Data processing method and device for application service, electronic equipment and readable medium

Abstract

The invention relates to an application service data processing method and device, electronic equipment and a readable medium, and relates to the technical field of computers. A specific embodiment of the method comprises the steps of receiving service data in an application service running process, writing the service data into a plaintext data table, and performing encryption processing on the service data so as to encrypt the service data in a full life cycle, writing the encrypted service data into an encrypted data table having a mapping relationship with the plaintext data table; wherein the full life cycle corresponding to the service data comprises a data generation stage, a data transmission stage, a data processing stage and a data library falling stage; and in response to the target service data query request, determining a data row corresponding to the target service data from the plaintext data table, determining an encryption row corresponding to the data row in the encryption data table according to the mapping relationship, obtaining the target service data in the encryption row, and decrypting the target service data to obtain the target service data. And sending the decryption processing result to a request end corresponding to the target service data query request. According to the implementation mode, the service data in the running process of the application service are encrypted and decrypted in the full data life cycle, the associated query of the encrypted data is realized, and the data processing efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data processing method, device, electronic device and readable medium for application services. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by its inclusion in this section.

[0003] Encryption technology is the cornerstone of network security technology. Data encryption is to convert a message (or plaintext) into meaningless ciphertext through encryption keys and encryption functions, and the recipient decrypts the data, that is, restores the ciphertext to plaintext through decryption functions and decryption keys. At present, there is no solution for full-process data encryption of service data during the operation of application services (that is, data encryption is implemented in the entire process of service data generation, service data transmission, service data processing, and service data storage). The relevant technology mainly encrypts the data to be stored and stores it in the database. After the data is encrypted and stored in the database, there is a situation where related queries cannot be supported. When querying through fuzzy query and other methods, there are technical problems such as low data query efficiency, high processing resource consumption, and poor user experience. Summary of the invention

[0004] The embodiments of the present invention provide a data processing method, device, electronic device and readable medium for an application service, which at least solve the problems of how to implement data encryption in the entire process of data generation, transmission, processing and storage for service data during the operation of the application service, and how to implement associated queries on the stored encrypted data, improve query efficiency, improve data processing efficiency, reduce processing resource consumption and improve user experience.

[0005] In order to solve the above problem, one aspect of an embodiment of the present invention provides a data processing method for an application service, including:

[0006] Receive service data during the operation of the application service, write the service data into a plaintext data table, encrypt the service data to encrypt the service data over the entire life cycle, and write the encrypted service data into an encrypted data table that is mapped to the plaintext data table; the entire life cycle of the service data includes a data generation phase, a data transmission phase, a data processing phase, and a data storage phase;

[0007] In response to a target service data query request, the data row corresponding to the target service data is determined from the plaintext data table, and the encrypted row corresponding to the data row in the encrypted data table is determined based on the mapping relationship, the target service data in the encrypted row is obtained, the target service data is decrypted, and the decryption result is sent to the request end corresponding to the target service data query request.

[0008] In some of the embodiments, before the step of encrypting the service data, the method further includes:

[0009] Determine the data to be desensitized from the service data based on the data type, and perform desensitization on the data to be desensitized.

[0010] In some embodiments, the service data is encrypted to achieve encryption of the service data throughout the entire life cycle, and the step of writing the encrypted service data into an encrypted data table that is mapped to the plaintext data table includes:

[0011] Obtaining a data encryption key from a key management system; wherein the data encryption key includes a plaintext data key and a ciphertext data key;

[0012] The service data is encrypted according to the plaintext data key to encrypt the service data throughout the entire life cycle to obtain encrypted data;

[0013] The encrypted data and the ciphertext data key are written into an encrypted data table that is mapped to the plaintext data table.

[0014] In some embodiments, the step of decrypting the target service data includes:

[0015] Obtain the plaintext data key corresponding to the ciphertext data key from the key management system, decrypt the target service data according to the plaintext data key, and obtain the decryption result.

