Method, device and storage medium for data migration

Abstract

A data migration method, device and storage medium. The method comprises: a migration device obtaining a first task certificate, the first task certificate being used to verify the authority of a user to unlock the following functions in the migration device: a key management service function, a storage service function; the migration device reading data from a source storage system, wherein the migration device uses the key management service function to encrypt the read data; the migration device storing the data; and the migration device writing the data into a target storage system. The method uses the key management service function in an offline migration device. Since the key management service function can also support cloud storage services, it can achieve compatibility and intercommunication of online and offline storage services. The migration device needs to unlock the key management service function and the storage service function through the first task certificate input by the user, and does not store any key or password information itself, thereby improving the security of data migration.

Description

Technical Field

[0001] This application relates to the field of data storage, and in particular to methods, devices and storage media for data migration. Background Technology

[0002] For large-scale data migration, such as petabytes (PB) level data, online migration would consume significant network resources and incur substantial costs. In such cases, offline data migration has become a popular method for large-scale data migration due to its lower cost, shorter implementation time, and higher cost-effectiveness, as it eliminates the need for online transmission.

[0003] Offline data migration involves transferring data from a source data system to a target data system using a migration device. For example, data from the source data system can be stored in the migration device, compressed and encrypted, and then the migration device can be transported to the target data system. The migration device then connects to the target data system and migrates the data there.

[0004] However, in existing offline migration methods, since the migration device transfers data through physical transmission, ensuring the security of data transmission is a problem that the industry urgently needs to solve. Summary of the Invention

[0005] This application provides a method, apparatus, and storage medium for data migration to address the security issues of offline data migration.

[0006] In a first aspect, a data migration method is provided, comprising: a migration device acquiring a first task certificate, the first task certificate being used to verify user permissions to unlock the following functions in the migration device: key management service function and storage service function; the migration device reading data from a source storage system, wherein the migration device encrypts the read data using the key management service function; the migration device storing the data; and the migration device writing the data to a target storage system.

[0007] Secondly, a data migration method is provided, comprising: a management device receiving a migration task creation request sent by a client, the migration task creation request being used to request the creation of an offline migration task, the migration task creation request including user information; after receiving the migration task creation request, the management device initializing the migration device, the migration device being used to transfer data from a source storage system to a target storage system, the initialization including sending task certificate verification information to the migration device, the task certificate being used to verify user permissions to unlock the following functions in the migration device: key management service function and storage service function; the management device sending the task certificate to the client.

[0008] Thirdly, a device for data migration is provided, comprising: an acquisition unit for acquiring a first task certificate, the first task certificate being used to verify user permissions to unlock the following functions in the device: key management service function and storage service function; a reading unit for reading data from a source storage system, wherein the device uses the key management service function to encrypt the read data; a storage unit for storing the data; and a writing unit for writing the data to a target storage system.

[0009] Fourthly, a management device is provided, comprising: a receiving unit for receiving a migration task creation request sent by a client, the migration task creation request being used to request the creation of an offline migration task, the migration task creation request including user information; a processing unit for initializing a migration device according to the migration task creation request, the migration device being used to transfer data from a source storage system to a target storage system, the initialization including sending verification information of a task certificate to the migration device, the task certificate being used to verify user permissions to unlock the following functions in the migration device: key management service function and storage service function; and a sending unit for sending the task certificate to the client.

[0010] Fifthly, an electronic device is provided, including a processor configured to call a computer program from a memory, wherein when the computer program is executed, the processor is configured to perform a method in the first aspect or any possible implementation thereof, or the processor is configured to perform a method in the second aspect or any possible implementation thereof.

[0011] In a sixth aspect, a computer-readable storage medium is provided for storing a computer program including code for performing the methods of the first aspect or any possible implementation thereof, or for performing the methods of the second aspect or any possible implementation thereof.

[0012] In a seventh aspect, a computer program product is provided, comprising a computer program including code for performing the methods in the first aspect or any possible implementation thereof, or for performing the methods in the second aspect or any possible implementation thereof.

[0013] Eighthly, a system for data migration is provided, comprising: a management device and a migration device, wherein the management device is configured to receive a migration task creation request sent by a client, the migration task creation request being used to request the creation of an offline migration task, the migration task creation request including user information; the management device is further configured to initialize the migration device after receiving the migration task creation request, the initialization including sending verification information of a task certificate to the migration device, the task certificate being used to verify user permissions to unlock the following functions in the migration device: key management service function and storage service function; the management device is further configured to send the task certificate to the client; the migration device is configured to obtain the task certificate; the migration device is further configured to transmit data from a source storage system to a target storage system, wherein the migration device uses the key management service function to encrypt data read from the source storage system.

