Data processing method, system and device, computer equipment and storage medium

Abstract

The embodiment of the invention relates to a data processing method, system and device, computer equipment and a storage medium, and the method comprises the steps: dividing a processing request into a plurality of subtasks when the processing request of a target object for target data is received; each subtask is sent to a corresponding cloud node, so that each cloud node processes data of a local database according to the subtask to obtain processed target data, and the data of the local database is homomorphic encrypted data encrypted through a homomorphic encryption algorithm in advance; and sending the target data processed by each cloud node to the target object, wherein the target data processed by the cloud nodes are homomorphic encrypted data. Therefore, the data after homomorphic encryption can be processed in the cloud node, the data are in the state after homomorphic encryption in the data processing and data sending processes, the data do not need to be decrypted and processed, data leakage is avoided, and therefore the safety of the data of the cloud node in the processing process can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing technology, and in particular, to a data processing method, system, device, computer equipment and storage medium. Background Art

[0002] As the demand for data privacy protection continues to increase, especially in the fields of finance, medical care, and scientific research, how to securely share and process data in a multi-cloud environment has become a major challenge.

[0003] Traditional encryption technology is usually static encryption. Although it can protect static data, it is often necessary to decrypt the static encrypted data first during data calculation and sharing, which makes the data face the risk of leakage during transmission and processing, and the security is low. Therefore, how to improve the security of data processing in the cloud environment has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, in order to solve the above technical problems or part of the technical problems, the embodiments of the present invention provide a data processing method, system, apparatus, computer equipment and storage medium.

[0005] In a first aspect, an embodiment of the present invention provides a data processing method, including:

[0006] When receiving a processing request for target data from a target object, dividing the processing request into a plurality of subtasks;

[0007] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, wherein the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm;

[0008] The target data processed by each cloud node is sent to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

[0009] In a possible implementation, when the processing request is a query request for target data, sending each of the subtasks to a corresponding cloud node so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data includes:

[0010] Parsing the query request to obtain the data set to be queried and the query condition;

[0011] Determine multiple cloud nodes where the to-be-queried data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0012] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes performs a query on homomorphically encrypted data in the local database according to the query condition based on the subtask to obtain the first target data after the query;

[0013] The sending the target data processed by each of the cloud nodes to the target object includes:

[0014] Receiving the first target data sent by each of the cloud nodes;

[0015] Each of the first target data is merged and processed and then sent to the target object.

[0016] In a possible implementation, when the processing request is a comparison request for target data, sending each of the subtasks to a corresponding cloud node so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data includes:

[0017] Parsing the to-be-compared data set and the comparison standard from the comparison request;

[0018] Determine a plurality of cloud nodes where the to-be-compared data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0019] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask to obtain the compared second target data;

[0020] The sending the target data processed by each of the cloud nodes to the target object includes:

[0021] Receiving the second target data sent by each of the cloud nodes;

[0022] The second target data is merged and processed and then sent to the target object.

[0023] In a possible implementation manner, before receiving a processing request from a target object for target data, the method further includes:

[0024] When receiving the original data sent by the target object, determining the homomorphic encryption algorithm corresponding to the data type of the original data, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm;

[0025] Controlling the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm;

[0026] Encrypting the original data according to the encryption key and the homomorphic encryption algorithm;

[0027] The homomorphic encrypted data encrypted by the homomorphic encryption algorithm is stored in the local database of each cloud node.

[0028] In a possible implementation, the method further includes:

[0029] storing the encryption key via the key management service;

[0030] and / or, configuring access control permissions for the encryption key;

[0031] And / or, the encryption key is updated at every preset time interval.

[0032] In a possible implementation, the method further includes:

[0033] When the processing request is a synchronization request for target data, the target data is encrypted to obtain a data synchronization package, and the target data is target data encrypted by a homomorphic encryption algorithm;

[0034] Sending the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and then stores the target data in a local database of the target cloud node;

[0035] A data synchronization report is generated for sending to the target object.

[0036] In a second aspect, an embodiment of the present invention provides a data processing system, configured to implement any one of the methods in the first aspect, including:

[0037] An encryption and key management module, used for receiving original data to be encrypted, and performing homomorphic encryption on the original data by using a homomorphic encryption algorithm;

[0038] The encryption and key management module is also used to store and manage encryption keys used in homomorphic encryption;

[0039] Containerized computing nodes are used to containerize data processing request tasks through container orchestration services;

[0040] A data storage module, used to store homomorphically encrypted data through a distributed database service;

[0041] The data analysis module is used to process the homomorphically encrypted data through the big data computing framework management service;

[0042] The security control and automation management module is used to perform identity authentication and access control on the target object that sends the processing request, and to deploy and manage the data processing system.

