Data processing method and apparatus, device, and storage medium

Abstract

The application discloses a data processing method, device and equipment and a storage medium. The data processing method comprises the following steps: obtaining a running instruction of a program; in a trusted execution environment, obtaining a data description node and a preset structure tree according to file content comprising data required by the program to execute the running instruction, the data description node storing description information of the file content, encrypting a node key of a root node in the preset structure tree and encrypting a data key of a data node corresponding to the root node; encrypting the file content based on the preset structure tree to obtain an encryption result; the root node stores the node key and the data key, the node key encrypts a child node having a parent-child relationship with the root node in the preset structure tree, the data key encrypts a data node corresponding to the child node, and the data node stores the file content. The problem that data cannot be provided with encryption protection while being calculated and data for persistent storage cannot be provided with encryption protection in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, device, and storage medium. Background Technology

[0002] With the continuous development of internet technology, cloud-based data and services can be used to ensure the security of user data. In related technologies, computing systems can use a Trusted Execution Environment (TEE) to import encrypted user data into a trusted database running within the TEE. The trusted database's data processing engine then performs the calculations and returns the results to the user.

[0003] Although computing systems can use TEE (Transmission Equipment) to provide encrypted protection for data during computation, current encryption methods are ineffective in protecting user data if it is persistently stored on other storage media such as hard drives. This can lead to data leakage and compromise user data security. Summary of the Invention

[0004] This application provides a data processing method, apparatus, device, and storage medium that can provide encrypted protection for data during computation, as well as for data that needs to be persistently stored in other storage media, thereby preventing data leakage and improving data security.

[0005] According to a first aspect of the embodiments of this application, a data processing method is provided, comprising:

[0006] Obtain the program's execution instructions;

[0007] In a trusted execution environment, the file content is retrieved, which includes the data required for the program to execute its instructions.

[0008] Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0009] The file content is encrypted based on a preset tree structure to obtain the encryption result. The root node stores the node key and the data key. The node key is used to encrypt the child nodes in the preset tree structure that have a parent-child relationship with the root node, and the data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store the file content.

[0010] According to a second aspect of the embodiments of this application, a data processing method is provided, comprising:

[0011] In a trusted execution environment, obtain the content of the file to be encrypted;

[0012] Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0013] The file content is encrypted based on a preset structure tree to obtain the encryption result, which is then stored in a storage medium in an untrusted environment; among which,

[0014] The root node includes a node key and a data key. The node key is used to encrypt child nodes in the preset tree structure that have a parent-child relationship with the root node. The data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store file content.

[0015] According to a third aspect of the embodiments of this application, a data processing apparatus is provided, comprising:

[0016] The acquisition module is used to acquire the program's execution instructions;

[0017] The acquisition module is also used to acquire file content, including data required for program execution instructions, in a trusted execution environment;

[0018] The processing module is used to obtain the data description node and the preset structure tree corresponding to the data description node according to the file content. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0019] The encryption module is used to encrypt file content based on a preset tree structure to obtain the encryption result. The root node stores the node key and the data key. The node key is used to encrypt the child nodes in the preset tree structure that have a parent-child relationship with the root node, and the data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store the file content.

[0020] According to a fourth aspect of the embodiments of this application, a data processing apparatus is provided, comprising:

[0021] The acquisition module is used to acquire the content of the file to be encrypted in a trusted execution environment;

[0022] The acquisition module is also used to acquire, based on the file content, a data description node and a preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0023] The processing module is used to encrypt file content based on a preset structure tree, obtain the encryption result, and store the encryption result in a storage medium in an untrusted environment; wherein,

[0024] The root node includes a node key and a data key. The node key is used to encrypt child nodes in the preset tree structure that have a parent-child relationship with the root node. The data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store file content.

[0025] According to a fifth aspect of the embodiments of this application, a computer device is provided, including: a memory and a processor;

[0026] Memory, used to store computer programs;

[0027] A processor is used to execute a computer program stored in memory, which, when running, causes the processor to perform the steps of the data processing method as described in the first or second aspect.

[0028] According to a sixth aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a program or instructions are stored, which, when executed by a computer device, causes the computer device to perform the steps of the data processing method as shown in the first aspect or the second aspect.

[0029] According to a seventh aspect of the present application, a computer program product is provided, comprising a computer program that, when executed by a computer device, causes the computer device to perform the steps of the data processing method as shown in the first aspect or the second aspect.

