A cloud platform data management method and related apparatus

Abstract

The application discloses a cloud platform data management method and related device, which is used for protecting the safety of data such as privacy data, and can be applied to various scenes such as cloud technology, artificial intelligence, intelligent transportation, auxiliary driving and vehicle-mounted scenes. When a data operation is performed on target data in a cloud platform, it is identified whether the data operation is a pre-set operation for destroying the target data. If yes, metadata of the target data is extracted according to the data operation, the target data is located and extracted according to the metadata, and a management operation corresponding to the pre-set operation is performed on the target data, the management operation including at least one of a backup operation, an encryption operation and a hiding operation. The scheme determines whether to protect the target data according to whether the data operation is the pre-set operation for destroying the target data, instead of whether a user has an access right, so that malicious privileged users can be avoided to bypass or disable the scheme, and the effect on the malicious privileged users is better, and the safety of data is improved.

Description

Technical Field

[0001] This application relates to the field of cloud technology, and in particular to a cloud platform data management method and related apparatus. Background Technology

[0002] Public and private clouds have become the main carriers of enterprise digital transformation, and enterprise cloud adoption has become a mainstream trend. As enterprises move to the cloud, their relevant data can be stored on the cloud platform. Since data is the lifeblood of an enterprise, the security of data on the cloud platform is of great importance to the enterprise.

[0003] The relevant technologies primarily protect data security by restricting access permissions. However, this approach involves deploying security measures locally, and it is less effective against malicious privileged users. Such users can bypass or disable the system, making it difficult to guarantee data security. Summary of the Invention

[0004] To address the aforementioned technical issues, this application provides a cloud platform data management method and related apparatus that prevents malicious privileged users from bypassing or disabling the protection scheme. This method is effective against malicious privileged users and improves data security.

[0005] The embodiments of this application disclose the following technical solutions:

[0006] On one hand, embodiments of this application provide a cloud platform data management method, which is executed by a data management device, and the method includes:

[0007] To retrieve data operations to be performed on target data in the cloud platform;

[0008] If the data operation is determined to be a pre-defined operation, the metadata of the target data is extracted based on the data operation.

[0009] The target data is located and extracted based on the metadata.

[0010] Perform management operations on the target data corresponding to the pre-set operations, the management operations including at least one of backup operations, encryption operations, and hiding operations.

[0011] On one hand, embodiments of this application provide a cloud platform data management device, which is deployed on a data management device and includes an acquisition unit, an extraction unit, and a management unit.

[0012] The acquisition unit is used to acquire data operations performed on target data in the cloud platform;

[0013] The extraction unit is used to extract metadata of the target data according to the data operation if it is determined that the data operation is a pre-set operation.

[0014] The extraction unit is also used to locate and extract the target data based on the metadata;

[0015] The management unit is used to perform management operations on the target data corresponding to the pre-set operations, and the management operations include at least one of backup operations, encryption operations, and hiding operations.

[0016] On one hand, embodiments of this application provide a data management device for a cloud platform, the data management device including a processor and a memory:

[0017] The memory is used to store program code and transmit the program code to the processor;

[0018] The processor is used to execute the cloud platform data management method described above according to the instructions in the program code.

[0019] On one hand, embodiments of this application provide a computer-readable storage medium for storing program code for executing the cloud platform data management method described above.

[0020] On one hand, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the cloud platform data management method described in the foregoing aspects.

[0021] As can be seen from the above technical solution, when data operations are performed on target data in the cloud platform, the data management device can obtain the data operations performed on the target data in the cloud platform, thereby identifying whether the data operation is a pre-set operation that damages the target data. If it is determined that the data operation is a pre-set operation, the target data's metadata is extracted based on the data operation, and the target data is located and extracted based on the metadata. Then, management operations corresponding to the pre-set operations are performed on the target data. These management operations include at least one of backup, encryption, and hiding operations. In this way, even if pre-set operations are performed on the target data, the data management device can still protect the target data through these management operations. This solution deploys security protection on the cloud platform, using whether the data operation is a pre-set operation that damages the target data as the basis for whether to protect the target data. Therefore, when it is determined that the data operation is a pre-set operation that damages the target data, management operations to protect the target data's security are performed on the target data, rather than relying on whether the user has access permissions. This prevents malicious privileged users from bypassing or disabling the protection scheme, and is more effective against malicious privileged users, thus improving data security. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 An architecture diagram illustrating an application scenario of a cloud platform data management method provided in this application embodiment;

[0024] Figure 2 A flowchart illustrating a cloud platform data management method provided in this application embodiment;

[0025] Figure 3 A module architecture diagram for implementing a cloud platform data management method is provided in an embodiment of this application;

[0026] Figure 4 A structural flowchart of a cloud platform data management method provided in this application embodiment;

[0027] Figure 5 A flowchart illustrating the configuration and usage process of a preset data list provided in this application embodiment;

[0028] Figure 6 A flowchart illustrating the data protection module performing management operations and data recovery is provided as an embodiment of this application.

