a key obtaining request to the regional management node.

[0108] In another example, the partition service node may send a key acquisition request to the regional management node when the first key information loaded in its memory is damaged. In yet another example, the regional management node may notify the partition service node it manages of a key creation message after storing the first key information in the first storage system, and the partition service node may send a key acquisition request to the regional management node after receiving the key creation message.

[0109] The partition service node can send a key acquisition request to the regional management node through a remote procedure call RPC. That is, the key creation request is an RPC request, which is used to request to call the corresponding application programming interface API (Application Programming Interface) provided by the regional management node. The regional management node can remotely call the API interface provided by the first storage system to obtain the first key information from the first storage system.

[0110] In a specific example, the key creation request may be a shell command, which is essentially a call to an API interface.

[0111] In the above 303, loading the first key information means loading the related data of the above first key information into a specified location in the memory for subsequent encryption and decryption.

[0112] In the above 304, the data of the partition allocated to the partition service node in the Hbase table is encrypted or decrypted according to the loaded first key information.

[0113] It should be supplemented that storing the first key information in the first storage system can achieve persistent storage of the first key information, thereby improving reliability.

[0114] In actual application, the above-mentioned first key information may include: a first ciphertext key and a ciphertext password. Among them, the ciphertext password is obtained by encrypting the plaintext password; the first ciphertext key is obtained by encrypting the first plaintext key according to the plaintext password. That is to say, in the embodiment of the present application, the first storage system stores the ciphertext password. In this way, even if the first ciphertext key and the ciphertext password are illegally obtained, the illegal acquirer cannot decrypt the first ciphertext key according to the ciphertext password to obtain the first plaintext key, so that the data cannot be cracked, thereby improving the security of data storage. Of course, the above-mentioned first key information may also include: the key name corresponding to the first ciphertext key.

[0115] Accordingly, the “loading the first key information” in the above 303 can be implemented by the following steps:

[0116] 3031. Decrypt the ciphertext password according to a preset cryptographic algorithm to obtain a plaintext password.

[0117] 3032. Decrypt the first ciphertext key according to the plaintext password to obtain a first plaintext key.

[0118] 3033. Cache the first plaintext key in the memory of the partition service node.

[0119] The first plaintext key is used to process data of the partition assigned to the partition service node in the Hbase table.

[0120] In the above 3031, the preset cryptographic algorithm is preset and configured on the partition service node. The preset cryptographic algorithm can be a shift cryptographic algorithm. The implementation of the shift cryptographic algorithm can refer to the prior art and will not be described in detail here.

[0121] The ciphertext password can be input into a preset cryptographic algorithm to be decrypted by the preset cryptographic algorithm to obtain a plaintext password.

[0122] In the above 3032, the first ciphertext key is decrypted according to the plaintext password to obtain the first plaintext key.

[0123] In the above 3033, the first plaintext key is cached in a specified location in the memory of the partition service node, so that the above data can be processed later according to the first plaintext key.

[0124] In an achievable solution, the step of “processing the data of the partition in the Hbase table allocated to the partition service node according to the loaded first key information” in 304 above includes:

[0125] 3041. Obtain a second plaintext key.

[0126] 3042. Encrypt the data according to the second plaintext key to obtain ciphertext data.

[0127] 3043. Encrypt the second plaintext key according to the first plaintext key to obtain a second ciphertext key.

[0128] 3044. Determine a storage file based on the ciphertext data and the second ciphertext key.

[0129] The storage file includes the ciphertext data and the second ciphertext key.

[0130] 3045. Store the storage file.

[0131] In the above 3041, the partition service node may generate the above second plaintext key in the memory in advance, and when it is needed later, it can be directly obtained from the memory. The second plaintext key is also the above DEK, which is the key actually used to encrypt data. The partition service node may generate the above second plaintext key in the memory each time the partition assigned to the partition service node in the Hbase table is opened. Note: The partition service node will delete the above second plaintext key in the memory each time the partition assigned to the partition service node in the Hbase table is closed. That is, the second plaintext key changes with the change of the partition status.