[0043] In a third aspect, an embodiment of the present invention provides a data processing device, including:

[0044] A division module, for dividing the processing request into a plurality of subtasks when receiving a processing request of the target object for the target data;

[0045] A first sending module is used to send each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, and the data in the local database is homomorphically encrypted data that has been pre-encrypted by a homomorphic encryption algorithm;

[0046] The second sending module is used to send the target data processed by each cloud node to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

[0047] In a fourth aspect, an embodiment of the present invention provides a computer device, comprising: a processor and a memory, wherein the processor is used to execute a data processing program stored in the memory to implement the data processing method described in any one of the first aspects above.

[0048] In a fifth aspect, an embodiment of the present invention provides a storage medium, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data processing method described in any one of the first aspects above.

[0049] The data processing scheme provided by the embodiment of the present invention divides the processing request into multiple subtasks when receiving a processing request for target data from a target object; sends each of the subtasks to the corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data, and the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm; sends the target data processed by each of the cloud nodes to the target object, and the target data processed by the cloud node is homomorphically encrypted data. Thus, the homomorphically encrypted data can be processed in the cloud node according to the processing request, and the data is in a homomorphically encrypted state during the processing and sending of the data, and there is no need to decrypt the data for post-processing, thereby avoiding data leakage, and thus improving the security of the cloud node data during the processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flowchart of a data processing method provided by an embodiment of the present invention;

[0051] Figure 2A schematic diagram of a flow chart of another data processing method provided by an embodiment of the present invention;

[0052] Figure 3 A schematic diagram of the structure of a data processing system provided by an embodiment of the present invention;

[0053] Figure 4 A schematic diagram of the structure of a data processing device provided by an embodiment of the present invention;

[0054] Figure 5 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] To facilitate understanding of the embodiments of the present invention, specific embodiments will be further explained below in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0057] Figure 1 A flow chart of a data processing method provided by an embodiment of the present invention is as follows: Figure 1 As shown, the method specifically includes:

[0058] S11. When a processing request for target data from a target object is received, the processing request is divided into a plurality of subtasks.

[0059] The data processing method provided in the embodiment of the present invention is applied to computer equipment, which may include but is not limited to: cloud computing management platforms (for example, OpenStack), servers, desktop computers, etc. Specifically, the encrypted data in each cloud node in a multi-cloud environment can be processed according to the received processing request. During the processing, the data is in an encrypted state and no decryption post-processing is required, thereby avoiding data leakage.

[0060] In this embodiment, the execution subject is described as a cloud computing management platform, and the target object is a user who establishes a connection with the cloud computing management platform through a Web console or an API interface. When a processing request for target data is received, the processing request is divided into multiple subtasks that can be executed in parallel. For cross-cloud scenarios, each subtask will be distributed to different cloud nodes (for example, different data centers or private clouds / public clouds) for processing. The types of processing requests may include but are not limited to: cross-cloud data query, cross-cloud data comparison, and cross-cloud data synchronization for target data.

[0061] S12. Send each subtask to the corresponding cloud node, so that each cloud node processes the data in the local database according to the subtask to obtain the processed target data. The data in the local database is homomorphic encrypted data that has been pre-encrypted by a homomorphic encryption algorithm.

[0062] In this embodiment, when storing data, each cloud node will homomorphically encrypt the data through a homomorphic encryption algorithm, and store the homomorphically encrypted data in a local database in the cloud node. Homomorphic encryption allows processing or calculation operations to be performed directly on ciphertext without decrypting the data, and the result of the processing or calculation is still in the form of homomorphic encryption. After decrypting the result, the same result as that of processing or calculating directly on the plaintext can be obtained. Therefore, data in a homomorphic encrypted state can be directly processed without decryption.

[0063] Specifically, when the processing request is divided into multiple subtasks, the cloud node corresponding to the subtask is determined according to the task type of each subtask and the data required to process the subtask (for example, subtask A is a data query, and the cloud nodes that can query data include: B, C, D, and the data to be queried is the data set in cloud node B. At this time, the cloud node corresponding to subtask A is determined to be B), and each subtask is sent to the corresponding cloud node. After receiving the subtask, the cloud node will process the homomorphically encrypted data in the local database in the cloud node according to the type of processing request corresponding to the subtask. The homomorphically encrypted data will not be decrypted during the processing process.