[0029] Figure 7 A signaling interaction diagram of a cloud platform data management method provided in an embodiment of this application;

[0030] Figure 8 A flowchart for intercepting a pre-defined operation is provided as an embodiment of this application;

[0031] Figure 9 A flowchart of a data extraction process provided in an embodiment of this application;

[0032] Figure 10 A structural diagram of a cloud platform data management device provided in an embodiment of this application;

[0033] Figure 11 A structural diagram of a terminal provided in an embodiment of this application;

[0034] Figure 12 This is a structural diagram of a server provided in an embodiment of this application. Detailed Implementation

[0035] The embodiments of this application will now be described with reference to the accompanying drawings.

[0036] The relevant technologies primarily protect data security by restricting access permissions. However, this approach involves deploying security measures locally, and it is less effective against malicious privileged users. Such users can bypass or disable the system, making it difficult to guarantee data security.

[0037] To address the aforementioned technical problems, this application provides a cloud platform data management method. This method deploys security protection on the cloud platform, using whether a data operation is a pre-defined operation that damages the target data as the basis for determining whether to protect the target data. Thus, when it is determined that a data operation is a pre-defined operation that damages the target data, management operations to protect the security of the target data are performed on the target data, rather than relying on whether the user has access rights. This prevents malicious privileged users from bypassing or disabling the protection scheme, and is more effective against malicious privileged users, thereby improving data security.

[0038] It should be noted that the methods provided in the embodiments of this application may involve cloud technology, specifically cloud computing, cloud storage, cloud security, etc.

[0039] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed.

[0040] As a provider of fundamental cloud computing capabilities, a cloud resource pool (referred to as a cloud platform) is established, generally called an IaaS (Infrastructure as a Service) platform. Various types of virtual resources are deployed in the resource pool for external customers to choose from. The cloud resource pool mainly includes: computing devices (virtualized machines, or virtual machines, which may contain operating systems), storage devices, and network devices.

[0041] Cloud storage is a new concept that extends and develops from cloud computing. Currently, cloud storage uses logical volumes as a storage method. When creating a logical volume, physical storage space is allocated to each logical volume. This physical storage space may consist of a single storage device or the disks of several storage devices. Clients store data on a logical volume, which means storing the data on the cloud platform's file system. The file system divides the data into many parts, each containing not only the data but also additional information such as data identifiers (IDs, ID entities). The file system writes each part separately to the physical storage space of the logical volume, and records the storage location information of each part. Therefore, when a client requests access to data, the file system can allow the client to access the data based on the storage location information of each part.

[0042] The process of allocating physical storage space for a logical volume can be as follows: the physical storage space is pre-divided into strips according to the capacity estimate of each part stored in the logical volume (this estimate often has a large margin relative to the actual capacity of the part to be stored) and the grouping of Redundant Array of Independent Disks (RAID). A logical volume can be understood as a strip, thus allocating physical storage space to the logical volume.

[0043] Next, we will combine Figure 1 The application scenarios of the cloud platform data management method provided in the embodiments of this application are introduced. Figure 1 This paper illustrates an architectural diagram of an application scenario for a cloud platform data management method. This scenario may include a server 101 and a terminal 102. The data management device can be the server 101, which can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal 102 can be a terminal used by an object to perform data operations on target data. This object can be a user, such as a privileged administrator. The terminal 102 can be a mobile phone, computer, smart voice interaction device, smart home appliance, vehicle terminal, aircraft, etc., but is not limited to these. The terminal 102 and the server 101 can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0044] It should be noted that the embodiments of this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, assisted driving, and vehicle scenarios.

[0045] When a user (such as a privileged administrator) performs data operations on target data in the cloud platform through terminal 102, server 101 can obtain the data operations performed on the target data in the cloud platform, thereby identifying whether the data operation is a pre-set operation that damages the target data. The pre-set operation can be a pre-set high-risk operation that violates the wishes of the object to which the target data belongs, such as modification operations, deletion operations, encryption operations, etc.

[0046] If server 101 determines that the data operation is a pre-defined operation, it extracts the metadata of the target data based on the data operation. The metadata is used to describe the relevant information of the target data, such as directory information, inodes, etc., of the directory where the target data is located. The directory information may include, for example, the name and path of the target data.

[0047] In this way, server 101 can locate and extract the target data based on metadata, and then perform management operations corresponding to pre-defined operations on the target data. These management operations include at least one of backup, encryption, and hiding operations. Backup operations back up the target data, ensuring that even if a privileged administrator performs a pre-defined operation on the target data, a backup of the original target data remains on the cloud platform. Encryption operations encrypt the target data, protecting its security. Hiding operations conceal the target data; although it is no longer displayed in the directory, its contents are not deleted. Hiding operations are particularly useful when the pre-defined operation is deletion, as the privileged administrator will believe the target data has been deleted, thus preventing further attacks and ensuring the data's security.