[0132] In one example, in the above 3042, an initial vector generated for the data may be obtained; the data may be encrypted according to the initial vector and the second plaintext key to obtain initial ciphertext data; and the ciphertext data may be determined according to the initial ciphertext data and the initial vector. The ciphertext data includes the initial ciphertext data and the initial vector. Before the data is encrypted according to the initial vector and the second plaintext key, the data may also be encoded and compressed.

[0133] Taking the Hbase table in the database cluster as an example, the above data may be data in a block in the file Hfile corresponding to the Hbase table, or may be WALEdit in the log log.

[0134] Take the storage file Hfile as an example. Figure 4 As shown, Hfile generally includes multiple data blocks 100 (datablock), multiple index blocks 200 (index block) and metadata area (may include file tail trailer), which can be encrypted at block level to improve storage security. Specifically, multiple data blocks and multiple index blocks in Hfile can be encoded, compressed and encrypted according to the first plaintext key to obtain multiple ciphertext data blocks and multiple ciphertext index blocks.

[0135] Figure 5a The processing flow of the data block 100 is shown. The data block is encoded 211, compressed 212 and encrypted 213 to obtain a ciphertext data block (including a header and an array of encrypted bytes). According to a plurality of ciphertext data blocks, a plurality of ciphertext index blocks and a second ciphertext key, a storage file is determined. Specifically, the second ciphertext key can be stored in a metadata area in the storage file, such as a file trailer.

[0136] The data block includes multiple key-value pairs.

[0137] Take log as an example, Figure 6aAs shown, the log log usually includes multiple WALEdit311. In actual application, the WALEdit in the log log is added to the end of the log storage file in the third storage system. In this process, the WALEdit is encrypted according to the second plaintext key to obtain the ciphertext WALEdit, the log storage file is opened, and the ciphertext WALEdit is written to the end of the log storage file; when the log storage file is closed, the second ciphertext key is placed in the metadata area meta312 of the log storage file to obtain a new log storage file. Figure 6a A log storage file is shown, in which a plurality of encrypted WALEdits are stored, and a second ciphertext key is stored in the metadata area meta312.

[0138] In the above 3045, the above storage file can be stored in a third storage system. The third storage system can be a distributed file storage system, for example: HDFS (Hadoop Distributed File System). In an example, the above third storage system and the first storage system can be the same storage system or different storage systems, and the embodiment of the present application does not specifically limit this.

[0139] In actual application, after triggering the flush operation, Hfile compaction operation or flushing WALEdit in wal to the third storage system for the partition region in the Hbase table in the database cluster assigned to the partition service node, the above steps 1031 to 1034 are executed, that is, when a new file is generated, the encryption process is triggered. In addition, the above partition region includes multiple Stores; each Store includes a Memstore and multiple StoreFiles (that is, HFiles). In order to improve storage security, different second plaintext keys can be generated in memory for different Stores. In this way, the second plaintext keys used for encryption of Hfiles corresponding to different Stores are different. And as the state of the Region changes (open or close), the DEK corresponding to the Store inside it will also be updated accordingly.

[0140] like Figure 5b As shown in the figure, the processing flow of the entire cluster is as follows:

[0141] S40: The client requests the global management node to create a CMK.

[0142] S41. The global management node sends the created CMK to the regional management node, so that the regional management node stores the CMK on Zookeeper through the API.

[0143] S42. The partition service node obtains the CMK from the regional management node.

[0144] S43. The partition service node encrypts the log WAL according to the DEK to obtain a ciphertext log file, and encrypts the DEK with the CMK to obtain a ciphertext DEK.

[0145] S44. The partition service node encrypts the data file of the relevant partition according to the DEK to obtain a ciphertext data file, and encrypts the DEK with the CMK to obtain a ciphertext DEK.

[0146] S45. Associate the ciphertext log file with the ciphertext DEK and store them on HDFS.

[0147] S46. Associate the ciphertext data file with the ciphertext DEK and store them on HDFS.