[0064] S13. Send the target data processed by each cloud node to the target object. The target data processed by the cloud node is homomorphically encrypted data.

[0065] In this embodiment, each cloud node will send the target data processed according to the subtask to a preset central node, or send it to the processing module of the cloud computing management platform, so that the central node or the processing module can summarize the processed target data sent by each cloud node, and return it to the target object through the API after summarizing, so that the target object can use the key corresponding to the homomorphic encryption to decrypt the processed target data to obtain the final result. The data is not decrypted during the data sending process, that is, the processed target data in an encrypted state is sent to the target object.

[0066] The data processing method provided by the embodiment of the present invention divides the processing request into multiple subtasks when receiving a processing request for target data from a target object; sends each of the subtasks to the corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data, and the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm; sends the target data processed by each of the cloud nodes to the target object, and the target data processed by the cloud node is homomorphically encrypted data. Thus, the homomorphically encrypted data can be processed in the cloud node according to the processing request, and the data is in a homomorphically encrypted state during the processing and sending of the data, and there is no need to decrypt the data for post-processing, thereby avoiding data leakage, and thus improving the security of the cloud node data during the processing process.

[0067] Figure 2 A flow chart of another data processing method provided by an embodiment of the present invention is as follows: Figure 2 As shown, the method specifically includes:

[0068] S21. When receiving the original data sent by the target object, determine the homomorphic encryption algorithm corresponding to the data type of the original data, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm; control the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm;

[0069] S22. Encrypt the original data according to the encryption key and the homomorphic encryption algorithm; store the homomorphic encrypted data encrypted by the homomorphic encryption algorithm in the local database of each cloud node.

[0070] In this embodiment, steps S21 and S22 are described uniformly, the original data is the data that needs to be stored in the cloud, the target object is the user who sends the original data, and the target object can upload the original data to the cloud computing management platform (for example, the CloudSecureShare platform) through the Web console or API interface.

[0071] Furthermore, homomorphic encryption algorithms corresponding to different data types are pre-set in the cloud computing management platform. Homomorphic encryption algorithms may include but are not limited to: Paillier public key encryption, CKKS homomorphic encryption (Cheon-Kim-Kim-Song), BFV homomorphic encryption (Brakerski-Fan-Vercauteren), etc. After the platform system receives the original data, it obtains the data type of the original data and determines the homomorphic encryption algorithm corresponding to the current data type, or the user can select a homomorphic encryption algorithm according to the encryption requirements, and generates an encryption key corresponding to the currently determined homomorphic encryption algorithm through the key management service in the system (for example, OpenStack Barbican). The key management service is a service for managing the life cycle of encryption keys, including the creation, storage, distribution, rotation, and destruction of keys. Furthermore, the system calls the encryption module, performs homomorphic encryption processing on the original data according to the determined homomorphic encryption algorithm and encryption key, and obtains homomorphic encrypted data.

[0072] Determine the cloud node corresponding to the encrypted homomorphically encrypted data. The determination method may include but is not limited to: randomly selecting a cloud node, or determining the cloud node corresponding to the current data type, or determining the cloud node corresponding to the address of the current target object, etc. Store the homomorphically encrypted data in the local database of the corresponding cloud node (for example, OpenStack Trove distributed database). The homomorphically encrypted data always remains encrypted during the transmission and storage process, that is, the data stored in the local database are all encrypted data.

[0073] In one possible implementation, the encryption key is stored via a key management service; and / or, the access control authority of the encryption key is configured; and / or, the encryption key is updated at every preset time interval.

[0074] In this embodiment, the encryption key is securely stored, access controlled, and periodically rotated through a key management service (e.g., Barbican). The security of the encryption key can be ensured by configuring the access rights of the encryption key, and a new encryption key can be generated at a preset interval and the original encryption key can be updated for use. Therefore, when the encryption key is leaked, the new encryption key has been updated and data will not be leaked, thus achieving the management of the encryption key life cycle.

[0075] S23, when a processing request is received and the processing request is a query request for target data, the query request is divided into a plurality of subtasks; a data set to be queried and a query condition are parsed from the query request; a plurality of cloud nodes where the data set to be queried is located are determined, and the divided subtasks correspond to the cloud nodes one by one;

[0076] S24, sending each subtask to the corresponding cloud node, so that each cloud node queries the homomorphically encrypted data in the local database according to the query conditions according to the subtask, and obtains the first target data after the query;

[0077] S25, receiving the first target data sent by each cloud node; merging and processing each first target data and sending it to the target object.