[0014] In this embodiment, the key management service function is used on the offline migration device. Since the key management service function can also support cloud storage services, the key management service function is used to encrypt data during the offline migration process. This enables compatibility and interoperability between cloud and offline storage services, allowing data to flow securely across the entire network. This improves the security of data transmission and user experience. Furthermore, the migration device needs to unlock the key management service function and storage service function through the first task certificate entered by the user. It does not store any key or password information itself, thereby improving the security of data migration. Attached Figure Description

[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0016] Figure 1 This is a schematic diagram of the system architecture for offline data migration according to an embodiment of this application;

[0017] Figure 2 This is a schematic diagram of the structure of a migration device 200 according to an embodiment of this application;

[0018] Figure 3 This is a flowchart illustrating a data migration method according to an embodiment of this application;

[0019] Figure 4This is a schematic diagram of the process for starting up the migration device according to an embodiment of this application;

[0020] Figure 5 This is a flowchart illustrating a data migration method according to an embodiment of this application;

[0021] Figure 6 This is a flowchart illustrating a data migration method according to an embodiment of this application;

[0022] Figure 7 This is a schematic diagram of the structure of a device 700 according to an embodiment of this application;

[0023] Figure 8 This is a schematic diagram of the structure of a device 800 according to an embodiment of this application;

[0024] Figure 9 This is a schematic diagram of the structure of a device 900 according to an embodiment of this application. Detailed Implementation

[0025] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0026] First, let me explain the terms used in this application:

[0027] Key Management Service (KMS): This refers to the functions responsible for key management and data encryption services to provide data encryption protection for login.

[0028] Offline migration refers to copying data from the source storage system to the target storage system using offline migration equipment.

[0029] Trusted Platform Module (TPM): An international standard for secure cryptographic processors that process encryption keys within a device through dedicated secure hardware integrated into the device.

[0030] Network File System (NFS): A heterogeneous platform shared file system that enables file sharing between different types of systems over a network.

[0031] Server Message Block (SMB): A network file-sharing protocol that allows applications or users to access file resources from a remote file server.

[0032] Object storage service (OSS): refers to an object-based storage service system that can store files of any type.

[0033] Hadoop Distributed File System (HDFS): A distributed file system.

[0034] File Transfer Protocol (FTP): A protocol that controls the bidirectional transfer of files over a network. Servers that support the FTP protocol are called FTP servers.

[0035] Secure Shell File Transfer Protocol (SFTP): An encryption method that provides secure network access for transferring files.

[0036] FTPS refers to an extension protocol that adds support for Transport Layer Security (TLS) and Security Socket Layer (SSL) encryption protocols to FTP.

[0037] As mentioned earlier, in existing offline migration methods, since the migration device transfers data through physical transmission, although the data is encrypted when stored in the migration device, the encryption methods used in current offline migration solutions are relatively simple, posing significant data security risks during the offline migration process.

[0038] To address the aforementioned issues, this application provides a data migration solution that enhances the security of offline data migration.

[0039] Figure 1 This is a schematic diagram of a system architecture for offline data migration according to an embodiment of this application. Figure 1 As shown, the scenario includes client 50, management device 100, migration device 200, source storage system 30, and target storage system 40.

[0040] Client 50 can communicate with management device 100 via a network. Users can send requests to management device 100 to establish offline migration tasks by operating client 50. Client 50 can also be used to receive task certificates and device information corresponding to offline migration tasks from management device 100.

[0041] The management device 100 is used to receive offline migration task requests from the client 50 via the network, create offline migration tasks according to the requests, and generate and issue task certificates and device information corresponding to the offline migration tasks.

[0042] There is a corresponding relationship between the aforementioned task certificates and offline migration tasks. The task certificate can be used to perform one or more of the following functions: authenticating the migration device, user authorization authentication, starting the migration service, and starting at least one of the following functions of the migration device: migration task management service function, key management service function, and storage service function. As an example and not a limitation, the task certificate may include at least one of the following: migration device identifier, user identifier (ID), task authorization information, key management service root information and authorization information, storage service unlock authorization information, and task certificate validity information.

[0043] The aforementioned device information is used to associate offline migration tasks with specific migration devices 200. In other words, associating user information with migration devices 200 allows for the unlocking and activation of the migration device 200. This means the migration device 200 can only be activated after obtaining the correct device information, thereby improving the security of data migration. As an example, and not a limitation, the device information includes at least one of the following: device identifier, the device's basic input / output system (BOIS) password, user ID and password, trusted platform module (TPM) authentication information, and root password information for the key management service.