[0030] According to the data processing method, apparatus, device, and storage medium in the embodiments of this application, the file content required for the program to execute the execution instructions is obtained in a trusted execution environment through the program's execution instructions. Based on the file content, data description nodes and the corresponding preset structure tree are obtained, and the file content is encrypted based on the preset structure tree to obtain the encryption result. Therefore, encrypting the file content through data description nodes and the preset structure tree can, on the one hand, provide data protection for programs running in a trusted execution environment; on the other hand, using the preset structure tree and cryptographic techniques to encrypt data that needs protection can also provide encryption protection for the data when the encryption result is stored in a persistent storage medium. Based on this, the embodiments of this application can provide encryption protection for data during computation while also providing encryption protection for data that needs to be persistently stored in other storage media, preventing data leakage. This achieves persistent data storage capability with confidentiality and integrity protection for programs running in a trusted execution environment, providing full lifecycle security protection for the program. Attached Figure Description

[0031] This application can be better understood from the following description of specific embodiments in conjunction with the accompanying drawings, wherein the same or similar reference numerals denote the same or similar features.

[0032] Figure 1 This is a schematic diagram illustrating a data processing architecture according to one embodiment;

[0033] Figure 2 This is a schematic diagram illustrating a data processing method according to one embodiment;

[0034] Figure 3 This is a flowchart illustrating a data processing method according to one embodiment;

[0035] Figure 4 This is a schematic diagram illustrating a preset structure tree according to one embodiment;

[0036] Figure 5 This is one of the flowcharts illustrating a data processing method according to one embodiment;

[0037] Figure 6 This is a second flowchart illustrating a data processing method according to one embodiment;

[0038] Figure 7 This is one of the schematic diagrams illustrating the structure of a data processing apparatus according to one embodiment;

[0039] Figure 8 This is a second schematic diagram showing the structure of a data processing apparatus according to one embodiment;

[0040] Figure 9 This is a schematic diagram illustrating the hardware structure of a computer device according to one embodiment. Detailed Implementation

[0041] The features and exemplary embodiments of various aspects of this application will now be described in detail. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only configured to explain this application and are not configured to limit this application. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples of this application.

[0042] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0043] Based on this, the following is in conjunction with the appendix Figure 1 and attached Figure 2 The data processing architecture provided in the embodiments of this application is shown below, and the data processing methods provided in the embodiments of this application will be described in detail.

[0044] In one or more possible embodiments, such as Figure 1 As shown, the data processing architecture proposed in this application embodiment may include a server 10 and a storage medium 11 with persistent storage, such as a solid-state drive or a hard disk drive.

[0045] The server 10 in this embodiment can be a hardware server or a cloud server. Server 10 can provide an operating system, a TEE (Transmission Equipment), a computing platform, a database 101, and an operating system interface 102. The operating system in this embodiment can be a UNIX operating system or a Linux operating system, the computing platform can be a privacy-enhancing computing platform such as the DataTrust computing platform, and the operating system interface 102 can be a Portable Operating System Interface (POSIX).

[0046] Based on this, in some examples, an instance of the Software Guard Extensions (SGX) security enhancement specification in server 10 can be used to distribute data to the TEE on the database 101 end through a secure channel. The TEE then protects the encrypted data and the data processing process via an application's (hereinafter referred to as the program's) Software Development Kit (SDK). It should be noted that SGX can also provide full encryption services for the hardware environment and secure channel in server 10.

[0047] The TEE can provide a protected, isolated area in the memory of server 10. Only the computing platform (or program) in the kernel of the authenticated database 101 can access the content stored in database 101 through the portable operating system interface, and use the data description nodes provided in this application embodiment and the corresponding preset structure tree, such as a variant structure tree of Merkle Hash Tree (MHT), to encrypt or decrypt the data. Other logic within database 101 or any other program running on server 10 (including operating systems, container software, etc.) cannot access the data in the TEE, thus ensuring data security at the database end.

[0048] In another instance, in addition to using SGX to implement TEE technology, this application also provides other types of examples such as Secure Memory Encryption (SEV), Trust Zone, or Enclave.

[0049] Based on this, if based on the above architecture, the data processing method provided by the embodiments of this application can utilize the trusted execution environment implemented by SGX to provide runtime protection for the database engine and persistent data, enabling the computing platform integrated in server 10, such as the privacy-enhancing computing platform, to run securely even when deployed in an untrusted environment, thus preventing data leakage.