[0078] In this embodiment, steps S23-S25 are described uniformly, and the target object can send a processing request for the target data to the cloud computing management platform. The processing request may include but is not limited to: cross-cloud data query, cross-cloud data comparison, and cross-cloud data synchronization.

[0079] When the processing request submitted by the target object in the Web console or through the API is a query request, the cloud computing management platform system preprocesses the query request so that the processed query request is suitable for processing homomorphically encrypted data. The system divides the query request into multiple subtasks that can be executed in parallel. The data set to be queried and the query conditions are parsed from the query request. Each cloud node stores a data set composed of different homomorphically encrypted data, and multiple cloud nodes corresponding to the parsed data set to be queried are determined. The number of multiple subtasks can also be adjusted according to the number of determined cloud nodes, and the divided subtasks correspond to the cloud nodes one by one. Each subtask is sent to the corresponding cloud node, so that each cloud node executes the query of homomorphically encrypted data in the local database, and directly performs query calculation on the homomorphically encrypted data according to the query conditions to obtain the first target data after the query. The first target data is homomorphically encrypted data, that is, the data is avoided from being decrypted during the query calculation process. In this way, the characteristics of the homomorphic encryption algorithm can be used to ensure that the query result of the homomorphic encryption is consistent with the plaintext query result.

[0080] Furthermore, the first target data of each cloud node is received and aggregated to the central node. The result of merging and aggregating all the first target data is returned to the target object through the API, so that the target object can use the encryption key to decrypt the first target data to obtain the final query result.

[0081] S26. When a processing request is received and the processing request is a comparison request for target data, the comparison request is divided into a plurality of subtasks, and a to-be-compared data set and a comparison standard are parsed from the comparison request; a plurality of cloud nodes where the to-be-compared data set is located are determined, and the divided subtasks correspond to the cloud nodes one by one;

[0082] S27, sending each subtask to the corresponding cloud node, so that each cloud node compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask, and obtains the compared second target data;

[0083] S28, receiving the second target data sent by each of the cloud nodes; merging and processing the second target data and sending them to the target object.

[0084] In this embodiment, steps S26-S28 are described uniformly. When the processing request submitted by the target object in the Web console or through the API is a comparison request for the target data, the cloud computing management platform system preprocesses the comparison request so that the processed comparison request is suitable for processing homomorphically encrypted data. The system divides the comparison request into multiple subtasks that can be executed in parallel. The data set to be compared and the comparison standard are parsed from the comparison request. Each cloud node stores a data set composed of different homomorphically encrypted data, and determines the multiple cloud nodes corresponding to the parsed data set to be compared. The number of multiple subtasks can also be adjusted according to the number of determined cloud nodes, and the divided subtasks correspond to the cloud nodes one by one. Each subtask is sent to the corresponding cloud node so that each cloud node performs the comparison of homomorphically encrypted data in the local database, and directly performs the comparison calculation on the homomorphically encrypted data according to the comparison standard to obtain the second target data after comparison. The second target data is homomorphically encrypted data, that is, the data is avoided from being decrypted during the comparison calculation process. In this way, the characteristics of the homomorphic encryption algorithm can be used to ensure that the comparison result of the homomorphically encrypted data is consistent with the plaintext comparison result.

[0085] Furthermore, the second target data of each cloud node is received and aggregated to the central node. The result of merging and aggregating all the second target data is returned to the target object through the API, so that the target object can use the encryption key to decrypt the second target data to obtain the final comparison result.

[0086] S29. When the processing request is a synchronization request for target data, encrypt the target data to obtain a data synchronization package, where the target data is the target data encrypted by the homomorphic encryption algorithm;

[0087] S30. Send the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and stores the target data in the local database of the target cloud node; generate a data synchronization report for sending to the target object.

[0088] In this embodiment, steps S29-S30 are described uniformly. When the target object submits a cross-cloud target data synchronization request in the Web console or API interface, the data set to be synchronized and the target cloud node to be synchronized are obtained from the synchronization request. The system encrypts the target data to be synchronized and packages it to form a data synchronization package. The data and metadata in the synchronization package are homomorphically encrypted data to ensure the security of data transmission.

[0089] Furthermore, the system transmits the data synchronization package to the target cloud node through a secure channel such as a dedicated line or VPN. During the transmission process, the data packet remains in a homomorphic encryption state to prevent theft or tampering. The target cloud node decrypts the received data synchronization package to obtain the target data, which is the original homomorphic encrypted data. The target data is written to the local database of the target cloud node, which remains in a homomorphic encryption state after writing, and uses the local key management service for encryption key storage and management.