[0044] The management device 100 is also used to initialize the migration device 200. Initialization includes issuing authorization information to the migration device, which indicates that a user ID is authorized to operate the migration device. The initialization also includes sending verification information for the task certificate to the migration device. The migration device can use this verification information to verify the trustworthiness of the task certificate. As an example, the verification information for the task certificate could be the hash value of the task certificate.

[0045] After initialization is complete, the migration device 200 can be sent to the user via physical transport. In some examples, the management device 100 may include a server, a cloud server, a cloud service management platform, etc.

[0046] Migration device 200 serves as the carrier for offline data migration. After the managed device 100 is initialized, migration device 200 is sent to the user. After starting migration device 200, the user connects it to the source storage system 30 and transfers or copies data from the source storage system 30 to migration device 200. After the data transfer to the source storage system 30 is complete, migration device 200 is sent to the target storage system 40, and migration device 200 is connected to the target storage system 40 to transfer data from migration device 200 to the target storage system 40.

[0047] In this embodiment, the source storage system 30 provides the data to be migrated, and the target storage system 40 receives the data to be migrated. This application does not limit the types of the source storage system 30 and the target storage system 40. In some examples, the source storage system 30 may be a data center established locally by the user, and the target storage system 40 may be a cloud storage system. For example, the source storage system 30 may be an in-vehicle storage system, and the target storage system 40 may be a local data center or a cloud storage system. For another example, the source storage system 30 and the target storage system 40 may be different data centers. Here, a cloud storage system refers to a storage service system accessible via a public network.

[0048] It should be understood that Figure 1 The application scenarios described are merely examples and not limitations. In practice, appropriate modifications and additions or subtractions can be made to the above scenarios, and the solutions of the embodiments of this application will still be applicable.

[0049] Figure 2 This is a schematic diagram of the structure of a migration device 200 according to an embodiment of this application. Figure 2 As shown, the migration device 200 may include units that implement the following functions: migration task management service function 210, key management service function 220, and storage service function 230.

[0050] The migration task management service function 210 is used to perform tasks such as initiating, monitoring, alarming, and generating audit logs.

[0051] Key management service function 220 is used to implement key management and data encryption services. As an example, key management service function 220 can be used to provide an offline version of the cloud key management service, which is compatible with cloud storage services. Cloud storage services can refer to service systems that provide storage services over a public network. The key management service in migration device 200 is compatible with cloud storage services, thereby facilitating the compatibility and interaction of encrypted data in the cloud, offline, or between various cloud storage services, enabling secure global data flow.

[0052] Storage service function 230 is used to provide data storage services, such as NFS / SMB, object storage services, HDFS, FTP / SFTP / FTPS, including standalone or clustered services. Optionally, storage service function 230 can also perform a lock storage service function, wherein the lock storage service function refers to prohibiting read and write services of migration device 200.

[0053] Optionally, the storage service on the migration device 200 can have the same operation interface, usage method, and data encryption method as the cloud storage service, so that cloud tools can be directly applied offline to improve user experience.

[0054] Optionally, the key management service on the offline migration device 200 is the same as that on the cloud. Encrypted data can achieve compatibility and interoperability between cloud and offline services, and between cloud and offline services. Data can flow securely across the entire domain to improve the security of data transmission.

[0055] The embodiments of this application are not only applicable to offline data migration to the cloud, cloud data sharing or backup, and data migration between data centers, but also applicable to hybrid cloud scenarios such as storage gateways.

[0056] The technical solution of this application and how it solves the above-mentioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0057] Figure 3 This is a schematic flowchart of a data migration method according to an embodiment of this application. Figure 3 As shown, the method includes the following.

[0058] S301. The client sends a migration task creation request to the management device. Correspondingly, the management device receives the migration task creation request, which is used to request the creation of an offline migration task.

[0059] Optionally, users can send migration task creation requests to the management device via the client.

[0060] Optionally, the migration task is associated with user information. As an example, the user information includes a user identifier (ID) and first authorization information corresponding to the user ID. This first authorization information is used by the management device to verify whether the user ID has the authority to create the migration task.

[0061] S302. The management device initializes the migration device. Initialization is used to associate the migration device with the migration task.

[0062] As an example, initializing the migration device includes: issuing second authorization information to the migration device, which indicates that the user ID has the right to operate the migration device. The initialization also includes: sending verification information of the task certificate to the migration device. The migration device can use this verification information to verify whether the task certificate is trustworthy. As an example, the verification information of the task certificate could be the hash value of the task certificate.