[0048] In this way, even if pre-defined operations are performed on the target data, server 101 can still protect the target data through the aforementioned management operations. This solution deploys security protection on the cloud platform, using whether the data operation is a pre-defined operation that damages the target data as the basis for determining whether to protect the target data. Therefore, when it is determined that a data operation is a pre-defined operation that damages the target data, management operations to protect the target data's security are performed on the target data, rather than relying on whether the user has access permissions. This prevents malicious privileged users from bypassing or disabling the protection scheme, and is more effective against malicious privileged users, thus improving data security.

[0049] Next, the data management method provided in the embodiments of this application will be described in detail with reference to the accompanying drawings.

[0050] See Figure 2 , Figure 2 A flowchart of a cloud platform data management method is shown, the method comprising:

[0051] S201, Obtain the data operation to be performed on the target data in the cloud platform.

[0052] Cloud computing infrastructure providers offer cloud platforms to customers, allowing them to store their data. These cloud platforms can include virtual machines (VMs), which are complete computer systems running in a completely isolated environment. They provide the functionality of a physical computer and run user-installed operating systems and business applications.

[0053] This application provides data protection based on the characteristics of a cloud platform, mainly involving four parts, see [link to relevant documentation]. Figure 3 As shown, these four parts can be KVM Hypervisor, QEMU, Guest OS, and Data Protection (DP) module.

[0054] KVM Hypervisor (Kernel Virtual Machine Hypervisor) is an open-source virtualization technology built into Linux. It transforms Linux into a virtual machine monitoring program, allowing the host machine to run multiple independent VMs simultaneously. KVM Hypervisor is the fundamental module for intercepting pre-defined operations (also known as high-risk operations) and protecting data. It mainly consists of a code injection module, a memory protection module, and an operation redirection module, implementing functions such as injecting data operation detection code, protecting the detection code and interception locations, and redirecting data operations. Since the primary function of KVM Hypervisor is data operation detection, it can be used as a detection module for data management devices.

[0055] QEMU runs as a user process on the host machine and works with the KVM Hypervisor to abstract, manage, and simulate VM resources. It serves as the interface between the cloud platform's console and the virtualization platform, responsible for transmitting and retrieving pre-defined data lists. It consists of a receiving module, a transmitting module, and an extracting module. Since QEMU is primarily used for data extraction, it can also function as the data extraction module for data management devices.

[0056] The preset data list can be obtained through the cloud platform's console. The console helps users manage the underlying infrastructure, platform, applications, etc. For example, customers can define preset data through the console, or identify preset data through the console. In this way, the console can generate a preset data list based on the determined preset data and send the preset data list to QEMU.

[0057] The data management device can be the host machine of a VM, or the operating system running within the VM, which can be represented as a Guest OS. The Guest OS is the workload system deployed by the customer, and code modules are injected into it by the KVM Hypervisor to implement data detection. It can include data detection modules, parameter parsing, and event notification modules.

[0058] Data Protection (DP) is a user program running on the host machine. It provides security protection and operation logging for requested data resources, and is responsible for key management, data backup, data recovery, and time period management. It consists of a password management module and a period management module. Since DP is primarily used for data protection, it can be used as a data protection module for data management devices.

[0059] based on Figure 3 The architecture diagram shown illustrates that the Data Protection Module (DP) service automatically starts after the data management device is powered on. When a user (e.g., a privileged administrator) performs data operations on target data within the cloud platform, the data management device can obtain these data operations through the detection module (i.e., the KVM Hypervisor). Because the KVM Hypervisor injects code into the Guest OS, it can obtain data operations within the Guest OS and perform real-time detection of these operations. See also... Figure 4 As shown, Figure 4 Taking the deletion operation as an example, after the user performs the deletion operation (step 1), the KVMHypervisor can obtain the deletion operation (step 2).

[0060] It should be noted that users (such as privileged administrators) may circumvent data operation interception and the determination of pre-set operations by tampering with the interception location, the criteria for determining whether it is a pre-set operation, or the client page table, thereby enabling them to successfully perform data operations on the target data. In this case, after obtaining the data operation, this embodiment can write-protect the interception location, detection module, and client page table involved in the data operation. In some cases, the KVM Hypervisor can use the EPT table to write-protect the interception location, detection module, and client page table involved in the target data. The EPT table (Extended Page Table) can be used to implement isolation of the VM physical address space.

[0061] This approach prevents privileged administrators from circumventing data operation interception and the determination of pre-set operations by tampering with interception locations, the criteria for determining whether an operation is pre-defined, or client page tables, thereby further enhancing data security.

[0062] S202. If it is determined that the data operation is a pre-set operation, extract the metadata of the target data according to the data operation.