[0148] In addition, the “processing the data according to the loaded first key information” in 304 above also includes:

[0149] 3046. Obtain ciphertext data and a second ciphertext key from a storage file of the partition allocated to the partition service node in the relevant Hbase table.

[0150] 3047. Decrypt the second ciphertext key according to the first plaintext key to obtain a second plaintext key.

[0151] 3048. Decrypt the ciphertext data according to the second plaintext key to obtain plaintext data.

[0152] In the above 3046, the ciphertext data and the second ciphertext key may be obtained from the storage file in the third storage system. The second ciphertext key is stored in the metadata area of ​​the storage file.

[0153] In the above 3047, the loaded first plaintext key is obtained from the memory of the partition service node, and the second ciphertext key is decrypted according to the first plaintext key to obtain the second plaintext key.

[0154] In one example, in the above 3048, the ciphertext data is parsed to obtain the initial vector and the initial ciphertext data; the initial ciphertext data is decrypted according to the second plaintext key and the initial vector to obtain the plaintext data. In actual application, the plaintext data can also be decompressed and decoded to obtain the original data.

[0155] Figure 6b The figure shows the decryption process of the data block in the file File. Figure 6b As shown, the decryption process includes:

[0156] S21, the file reader filereader reads the storage file LDFile,

[0157] S22. According to the index block indexblocks in LDFile, search ScannedBlocks (that is, the above-mentioned ciphertext data block)

[0158] S23. Find the target ciphertext data block Datablock.

[0159] S24. Obtain the ciphertext DEK from the metadata area Trailer of the LDFile.

[0160] S25. Decrypt the ciphertext DEK according to the plaintext CMK in the memory to obtain the plaintext DEK.

[0161] S26. Decrypt the ciphertext byte array in the target ciphertext data block Datablock according to the plaintext DEK.

[0162] S27. Decompress.

[0163] S28. Decode to obtain the plaintext data block Datablock.

[0164] S29. Return the target KeyValue in the plaintext data block Datablock to the file reader filereader.

[0165] Figure 6c The figure shows the decryption process of the ciphertext WALEdit in the log. Figure 6c As shown, the process includes:

[0166] S31. Decrypt the ciphertext DEK obtained from the metadata area meta in the log file according to the plaintext CMK to obtain the plaintext DEK.

[0167] S32. Decrypt the ciphertext WALEdit in the log file log according to the plaintext DEK to obtain the plaintext WALEdit.

[0168] S33. The log reader WALReader outputs the plain text WALEdit.

[0169] The above decryption process occurs when the partition service node accesses the storage file in the third storage system or during the Hfile merging process.

[0170] In order to facilitate the user to perform key rotation, the above method further includes:

[0171] 305. After receiving the key rotation request sent by the client, trigger the step of sending a key acquisition request to the regional management node.

[0172] 306. Decrypt the storage file of the partition allocated to the partition service node in the Hbase table according to the original second key information in the memory of the partition service node to obtain a decrypted storage file.

[0173] 307. Merge the decrypted storage files to obtain a merged storage file.

[0174] In the above 304, “processing the data of the partition in the Hbase table allocated to the partition service node according to the loaded first key information” includes:

[0175] 3041. Encrypt the merged storage file according to the loaded first key information.

[0176] In the above 306, if the loaded second key information exists in the memory of the partition service node, it means that the storage files in the current third storage system are all encrypted by the loaded second key information.

[0177] In order to replace the new key, the storage file needs to be decrypted according to the loaded second key information to obtain the decrypted storage file; and the decrypted storage files are merged to obtain the merged storage file; then, the merged storage file is encrypted with the new first key information to obtain the ciphertext merged storage file. The ciphertext merged storage file is stored in the third storage system.

[0178] In one example, the storage file refers to the storage file Hfile corresponding to the partition allocated to the partition service node in the hbase table in the database cluster.

[0179] In actual application, after the above step 306, the loaded second key information can be marked as expired in the memory, or the second key information can be deleted in the memory of the partition service node so that the subsequent partition service node can process the data according to the first key information.