[0090] After the synchronization is completed, the system generates a data synchronization report, which includes the integrity check results of the synchronized data and the log information of the synchronization process. The data synchronization report is returned to the user through the API or Web console, and the user can view and confirm the success of the synchronization.

[0091] The data processing method provided by the embodiment of the present invention stores homomorphically encrypted data processed by homomorphic encryption in different cloud nodes in advance, and performs query, comparison, synchronization and other processing on the homomorphically encrypted data when receiving different processing requests. The data remains in a homomorphic encrypted state during the processing process and the data transmission process. After the final processing result is returned to the user, the user can decrypt the processing result to obtain a plaintext processing result, so that the data in the homomorphic encrypted state can be processed. The data is not decrypted during the processing process, avoiding the risk of data leakage, ensuring the security of the data processing process, and the final processing result is consistent with the processing result in the plaintext state, ensuring the accuracy of the processing in the data encryption state. And through the key management service, the situation of data leakage caused by key leakage is avoided, and the security of key management is improved.

[0092] Figure 3 A schematic diagram of a data processing system provided by an embodiment of the present invention is shown in FIG. Figure 3 As shown, the system specifically includes:

[0093] The encryption and key management module 31 is used to receive the original data to be encrypted, and to perform homomorphic encryption on the original data by using a homomorphic encryption algorithm;

[0094] The encryption and key management module 32 is also used to store and manage encryption keys used in homomorphic encryption;

[0095] A containerized computing node 33, used to containerize data processing request tasks through a container orchestration service;

[0096] A data storage module 34, used to store homomorphically encrypted data through a distributed database service;

[0097] A data analysis module 35 is used to process the homomorphically encrypted data through a big data computing framework management service;

[0098] The security control and automation management module 36 is used to perform identity authentication and access control on the target object that sends the processing request, and to deploy and manage the data processing system.

[0099] In this embodiment, after the user uploads the original data, the encryption and key management module selects the homomorphic encryption algorithm corresponding to the data type of the original data (supporting algorithms such as Paillier, CKKS, BFV and HE-CNN) for encryption, and implements the management of multi-tenant key management services through the console's identity identification and management access service (Identity and Access Management, IAM) to ensure the security and life cycle management of the keys. Multi-tenancy provides logically independent resources and services for multiple users on the same physical infrastructure to ensure data isolation and security between users.

[0100] Containerized computing nodes can use containerized applications (e.g., Kubernetes services) to containerize computing tasks, achieve elastic scheduling and dynamic resource allocation, and ensure that the system can handle computing tasks with high concurrency data. This embodiment is applied to cloud-native architecture, and can use application architectures built with technologies such as containerization, microservices, and continuous integration / continuous delivery (CI / CD) to adapt to the elastic expansion and automated management of cloud environments.

[0101] The data storage module can use OpenStack Trove's distributed database service to store homomorphic encrypted data, supporting efficient query and retrieval of large-scale data. Data is always encrypted during storage and transmission to eliminate the risk of leakage.

[0102] The data analysis module can integrate the OpenStack Sahara service to perform large-scale analysis of data in an encrypted state, such as machine learning and data mining, to meet complex business needs.

[0103] Security control and automated management: Modules can implement user authentication and role-based access control through OpenStack Keystone. Use automated operation and maintenance tools (for example, Ansible) for automated deployment and management to ensure efficient operation and maintenance and rapid expansion of the system.

[0104] The data processing system provided in this embodiment implements ciphertext computing through homomorphic encryption, eliminates the risk of data leakage during the computing process, and enhances the overall security of the system. At the same time, a cloud-native architecture can be adopted to support elastic expansion in a multi-cloud environment. The system can dynamically adjust resource configuration according to actual needs to adapt to data computing tasks of different scales. In addition, an intuitive Web console and standardized API interface are provided to simplify the operation process, improve user experience, and lower technical barriers.