[0063] Data management devices can determine whether a data operation is a pre-defined operation through a detection module (i.e., the KVM Hypervisor). If so, they extract metadata of the target data based on the data operation. For example, in... Figure 4 In the process, when the KVM Hypervisor determines that the data operation it has obtained is a delete operation, since deletion is a pre-defined operation, it can extract the metadata of the target data based on the data operation and send this metadata to the data extraction module (i.e., QEMU). For example... Figure 4 As shown in step 3.

[0064] It should be noted that there are several ways to determine whether a data operation is a pre-defined operation through the KVM Hypervisor. One method is for the KVM Hypervisor to identify the guest type and set up data operation interception based on VMI technology, thereby detecting in real time whether the data operation inside the VM is a pre-defined operation. Another method is for the KVM Hypervisor to inject code into the Guest OS to achieve efficient interception. This application embodiment mainly uses the second method as an example for introduction.

[0065] It is understandable that cloud platforms store a large amount of customer data, some of which may be critical and could cause significant losses if compromised by other users. Other data may be insignificant. In such cases, a pre-defined data list can be obtained. This list includes multiple pre-set data points, which may be the aforementioned critical data. These pre-defined data points can be defined by the customer through a console or identified by the console using intelligent critical data recognition technology. After a data operation is performed, the data management device can traverse the pre-defined data list to determine if the target data for the data operation is a pre-defined data point. If the target data is determined to be a pre-defined data point in the pre-defined data list, the step of extracting metadata from the target data based on the data operation is executed. It should be noted that the order of this step and the step of determining whether the data operation is a pre-defined operation is not limited in this embodiment.

[0066] For details on configuring and using the preset data list, please refer to [link / reference]. Figure 5As shown, a preset data list is defined and generated via the console (see S501), such as defining databases, system configuration files, and files in specific directories as pre-defined data as protection objects. The console provides options for commonly preset data for quick user selection. The preset data list is then sent to the corresponding data extraction module (see S502). The detection module sends its address (see S503), the data extraction module receives the address of the detection module (see S504), and the data extraction module sends the preset data list to the detection module according to the address (see S505).

[0067] This method allows for the protection of pre-defined data, thereby improving the security of critical data. At the same time, since it eliminates the need to protect all data, it reduces the consumption of processing resources.

[0068] S203. Locate and extract the target data based on the metadata.

[0069] It should be noted that in some cases, metadata can be carried in the data parsing request. That is, the method of locating and extracting the target data based on metadata might involve the detection module sending a data parsing request to the data extraction module (i.e., QEMU), and this data parsing request including metadata. Then, in response to the data parsing request, the data extraction module locates and extracts the target data based on the metadata. For example... Figure 4 As shown in step 4.

[0070] S204. Perform a management operation on the target data corresponding to the pre-set operation, wherein the management operation includes at least one of backup operation, encryption operation and hiding operation.

[0071] In this embodiment, the data protection module in the data management device is used for data backup, encryption, and hiding operations. Therefore, the data management device can perform management operations corresponding to pre-set operations on the target data through the data protection module (i.e., DP). After performing the management operation, a warning notification can be sent to the console to achieve a warning function.

[0072] In one possible implementation, the data extraction module may send a notification to the data protection module (step 5), causing the data protection module to perform management operations on the target data (step 6).

[0073] It should be noted that the data protection module can collect the host machine's hardware characteristics (see...). Figure 6 As shown in S601, determine whether the host machine supports SGX (see S601). Figure 6 If not, throw an exception and enable normal mode (see S602). Figure 6If so, then enable safe mode (see S603). Figure 6 (As shown in S604).

[0074] When the management operation is a hidden operation, the target data is hidden, making privileged administrators mistakenly believe that the target data has been deleted, thereby improving data security.

[0075] It is understandable that when the management operation is a backup operation and an encryption operation, a backup information table and a backup data table can be generated in advance. The backup information table records the object information of the data's owner, and the backup data table records the information of the backup data. Here, the object can refer to a customer using the cloud platform. Then, an encryption key for the corresponding object is generated based on the object information and a random number generated by a random number generator, and added to the backup information table. It should be noted that this application embodiment does not limit the timing of the backup data table generation; for example, the backup data table can be generated at the same time as the backup information table, or the backup information table can be generated first (see...). Figure 6 As shown in S605, then based on the object information and the random number generated by the random number generator, the corresponding object's encryption key is generated (see [reference]). Figure 6 As shown in S606), and add it to the backup information table (see [reference]). Figure 6 After (as shown in S607), generate the backup data table (see...). Figure 6 (As shown in S608). Specifically, if a new object, such as a customer, joins the cloud platform, a virtual machine is generated for the new object (see [reference]). Figure 6 As shown in S609), and extract object information (see...). Figure 6 (As shown in S610) is used to generate the corresponding encryption key.