[0180] The above process can be called a key rotation process. Figure 3b The key rotation flow chart provided in the embodiment of the present application is shown. Figure 3bAs shown, the client can trigger the partition service node to perform key rotation S1 (corresponding to S1: triggering rotation), and the partition service node S1 obtains the first key information from the regional management node and loads the first key information into the memory (corresponding to S2: original CMK state transfer). The partition service node executes the above steps 306, 307 and 3041, (corresponding to S3: major compaction of the table). The partition service node deletes the original second key information in the memory (corresponding to S4: original CMK safe deletion), and the rotation ends S5. The entire rotation process does not require restarting the cluster.

[0181] Furthermore, the above method may also include: the partition service node receives an encryption configuration attribute update request of the Hbase table, the encryption configuration attribute update request carries relevant information of the target key algorithm, for example, the name; the encryption configuration attribute of the partition assigned to the partition service node in the Hbase table is changed to relevant information of the target key algorithm to obtain the modified encryption configuration attribute; the partition is closed; and the partition is opened to reload the modified encryption configuration attribute.

[0182] In this way, the encryption algorithm of the database table is changed. The target key algorithm can be AES or SMS4 algorithm.

[0183] In actual application, the client can send an encrypted configuration attribute update request to the above-mentioned global management node. After receiving the update request, the global management node forwards the update request to the regional management node, and then the regional management node forwards it to the partition service node.

[0184] To sum up, in the process of static data encryption, key hierarchy encryption, envelope encryption and block-level encryption granularity are used, which is transparent to users and suitable for big data scenarios. In the technical solution provided in the embodiment of the present application, key management can be independent of external KMS services, forming a closed loop of key management and rotation, and an interface for docking with KMS is also reserved. Users can choose the corresponding encryption service according to their needs. Static encryption key management is relatively simpler for users. User management keys can be created through API or shell commands, and there is no need to restart the cluster from creation to key effectiveness, and subsequent key rotation, so it is more user-friendly. All key-related configurations are unclear, and there is no risk of key and configuration leakage; it also supports the SMS4 national encryption algorithm.

[0185] It should be noted here that: for the contents of each step not fully described in detail in the method provided in the embodiment of the present application, please refer to the corresponding contents in the above embodiment, which will not be repeated here. In addition, in addition to the above steps, the method provided in the embodiment of the present application may also include other parts or all of the steps in the above embodiments, which can be specifically referred to the corresponding contents in the above embodiments, which will not be repeated here.

[0186] Figure 7 The flowchart of the data processing method provided by an embodiment of the present application is shown. The method is applied to the regional management node in the Hbase database cluster, that is, the execution subject of the method is the regional management node in the Hbase database cluster. The Hbase database can be a non-relational database. The Hbase database cluster includes a global management node, the regional management node, and a partition service node managed by the regional management node. Figure 7 As shown, the method includes:

[0187] 701. Receive first key information generated by the global management node according to a key creation request from a client.

[0188] 702. Store the first key information in the first storage system through an application programming interface.

[0189] 703. After receiving the key acquisition request sent by the partition service node, obtain the first key information from the first storage system through an application programming interface.

[0190] 704. Send the first key information to the partition service node so that the partition service node loads it.

[0191] The partition service node is used to process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

[0192] The specific implementation of the above steps 701, 702, 703 and 704 can refer to the corresponding content in the above embodiments, which will not be repeated here.

[0193] It should be noted here that: for the contents of each step not fully described in detail in the method provided in the embodiment of the present application, please refer to the corresponding contents in the above embodiment, which will not be repeated here. In addition, in addition to the above steps, the method provided in the embodiment of the present application may also include other parts or all of the steps in the above embodiments, which can be specifically referred to the corresponding contents in the above embodiments, which will not be repeated here.

[0194] The regional management node will be combined with Figure 1 The technical solution provided in the embodiment of the present application is introduced as follows:

[0195] 1. The client (not shown) sends a creation command for remotely calling a shell interface or an API interface to the global management node 1.