[0105] The data processing system provided in this embodiment can be as follows Figure 3 The system shown in FIG. 1 may execute Figure 1-2 All steps of the data processing method in Figure 1-2 For details on the technical effects of the data processing method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0106] Figure 4 A structural diagram of a data processing device provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the device specifically includes:

[0107] A division module 41 is used for, when receiving a processing request of a target object for target data, dividing the processing request into a plurality of subtasks;

[0108] A first sending module 42 is used to send each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, and the data in the local database is homomorphically encrypted data that is pre-encrypted by a homomorphic encryption algorithm;

[0109] The second sending module 43 is used to send the target data processed by each cloud node to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

[0110] In a possible implementation, the parsing module 44 is used to parse the query request to obtain the data set to be queried and the query condition;

[0111] A determination module 45 is used to determine a plurality of cloud nodes where the to-be-queried data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0112] The first sending module is specifically used to send each of the subtasks to the corresponding cloud node, so that each of the cloud nodes performs a query on the homomorphically encrypted data in the local database according to the query condition according to the subtask, and obtains the first target data after the query;

[0113] A receiving module 46, configured to receive the first target data sent by each of the cloud nodes;

[0114] The second sending module is specifically configured to merge and process each of the first target data and then send the merged data to the target object.

[0115] In a possible implementation manner, the parsing module is further used to parse the comparison data set and the comparison standard from the comparison request;

[0116] The determination module is further used to determine a plurality of cloud nodes where the to-be-compared data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0117] The first sending module is specifically used to send each of the subtasks to the corresponding cloud node, so that each of the cloud nodes compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask to obtain the compared second target data;

[0118] The receiving module is further used to receive the second target data sent by each of the cloud nodes;

[0119] The second sending module is specifically configured to merge and process the second target data and then send the merged data to the target object.

[0120] In a possible implementation, the determination module is further used to determine the homomorphic encryption algorithm corresponding to the data type of the original data when the original data sent by the target object is received, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm;

[0121] An encryption module 47, used to control the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm;

[0122] Encrypting the original data according to the encryption key and the homomorphic encryption algorithm;

[0123] The storage module 48 is used to store the homomorphic encrypted data encrypted by the homomorphic encryption algorithm into the local database of each cloud node.

[0124] In a possible implementation manner, the storage module is further configured to store the encryption key through the key management service;

[0125] and / or, configuring access control permissions for the encryption key;

[0126] And / or, the encryption key is updated at every preset time interval.

[0127] In a possible implementation, the encryption module is further configured to, when the processing request is a synchronization request for target data, encrypt the target data to obtain a data synchronization package, and the target data is target data encrypted by a homomorphic encryption algorithm;

[0128] The first sending module is further used to send the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and stores the target data in the local database of the target cloud node;

[0129] The second sending module is further used to generate a data synchronization report for sending to the target object.

[0130] The data processing device provided in this embodiment may be as follows Figure 4 The device shown in FIG. 1 can perform the following steps: Figure 1-2 All steps of the data processing method in Figure 1-2 For details on the technical effects of the data processing method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0131] Figure 5 A schematic diagram of the structure of a computer device provided by an embodiment of the present invention, Figure 5 The computer device 500 shown includes: at least one processor 501, a memory 502, at least one network interface 504 and other user interfaces 503. The various components in the computer device 500 are coupled together via a bus system 505. It is understood that the bus system 505 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 505 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 505 is not described in detail. Figure 5 Various buses are labeled as bus system 505 .

[0132] The user interface 503 may include a display, a keyboard, or a pointing device (eg, a mouse, a trackball, a touch pad, or a touch screen).

[0133] It can be understood that the memory 502 in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM). The memory 502 described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0134] In some implementations, the memory 502 stores the following elements, executable units or data structures, or a subset thereof, or an extended set thereof: an operating system 5021 and an application program 5022 .

[0135] The operating system 5021 includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic services and process hardware-based tasks. The application 5022 includes various application programs, such as a media player (Media Player), a browser (Browser), etc., which are used to implement various application services. The program for implementing the method of the embodiment of the present invention can be included in the application 5022.

[0136] In the embodiment of the present invention, by calling the program or instruction stored in the memory 502, specifically, the program or instruction stored in the application 5022, the processor 501 is used to execute the method steps provided by each method embodiment, for example, including:

[0137] When receiving a processing request for target data from a target object, dividing the processing request into a plurality of subtasks;

[0138] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, wherein the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm;

[0139] The target data processed by each cloud node is sent to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

[0140] In a possible implementation, the query request is parsed to obtain the data set to be queried and the query condition;

[0141] Determine multiple cloud nodes where the to-be-queried data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0142] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes performs a query on homomorphically encrypted data in the local database according to the query condition based on the subtask to obtain the first target data after the query;

[0143] The sending the target data processed by each of the cloud nodes to the target object includes:

[0144] Receiving the first target data sent by each of the cloud nodes;

[0145] Each of the first target data is merged and processed and then sent to the target object.