[0050] The following is combined Figure 2 Taking a privacy-enhancing computing platform as an example, the data method provided in the embodiments of this application will be described.

[0051] Server 10 obtains the program's execution instructions in the operating system, provides a TEE through an SGX instance, and, taking the program's SDK as an example, distributes the file content to the trusted execution environment on the database 101 through the portable operating system interface 102. The file content includes the data required for the program to execute the execution instructions.

[0052] In a trusted execution environment, server 10 obtains data description nodes and their corresponding preset structure trees based on the file content. The data description nodes store description information and key information about the file content. The key information includes the node key for encrypting the root node in the preset structure tree and the data key for encrypting the data nodes corresponding to the root node. Thus, the preset structure tree, using cryptographic techniques, encrypts the file content to obtain the encryption result. The root node stores both the node key and the data key. The node key is used to encrypt child nodes in the preset structure tree that have a parent-child relationship with the root node, and the data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store the file content, providing data protection capabilities for programs running in the trusted execution environment.

[0053] Then, server 10 can store the encrypted result, i.e. TEE SDK, obtained in the trusted execution environment through portable operating system interface 102 into storage medium 11 with persistent storage. Here, the execution environment provided by storage medium 11 can be a trusted environment or an untrusted environment. Thus, on the one hand, SGX can be deployed in an untrusted environment to run securely, preventing data leakage and ensuring the data protection requirements of the privacy-enhancing computing platform. On the other hand, storing the encrypted result in a trusted environment can also provide persistent data storage capabilities with confidentiality and integrity protection, providing full lifecycle security protection for data.

[0054] It should be noted that, as Figure 2 As shown, in this embodiment of the application, based on different instructions such as instructions for obtaining file content and access instructions, a portable operating system interface with different compatible programming attributes can be provided to the user. In this embodiment of the application, the portable operating system interface can not only support functions such as file system class interfaces and environment variable associations, but also be compatible with encrypted and decrypted data, so that the program can have the ability to protect program data with less or no modification, thereby improving the convenience of program portability.

[0055] For example, the portable operating system interface 102 with different compatible programming attributes may include at least one of the following: an interface for opening a specified file (int open), an interface for reading specified content into a buffer (ssize_t read), an interface for writing buffer data to a file (ssize_t write), an interface for moving the file pointer (off_t lseek), an interface for obtaining information about an open file (int fstat), an interface for closing an open file (int close), an interface for deleting a specified file (int remove), and an interface for obtaining information about a specified file (int stat).

[0056] Specifically, if an instruction to retrieve file content is received, the file content can be retrieved through the information interface (int stat) for the specified file.

[0057] Based on the above architecture and application scenarios, the following will combine... Figure 3 The data processing method provided in the embodiments of this application will be described in detail.

[0058] Figure 3 This is a flowchart illustrating a data processing method according to one embodiment.

[0059] like Figure 3 As shown, the data processing method can be applied to computer equipment, which may include (e.g., Figure 1 and / or as Figure 2 The data processing method for the server shown may specifically include steps 310 to 340.

[0060] Step 310: Obtain the program's execution instructions.

[0061] Step 320: In a trusted execution environment, obtain the file content, which includes the data required for the program to execute the running instructions.

[0062] Furthermore, the trusted execution environment includes a first invocation interface, which is a portable operating system interface. Based on this, step 320 may specifically include:

[0063] In a trusted execution environment, file content is obtained through the first API call.

[0064] Step 330: Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0065] For example, such as Figure 4 As shown, the Metadata Node stores description information and key information of the file content. The key information includes the node key of the root node in the encryption preset structure tree, such as the encryption root (MHT) node 10, and the data key for encrypting the data (Data) node 11 corresponding to the MHT node 10.

[0066] Furthermore, this embodiment of the application can store file compatibility through multiple nodes in a preset structure tree. Here, the preset structure tree can be a variant of the Merkle tree structure tree, and the amount of data that each node in the preset structure tree can store can be configured according to user needs, such as 4096 bytes or 8192 bytes. Thus, this embodiment of the application can support random access operations on very large files, such as those greater than or equal to 16 zettabytes (ZB), while ensuring data access performance through the preset structure tree.

[0067] Step 340: Encrypt the file content based on the preset structure tree to obtain the encryption result; wherein, the root node includes a node key and a data key. The node key is used to encrypt the child nodes in the preset structure tree that have a parent-child relationship with the root node, and the data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store the file content.