[0076] In this way, when a management operation corresponding to a pre-defined operation needs to be performed on the target data, the encryption key corresponding to the target object can be found in the backup information table based on the object information of the target object to which the target data belongs. The target data is then backed up, and the target data after the backup operation is performed is encrypted using the encryption key corresponding to the target object, resulting in backup data (i.e., encrypted backup of the target data). The information corresponding to the backup data is then added to the backup data table.

[0077] It should be noted that this application embodiment also provides a one-click recovery function. When it is necessary to recover the target data for which management operations have been performed, the customer can trigger the one-click recovery function to send a data recovery request for the target data to the data management device. After receiving the data recovery request, the data management device can respond to the data recovery request and perform data recovery on the target data after the management operations have been performed. After the data recovery is performed, a recovery completion notification can be sent to the console.

[0078] For example, when the management operation is a hidden operation, the target data will be displayed in the directory; when the management operation is a backup operation or an encryption operation, the encryption key corresponding to the target object can be found in the backup information table based on the object information of the target object to which the target data belongs, the target data after the management operation is performed can be restored, and the information of the backup data corresponding to the target data can be deleted from the backup data table.

[0079] Specifically, you can wait for a request (see...) Figure 6 As shown in S611, upon receiving a request, it is determined whether the request is for requesting data backup (see [reference]). Figure 6 If so, then the target data is encrypted and backed up (see section S612). Figure 6 As shown in S613), and add the information corresponding to the backup data to the backup data table (see...). Figure 6 (As shown in S614). If not, it indicates that the request is a data recovery request, and data recovery is performed (see...). Figure 6 As shown in S615), and delete the information of the backup data corresponding to the target data from the backup data table (see S615). Figure 6 (As shown in S616). Send a notification to the console (see...) Figure 6 As shown in S617, when performing encrypted backup, the notification sent is a warning notification, and when performing data recovery, the notification sent is a recovery completion notification.

[0080] As can be seen from the above technical solution, when data operations are performed on target data in the cloud platform, the data management device can obtain the data operations performed on the target data in the cloud platform, thereby identifying whether the data operation is a pre-set operation that damages the target data. If it is determined that the data operation is a pre-set operation, the target data's metadata is extracted based on the data operation, and the target data is located and extracted based on the metadata. Then, management operations corresponding to the pre-set operations are performed on the target data. These management operations include at least one of backup, encryption, and hiding operations. In this way, even if pre-set operations are performed on the target data, the data management device can still protect the target data through these management operations. This solution deploys security protection on the cloud platform, using whether the data operation is a pre-set operation that damages the target data as the basis for whether to protect the target data. Therefore, when it is determined that the data operation is a pre-set operation that damages the target data, management operations to protect the target data's security are performed on the target data, rather than relying on whether the user has access permissions. This prevents malicious privileged users from bypassing or disabling the protection scheme, and is more effective against malicious privileged users, thus improving data security.

[0081] This application fully leverages the characteristics of cloud platforms, achieving secure and reliable data protection based on virtualization technology. It addresses the current inability to effectively counter destructive operations by high-end attackers and internally malicious privileged administrators. Specific advantages include high security, strong transparency, high efficiency, flexible policies, and rapid response (i.e., no time lag). High security is reflected in the integrity protection of code and data within the virtual machine provided by virtualization technology, ensuring the effectiveness of data management and making it difficult to bypass. Strong transparency is reflected in the ability to provide protection to customers in a transparent, bypass-oriented manner based on cloud computing characteristics, unaffected by customer business operations. High efficiency is reflected in the filtering operations within the virtual machine, enabling real-time detection. Furthermore, compared to overall snapshots, managing only the target data is more efficient. Flexible policies are reflected in the ability to define different security policies, including detection, interception, and management operations.

[0082] This application also provides a cloud platform data management method, the signaling interaction diagram of which can be found in [reference needed]. Figure 7 As shown, the method includes:

[0083] S701, The console generates a preset data list.

[0084] S702, the data protection module starts automatically.

[0085] S703, the detection module detects data operations.

[0086] S704, The detection module extracts the metadata of the target data based on data operations.

[0087] S705, The data extraction module receives data parsing requests.

[0088] S706, Data Extraction Module extracts target data.

[0089] S707, the data protection module performs management operations corresponding to the data operations on the target data.

[0090] S708, the user triggers a data recovery request in the console.

[0091] S709, The data protection module performs data recovery on the target data after the management operation is completed based on the data recovery request.

[0092] The S710 data extraction module stores the recovered target data into the cloud platform.