[0196] 2. Global management node 1 verifies the creation command. After the verification passes, the first plaintext CMK is generated.

[0197] 3. Use the jckes encryption algorithm provided by JDK and the plaintext password entered by the user to encrypt the first plaintext CMK to obtain the first ciphertext CMK.

[0198] 4. Use the shift cipher algorithm to encrypt the plaintext password to obtain the ciphertext password.

[0199] 5. Store the first key information in the second storage system provided by Zookeeper on the global management node, where the first key information includes: the ciphertext password and the first ciphertext CMK association

[0200] 6. Synchronize the first key information to the regional management node 2.

[0201] 7. Regional management node 2 stores the synchronized first key information in the first storage system provided by zookeeper on regional management node 2.

[0202] 8. Regional management node 2 sends a key creation message to partition service node 3.

[0203] 9. After receiving the key creation message, the partition service node 3 sends a key acquisition request to the regional management node 2.

[0204] 10. The regional management node 2 obtains the first key information from the first storage system through the application programming interface.

[0205] 11. The regional management node 2 sends the first key information to the partition service node 41.

[0206] 12. The partition service node 3 loads the first key information to cache the first plaintext CMK in a specified location in the local memory.

[0207] 13. After the partition service node 3 has loaded the first key information, the partition service node 3 determines whether there is a loaded second plaintext CMK in its memory.

[0208] 14. If it exists, the partition service node 3 decrypts the storage file according to the loaded second plaintext CMK to obtain the decrypted storage file;

[0209] 15. Partition service node 3 merges the decrypted storage files to obtain a merged storage file;

[0210] 16. The partition service node 3 encrypts the merged storage file according to the loaded first plaintext CMK.

[0211] 17. Delete the loaded second plaintext CMK in the memory of partition service node 3 to implement key rotation.

[0212] 18. When partition service node 3 triggers a flush or compaction operation, it encrypts the newly generated file according to the first plaintext CMK.

[0213] The encryption process can be referred to the corresponding contents in the above embodiments, which will not be described here. The newly generated files include Hfile or log storage files.

[0214] 19. When partition service node 3 accesses the encrypted file stored on HDFS, it decrypts the encrypted Hfile according to the first plaintext CMK.

[0215] The decryption process can refer to the corresponding content in the above embodiments, which will not be repeated here. The encrypted file includes the encrypted Hfile or the encrypted log storage file.

[0216] Figure 8 The structural block diagram of a data processing device provided by another embodiment of the present application is shown. The device is set in a global management node in an Hbase database cluster, and the Hbase database cluster includes the global management node, a regional management node, and a partition service node managed by the regional management node. Figure 8 As shown, the device comprises:

[0217] The first receiving module 801 is used to receive a key creation request sent by a client;

[0218] A first generating module 802, configured to generate first key information according to the key creation request;

[0219] A first sending module 803, configured to send the first key information to the regional management node, so that the regional management node stores the first key information in a first storage system through an application programming interface;

[0220] After receiving the key acquisition request sent by the partition service node, the regional management node obtains the first key information from the first storage system through the application programming interface, and sends the first key information to the partition service node, so that the partition service node can load and process the data of the partition assigned to the partition service node in the relevant Hbase table according to the loaded first key information.

[0221] Optionally, the above device may further include a first storage module, which is used to:

[0222] The first key information is stored in a second storage system through an application programming interface.

[0223] It should be noted here that: the data processing device provided in the above embodiment can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding contents in the above method embodiments, which will not be repeated here.

[0224] Fig. 9 The structural block diagram of a data processing device provided by another embodiment of the present application is shown. The device is set in a partition service node in an Hbase database cluster. The Hbase database cluster includes the partition service node, a regional management node that manages the partition service node, and a global management node. The device includes:

[0225] A second sending module 901 is used to send a key acquisition request to the regional management node, so that the regional management node acquires first key information from the first storage system through an application programming interface;

[0226] A second receiving module 902 is used to receive the first key information returned by the regional management node;

[0227] A loading module 903, used to load the first key information;

[0228] A processing module 904 is used to process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information;

[0229] The regional management node receives the first key information generated by the global management node according to the key creation request of the client and stores the first key information in the first storage system through an application programming interface.

