Data processing methods, apparatus, electronic devices and computer-readable storage media

Abstract

The present disclosure provides a data processing method, device, electronic device, computer-readable storage medium and computer program product, which relate to the field of computer technology, and in particular to the field of data security technology. The implementation scheme is: obtaining encrypted data encrypted by a server using a first key; obtaining the first key and a first identifier of a first application that is allowed to access the encrypted data from the server; mapping the encrypted data to a virtual directory; in response to receiving a request from a second application to access the encrypted data through the virtual directory, verifying the second application based on the first identifier and the second identifier of the second application; and in response to the first identifier matching the second identifier, decrypting the encrypted data using the first key so that the second application can access the decrypted data.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, in particular to the field of data security technology, and specifically to a data processing method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of computer technology, more and more computing devices can share data. In the scenario of data sharing, data security has gradually become an issue that cannot be ignored. Data encryption and decryption technology can help improve data security.

[0003] The methods described in this section are not necessarily methods that have been previously conceived or employed. Unless otherwise indicated, it should not be assumed that any method described in this section is considered to be prior art simply because it is included in this section. Similarly, unless otherwise indicated, the issues mentioned in this section should not be considered to have been recognized in any prior art. Summary of the invention

[0004] The present disclosure provides a data processing method, apparatus, electronic device, computer-readable storage medium, and computer program product.

[0005] According to one aspect of the present disclosure, a data processing method is provided, which is applied to a client. The method includes: obtaining encrypted data encrypted by a server using a first key; obtaining the first key and a first identifier of a first application that is allowed to access the encrypted data from the server; mapping the encrypted data to a virtual directory; in response to receiving a request from a second application to access the encrypted data through the virtual directory, verifying the second application based on the first identifier and the second identifier of the second application; and in response to the first identifier matching the second identifier, decrypting the encrypted data using the first key so that the second application can access the decrypted data.

[0006] According to another aspect of the present disclosure, a data processing device is provided, which is applied to a client. The device includes: a first acquisition unit, configured to acquire encrypted data encrypted by a server using a first key; a second acquisition unit, configured to acquire the first key and a first identifier of a first application that is allowed to access the encrypted data from the server; a mapping unit, configured to map the encrypted data to a virtual directory; a verification unit, configured to verify the second application based on the first identifier and the second identifier of the second application in response to receiving an access request for the encrypted data from the second application through the virtual directory; and a decryption unit, configured to decrypt the encrypted data using the first key in response to the first identifier matching the second identifier, so that the second application can access the decrypted data.

[0007] According to another aspect of the present disclosure, an electronic device is provided, comprising at least one processor; and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the data processing method described above.

[0008] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the above data processing method.

[0009] According to another aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein the computer program implements the above data processing method when executed by a processor.

[0010] According to one or more embodiments of the present disclosure, the data encryption and decryption capabilities can be decoupled from the development of business applications, thereby improving the efficiency of data encryption and decryption.

[0011] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0013] Figure 1 A schematic diagram showing an exemplary system in which the various methods described herein may be implemented according to an embodiment of the present disclosure;

[0014] Figure 2 A flow chart of a data processing method according to an embodiment of the present disclosure is shown;

[0015] Figure 3 A flowchart showing a partial process of a data processing method according to an embodiment of the present disclosure;

[0016] Figure 4 A flow chart of a data processing method according to an embodiment of the present disclosure is shown;

[0017] Figure 5 A structural block diagram of a data processing device according to an embodiment of the present disclosure is shown;

[0018] Figure 6A structural block diagram of a data processing device according to an embodiment of the present disclosure is shown; and

[0019] Figure 7 A structural block diagram of an exemplary electronic device that can be used to implement the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0020] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0021] In the present disclosure, unless otherwise specified, the use of the terms "first", "second", etc. to describe various elements is not intended to limit the positional relationship, temporal relationship, or importance relationship of these elements, and such terms are only used to distinguish one element from another element. In some examples, the first element and the second element may refer to the same instance of the element, and in some cases, based on the description of the context, they may also refer to different instances.