[0063] The task certificate can be used to perform one or more of the following functions: authenticating the migration device, user authorization authentication, starting the migration service, starting the migration task management service function of the migration device, key management service function, and storage service function. As an example, and not a limitation, the task certificate may include one or more of the following: migration device identifier, user ID, task authorization information, root information and authorization information of the key management service, storage service unlocking authorization information, and task certificate validity information.

[0064] In some examples, the aforementioned task certificates include a first task certificate and a second task certificate. The first task certificate is used to unlock the migration task management service, key management service, and storage service functions in the migration device when reading data from the source storage system. The second task certificate is used to unlock the relevant functions in the migration device when writing data to the target storage system. By using different task certificates when reading and writing data on the migration device, the security of the offline data migration process can be improved.

[0065] In some examples, the migration device can also use the same task certificate when reading and writing data.

[0066] In some examples, the task certificate can be a password-protected encrypted file. For instance, the task certificate can be in PKCS#12 format. PKCS#12 defines an archive file format for storing multiple encrypted objects in a single file. It is typically used to package a private key and its associated certificate, or to package the entire trust chain.

[0067] S303. Send the task certificate and device information corresponding to the migration task to the client.

[0068] The aforementioned device information is used to verify the association between user information and the migration device. It can be used to unlock and start the migration device, meaning the migration device can only be started after obtaining the correct device information, thereby improving the security of data migration. As an example, and not a limitation, the device information includes one or more of the following: the migration device's identifier, the migration device's basic input / output system (BOIS) password, the user ID and password, and the trusted platform module (TPM) authentication information.

[0069] Optionally, if both the source and target storage systems are user-controlled systems, then a first task certificate and a second task certificate need to be sent to the client. If the source storage system is user-controlled and the target storage system and management device are administrator-controlled systems, then only the first task certificate needs to be sent to the client. If the source and management systems are administrator-controlled and the target storage system is user-controlled, then only the second task certificate needs to be sent to the client.

[0070] S304. Send the migration device to a first address, where the first address is the location of the source storage system or a location that supports connection to the source storage system.

[0071] The aforementioned connection can refer to the ability for communication and data transfer between the migration device and the source storage system. As an example, the first address can be specified by the user. As another example, the migration device can be physically transported to the first address.

[0072] Connecting the migration device to the source storage system, also known as mounting the migration device, involves powering on the migration device and connecting it to the source storage system so that the migration device and the source storage system can communicate and transmit data.

[0073] S305. Based on the equipment information and task certificate, start the equipment migration.

[0074] The device information is used to verify the relationship between user information and the migration device in order to activate the migration device itself. This verifies whether the user has the right to use the migration device. The task certificate is used to activate the migration task management service, storage service, and key management service functions within the migration device. Specifically, device information and the task certificate can be entered into the migration device to activate it.

[0075] In some examples, the task certificate used in S305 can be the second task certificate mentioned above, which is the task certificate issued for the migration device to write data outwards.

[0076] As an example, if the source storage system is controlled by the user, the user can obtain device information and task certificates through the client, and input the device information and task certificates into the migration device through the storage medium.

[0077] Optionally, if the target storage system and management device are controlled by the administrator, the administrator can obtain device information and task certificates through the management device and initiate the device migration.

[0078] S306. Connect the migration device to the source storage system and start the migration task.

[0079] Optionally, source storage system information can be entered into the migration device to initiate the migration task. As an example, source storage system information may include: data source address and account information, etc. The migration task management service function can be used to verify the source storage system information and initiate the migration task.

[0080] S307. The migration device reads and stores data from the source storage system.

[0081] As an example, the migration device reads data from the source storage system, encrypts the data using an encryption algorithm carried by the migration device, and then writes it to the migration device. Specifically, the migration device can use a key management service to implement the encryption algorithm for the data.

[0082] S308. After the migration device completes data storage, delete the following information from the migration device: source storage information and task certificate.

[0083] Optionally, after data storage is completed, the migration device can stop the migration task management service and the key management service, and lock the storage service function within the migration device. Locking the storage service function means prohibiting read and write access to the migration device.

[0084] Optionally, the migrated device can save device status information and related audit logs. Saving device status information refers to saving the current status information of the internal units of the migrated device, equivalent to a device snapshot. For example, this status information includes: device identifier, storage checksum, device service status, operation time, usage information, etc. Audit logs are logs recording the operations performed by the migrated device. The device status information and audit logs can be used to detect whether the migrated device has been replaced or its data has been tampered with during subsequent processes.