[0068] Here, the preset structure tree in this embodiment may include at least two layers, each layer including at least one MHT node and a Data node corresponding to the MHT node.

[0069] For example, still using Figure 4 Taking a three-layer preset tree structure as an example, MHT node 10 and its corresponding Data node 11 are in the first layer. MHT node 21, MHT node 22, its corresponding Data node 211, and its corresponding Data node 221 are in the second layer. MHT node 31 and its corresponding Data node 311 are in the third layer.

[0070] For both the first and second layers, MHT node 10 is the root node (i.e., parent node) of MHT nodes 21 and 22, and MHT nodes 21 and 22 are child nodes of MHT node 10. Based on this, the node key stored in MHT node 10 is used to encrypt MHT nodes 21 and 22, which have a parent-child relationship with MHT node 10 in the preset structure tree. Specifically, the node key may include node key 1 and node key 2, where node key 1 is used to encrypt MHT node 21 and node key 2 is used to encrypt MHT node 22. The data key stored in MHT node 10 is used to encrypt Data node 211 corresponding to MHT node 21, and Data node 221 corresponding to MHT node 22. Specifically, the data key may include data key 1 and data key 2, where data key 1 is used to encrypt Data node 211 and data key 2 is used to encrypt Data node 221.

[0071] Similarly, for the second and third layers, MHT node 21 is the root node (i.e., parent node) of MHT node 31, and MHT node 31 is a child node of MHT node 21. Based on this, the node key stored in MHT node 21 is used to encrypt MHT node 31, which has a parent-child relationship with MHT node 21 in the preset structure tree. The data key stored in MHT node 21 is used to encrypt the Data node 311 corresponding to MHT node 31. Thus, when the preset structure tree can include at least four layers, the file content can be encrypted based on the preset structure tree in the manner described above.

[0072] It should be noted that, in this embodiment, the node key stored in the data description node for encrypting the root node in the preset structure tree can be specified by the user or randomly generated by the server. The decryption key is then fed back to the user for decryption. The data key stored in the data description node for encrypting the data node corresponding to the root node in this embodiment can be derived from a user-specified key. The node key and data key stored in the root node can be generated based on a random algorithm; specifically, they can be generated based on key information using a random algorithm.

[0073] Based on this, and Figure 3 The decryption steps corresponding to the data processing steps shown may specifically include:

[0074] First, obtain the program's access instructions, which include a first description of the file content to be accessed.

[0075] Next, according to the access instruction, the encrypted result is read into the trusted execution environment. Further, if the trusted execution environment includes a second calling interface, and the second calling interface is a portable operating system interface, the encrypted result can be read into the trusted execution environment through the second calling interface according to the access instruction. In one example, if the access instruction is to access the encrypted file content stored in the storage medium of the trusted environment, the encrypted result is read into the trusted execution environment through the second calling interface according to the access instruction. In another example, if an access instruction is obtained, and the access instruction is to access the encrypted file content stored in the storage medium of an untrusted environment, the encrypted result is read from the storage medium of the untrusted environment into the trusted execution environment according to the access instruction through the second calling interface.

[0076] Next, the first description information in the access instruction is matched with the description information stored in the encrypted result to obtain the matching result.

[0077] Furthermore, if the matching result includes a data description node that stores description information, the key information stored in the data description node and the preset structure tree corresponding to the data description node are obtained.

[0078] Then, based on the key information, the nodes in the preset tree structure are decrypted to obtain the file content stored in the preset tree structure, so that the program can access the file content.

[0079] Therefore, in a trusted execution environment, based on the content of the file to be encrypted, data description nodes and their corresponding preset structure trees are obtained. The file content is then encrypted based on these preset structure trees to obtain the encryption result. In this way, encrypting file content using data description nodes and preset structure trees provides data protection for programs running in a trusted execution environment. Furthermore, encrypting data requiring protection using the preset structure tree and cryptographic techniques ensures continued encryption protection even when the encrypted result is stored in a persistent storage medium. Based on this, the embodiments of this application can provide encryption protection for data during computation while simultaneously providing encryption protection for data that needs to be persistently stored in other storage media, preventing data leakage. This achieves persistent data storage capability with confidentiality and integrity protection for programs running in a trusted execution environment, providing full lifecycle security protection for the program.