[0093] S703-S706 describes the interception process for pre-defined operations, which will be detailed below. The KVM Hypervisor injects detection code into the Guest OS to achieve efficient interception (see...). Figure 8As shown in S801 (see section S801). Intercept data operations targeting the target data (see section S801). Figure 8 As shown in S802, data operations can typically exist in the form of functions; therefore, intercepting data operations can actually be done by intercepting functions that perform data operations. Send its own address and the interception address to the KVM Hypervisor (see...). Figure 8 As shown in S803 (see section S803). Write protection is applied to the client page tables involved in the interception location, detection module, and target data (see section S803). Figure 8 (As shown in S804). The data operation is determined to be a pre-defined operation (e.g., a high-risk operation, see [reference]). Figure 8 As shown in S805, determine whether the target data is the preset data (see S805). Figure 8 As shown in S806, if the target data is pre-defined data, then extract the metadata (see...). Figure 8 As shown in S807, the KVM Hypervisor is notified (flexible policies can be defined, such as denying operations, issuing warnings, etc.). Metadata is forwarded to the data extraction module (see...). Figure 8 As shown in S808). The data extraction module extracts the target data (see...). Figure 8 As shown in S809), and sends the target data to the data protection module (see...). Figure 8 (As shown in S810). If the target data is not the preset data, continue to perform data operations (see...). Figure 8 (As shown in S811).

[0094] The following section will provide a detailed introduction to the data extraction process of the data extraction module.

[0095] The metadata received by the data extraction module may include directory information and inodes (index nodes) of the target data. The target information may include the name and path of the target data. The target data can be stored in a virtual disk on the cloud platform, and the data extraction module can parse the virtual disk format. In some cases, the directory information of different data may be the same. Therefore, based on the directory information included in the metadata, multiple candidate directories are determined, and the candidate data under each candidate directory has a corresponding inode. Then, the inodes included in the metadata are compared with the inodes corresponding to the candidate data under each of the multiple candidate directories. If the inode corresponding to the candidate data in the target directory is the same as the inode included in the metadata, the target data is located in the target directory; the target data is then extracted from the target directory.

[0096] In other cases, when resolving virtual disk formats (see...) Figure 9 After (as shown in S901), the first candidate directory can also be determined based on the directory information in the metadata (see...). Figure 9(As shown in S902), then the index nodes included in the metadata are compared with the index nodes corresponding to the candidate data under the first candidate directory (see...). Figure 9 As shown in S903, determine whether the candidate data under the first candidate directory is the target data (see S903). Figure 9 (As shown in S904). If so, the candidate data under the first candidate directory is sent as the target data to the data protection module (see...). Figure 9 (As shown in S905). If not, continue searching for the target data (see...). Figure 9 As shown in S906, the first candidate directory is redefined.

[0097] It should be noted that, based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods.

[0098] based on Figure 2 Corresponding to the cloud platform data management method provided in the embodiments, this application also provides a cloud platform data management device 1000. See also Figure 10 The device 1000 is deployed on a data management device, and the device 1000 includes an acquisition unit 1001, an extraction unit 1002, and a management unit 1003.

[0099] The acquisition unit 1001 is used to acquire data operations performed on target data in the cloud platform;

[0100] The extraction unit 1002 is used to extract metadata of the target data according to the data operation if it is determined that the data operation is a pre-set operation.

[0101] The extraction unit 1002 is also used to locate and extract the target data based on the metadata;

[0102] The management unit 1003 is used to perform management operations on the target data corresponding to the pre-set operations, the management operations including at least one of backup operations, encryption operations and hiding operations.

[0103] In one possible implementation, the acquisition unit 1001 is used to acquire the data operation through the detection module;

[0104] The extraction unit 1002 is used to extract the metadata of the target data through the detection module if the detection module determines that the data operation is a pre-set operation;

[0105] The extraction unit 1002 is further configured to send a data parsing request to the data extraction module through the detection module, the data parsing request including the metadata; and in response to the data parsing request, locate and extract the target data through the data extraction module based on the metadata.

[0106] The management unit 1003 is specifically used to perform management operations on the target data corresponding to the pre-set operations through the data protection module.

[0107] In one possible implementation, the apparatus further includes a traversal unit and a determination unit:

[0108] The traversal unit is used to traverse a preset data list after acquiring the data operation to be performed on the target data in the cloud platform. The preset data list includes multiple pre-defined data.

[0109] The determining unit is configured to, if the target data is determined to be data pre-defined in the preset data list, perform the step of extracting metadata of the target data based on the data operation if the data operation is determined to be a pre-defined operation.

[0110] In one possible implementation, the device further includes a write protection unit:

[0111] The write protection unit is used to write-protect the interception location of the data operation, the detection module, and the client page table involved in the target data after acquiring the data operation performed on the target data in the cloud platform.

[0112] In one possible implementation, the extraction unit 1002 is specifically used for:

[0113] Based on the directory information included in the metadata, multiple candidate directories are determined, and the candidate data under each candidate directory has a corresponding index node;

[0114] If the index node corresponding to the candidate data in the target directory under the multiple candidate directories is the same as the index node included in the metadata, the target data is located in the target directory;

[0115] Extract the target data from the target directory.