[0230] Optionally, the above device may further include a third receiving module, configured to:

[0231] After receiving the key creation message sent by the regional management node, triggering the step of sending a key acquisition request to the regional management node;

[0232] The key creation message is generated by the regional management node after storing the first key information in the first storage system through an application programming interface.

[0233] Optionally, the above device may further include:

[0234] A judgment module, used for judging whether there is loaded second key information in the memory of the partition service node after the first key information is loaded;

[0235] a decryption module, configured to decrypt the storage file of the partition allocated to the partition service node in the Hbase table according to the second key information if the second key information is loaded in the memory of the partition service node, so as to obtain the decrypted storage file;

[0236] A merging module, used for merging the decrypted storage files to obtain a merged storage file;

[0237] The processing module 904 is specifically configured to:

[0238] The merged storage file is encrypted according to the loaded first key information.

[0239] Optionally, the above device may further include:

[0240] A deletion module is used to delete the second key information in the memory of the partition service node.

[0241] It should be noted here that: the data processing device provided in the above embodiment can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding contents in the above method embodiments, which will not be repeated here.

[0242] Fig.10 A structural block diagram of a data processing device provided by another embodiment of the present application is shown. The device is set in a regional management node in an Hbase database cluster, wherein the Hbase database cluster includes a global management node, the regional management node, and a partition service node managed by the regional management node; as shown in FIG6 , the device includes:

[0243] The fourth receiving module 1001 is used to receive the first key information generated by the global management node according to the key creation request of the client;

[0244] A second storage module 1002, configured to store the first key information in the first storage system through an application programming interface;

[0245] A first acquisition module 1003 is configured to acquire the first key information from the first storage system through an application programming interface after receiving a key acquisition request sent by the partition service node;

[0246] A third sending module 1004 is used to send the first key information to the partition service node, so that the partition service node loads it;

[0247] The partition service node is used to process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

[0248] It should be noted here that: the data processing device provided in the above embodiment can implement the technical solutions described in the above method embodiments. The specific implementation principles of the above modules or units can be found in the corresponding contents in the above method embodiments, which will not be repeated here.

[0249] Fig.11 FIG. 1 is a schematic diagram showing the structure of an electronic device provided by an embodiment of the present application. Fig.11 As shown, the electronic device includes a memory 1101 and a processor 1102. The memory 1101 can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method for operating on the electronic device. The memory 1101 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0250] The memory 1101 is used to store programs;

[0251] The processor 1102 is coupled to the memory 1101 and is used to execute the program stored in the memory 1101 to implement the data processing methods provided by the above-mentioned method embodiments.

[0252] Further, if Fig.11 As shown, the electronic device also includes: a communication component 1103, a display 1104, a power component 1105, an audio component 1106 and other components. Fig.11 Only some components are shown schematically, which does not mean that the electronic device only includes Fig.11 Components shown.

[0253] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the steps or functions of the data processing method provided by the above-mentioned method embodiments can be implemented.

[0254] Accordingly, an embodiment of the present application further provides a computer program product stored therein, including a computer program, which, when executed by a computer, can implement the steps or functions of the data processing methods provided by the above-mentioned method embodiments.

[0255] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0256] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0257] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method, wherein: A global management node applied to an Hbase database cluster, wherein the Hbase database cluster includes the global management node, a regional management node, and a partition service node managed by the regional management node; the method includes: Receive the key creation request sent by the client; Generate first key information according to the key creation request; Sending the first key information to the regional management node, so that the regional management node stores the first key information in a first storage system through an application programming interface; After receiving the key acquisition request sent by the partition service node, the regional management node obtains the first key information from the first storage system through the application programming interface, and sends the first key information to the partition service node, so that the partition service node can load and process the data of the partition assigned to the partition service node in the relevant Hbase table according to the loaded first key information.