[0080] Furthermore, in one or more possible embodiments, by storing the encrypted result obtained in the trusted execution environment to a storage medium in an untrusted environment, when an access command is received, the encrypted result stored in the storage medium in the untrusted environment is read into the trusted execution environment, and the encrypted result is decrypted in the trusted execution environment to obtain the file content, so that the program can access the file content. Therefore, embodiments of this application can store the encrypted result obtained in the trusted execution environment to a storage medium in an untrusted environment, enabling encrypted content to be securely stored even in an untrusted environment, preventing data leakage and ensuring data security.

[0081] Based on the same inventive concept, and using SGX to provide a TEE, and taking the program's SDK as an example, it achieves data processing functionality compatibility through a POSIX interface, combined with... Figure 5 This application provides a data processing method.

[0082] Figure 5 This is a flowchart illustrating a data processing method according to one embodiment.

[0083] like Figure 5 As shown, the data processing method can be applied to computer equipment, which may include (e.g., Figure 1 and / or as Figure 2 The data processing method for the server shown may specifically include steps 510 to 540.

[0084] Step 510: In a trusted execution environment, obtain the content of the file to be encrypted.

[0085] Specifically, in one or more examples, the trusted execution environment includes a first invocation interface, and step 510 may specifically include: in the trusted execution environment, obtaining the content of the file to be encrypted through the first invocation interface.

[0086] Step 520: Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0087] Step 530: Encrypt the file content based on the preset structure tree to obtain the encryption result; wherein, the root node stores the node key and the data key, the node key is used to encrypt the child nodes in the preset structure tree that have a parent-child relationship with the root node, the data key is used to encrypt the data nodes corresponding to the child nodes, and the data nodes are used to store the file content.

[0088] Step 540: Store the encryption result in a storage medium in an untrusted environment.

[0089] For example, the SDK is loaded into the server's process space when the program runs. When the program calls the first invocation interface in POSIX (such as the interface for obtaining information about a specified file) to access the specified file, the content of the file to be encrypted is obtained through the first invocation interface in the trusted execution environment.

[0090] Next, based on the file content, the data description node and the corresponding preset structure tree are obtained. If the SDK specifies an encrypted node key, the specified encrypted node key is stored in the data description node. This specified encrypted node key is used to encrypt the root node of the preset structure tree. A data key is derived based on the specified encrypted node key, and the data key is used to encrypt the data node corresponding to the root node.

[0091] Here, the data description node and its corresponding preset structure tree can be specified in the SDK or by the server. Then, the server randomly generates a key, which is used as the key stored in other nodes of the preset structure tree, such as the node key and data key stored in the root node.

[0092] Therefore, by encrypting file content through data description nodes and a preset structure tree, data protection can be provided for programs running in trusted execution environments. On the other hand, when the encrypted results are stored in a storage medium in an untrusted environment with persistent storage capabilities, encryption protection is provided for data that needs to be persistently stored in the untrusted environment, preventing data leakage. This achieves both providing persistent data storage capabilities with confidentiality and integrity protection for programs running in trusted environments, providing full lifecycle security protection for programs, and also providing data protection for programs in untrusted environments, preventing data leakage.

[0093] Based on this, and Figure 5 The decryption steps corresponding to the encryption steps in the data processing method shown can be specifically described as follows: Figure 6 As shown, the data processing method in this application embodiment may further include steps 610 to 650.

[0094] Step 610: Obtain the program's access instructions, which include first description information of the file content to be accessed.

[0095] Step 620: According to the access instruction, read the encrypted result stored in the storage medium into the trusted execution environment.

[0096] Specifically, in one or more examples, the trusted execution environment includes a second invocation interface, and step 620 may specifically include: reading the encrypted result stored in the storage medium into the trusted execution environment through the second invocation interface according to the access instruction.

[0097] It should be noted that the trusted execution environment includes a first call interface and a second call interface, which are portable operating system interfaces.

[0098] Step 630: Match the first description information with the description information stored in the encrypted result to obtain the matching result.

[0099] Step 640: If the matching result includes a data description node that stores description information, obtain the key information stored in the data description node and the preset structure tree corresponding to the data description node.

[0100] Step 650: Decrypt the nodes in the preset tree structure based on the key information to obtain the file content stored in the preset tree structure so that the program can access the file content.

[0101] For example, when a program calls the POSIX interface to access (including reading, writing, moving file pointers, etc.) file content, the SDK can transparently complete the data decryption operation according to the access instructions provided by the user, and read the encrypted result stored in the persistent storage medium into the trusted execution environment for decryption and use through the underlying system call to the POSIX interface.