[0116] In one possible implementation, the apparatus further includes a generation unit and an addition unit:

[0117] The generation unit is used to generate a backup information table and a backup data table. The backup information table is used to record the object information of the object to which the data belongs, and the backup data table is used to record the information of the backup data.

[0118] The generation unit is also used to generate an encryption key for the corresponding object based on the object information and the random number generated by the random number generator;

[0119] The adding unit is used to add the encryption key to the backup information table;

[0120] If the management operation is a backup operation and an encryption operation, the management unit 1003 is specifically used for:

[0121] Based on the object information of the target object to which the target data belongs, the encryption key corresponding to the target object is retrieved from the backup information table;

[0122] The target data is backed up, and the target data after the backup operation is performed is encrypted using the encryption key corresponding to the target object to obtain the backup data;

[0123] Add the information corresponding to the backup data to the backup data table.

[0124] In one possible implementation, after performing the management operation corresponding to the pre-set operation on the target data, the device further includes a receiving unit and a recovery unit:

[0125] The receiving unit is configured to receive a data recovery request for the target data;

[0126] The recovery unit is used to recover the target data after the management operation has been performed in response to the data recovery request.

[0127] This application provides a terminal, taking a smartphone as an example:

[0128] Figure 11 The diagram shown is a block diagram of a portion of the structure of a smartphone provided in an embodiment of this application. (Reference) Figure 11 A smartphone includes components such as a radio frequency (RF) circuit 1110, a memory 1120, an input unit 1130, a display unit 1140, a sensor 1150, an audio circuit 1160, a Wi-Fi module 1170, a processor 1180, and a power supply 1190. The input unit 1130 may include a touch panel 1131 and other input devices 1132, the display unit 1140 may include a display panel 1141, and the audio circuit 1160 may include a speaker 1161 and a microphone 1162. It is understood that... Figure 11The smartphone structure shown does not constitute a limitation on smartphones and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0129] The memory 1120 can be used to store software programs and modules. The processor 1180 executes various functions and data processing of the smartphone by running the software programs and modules stored in the memory 1120. The memory 1120 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the smartphone (such as audio data, phonebook, etc.). In addition, the memory 1120 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0130] The processor 1180 is the control center of the smartphone, connecting various parts of the smartphone via various interfaces and lines. It performs various functions and processes data by running or executing software programs and / or modules stored in the memory 1120 and calling data stored in the memory 1120. Optionally, the processor 1180 may include one or more processing units; preferably, the processor 1180 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1180.

[0131] In this embodiment, the steps performed by the processor 1180 in the smartphone can be achieved through... Figure 11 The structure shown is implemented.

[0132] This application also provides a server that can be used as a data management device. Please refer to [link to relevant documentation]. Figure 12 As shown, Figure 12This is a structural diagram of a server 1200 provided in an embodiment of this application. The server 1200 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 1222 (e.g., one or more processors) and a memory 1232, and one or more storage media 1230 (e.g., one or more mass storage devices) for storing application programs 1242 or data 1244. The memory 1232 and storage media 1230 can be temporary or persistent storage. The program stored in the storage media 1230 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the server. Furthermore, the CPU 1222 may be configured to communicate with the storage media 1230 and execute the series of instruction operations in the storage media 1230 on the server 1200.

[0133] Server 1200 may also include one or more power supplies 1226, one or more wired or wireless network interfaces 1250, one or more input / output interfaces 1258, and / or one or more operating systems 1241, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0134] In this embodiment, the central processing unit 1222 in server 1200 can perform the following steps:

[0135] To retrieve data operations to be performed on target data in the cloud platform;

[0136] If the data operation is determined to be a pre-defined operation, the metadata of the target data is extracted based on the data operation.

[0137] The target data is located and extracted based on the metadata.

[0138] Perform management operations on the target data corresponding to the pre-set operations, the management operations including at least one of backup operations, encryption operations, and hiding operations.

[0139] According to one aspect of this application, a computer-readable storage medium is provided for storing program code for executing the cloud platform data management method described in the foregoing embodiments.

[0140] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the above embodiments.