2. The method according to claim 1, wherein: Generating first key information according to the key creation request includes: Generate a first plaintext key according to the key creation request; Encrypting the first plaintext key according to the plaintext password to obtain a first ciphertext key; Encrypt the plaintext password according to a preset cryptographic algorithm to obtain a ciphertext password; The first key information includes the first ciphertext key and the ciphertext password.

3. The method according to claim 1, wherein: Also includes: The first key information is stored in a second storage system through an application programming interface.

4. The method according to any one of claims 1 to 3, wherein: Generating first key information according to the key creation request includes: According to the key creation request, an application programming interface is called to generate first key information.

5. A data processing method, wherein: A partition service node applied to an Hbase database cluster, wherein the Hbase database cluster includes the partition service node, a regional management node that manages the partition service node, and a global management node; the method includes: Sending a key acquisition request to the regional management node, so that the regional management node acquires first key information from the first storage system through an application programming interface; Receiving the first key information returned by the regional management node; Loading the first key information; Processing data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information; The regional management node receives the first key information generated by the global management node according to the key creation request of the client and stores the first key information in the first storage system through an application programming interface.

6. The method according to claim 5, wherein: The first key information includes a first ciphertext key and a ciphertext password; Loading the first key information includes: Decrypting the ciphertext password according to a preset cryptographic algorithm to obtain a plaintext password; Decrypting the first ciphertext key according to the plaintext password to obtain a first plaintext key; caching the first plaintext key in the memory of the partition service node; The first plaintext key is used to process data of the partition assigned to the partition service node in the Hbase table.

7. The method according to claim 5 or 6, wherein: Also includes: After receiving the key loading request sent by the client, the step of sending the key obtaining request to the regional management node is triggered.

8. The method according to claim 5 or 6, wherein: Also includes: After receiving the key rotation request sent by the client, triggering the step of sending a key acquisition request to the regional management node; Decrypting the storage file of the partition allocated to the partition service node in the Hbase table according to the original second key information in the memory of the partition service node to obtain the decrypted storage file; Merging the decrypted storage files to obtain a merged storage file; Processing data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information includes: The merged storage file is encrypted according to the loaded first key information.

9. The method according to claim 8, wherein: Also includes: The second key information is deleted in the memory of the partition service node.

10. A data processing method, wherein: A regional management node applied to an Hbase database cluster, wherein the Hbase database cluster includes a global management node, the regional management node, and a partition service node managed by the regional management node; the method includes: Receiving first key information generated by the global management node according to a key creation request of the client; Storing the first key information in a first storage system through an application programming interface; After receiving the key acquisition request sent by the partition service node, acquiring the first key information from the first storage system through an application programming interface; Sending the first key information to the partition service node for loading by the partition service node; The partition service node is used to process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

11. A data processing system, wherein: include: The global management node, regional management node and partition service nodes managed by the regional management node in the Hbase database cluster; The global management node is used to receive a key creation request sent by a client; Generate first key information according to the key creation request; Sending the first key information to the regional management node; The regional management node is used to receive the first key information; Storing the first key information in a first storage system through an application programming interface; The partition service node is used to send a key acquisition request to the regional management node; The regional management node is further configured to receive the key acquisition request sent by the partition service node; Acquire the first key information from the first storage system through an application programming interface; return the first key information to the partition service node; The partition service node is further used to receive the first key information returned by the regional management node; load the first key information; and process the data of the partition allocated to the partition service node in the Hbase table according to the loaded first key information.

12. An electronic device, wherein: include: A memory and a processor, wherein The memory is used to store programs; The processor is coupled to the memory, and is used to execute the program stored in the memory to implement the data processing method according to any one of claims 1 to 10.

13. A computer program product, wherein: include: Computer program; when the computer program is executed by a computer, it can implement the data processing method according to any one of claims 1 to 10.

14. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a computer, the data processing method according to any one of claims 1 to 10 can be implemented.

Images