[0022] The terms used in the description of various examples in this disclosure are only for the purpose of describing specific examples and are not intended to be limiting. Unless the context clearly indicates otherwise, if the number of elements is not specifically limited, the element can be one or more. In addition, the term "and / or" used in this disclosure covers any one of the listed items and all possible combinations.

[0023] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0024] As mentioned above, in data sharing scenarios, data security issues have gradually become an issue that cannot be ignored. For example, in cloud computing or edge computing scenarios, servers or client devices can encrypt or decrypt data to improve data security.

[0025] In some embodiments, an application layer file encryption and decryption solution may be used. However, encrypting or decrypting files at the application layer usually requires modifying the underlying code of the application, which is a cumbersome process and requires high development standards for application developers. In some embodiments, a dedicated encryption and decryption software development kit may be used to meet the needs of file encryption and decryption.

[0026] With the continuous development of edge computing technology, more and more computing nodes and applications are distributed and deployed in data centers close to terminals, which makes the service response performance and reliability higher than cloud computing technology. At the same time, data security at edge devices is becoming more and more important. For example, in the scenario of using edge computing technology for model training, model training can be performed in the cloud and deployed at the edge. The AI ​​model data at the edge device, important configuration files, and certificate files that edge-cloud communication relies on all have high security requirements. Once leaked, it will bring serious security risks.

[0027] In the edge AI scenario, edge devices usually adopt the currently popular cloud-native microservice architecture. Different microservices usually come from different R&D teams, and the underlying technologies or development languages ​​used are also different. In addition, a large number of open source software products and tools are used in common edge AI solutions. When there is a need to encrypt and decrypt data, developers need to adapt the corresponding encryption and decryption software development kits for different development languages. This work is huge and difficult to maintain. In addition, the use of encryption and decryption software development kits requires users to properly keep the keys themselves, and usually requires collaboration with key management services (KMS), which increases the overall difficulty of development. If the user of the software development kit does not follow the development specifications and hard-codes the keys in the code, the security of the data may be greatly reduced.

[0028] In view of this, the present disclosure proposes a data processing method, which maps encrypted data to a virtual directory through a client. When an application accesses the encrypted data through the access path of the virtual directory, the client can respond to the access request and verify whether the application that makes the access request is an authorized application according to the identifier; and provide decrypted data for the authorized application. As a result, there is no need for the client user to modify the underlying code of the application using a software development kit, and there is no need for developers to adapt the encryption and decryption software development kit for different development languages ​​used by different clients. While ensuring the overall encryption and decryption strength, the data encryption and decryption capabilities can be decoupled from the development of business applications, thereby improving the efficiency of data encryption and decryption.

[0029] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0030] Figure 1 FIG. 1 is a schematic diagram of an exemplary system 100 in which various methods and apparatuses described herein may be implemented according to an embodiment of the present disclosure. Figure 1, the system 100 includes one or more client devices 101, 102, 103, 104, 105, and 106, a server 120, and one or more communication networks 110 coupling the one or more client devices to the server 120. The client devices 101, 102, 103, 104, 105, and 106 may be configured to execute one or more applications.

[0031] In some embodiments, server 120 may also provide other services or software applications, which may include non-virtualized environments and virtualized environments. In some embodiments, these services may be provided as web-based services or cloud services, such as provided to users of client devices 101, 102, 103, 104, 105, and / or 106 under a software as a service (SaaS) model.

[0032] exist Figure 1 In the configuration shown, the server 120 may include one or more components that implement the functions performed by the server 120. These components may include software components, hardware components, or a combination thereof that can be executed by one or more processors. Users operating client devices 101, 102, 103, 104, 105, and / or 106 may in turn utilize one or more client applications to interact with the server 120 to utilize the services provided by these components. It should be understood that a variety of different system configurations are possible, which may differ from the system 100. Therefore, Figure 1 is one example of a system for implementing the various methods described herein and is not intended to be limiting.

[0033] In an embodiment of the present disclosure, the client devices 101 , 102 , 103 , 104 , 105 and / or 106 may run one or more services or software applications that enable execution of the data processing method according to an embodiment of the present disclosure.

[0034] The client device may provide an interface that enables a user of the client device to interact with the client device. The client device may also output information to the user via the interface. Figure 1 Only six client devices are depicted, but one skilled in the art will appreciate that the present disclosure may support any number of client devices.