[0085] In this embodiment of the application, after the migration device completes the reading and storage of data from the source storage system, the source storage information and task certificate in the migration device can be deleted to prevent the leakage of the above information during the transportation of the migration device, which would lead to the data in the migration device being read, thereby ensuring the security of data transmission.

[0086] In this embodiment of the application, after the migration device completes the reading and storage of data from the source storage system, the migration task management service function and the key management service function can be stopped, and the storage service function can be locked to prevent the data in the migration device from being illegally obtained during the transportation of the migration device, thereby ensuring the security of data transmission.

[0087] S309. Send the migration device to a second address, where the second address is the location of the target storage system or a location that supports connection to the target storage system.

[0088] The aforementioned connection can refer to the ability for communication and data transfer between the migration device and the target storage system. As an example, the second address can be specified by the user. As another example, the migration device can be physically transported to the second address.

[0089] Connecting the migration device to the target storage system, also known as mounting the migration device, involves powering on the migration device and connecting it to the target storage system so that the migration device and the target storage system can communicate and transmit data.

[0090] S310, Start the migration device.

[0091] The method for starting the migration device is similar to that in S305; the device information can be used to start the migration device. Furthermore, based on the task certificate, the migration task management service function, storage service function, and key management service function in the migration device can be started.

[0092] In some examples, the task certificate used in S310 may be the second task certificate mentioned above, which is the task certificate issued for the case of the migration device writing data outward.

[0093] Optionally, the method for obtaining device information and task certificates used to initiate the migration process may differ depending on the target storage system. For example, if both the target storage system and the management device are controlled by the administrator, the device information and task certificates can be obtained through the management device. In some examples, the target storage system and the management device may belong to the same server cluster, and data sharing and transmission may be implemented within the server cluster.

[0094] For example, if the target storage system is a user-controlled storage system, such as a data center established offline, device information and task certificates can be obtained through the client.

[0095] Optionally, after acquiring the migration device, a tamper check procedure can be run on the migration device to determine whether the migration device and data are intact. As an example, the tamper check procedure can verify the integrity of the migration device and data based on the device status information and audit logs stored on the migration device.

[0096] S311. Connect the migration device to the target storage system and start the migration task.

[0097] Optionally, target storage system information can be entered into the migration device to initiate the migration task. As an example, source storage system information may include: data target address and account information, etc. The migration task management service function can be used to verify the target storage system information and initiate the migration task.

[0098] S312, The migration device transfers data to the target storage system.

[0099] Optionally, the data transmitted from the migration device to the target storage system can be either decrypted plaintext or encrypted data. During data transmission, a key management service can be used to decrypt the data. The target storage system can also encrypt the data using a specified encryption method after receiving the decrypted data from the migration device; in this case, the target storage system needs to support the corresponding interface.

[0100] Alternatively, the target storage system can retain the same encrypted data as the migration device, or it can store plaintext data.

[0101] S313. Clean and relocate equipment.

[0102] After the data is transferred to the target storage system, the following information can be cleared from the migration device: target storage system information and mission certificate.

[0103] Optionally, after the data migration is completed, the migration device can stop the migration task management service function and the key management service function, and erase the stored data according to the specified criteria.

[0104] Optionally, the migration device can save relevant audit logs for a preset period of time to facilitate verification of the migration data during the subsequent process.

[0105] This application provides a secure offline data migration solution where no keys or passwords are stored on the migration device, thereby improving the security of data migration.

[0106] The offline migration method described in this application is characterized by its openness and identifiability. The offline migration process and the migration device are visible to users and third parties, thus exhibiting openness and high identifiability. Furthermore, this offline migration scheme is beneficial for users with large-scale data migration to and retention in the cloud.

[0107] Figure 4 This is a schematic diagram of the process of starting up the migration device according to an embodiment of this application. Figure 4 The method is performed by the migration device. Figure 4 This can be applied to the process of migrating devices to connect to a source or target storage system. For example... Figure 4 As shown, the method includes the following.

[0108] S401, Control the start-up of the migration equipment.

[0109] Controlling the activation of the migration device can refer to operations such as unsealing the migration device, verifying its integrity, powering it on, and connecting it to the network. Optionally, the migration device can be activated based on device information.

[0110] S402. Perform migration task authentication on the migration device.

[0111] Specifically, authenticating a migration task for a migration device can refer to authenticating the migration task based on a task certificate. The task certificate is used to unlock the migration task management service, key management service, and storage service functions of the migration device. As an example, and not a limitation, the task certificate may include one or more of the following: migration device identifier, user ID, task authorization information, root information and authorization information for the key management service, storage service unlocking authorization information, and task certificate validity information.