[0146] In a possible implementation, the to-be-compared data set and the comparison standard are parsed from the comparison request;

[0147] Determine a plurality of cloud nodes where the to-be-compared data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0148] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask to obtain the compared second target data;

[0149] The sending the target data processed by each of the cloud nodes to the target object includes:

[0150] Receiving the second target data sent by each of the cloud nodes;

[0151] The second target data is merged and processed and then sent to the target object.

[0152] In a possible implementation, when the original data sent by the target object is received, the homomorphic encryption algorithm corresponding to the data type of the original data is determined, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm;

[0153] Controlling the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm;

[0154] Encrypting the original data according to the encryption key and the homomorphic encryption algorithm;

[0155] The homomorphic encrypted data encrypted by the homomorphic encryption algorithm is stored in the local database of each cloud node.

[0156] In one possible implementation, the encryption key is stored by the key management service;

[0157] and / or, configuring access control permissions for the encryption key;

[0158] And / or, the encryption key is updated at every preset time interval.

[0159] In a possible implementation, when the processing request is a synchronization request for target data, the target data is encrypted to obtain a data synchronization package, and the target data is target data encrypted by a homomorphic encryption algorithm;

[0160] Sending the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and then stores the target data in a local database of the target cloud node;

[0161] A data synchronization report is generated for sending to the target object.

[0162] The method disclosed in the above embodiment of the present invention can be applied to the processor 501, or implemented by the processor 501. The processor 501 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 501 or the instruction in the form of software. The above processor 501 can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiment of the present invention can be directly embodied as a hardware decoding processor to execute, or the hardware and software units in the decoding processor can be executed. The software unit can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 502, and the processor 501 reads the information in the memory 502 and completes the steps of the above method in combination with its hardware.

[0163] It is understood that the embodiments described herein may be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPDevice, DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), general purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in the present application, or a combination thereof.

[0164] For software implementation, the technology described herein can be implemented by a unit that performs the functions described herein. The software code can be stored in a memory and executed by a processor. The memory can be implemented in the processor or outside the processor.

[0165] The computer device provided in this embodiment may be Figure 5 The computer device shown in , can execute Figure 1-2 All steps of the data processing method in Figure 1-2 For details on the technical effects of the data processing method shown, please refer to Figure 1-2 For the sake of brevity, the relevant description is not repeated here.

[0166] The embodiment of the present invention also provides a storage medium (computer-readable storage medium). The storage medium here stores one or more programs. The storage medium may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a read-only memory, a flash memory, a hard disk or a solid-state drive; the memory may also include a combination of the above-mentioned types of memory.

[0167] When one or more programs in the storage medium can be executed by one or more processors, the data processing method executed on the device side can be implemented.

[0168] The processor is used to execute the data processing program stored in the memory to implement the following steps of the data processing method performed on the device side:

[0169] When receiving a processing request for target data from a target object, dividing the processing request into a plurality of subtasks;

[0170] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, wherein the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm;

[0171] The target data processed by each cloud node is sent to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

[0172] In a possible implementation, the query request is parsed to obtain the data set to be queried and the query condition;

[0173] Determine multiple cloud nodes where the to-be-queried data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0174] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes performs a query on homomorphically encrypted data in the local database according to the query condition based on the subtask to obtain the first target data after the query;

[0175] The sending the target data processed by each of the cloud nodes to the target object includes:

[0176] Receiving the first target data sent by each of the cloud nodes;

[0177] Each of the first target data is merged and processed and then sent to the target object.

[0178] In a possible implementation, the to-be-compared data set and the comparison standard are parsed from the comparison request;

[0179] Determine a plurality of cloud nodes where the to-be-compared data set is located, and the divided subtasks correspond to the cloud nodes one by one;

[0180] Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask to obtain the compared second target data;

[0181] The sending the target data processed by each of the cloud nodes to the target object includes:

[0182] Receiving the second target data sent by each of the cloud nodes;

[0183] The second target data is merged and processed and then sent to the target object.

[0184] In a possible implementation, when the original data sent by the target object is received, the homomorphic encryption algorithm corresponding to the data type of the original data is determined, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm;

[0185] Controlling the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm;

[0186] Encrypting the original data according to the encryption key and the homomorphic encryption algorithm;

[0187] The homomorphic encrypted data encrypted by the homomorphic encryption algorithm is stored in the local database of each cloud node.

[0188] In one possible implementation, the encryption key is stored by the key management service;

[0189] and / or, configuring access control permissions for the encryption key;

[0190] And / or, the encryption key is updated at every preset time interval.