[0035] Client devices 101, 102, 103, 104, 105 and / or 106 may include various types of computer devices, such as portable handheld devices, general-purpose computers (such as personal computers and laptop computers), workstation computers, wearable devices, smart screen devices, self-service terminal devices, service robots, game systems, thin clients, various messaging devices, sensors or other sensing devices, etc. These computer devices may run various types and versions of software applications and operating systems, such as MICROSOFT Windows, APPLE iOS, UNIX-like operating systems, Linux or Linux-like operating systems (such as GOOGLE Chrome OS); or include various mobile operating systems, such as MICROSOFT Windows Mobile OS, iOS, Windows Phone, Android. Portable handheld devices may include cellular phones, smart phones, tablet computers, personal digital assistants (PDAs), etc. Wearable devices may include head-mounted displays (such as smart glasses) and other devices. Game systems may include various handheld game devices, Internet-enabled game devices, etc. Client devices are capable of executing various different applications, such as various Internet-related applications, communication applications (such as email applications), short message service (SMS) applications, and may use various communication protocols.

[0036] The network 110 may be any type of network known to those skilled in the art that may support data communications using any of a variety of available protocols, including but not limited to TCP / IP, SNA, IPX, etc. By way of example only, the one or more networks 110 may be a local area network (LAN), an Ethernet-based network, a token ring, a wide area network (WAN), the Internet, a virtual network, a virtual private network (VPN), an intranet, an extranet, a blockchain network, a public switched telephone network (PSTN), an infrared network, a wireless network (e.g., Bluetooth, WIFI), and / or any combination of these and / or other networks.

[0037] Server 120 may include one or more general purpose computers, dedicated server computers (e.g., PC (personal computer) servers, UNIX servers, mid-range servers), blade servers, mainframe computers, server clusters, or any other suitable arrangement and / or combination. Server 120 may include one or more virtual machines running virtual operating systems, or other computing architectures involving virtualization (e.g., one or more flexible pools of logical storage devices that may be virtualized to maintain a server's virtual storage device). In various embodiments, server 120 may run one or more services or software applications that provide the functionality described below.

[0038] The computing units in the server 120 may run one or more operating systems including any of the above operating systems and any commercially available server operating systems. The server 120 may also run any of a variety of additional server applications and / or middle-tier applications, including HTTP servers, FTP servers, CGI servers, JAVA servers, database servers, etc.

[0039] In some implementations, server 120 may include one or more applications to analyze and consolidate data feeds and / or event updates received from users of client devices 101, 102, 103, 104, 105, and / or 106. Server 120 may also include one or more applications to display data feeds and / or real-time events via one or more display devices of client devices 101, 102, 103, 104, 105, and / or 106.

[0040] In some embodiments, the server 120 may be a server of a distributed system, or a server combined with a blockchain. The server 120 may also be a cloud server, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. A cloud server is a host product in a cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private servers (VPS) services.

[0041] The system 100 may also include one or more databases 130. In some embodiments, these databases may be used to store data and other information. For example, one or more of the databases 130 may be used to store information such as audio files and video files. The databases 130 may reside in various locations. For example, the database used by the server 120 may be local to the server 120, or may be remote from the server 120 and may communicate with the server 120 via a network-based or dedicated connection. The databases 130 may be of different types. In some embodiments, the databases used by the server 120 may be, for example, relational databases. One or more of these databases may store, update, and retrieve data to and from the databases in response to commands.

[0042] In some embodiments, one or more of the databases 130 may also be used by applications to store application data. The databases used by the applications may be different types of databases, such as a key-value store, an object store, or a conventional store backed by a file system.

[0043] Figure 1The system 100 may be configured and operated in various ways to enable the application of various methods and apparatuses described in the present disclosure.

[0044] Figure 2 A flow chart of a data processing method 200 according to an embodiment of the present disclosure is shown. The data processing method 200 is applied to a client, for example, can be applied to an edge device in an edge computing scenario.