[0112] As an example, successful migration task authentication requires one or more of the following: the task certificate is in the correct format, the task certificate parameters are valid, the task certificate is fully authorized, and the task certificate is within its validity period. The task certificate parameters can refer to device parameters, such as a machine list.

[0113] S403. Start the key management service function in the migration device.

[0114] After the migration task is authenticated, the key management service function of the migration device can be activated to provide key management and data encryption services.

[0115] S404, Unlock the storage service function for the migrated device.

[0116] After the migration task is authenticated, the storage service of the migrated device can be unlocked to allow data read and write operations.

[0117] S405, Start the migration task.

[0118] Optionally, the source storage system information or the target storage system can be entered into the migration device to initiate the migration task.

[0119] Figure 5 This is a flowchart illustrating a data migration method according to an embodiment of this application. Figure 5 This method can be performed by the migration device. For example... Figure 5 As shown, the method includes the following.

[0120] S501. The migration device obtains the first task certificate. The first task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function.

[0121] Optionally, the first task certificate can also be used to unlock the migration task management service function in the migration device. The specific definition of the first task can be found in the previous description; for brevity, it will not be repeated here.

[0122] S502, The migration device reads data from the source storage system, wherein the migration device uses the key management service function to encrypt the read data.

[0123] Optionally, before the migration device reads data from the source storage system, the method further includes: the migration device acquiring device information, which is used to verify the association between the migration device and the user information, in order to start the migration device.

[0124] Optionally, the migration device is equipped with a key management service function. This key management service function can be the same as the storage service operation interface, usage method and data encryption method in the online storage service, thereby realizing compatibility and interoperability between cloud and offline storage services, and data can flow securely across the entire domain.

[0125] S503, Migrate device stored data.

[0126] Optionally, after migrating the data stored on the device, the process may include performing at least one of the following: the migration device deletes the source storage information, which is information related to the source storage system; the migration device deletes the first task certificate; the migration device stops the migration task management service function and the key management service function, wherein the migration task management service function is used to start and monitor the migration task; the migration device locks the storage service function, which means prohibiting read and write access to the migration device; and the migration device saves device status information and audit logs, wherein the audit logs are used to record the operations performed by the migration device.

[0127] S504, The migration device writes the data to the target storage system.

[0128] Optionally, before the migration device writes the data to the target storage system, the method further includes: the migration device running a tamper check program, which is used to determine whether the data in the migration device is complete based on the device status information and audit logs stored in the migration device.

[0129] Optionally, before the migration device writes data to the target storage system, the method further includes: the migration device obtaining device information and a second task certificate, and starting the migration device based on the device information and the second task certificate. The device information is used to verify the association between the migration device and the user information, and the second task certificate is used to unlock at least one of the following functions in the migration device: migration task management service function, key management service function, and storage service function.

[0130] Optionally, after the migration device writes the data to the target storage system, the process further includes performing at least one of the following: the migration device deletes the target storage information, which is information related to the target storage system; the migration device deletes the second task certificate; the migration device stops the migration task management service function and the key management service function, wherein the migration task management service function is used to start and monitor the migration task; the migration device erases the stored data; and the migration device saves device status information and audit logs, wherein the audit logs are used to record the operations performed by the migration device.

[0131] In this embodiment, the key management service function is used on the offline migration device. Since the key management service function can also support cloud storage services, the key management service function is used to encrypt data during the offline migration process. This enables compatibility and interoperability between cloud and offline storage services, allowing data to flow securely across the entire network. This improves the security of data transmission and user experience. Furthermore, the migration device needs to unlock the key management service function and storage service function through the first task certificate entered by the user. It does not store any key or password information itself, thereby improving the security of data migration.

[0132] In this embodiment of the application, the offline migration device does not store any key or password information during transportation. Instead, it sends the relevant task certificate and device information to the client online. Verification information is only entered when data read and write are performed, and the verification information and other relevant information are deleted after the data read and write are completed, thereby ensuring data security during the offline migration process.

[0133] Figure 6 This is a flowchart illustrating a data migration method according to an embodiment of this application. Figure 6 The method can be executed by the management device. For example... Figure 6 As shown, the method includes the following.

[0134] S601. The management device receives a migration task creation request sent by the client. The migration task creation request is used to request the creation of an offline migration task. The migration task creation request includes user information.

[0135] S602. The management device initializes the migration device according to the migration task creation request. The migration device is used to transfer data from the source storage system to the target storage system. The initialization includes sending the task certificate verification information to the migration device. The task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function.

[0136] Optionally, the initialization process for the migration device may also include other operations, such as issuing a second authorization message to the migration device, which indicates that the user ID has the right to operate the migration device. Related content can be found at [link / reference]. Figure 3 For the sake of brevity, the description in the text will not be repeated here.