[0191] In a possible implementation, when the processing request is a synchronization request for target data, the target data is encrypted to obtain a data synchronization package, and the target data is target data encrypted by a homomorphic encryption algorithm;

[0192] Sending the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and then stores the target data in the local database of the target cloud node;

[0193] A data synchronization report is generated for sending to the target object.

[0194] The professionals should further realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0195] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0196] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: include: When receiving a processing request for target data from a target object, dividing the processing request into a plurality of subtasks; Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, wherein the data in the local database is homomorphically encrypted data pre-encrypted by a homomorphic encryption algorithm; The target data processed by each cloud node is sent to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

2. The method according to claim 1, characterized in that When the processing request is a query request for target data, sending each of the subtasks to a corresponding cloud node so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data includes: Parsing the query request to obtain the data set to be queried and the query condition; Determine multiple cloud nodes where the to-be-queried data set is located, and the divided subtasks correspond to the cloud nodes one by one; Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes performs a query on homomorphically encrypted data in the local database according to the query condition based on the subtask to obtain the first target data after the query; The sending the target data processed by each of the cloud nodes to the target object includes: Receiving the first target data sent by each of the cloud nodes; Each of the first target data is merged and processed and then sent to the target object.

3. The method according to claim 1, characterized in that When the processing request is a comparison request for target data, sending each of the subtasks to a corresponding cloud node so that each of the cloud nodes processes the data in the local database according to the subtask to obtain the processed target data includes: Parsing the to-be-compared data set and the comparison standard from the comparison request; Determine a plurality of cloud nodes where the to-be-compared data set is located, and the divided subtasks correspond to the cloud nodes one by one; Sending each of the subtasks to a corresponding cloud node, so that each of the cloud nodes compares the homomorphically encrypted data in the local database according to the comparison standard according to the subtask to obtain the compared second target data; The sending the target data processed by each of the cloud nodes to the target object includes: Receiving the second target data sent by each of the cloud nodes; The second target data is merged and processed and then sent to the target object.

4. The method according to claim 1, characterized in that Before receiving the processing request of the target object for the target data, the method further includes: When receiving the original data sent by the target object, determining the homomorphic encryption algorithm corresponding to the data type of the original data, and there is a corresponding relationship between the data type and the homomorphic encryption algorithm; Controlling the key management service to generate an encryption key corresponding to the homomorphic encryption algorithm; Encrypting the original data according to the encryption key and the homomorphic encryption algorithm; The homomorphic encrypted data encrypted by the homomorphic encryption algorithm is stored in the local database of each cloud node.

5. The method according to claim 4, characterized in that The method further comprises: storing the encryption key via the key management service; and / or, configuring access control permissions for the encryption key; And / or, the encryption key is updated at every preset time interval.

6. The method according to claim 1, characterized in that The method further comprises: When the processing request is a synchronization request for target data, the target data is encrypted to obtain a data synchronization package, and the target data is target data encrypted by a homomorphic encryption algorithm; Sending the data synchronization package to the target cloud node corresponding to the synchronization request, so that the target cloud node decrypts the data synchronization package and then stores the target data in the local database of the target cloud node; A data synchronization report is generated for sending to the target object.

7. A data processing system, characterized in that: The method for implementing claim 1 comprises: An encryption and key management module, used for receiving original data to be encrypted, and performing homomorphic encryption on the original data by using a homomorphic encryption algorithm; The encryption and key management module is also used to store and manage encryption keys used in homomorphic encryption; Containerized computing nodes are used to containerize data processing request tasks through container orchestration services; A data storage module, used to store homomorphically encrypted data through a distributed database service; The data analysis module is used to process the homomorphically encrypted data through the big data computing framework management service; The security control and automation management module is used to perform identity authentication and access control on the target object that sends the processing request, and to deploy and manage the data processing system.

8. A data processing device, characterized in that: include: A division module, for dividing the processing request into a plurality of subtasks when receiving a processing request of the target object for the target data; A first sending module is used to send each of the subtasks to a corresponding cloud node, so that each of the cloud nodes processes the data in the local database according to the subtask to obtain processed target data, and the data in the local database is homomorphically encrypted data that has been pre-encrypted by a homomorphic encryption algorithm; The second sending module is used to send the target data processed by each cloud node to the target object, and the target data processed by the cloud node is homomorphically encrypted data.

9. A computer device, characterized in that: include: A processor and a memory, wherein the processor is used to execute a data processing program stored in the memory to implement the data processing method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data processing method according to any one of claims 1 to 7.

Images