[0045] The method 200 comprises the following steps:

[0046] Step S210: Obtaining encrypted data encrypted by the server using a first key;

[0047] Step S220: Obtain a first key and a first identifier of a first application program that is allowed to access encrypted data from a server;

[0048] Step S230, mapping the encrypted data to the virtual directory;

[0049] Step S240: in response to receiving a request from the second application to access the encrypted data through the virtual directory, verifying the second application based on the first identifier and the second identifier of the second application; and

[0050] Step S250: In response to the first identifier matching the second identifier, decrypt the encrypted data using the first key so that the second application can access the decrypted data.

[0051] Clients can communicate with server devices (such as cloud servers in edge computing scenarios).

[0052] In step S210, the encrypted data obtained may be encrypted by the server using the first key based on various encryption technologies (such as symmetric encryption technology). And the encrypted data may be encrypted text data, image data, video data, etc. The encrypted data may also be AI model data, model-related configuration files, and certificate files that edge-cloud communication relies on. In one example, a 64-bit data block may be encrypted using a 56-bit key based on the Data Encryption Standard (DES).

[0053] In step S220, the first key obtained by the client is the first key used by the server to encrypt the data. The first identifier may be a unique numeric string corresponding to the first application. In one example, there may be multiple first applications that are allowed to access the encrypted data, and thus, there may be multiple identifiers, each of which may correspond to a first application that is allowed to access the encrypted data.

[0054] In step S230, the encrypted data may be mapped to a virtual directory according to a preset mapping rule. The virtual directory may be a mapping of a source directory storing the encrypted data. The access path of the virtual directory is different from the access path of the source directory, and the virtual directory may be used to receive an application's access request to the encrypted data. In other words, the application will not directly access the source directory, but access the mapped virtual directory.

[0055] It should be understood that unencrypted plaintext data can also be mapped to a virtual directory, and an application can also send an access request to the plaintext data through the virtual directory, which will not be described in detail here.

[0056] In step S240, the client may generate a second identifier corresponding to the second application according to the access request of the second application. And verifying the second application may include verifying whether the second identifier matches the first identifier. In one example, when there are multiple first identifiers, it may be verified whether the second identifier matches any one of the multiple first identifiers.

[0057] The client maps the encrypted data to the virtual directory. When the application accesses the encrypted data through the access path of the virtual directory, the client can respond to the access request and verify whether the application making the access request is an authorized application based on the identifier; and provide decrypted data for the authorized application. As a result, there is no need for the client user to modify the underlying code of the application using the software development kit, nor is there a need for developers to adapt the encryption and decryption software development kit for different development languages ​​used by different clients. While ensuring the overall encryption and decryption strength, the data encryption and decryption capabilities can be decoupled from the development of business applications, thereby improving the efficiency of data encryption and decryption.

[0058] In addition, by utilizing the identification of the application, more fine-grained application-level permission control can be achieved. In other words, only those applications that are verified as being allowed to access the encrypted data can access the decrypted data, while those applications on the same client device that are not verified as being allowed to access the encrypted data cannot access the decrypted data. In addition, even if the application on the client device is maliciously tampered with, or a malicious application attempts to access the encrypted file, the application cannot obtain the decrypted data because the current identification and the first identification do not match.

[0059] Figure 3 FIG. 2 is a flow chart showing a partial process of a data processing method 200 according to an embodiment of the present disclosure. According to some embodiments, as Figure 3 As shown, the above step S220 may include:

[0060] Step S321: receiving access policy information from the server, wherein the access policy information is obtained by the server encrypting both the first key and the first identifier using the second key; and

[0061] Step S322: Decrypt the access policy information using the second key to obtain the first key and the first identifier.

[0062] The second key can be a root key, and both the server and the client can hold the root key. Therefore, by using the second key to encrypt both the first key and the first identifier, the obtained access policy information is more secure, further improving the security of the first key and the first identifier during transmission.

[0063] According to some embodiments, the client may include a key chip, and the above step S322 may include:

[0064] The access policy information is decrypted using the second key prefabricated in the key chip.

[0065] The key chip can be a TPM (Trusted Platform Module) security chip (TPM chip is a security chip that complies with the Trusted Platform Module standard) or an SE (Secure Element) chip (SE chip is a security element chip that can have encryption / decryption logic circuits). The key chip can serve as a trusted credential for the client device and effectively prevent illegal users from accessing the client device.