[0016] In some embodiments, the step of encrypting the service data further includes:

[0017] A corresponding data key is generated according to the business type and receiving time of the service data, and the service data is encrypted according to the data key.

[0018] In some of these embodiments, the method further comprises:

[0019] The initial service data in the plaintext data table is obtained, the initial service data is encrypted and then synchronized to the encrypted data table.

[0020] In some embodiments, the step of encrypting the initial service data and then synchronizing it to the encrypted data table includes:

[0021] The initial service data is divided into data rows, and multiple threads are created according to the division results. The encryption processing of the initial service data is concurrently executed by the multiple threads and synchronized to the encrypted data table.

[0022] In order to solve the above problem, another aspect of an embodiment of the present invention provides a data processing device for an application service, including:

[0023] An encryption processing module is used to receive service data during the operation of the application service, write the service data into a plaintext data table, encrypt the service data to encrypt the service data over the entire life cycle, and write the encrypted service data into an encrypted data table that is mapped to the plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage;

[0024] The decryption processing module is used to respond to the target service data query request, determine the data row corresponding to the target service data from the plaintext data table, and determine the encrypted row corresponding to the data row in the encrypted data table according to the mapping relationship, obtain the target service data in the encrypted row, decrypt the target service data, and send the decryption processing result to the request end corresponding to the target service data query request.

[0025] In order to solve the above problems, another aspect of an embodiment of the present invention provides an electronic device, including: a processor, and a memory for storing a program, wherein the program includes instructions, and when the instructions are executed by the processor, the processor executes any one of the data processing methods of the above application services.

[0026] In order to solve the above problem, another aspect of an embodiment of the present invention provides a non-transitory machine-readable medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute any of the above data processing methods for the application services.

[0027] The beneficial effects of the embodiments of the present invention are as follows: by creating a plaintext data table and an encrypted data table in a mapping relationship, the service data in the application service operation process is directly written into the plaintext data table on the one hand, and is written into the encrypted data table after encryption processing on the other hand. After receiving the target service data query request, the data row of the target service data is first determined from the plaintext data table, and then the encrypted row of the target service data in the encrypted data table is determined according to the mapping relationship, and the encrypted row data is decrypted and the decryption processing result is fed back. Data encryption is achieved for the service data in the application service operation process during the entire data life cycle of data generation, transmission, processing and storage, and associated query for encrypted data is achieved, which improves data query efficiency, improves data processing efficiency, improves user experience, and ensures data security of service data in application services.

[0028] The details of one or more embodiments of the invention are set forth in the following drawings and description so that other features, objects, and advantages of the invention are more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other embodiments can be obtained based on these drawings without creative work.

[0030] Figure 1 It is a main flow chart of a data processing method for an application service according to an embodiment of the present invention.

[0031] Figure 2a It is a main flow chart of a data processing method for an application service according to another embodiment of the present invention.

[0032] Figure 2b yes Figure 2a The method shown is a schematic diagram of the main process of writing service data in the process of application service operation into a plaintext data table and an encrypted data table respectively;

[0033] Figure 2c yes Figure 2a A schematic diagram of the main flow of the data encryption process and decryption process in the method shown;

[0034] Figure 2d yes Figure 2a A schematic diagram of the main flow of data processing based on application services, data processing devices and databases in the method shown.

[0035] Figure 3 It is a main flow chart of a data processing device for an application service according to another embodiment of the present invention.

[0036] Figure 4 Schematic diagram of the structure of the electronic device of this embodiment. DETAILED DESCRIPTION

[0037] Embodiments of the present embodiment will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present embodiment are shown in the accompanying drawings, it should be understood that the present embodiment can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein, which are instead provided for a more thorough and complete understanding of the present embodiment. It should be understood that the drawings and embodiments of the present embodiment are only for exemplary purposes and are not intended to limit the scope of protection of the present embodiment.