[0141] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0142] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0144] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0145] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0146] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0147] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A cloud platform data management method, characterized in that, The method is executed by a data management device, which includes a detection module, a data extraction module, and a data protection module. The method includes: The detection module acquires data operations performed on target data in the cloud platform, including: injecting detection code into the operating system running on the data management device through the detection module, intercepting data operations that exist in the form of functions, and acquiring data operations within the operating system; Extended page tables are used to write-protect the interception location of data operations, the detection module, and the client page tables involved in the target data. The extended page tables are used to achieve isolation of the virtual machine's physical address space. Identify whether the data operation is a pre-set operation that damages the target data; If the data operation is determined to be a pre-set operation, the metadata of the target data is extracted based on the data operation, including: if the detection module determines that the data operation is a pre-set operation, the metadata of the target data is extracted through the detection module; the metadata includes directory information and index nodes of the directory where the target data is located, and the pre-set operation includes at least one of modification operation, deletion operation and encryption operation; Locating and extracting the target data based on the metadata includes: sending a data parsing request to the data extraction module through the detection module, the data parsing request including the metadata; and responding to the data parsing request, locating and extracting the target data based on the metadata through the data extraction module. The data protection module performs management operations on the target data corresponding to the preset operations. The management operations include at least one of backup operations, encryption operations, and hiding operations. When it is determined that the data operation is a preset operation that damages the target data, the management operation used to protect the security of the target data is performed on the target data. Wherein, if the preset operation is a delete operation, then the management operation corresponding to the preset operation is a hide operation; If the management operation includes a backup operation and an encryption operation, then the management operation performed on the target data corresponding to the pre-set operation includes: finding the encryption key corresponding to the target object in the backup information table according to the object information of the target object to which the target data belongs, performing a backup operation on the target data, and using the encryption key corresponding to the target object to perform an encryption operation on the target data after the backup operation, to obtain backup data, and adding the information corresponding to the backup data to the backup data table.

2. The method according to claim 1, characterized in that, After obtaining the data operations performed on the target data in the cloud platform, the method further includes: Traverse the preset data list, which includes multiple pre-defined data; If the target data is determined to be data pre-defined in the preset data list, the step of extracting the metadata of the target data based on the data operation is executed if the data operation is determined to be a pre-defined operation.

3. The method according to claim 1, characterized in that, The step of locating and extracting the target data based on the metadata includes: Based on the directory information included in the metadata, multiple candidate directories are determined, and the candidate data under each candidate directory has a corresponding index node; If the index node corresponding to the candidate data in the target directory under the multiple candidate directories is the same as the index node included in the metadata, the target data is located in the target directory; Extract the target data from the target directory.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: Generate the backup information table and the backup data table. The backup information table is used to record the object information of the object to which the data belongs. The backup data table is used to record the information of the backup data. An encryption key for the corresponding object is generated based on the object information and a random number generated by the random number generator, and then added to the backup information table.

5. The method according to any one of claims 1-3, characterized in that, After performing the management operation corresponding to the preset operation on the target data, the method further includes: Receive a data recovery request for the target data; In response to the data recovery request, data recovery is performed on the target data after the management operation was executed.

6. A cloud platform data management device, characterized in that, The device is deployed on a data management device, which includes a detection module, a data extraction module, and a data protection module. The device also includes an acquisition unit, an extraction unit, a write protection unit, and a management unit. The acquisition unit is used to acquire data operations performed on target data in the cloud platform through the detection module, including: injecting detection code into the operating system running on the data management device through the detection module, intercepting data operations that exist in the form of functions, and acquiring data operations within the operating system; The write protection unit is used to write-protect the interception location of data operations, the detection module, and the client page table involved in the target data using an extended page table. The extended page table is used to implement isolation of the virtual machine's physical address space. The extraction unit is used to identify whether the data operation is a pre-set operation that damages the target data; if the data operation is determined to be a pre-set operation, the metadata of the target data is extracted based on the data operation, including: if the detection module determines that the data operation is a pre-set operation, the metadata of the target data is extracted through the detection module; the metadata includes directory information and index nodes of the directory where the target data is located, and the pre-set operation includes at least one of modification operation, deletion operation and encryption operation; The extraction unit is further configured to locate and extract the target data based on the metadata, including: sending a data parsing request to the data extraction module through the detection module, the data parsing request including the metadata; and, in response to the data parsing request, locating and extracting the target data based on the metadata through the data extraction module. The management unit is used to perform management operations on the target data corresponding to the preset operations through the data protection module. The management operations include at least one of backup operations, encryption operations, and hiding operations. When it is determined that the data operation is a preset operation that destroys the target data, the management operation used to protect the security of the target data is performed on the target data. Wherein, if the preset operation is a delete operation, then the management operation corresponding to the preset operation is a hide operation; If the management operation includes a backup operation and an encryption operation, then the management unit is specifically used to: find the encryption key corresponding to the target object from the backup information table according to the object information of the target object to which the target data belongs, perform a backup operation on the target data, and use the encryption key corresponding to the target object to perform an encryption operation on the target data after the backup operation is performed to obtain backup data, and add the information corresponding to the backup data to the backup data table.

7. The apparatus according to claim 6, characterized in that, It also includes traversal units and determination units: The traversal unit is used to traverse a preset data list after the data operation performed on the target data in the cloud platform is obtained. The preset data list includes multiple pre-defined data. The determining unit is configured to, if the target data is determined to be data pre-defined in the preset data list, perform the step of extracting metadata of the target data based on the data operation if the data operation is determined to be a pre-defined operation.

8. A data management device for a cloud platform, characterized in that, The data management device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the method according to any one of claims 1-5 according to the instructions in the program code.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code that, when executed by a processor, causes the processor to perform the method according to any one of claims 1-5.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-5.

Images