[0137] S603, the management device sends the task certificate to the client.

[0138] Optionally, the aforementioned task certificate may include Figure 3 The first task certificate and / or the second task certificate mentioned above. For brevity, the definitions of the first task certificate and the second task certificate can be found in the previous descriptions and will not be repeated here.

[0139] Optionally, Figure 6 The method also includes: the management device sending device information to the client, which is used to verify the association between the migrated device and the user information.

[0140] In this embodiment, after creating a migration task, the management device sends verification information of the task certificate when initializing the migration device, and sends device information and task certificate to the client. Thus, the offline migration device does not store any key or password information during transportation, but sends the relevant task certificate and device information to the client online. Verification information is only entered when data read and write are performed, and the verification information and other relevant information are deleted after the data read and write are completed, thereby ensuring data security during the offline migration process.

[0141] Figure 7 This is a schematic diagram of the structure of an apparatus 700 according to an embodiment of this application. The apparatus 700 is used to perform the method executed by the migration device described above. The apparatus 700 includes the following units.

[0142] The acquisition unit 710 is used to acquire a first task certificate, which is used to verify the user's permissions to unlock the following functions in the device: key management service function and storage service function.

[0143] The reading unit 720 is used to read data from the source storage system, wherein the migration device uses the key management service function to encrypt the read data;

[0144] Storage unit 730 is used to store the data;

[0145] The writing unit 740 is used to write the data to the target storage system.

[0146] Figure 8 This is a schematic diagram of the structure of an apparatus 800 according to an embodiment of this application. The apparatus 800 is used to perform the method executed by the management device described above. The apparatus 800 includes the following units.

[0147] The receiving unit 810 is used to receive a migration task creation request sent by the client. The migration task creation request is used to request the creation of an offline migration task, and the migration task creation request includes user information.

[0148] The processing unit 820 is configured to initialize the migration device according to the migration task creation request. The migration device is used to transfer data from the source storage system to the target storage system. The initialization includes sending verification information of the task certificate to the migration device. The task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function.

[0149] Sending unit 830 is used to send the task certificate to the client.

[0150] Figure 9 This is a schematic diagram of the structure of a device 900 according to an embodiment of this application. The device 900 is used to perform the method described above by the migration device or the management device.

[0151] The device 900 includes a processor 910, which is configured to execute computer programs or instructions stored in a memory 920, or to read data stored in the memory 920, to perform the methods described in the above method embodiments. Optionally, there may be one or more processors 910.

[0152] Optionally, such as Figure 9 As shown, the device 900 also includes a memory 920 for storing computer programs or instructions and / or data. The memory 920 may be integrated with the processor 910 or may be disposed separately. Optionally, there may be one or more memories 920.

[0153] Optionally, such as Figure 9As shown, the device 900 also includes a communication interface 930, which is used for receiving and / or transmitting signals. For example, the processor 910 is used to control the communication interface 930 to receive and / or transmit signals.

[0154] Optionally, the device 900 is used to implement the operations performed by the migration device or management device in the various method embodiments described above.

[0155] It should be pointed out that, Figure 9 The device 900 in the above embodiment may be the migration device or management device, or it may be a component of the migration device or management device (such as a chip), which is not limited here.

[0156] In this application embodiment, a processor is a circuit with signal processing capabilities. In one implementation, the processor can be a circuit with instruction reading and execution capabilities, such as a CPU, microprocessor, GPU (which can be understood as a type of microprocessor), or DSP. In another implementation, the processor can implement certain functions through the logical relationships of hardware circuits. These logical relationships are fixed or reconfigurable. For example, the processor may be a hardware circuit implemented as an ASIC or PLD, such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and configuring the hardware circuit can be understood as the process of the processor loading instructions to implement the functions of some or all of the above units. Furthermore, it can also be a hardware circuit designed for artificial intelligence, which can be understood as an ASIC, such as an NPU, TPU, or DPU.

[0157] As can be seen, each unit in the above device can be one or more processors (or processing circuits) configured to implement the above methods, such as: CPU, GPU, NPU, TPU, DPU, microprocessor, DSP, ASIC, FPGA, or a combination of at least two of these processor forms.

[0158] Furthermore, the units in the above devices can be integrated in whole or in part, or they can be implemented independently. In one implementation, these units are integrated together as a system-on-a-chip (SOC). The SOC may include at least one processor for implementing any of the above methods or implementing the functions of the units in the device. The at least one processor may be of different types, such as CPU and FPGA, CPU and artificial intelligence processor, CPU and GPU, etc.