[0066] By setting a key chip on the client device and pre-making a second key (root key) in the key chip, if an attacker copies the encrypted files and authorized applications (applications that are allowed to access encrypted files) in the client to other client devices (without key chips), since the second key (root key) does not exist on other client devices without key chips, the access policy information cannot be decrypted, and the decrypted data cannot be obtained. In this way, a trust chain can be established among the encrypted data, authorized applications, and authorized client devices.

[0067] According to some embodiments, the above step S230 may include:

[0068] Maps the encrypted data stored in the source directory to a virtual directory that has the same directory structure as the source directory.

[0069] Therefore, when the second application accesses encrypted data or other data in the virtual directory, since the virtual directory has the same directory structure as the source directory, the second application only needs to access the virtual directory according to the mapping relationship between the virtual directory and the source directory, without modifying the structure of the access path when the application accesses the data.

[0070] In some scenarios (such as edge AI scenarios), edge devices are mostly based on the popular cloud-native microservice architecture. Under the premise of ensuring data security, it will be beneficial to further improve the user experience.

[0071] Figure 4 FIG. 4 is a flow chart showing a data processing method 400 according to an embodiment of the present disclosure. Figure 4 As shown, steps S410 to S450 in method 400 are Figure 2 Steps S210 to S250 described in relation to method 200 are similar and will not be described again for the sake of brevity.

[0072] According to some embodiments, before step S430, mapping the encrypted data to the virtual directory, method 400 may further include:

[0073] Step S460: receiving second configuration information modified by the server based on the first configuration information input by the user, the first configuration information and the second configuration information being used to indicate a data access path required for deploying the second application; and

[0074] Step S470: Based on the second configuration information, configure the client so that the second application can issue an access request to the encrypted data through the virtual directory.

[0075] In step S460, the server may be a master server in a Kubernetes (K8s) cluster. Kubernetes is a lightweight, scalable open source platform for managing containerized applications and services. In Kubernetes, the containers that make up an application can be combined into a logical unit for easy management. When a user submits first configuration information to a server to request deployment of a related business application, the server may modify the first configuration information to generate second configuration information. For example, the access path in the first configuration information, the configuration of computing resources, etc. may be modified.

[0076] After the client is reconfigured based on the second configuration information, the second application can issue an access request to the encrypted data through the virtual directory.

[0077] After step S470, the encrypted data is mapped to the virtual directory, and the image of the relevant business application is started, so that when the user requests to deploy the relevant business application, the client can automatically complete the decryption of the data without the user manually modifying the configuration information and the startup sequence of the application. The business application can access the encrypted data as if it were accessing plain text data, reducing the user's perception of the decryption process, thereby improving the user experience.

[0078] In some scenarios (such as edge AI scenarios), the network situation at the client device (such as an edge device) may be complex, and it may not be possible to obtain the first key and the first identifier from the server at any time.

[0079] According to some embodiments, the method 200 may further include: storing the first key and the first identifier locally on the client.

[0080] In some examples, the first key and the first identifier may be stored in a memory of the client.

[0081] Therefore, by storing the first key and the first identifier locally on the client, the client device's dependence on the network environment when decrypting data can be reduced, thereby improving the stability of data decryption and avoiding the adverse effects of fluctuations in network conditions on data decryption.

[0082] According to some embodiments, the method 200 may further include:

[0083] In response to the first identifier not matching the second identifier, the encrypted data is sent to the second application.

[0084] Thus, when the first identifier does not match the second identifier, the application program that issues the access request may be considered as an unauthorized application, and therefore, only the encrypted data is provided to the unauthorized application instead of the decrypted data.

[0085] According to some embodiments, the first identifier may be a first digital signature, and the second identifier may be a second digital signature. An application may have a unique corresponding digital signature. The digital signature may be generated by a server based on a digital signature standard (DSS). In one example, a hash algorithm may be used to make a digital summary of the application, and then the digital summary may be asymmetrically encrypted using a signature private key to generate a digital signature.