[0102] In summary, the embodiments of this application utilize cryptographic technology to provide persistent data protection for programs running in a Trusted Execution Environment (TCB). The data requiring protection is encrypted using a key and stored on a persistent storage medium (such as a hard disk). This provides programs running in the TCB with persistent data storage capabilities that offer both confidentiality and integrity protection. Even if system calls are excluded from the TCB of the TCB, full lifecycle security protection is still provided. Therefore, it is possible to provide encrypted protection for data during computation while simultaneously providing encrypted protection for data that needs to be persistently stored on other storage media.

[0103] Furthermore, in this embodiment, the application provides the data protection to the user in the form of an SDK. Through a set of standard POSIX interfaces, existing programs can be ported and adapted with minimal or no modification to ensure data protection, without needing to focus too much on low-level details. The POSIX-compatible programming interface provided to the user enhances the ease of program portability by enabling minimal or no modification to the program's data protection capabilities. Simultaneously, it effectively addresses the issue of SDKs not supporting data encryption protection. Moreover, by utilizing the SGX trusted execution environment, runtime protection is provided for the database engine and persistent data, enabling the computing platform integrated into the service to run securely even when deployed in an untrusted environment, preventing data leakage.

[0104] Based on the data processing methods described above, this application provides a corresponding data processing apparatus. Specifically, in conjunction with... Figure 7 Please provide a detailed explanation.

[0105] Figure 7 This is a schematic diagram illustrating the structure of a data processing apparatus according to one embodiment.

[0106] like Figure 7 As shown, the data processing device 70 is applied to, for example... Figure 1 The server shown, the data processing device 70 may specifically include:

[0107] The acquisition module 701 is used to acquire the program's execution instructions;

[0108] The acquisition module 701 is also used to acquire file content in a trusted execution environment, the file content including data required for the program to execute running instructions;

[0109] The processing module 702 is used to obtain the data description node and the preset structure tree corresponding to the data description node according to the file content. The data description node stores the description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0110] The encryption module 703 is used to encrypt file content based on a preset structure tree to obtain an encryption result. The root node stores a node key and a data key. The node key is used to encrypt child nodes in the preset structure tree that have a parent-child relationship with the root node. The data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store file content.

[0111] The data processing apparatus 70 provided in the embodiments of this application will now be described in detail.

[0112] In one or more possible embodiments, the acquisition module 701 may be specifically used to acquire file content through the first calling interface in a trusted execution environment, where the trusted execution environment includes a first calling interface and the first calling interface is a portable operating system interface.

[0113] In another or more possible embodiments, the data processing device 70 in this application embodiment may further include a storage module for storing the encryption result to a storage medium in an untrusted environment.

[0114] In another or more possible embodiments, the data processing device 70 in this application embodiment may further include a reading module, a matching module, and a decryption module; wherein,

[0115] The acquisition module 701 is also used to acquire the program's access instructions, the access instructions including first descriptive information of the file content to be accessed;

[0116] The read module is used to read the encrypted result into the trusted execution environment according to the access command;

[0117] The matching module is used to match the first description information with the description information stored in the encrypted result to obtain the matching result;

[0118] The acquisition module 701 is also used to acquire, when the matching result includes a data description node storing description information, the key information stored in the data description node and the preset structure tree corresponding to the data description node;

[0119] The decryption module is used to decrypt nodes in a preset tree structure based on key information, thereby obtaining the file content stored in the preset tree structure so that the program can access the file content.

[0120] Furthermore, the reading module can be specifically used to read the encrypted result into the trusted execution environment through the second calling interface according to the access instruction, provided that the trusted execution environment includes a second calling interface and the second calling interface is a portable operating system interface.

[0121] Therefore, by using the program's execution instructions, the file content required for the program's execution instructions is obtained in a trusted execution environment. Based on the file content, data description nodes and their corresponding preset structure trees are obtained. The file content is then encrypted using these preset structure trees to obtain the encryption result. Thus, encrypting file content using data description nodes and preset structure trees provides data protection for programs running in a trusted execution environment. Furthermore, encrypting data requiring protection using the preset structure tree and cryptographic techniques ensures continued encryption protection even when the encrypted result is stored in a persistent storage medium. Based on this, the embodiments of this application can provide encryption protection for data during computation while simultaneously providing encryption protection for data that needs to be persistently stored in other storage media, preventing data leakage. This achieves persistent data storage capabilities with confidentiality and integrity protection for programs running in a trusted execution environment, providing full lifecycle security protection for the program.