[0159] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to implement... Figures 1 to 6The steps in the method performed when migrating or managing equipment.

[0160] Accordingly, embodiments of this application also provide a computer program product, including a computer program / instructions, which, when executed by a processor, cause the processor to implement... Figures 1 to 6 The steps in the method performed when migrating or managing equipment.

[0161] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0163] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0164] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0165] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0166] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0167] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0168] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0169] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data migration method, comprising: The migration device acquires a first task certificate, which is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function. The migration device itself does not store key and password information. The migration device reads data from the source storage system, wherein the migration device uses the key management service function to encrypt the read data; The migration device stores the data; The migration device writes the data to the target storage system.

2. The method of claim 1, further comprising, before the migration device reads data from the source storage system: The migration device acquires device information, which is used to verify the association between the migration device and user information in order to start the migration device.

3. The method of claim 1 or 2, further comprising, after the migration device stores the data, performing at least one of the following: The migration device deletes the source storage information, which is information related to the source storage system. The migration device deletes the first task certificate; The migration device stops the migration task management service function and the key management service function. The migration task management service function is used to start and monitor the migration task. The migration device locks the storage service function, which means prohibiting read and write access to the migration device; The migration device stores device status information and audit logs, and the audit logs are used to record the operations performed by the migration device.

4. The method of claim 1 or 2, further comprising: Before the migration device writes the data to the target storage system, the method further includes: The migration device runs a tampering check program, which is used to determine whether the data in the migration device is complete based on the device status information and audit logs stored in the migration device.

5. The method of claim 1 or 2, further comprising: Before the migration device writes the data to the target storage system, the method further includes: The migration device acquires device information and a second task certificate, and starts the migration device based on the device information and the second task certificate. The device information is used to verify the association between the migration device and user information, and the second task certificate is used to unlock the following functions in the migration device: the key management service function and the storage service function.

6. The method of claim 5, further comprising, after the migration device writes the data to the target storage system, performing at least one of the following: The migration device deletes the target storage information, which is information related to the target storage system. The migration device deletes the second task certificate; The migration device stops the migration task management service function and the key management service function. The migration task management service function is used to start and monitor the migration task. The migration device erases the stored data; The migration device stores device status information and audit logs, which are used to record the operations performed by the migration device.

7. A data migration method, comprising: The management device receives a migration task creation request sent by the client. The migration task creation request is used to request the creation of an offline migration task, and the migration task creation request includes user information. After receiving the migration task creation request, the management device initializes the migration device, which is used to transfer data from the source storage system to the target storage system. The initialization includes sending task certificate verification information to the migration device. The task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function. The migration device itself does not store key and password information. The management device sends the task certificate to the client.

8. The method of claim 7, further comprising: The management device sends device information to the client. The device information is used to verify the association between the migration device and the user information in order to start the migration device.

9. An apparatus for data migration, comprising: The acquisition unit is used to acquire a first task certificate, which is used to verify the user's permissions to unlock the following functions in the device: key management service function and storage service function; the device itself does not store key and password information. A reading unit is used to read data from a source storage system, wherein the device uses the key management service function to encrypt the read data; Storage unit, used to store the data; The writing unit is used to write the data to the target storage system.

10. A management device, comprising: The receiving unit is used to receive a migration task creation request sent by the client. The migration task creation request is used to request the creation of an offline migration task, and the migration task creation request includes user information. The processing unit is configured to initialize a migration device according to the migration task creation request. The migration device is used to transfer data from the source storage system to the target storage system. The initialization includes sending verification information of the task certificate to the migration device. The task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function. The migration device itself does not store key and password information. The sending unit is used to send the task certificate to the client.

11. An electronic device, comprising: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method of any one of claims 1 to 6, or to implement the method of claim 7 or 8.

12. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method of any one of claims 1 to 6, or to implement the method of claim 7 or 8.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6, or implements the method of claim 7 or 8.

14. A system for data migration, comprising: The management device and the migration device, wherein the migration device itself does not store key and password information; The management device is used to receive a migration task creation request sent by the client. The migration task creation request is used to request the creation of an offline migration task. The migration task creation request includes user information. The management device is also used to initialize the migration device after receiving the migration task creation request. The initialization includes sending verification information of the task certificate to the migration device. The task certificate is used to verify the user's permissions to unlock the following functions in the migration device: key management service function and storage service function. The management device is also used to send the task certificate to the client; The migration device is used to obtain the task certificate; The migration device is also used to transfer data from the source storage system to the target storage system, wherein the migration device uses the key management service function to encrypt the data read from the source storage system.

Images