[0086] According to another aspect of the present disclosure, a data processing device is provided, which is applied to a client. Figure 5 , Figure 5 The structure block diagram of a data processing device 500 according to an embodiment of the present disclosure is shown. The device 500 includes:

[0087] A first obtaining unit 510 is configured to obtain encrypted data encrypted by the server using a first key;

[0088] A second obtaining unit 520 is configured to obtain a first key and a first identifier of a first application program that is allowed to access the encrypted data from a server;

[0089] A mapping unit 530, configured to map the encrypted data into a virtual directory;

[0090] The verification unit 540 is configured to verify the second application based on the first identification and the second identification of the second application in response to receiving a request from the second application to access the encrypted data through the virtual directory; and

[0091] The decryption unit 550 is configured to decrypt the encrypted data using the first key in response to the first identifier matching the second identifier, so that the second application can access the decrypted data.

[0092] According to some embodiments, the second obtaining unit 520 may be further configured to:

[0093] receiving access policy information from the server, wherein the access policy information is obtained by the server encrypting both the first key and the first identifier using the second key; and

[0094] The access policy information is decrypted using the second key to obtain the first key and the first identifier.

[0095] According to some embodiments, the client may include a key chip, and the second obtaining unit 520 may be further configured to: decrypt the access policy information using a second key prefabricated in the key chip.

[0096] According to some embodiments, the mapping unit 530 may be further configured to:

[0097] Maps the encrypted data stored in the source directory to a virtual directory that has the same directory structure as the source directory.

[0098] Figure 6 FIG. 6 shows a structural block diagram of a data processing device 600 according to an embodiment of the present disclosure. Figure 6 As shown, the first acquisition unit 610, the second acquisition unit 620, the mapping unit 630, the verification unit 640 and the decryption unit 650 included in the apparatus 600 are Figure 5 The corresponding units in the data processing device 500 described in are similar, and for the sake of brevity, they are not repeated here.

[0099] like Figure 6As shown, according to some embodiments, the apparatus 600 may further include a configuration unit 660. The configuration unit 660 is configured to: before mapping the encrypted data to the virtual directory, receive second configuration information modified by the server based on first configuration information input by a user, the first configuration information and the second configuration information being used to indicate a data access path required for deploying the second application; and configure the client based on the second configuration information so that the second application can issue an access request to the encrypted data through the virtual directory.

[0100] Continue to refer Figure 6 According to some embodiments, the apparatus 600 may further include a storage unit 670. The storage unit 670 is configured to store the first key and the first identifier locally on the client.

[0101] Continue to refer Figure 6 According to some embodiments, the apparatus 600 may further include a sending unit 680. The sending unit 680 is configured to send the encrypted data to the second application in response to the first identifier not matching the second identifier.

[0102] According to some embodiments, the first identification may be a first digital signature and the second identification may be a second digital signature.

[0103] According to an embodiment of the present disclosure, an electronic device, a readable storage medium and a computer program product are also provided.

[0104] refer to Figure 7 , a block diagram of an electronic device 700 that can be used as a server or client of the present disclosure will now be described, which is an example of a hardware device that can be applied to various aspects of the present disclosure. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0105] like Figure 7As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0106] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 can be any type of device that can input information to the electronic device 700. The input unit 706 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device, and can include but is not limited to a mouse, a keyboard, a touch screen, a trackpad, a trackball, a joystick, a microphone and / or a remote control. The output unit 707 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator and / or a printer. The storage unit 708 can include but is not limited to a disk, an optical disk. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver and / or a chipset, such as Bluetooth TM devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0107] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as method 200 or method 400. For example, in some embodiments, method 200 or method 400 may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of method 200 or method 400 described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to execute the method 200 or the method 400 in any other appropriate manner (eg, by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0110] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0113] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0115] Although the embodiments or examples of the present disclosure have been described with reference to the accompanying drawings, it should be understood that the above-mentioned methods, systems and devices are merely exemplary embodiments or examples, and the scope of the present invention is not limited by these embodiments or examples, but only by the claims after authorization and their equivalent scope. Various elements in the embodiments or examples can be omitted or replaced by their equivalent elements. In addition, each step can be performed in an order different from that described in the present disclosure. Further, the various elements in the embodiments or examples can be combined in various ways. It is important that with the evolution of technology, many elements described herein can be replaced by equivalent elements that appear after the present disclosure.