[0122] Furthermore, based on the aforementioned data processing methods, this application provides a corresponding data processing apparatus. (Specifically combined with...) Figure 8 Please provide a detailed explanation.

[0123] Figure 8 This is a schematic diagram illustrating the structure of a data processing apparatus according to one embodiment.

[0124] like Figure 8 As shown, the data processing device 80 is applied to, for example... Figure 1 The server shown, the data processing device 80, may specifically include:

[0125] The acquisition module 801 is used to acquire the content of the file to be encrypted in a trusted execution environment;

[0126] The acquisition module 801 is also used to acquire, based on the file content, a data description node and a preset structure tree corresponding to the data description node. The data description node stores description information and key information of the file content. The key information includes the node key of the root node in the preset structure tree and the data key of the data node corresponding to the root node.

[0127] The processing module 802 is used to encrypt the file content based on a preset structure tree, obtain the encryption result, and store the encryption result in a storage medium in an untrusted environment.

[0128] The root node includes a node key and a data key. The node key is used to encrypt child nodes in the preset tree structure that have a parent-child relationship with the root node, and the data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store file content.

[0129] Figure 9 This is a schematic diagram illustrating the hardware structure of a computer device according to one embodiment.

[0130] like Figure 9 As shown, the computer device 900 includes an input device 901, an input interface 902, a processor 903, a memory 904, an output interface 905, and an output device 906.

[0131] Input interface 902, processor 903, memory 904, and output interface 905 are interconnected via bus 910. Input device 901 and output device 906 are connected to bus 910 via input interface 902 and output interface 905, respectively, and thus connected to other components of computer device 900. Specifically, input device 901 receives input information from the outside and transmits the input information to processor 903 via input interface 902; processor 903 processes the input information based on computer-executable instructions stored in memory 904 to generate output information, temporarily or permanently stores the output information in memory 904, and then transmits the output information to output device 906 via output interface 905; output device 906 outputs the output information to the outside of computer device 900 for user use.

[0132] In one embodiment, Figure 9 The computer device 900 shown can be implemented as a data processing device, which may include: a memory configured to store a program; and a processor configured to run the program stored in the memory to perform the data processing method described in the above embodiments.

[0133] In one embodiment, the memory can also be used to store file content and in conjunction with the above. Figures 1 to 6 The calculation results for each step in the described data processing procedure. As an example, the calculation results shall include at least: descriptive information, key information, and encryption result.

[0134] According to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as a computer-readable storage medium. For example, embodiments of this application include a computer-readable storage medium that stores a program or instructions on the medium, which, when executed by a computer device, causes the computer device to perform the steps of the above-described method.

[0135] According to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0136] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions that, when run on a computer, cause the computer to perform the methods described in the various embodiments above. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives), etc.

[0137] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data processing method, comprising: Obtain the program's execution instructions; In a trusted execution environment, the file content is obtained, which includes the data required by the program to execute the running instructions; Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key for encrypting the root node in the preset structure tree and the data key for encrypting the data node corresponding to the root node. The file content is encrypted based on the preset structure tree to obtain an encryption result; wherein, the root node stores a node key and a data key, the node key is used to encrypt child nodes in the preset structure tree that have a parent-child relationship with the root node, the data key is used to encrypt the data nodes corresponding to the child nodes, and the data nodes are used to store the file content; The method further includes: Obtain the access instruction of the program, the access instruction including first descriptive information of the file content to be accessed; According to the access instruction, the encryption result is read into the trusted execution environment; The first description information is matched with the description information stored in the encryption result to obtain a matching result; If the matching result includes a data description node that stores the description information, obtain the key information stored in the data description node, and the preset structure tree corresponding to the data description node; Based on the key information, the nodes in the preset structure tree are decrypted to obtain the file content stored in the preset structure tree, so that the program can access the file content.

2. The method according to claim 1, wherein, The trusted execution environment includes a first calling interface, which is a portable operating system interface. In the trusted execution environment, obtaining file content includes: In a trusted execution environment, the file content is obtained through the first call interface.

3. The method according to claim 1, wherein, The description also includes: The encryption result is stored in a storage medium in an untrusted environment.

4. The method according to claim 1, wherein, The trusted execution environment includes a second calling interface, which is a portable operating system interface; the step of reading the encryption result into the trusted execution environment according to the access instruction includes: According to the access instruction, the encrypted result is read into the trusted execution environment through the second calling interface.