Claims

1. A data processing method, applied to a client, comprising: Acquire encrypted data encrypted by a server in communication connection with the client using a first key; Acquiring the first key and a first identifier of a first application program that is allowed to access the encrypted data from the server includes: receiving access policy information from the server, wherein the access policy information is obtained by the server encrypting both the first key and the first identifier using a second key; and Decrypting the access policy information using the second key to obtain the first key and the first identifier; Mapping the encrypted data into a virtual directory, the virtual directory being a mapping of a source directory storing the encrypted data, and an access path of the virtual directory being different from an access path of the source directory; In response to receiving a request from a second application to access the encrypted data through the virtual directory, verifying the second application based on the first identifier and a second identifier of the second application; and In response to the first identifier matching the second identifier, the encrypted data is decrypted using the first key to enable the second application to access the decrypted data.

2. The method according to claim 1, wherein: The client includes a key chip, and wherein decrypting the access policy information using the second key includes: The access policy information is decrypted using a second key prefabricated in the key chip.

3. The method according to claim 1, wherein: Mapping the encrypted data to the virtual directory includes: The encrypted data stored in the source directory is mapped into the virtual directory, the virtual directory having the same directory structure as the source directory.

4. The method according to any one of claims 1 to 3, further comprising: Before mapping the encrypted data into the virtual directory, receiving second configuration information modified by the server based on first configuration information input by a user, wherein the first configuration information and the second configuration information are used to indicate a data access path required for deploying a second application; as well as Based on the second configuration information, the client is configured so that the second application can issue an access request to the encrypted data through the virtual directory.

5. The method according to any one of claims 1 to 3, further comprising: The first key and the first identifier are stored locally on the client.

6. The method according to any one of claims 1 to 3, further comprising: In response to the first identifier not matching the second identifier, sending the encrypted data to the second application.

7. The method according to any one of claims 1 to 3, wherein: The first identification is a first digital signature and the second identification is a second digital signature.

8. A data processing device, applied to a client, comprising: A first acquisition unit is configured to acquire encrypted data encrypted by a server in communication connection with the client using a first key; A second acquisition unit is configured to acquire the first key and a first identifier of a first application program that is allowed to access the encrypted data from the server, wherein the second acquisition unit is further configured to: receiving access policy information from the server, wherein the access policy information is obtained by the server encrypting both the first key and the first identifier using a second key; and Decrypting the access policy information using the second key to obtain the first key and the first identifier; A mapping unit configured to map the encrypted data into a virtual directory, wherein the virtual directory is a mapping of a source directory storing the encrypted data, and an access path of the virtual directory is different from an access path of the source directory; a verification unit configured to verify the second application based on the first identifier and a second identifier of the second application in response to receiving a request from the second application to access the encrypted data through the virtual directory; and The decryption unit is configured to decrypt the encrypted data using the first key in response to the first identifier matching the second identifier, so that the second application can access the decrypted data.

9. The device according to claim 8, wherein: The client includes a key chip, and wherein the second acquisition unit is further configured to: The access policy information is decrypted using a second key prefabricated in the key chip.

10. The device according to claim 8, wherein: The mapping unit is further configured to: The encrypted data stored in the source directory is mapped into the virtual directory, the virtual directory having the same directory structure as the source directory.

11. The apparatus according to any one of claims 8 to 10, further comprising a configuration unit, wherein the configuration unit is configured to: before mapping the encrypted data to the virtual directory, receiving second configuration information modified by the server based on first configuration information input by a user, wherein the first configuration information and the second configuration information are used to indicate a data access path required for deploying a second application; and Based on the second configuration information, the client is configured so that the second application can issue an access request to the encrypted data through the virtual directory.

12. The device according to any one of claims 8 to 10, further comprising: A storage unit is configured to store the first key and the first identifier locally on the client.

13. The device according to any one of claims 8 to 10, further comprising: The sending unit is configured to send the encrypted data to the second application in response to the first identifier not matching the second identifier.

14. The device according to any one of claims 8 to 10, wherein: The first identification is a first digital signature and the second identification is a second digital signature.

15. An electronic device, comprising: at least one processor; as well as a memory communicatively coupled to the at least one processor; in The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

17. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images