5. A data processing method, comprising: In a trusted execution environment, obtain the content of the file to be encrypted; Based on the file content, obtain the data description node and the preset structure tree corresponding to the data description node. The data description node stores the description information and key information of the file content. The key information includes the node key for encrypting the root node in the preset structure tree and the data key for encrypting the data node corresponding to the root node. The file content is encrypted based on the preset structure tree to obtain an encryption result, and the encryption result is stored in a storage medium in an untrusted environment; wherein, the root node includes a node key and a data key, the node key is used to encrypt child nodes in the preset structure tree that have a parent-child relationship with the root node, the data key is used to encrypt the data nodes corresponding to the child nodes, and the data nodes are used to store the file content; The method further includes: Obtain the program's access instruction, the access instruction including first descriptive information of the file content to be accessed; According to the access instruction, the encryption result is read into the trusted execution environment; The first description information is matched with the description information stored in the encryption result to obtain a matching result; If the matching result includes a data description node that stores the description information, obtain the key information stored in the data description node, and the preset structure tree corresponding to the data description node; Based on the key information, the nodes in the preset structure tree are decrypted to obtain the file content stored in the preset structure tree, so that the program can access the file content.

6. A data processing apparatus, comprising: The acquisition module is used to acquire the program's execution instructions; The acquisition module is further configured to acquire file content in a trusted execution environment, the file content including data required by the program to execute the running instructions; The processing module is used to obtain a data description node and a preset structure tree corresponding to the data description node according to the file content. The data description node stores the description information and key information of the file content. The key information includes a node key for encrypting the root node in the preset structure tree and a data key for encrypting the data node corresponding to the root node. An encryption module is used to encrypt the file content based on the preset structure tree to obtain an encryption result; wherein, the root node stores a node key and a data key, the node key is used to encrypt child nodes in the preset structure tree that have a parent-child relationship with the root node, the data key is used to encrypt the data nodes corresponding to the child nodes, and the data nodes are used to store the file content; The acquisition module is further configured to acquire the access instruction of the program, the access instruction including first descriptive information of the file content to be accessed; A reading module is used to read the encryption result into the trusted execution environment according to the access instruction; A matching module is used to match the first description information with the description information stored in the encryption result to obtain a matching result; The acquisition module is further configured to, when the matching result includes a data description node storing the description information, acquire the key information stored in the data description node, and a preset structure tree corresponding to the data description node; The decryption module is used to decrypt the nodes in the preset structure tree based on the key information to obtain the file content stored in the preset structure tree, so that the program can access the file content.

7. A data processing apparatus, comprising: The acquisition module is used to acquire the content of the file to be encrypted in a trusted execution environment; The acquisition module is further configured to acquire, based on the file content, a data description node and a preset structure tree corresponding to the data description node, wherein the data description node stores description information and key information of the file content, and the key information includes a node key for encrypting the root node in the preset structure tree and a data key for encrypting the data node corresponding to the root node; The processing module is used to encrypt the file content based on the preset structure tree, obtain the encryption result, and store the encryption result in a storage medium in an untrusted environment; wherein, The root node includes a node key and a data key. The node key is used to encrypt child nodes in the preset tree structure that have a parent-child relationship with the root node. The data key is used to encrypt the data nodes corresponding to the child nodes. The data nodes are used to store the file content. The acquisition module is further configured to acquire the program's access instructions, the access instructions including first descriptive information of the file content to be accessed; A reading module is used to read the encryption result into the trusted execution environment according to the access instruction; A matching module is used to match the first description information with the description information stored in the encryption result to obtain a matching result; The acquisition module is further configured to, when the matching result includes a data description node storing the description information, acquire the key information stored in the data description node, and a preset structure tree corresponding to the data description node; The decryption module is used to decrypt the nodes in the preset structure tree based on the key information to obtain the file content stored in the preset structure tree, so that the program can access the file content.

8. A computer device, comprising: Memory and processor The memory is used to store computer programs; The processor is configured to execute a computer program stored in the memory, wherein when the computer program is executed, the processor performs the steps of the data processing method according to any one of claims 1 to 5.

9. A computer-readable storage medium storing a program or instructions that, when executed by a computer device, cause the computer device to perform the steps of the data processing method as described in any one of claims 1 to 5.

10. A computer program product comprising a computer program that, when executed by a computer device, causes the computer device to perform the steps of the data processing method as described in any one of claims 1 to 5.

Images