[0038] In the related technology, the query operation of encrypted data is mainly performed by fuzzy query. Specifically, it can be divided into: 1. Decrypt the full amount of encrypted data before performing the query operation, but it requires more computing and processing resources and is not suitable for scenarios with large data volumes; 2. Perform word segmentation and combination on the ciphertext data, encrypt the result set of the word segmentation combination separately, and then perform the query, but it not only increases the storage cost, but also reduces data security; 3. From the algorithm level, that is, use decoding to perform encryption and decryption, keep the order of ciphertext and plaintext consistent, so as to support fuzzy query of ciphertext, but it is more difficult. Therefore, in the related technology, it is impossible to realize the encryption and decryption operation of the service data in the process of business service operation, and it is impossible to realize the associated query of encrypted data. There are problems such as low query efficiency and data processing efficiency, and large consumption of processing resources.

[0039] In order to solve the above problems, an embodiment of the present invention provides a data processing method for application services, such as Figure 1 As shown, the data processing method of the application service mainly includes:

[0040] Step S101, receiving service data during the operation of the application service, writing the service data into a plaintext data table, and encrypting the service data to encrypt the service data throughout its entire life cycle, and writing the encrypted service data into an encrypted data table that is mapped to the plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage.

[0041] Among them, the service data provided by the embodiment of the present invention is the encryption and decryption object, and the application service operation process includes the service data of the whole life cycle of data generation, data transmission, data processing and data storage. After obtaining the service data in the application service operation process and encrypting it, the encryption operation of the service data in the whole life cycle is realized, so that the service data is in an encrypted state during the application service operation process. The above service data may include user personal information data, streaming media data, etc.

[0042] Through the above settings, after receiving the service data within the application service operation cycle, on the one hand, the full amount of plaintext service data can be directly written into the plaintext data table, and on the other hand, the service data can be encrypted and then written into the encrypted data table. The process of encrypting the above service data throughout the process is imperceptible to the application service, which ensures the normal operation of the application service during the execution of encryption operations, improves data security, and expands the applicable scenarios of the data processing solution of the application service. At the same time, since there is a mapping relationship between the plaintext data table and the encrypted data table, the associated query of the encrypted data can be implemented according to the mapping relationship in the future, thereby improving the query efficiency.

[0043] According to a specific implementation of an embodiment of the present invention, the plaintext data table is a table in which multiple data fields included in the service data are written in plaintext. For example, the service data is user personal information data, specifically including user ID (id), user name (user_name), user password (password) and user address (address), and the corresponding plaintext data table is as follows:

[0044] id user_name password address 1 Zhang San zs0304 Shanghai Jing'an District 2 Li Si lllxuys000 Chaoyang District, Beijing 3 Wang Wu 332aqqq Zhengzhou Jinshui District 4 Zhao Liu 9788hrchg Beijing Haidian District 5 Sun Qi sunqi520 Hangzhou West Lake District …… …… …… ……

[0045] Correspondingly, the encrypted data table is a table in which multiple data fields included in the service data are written in the form of ciphertext, and the above service data is encrypted. The corresponding encrypted data table corresponding to the above plaintext data table is as follows:

[0046] id user_name password address 1 +Px HkDJ Wu86TG8y 2 B7y1NA== hJbMYg== 6Wu86= 3 VxPd HkDJ wxya 4 6P 5j 9F77Kt 5 VxD ceurlz wxya …… …… …… ……

[0047] In some of the embodiments, before the step of encrypting the service data, the method further includes: determining the data to be desensitized from the service data according to the data type, and desensitizing the data to be desensitized.

[0048] Data desensitization refers to the deformation of certain sensitive information through desensitization rules to achieve reliable protection of sensitive privacy data. Through the above settings, in response to data query requests, encrypted data is obtained from the encrypted data table for decryption processing and then fed back to the corresponding query request end. Therefore, according to the data desensitization requirements, the desensitized data can be desensitized before the data encryption operation, which can not only meet the data compliance requirements, but also display the desensitized data after decryption according to the user's query permissions.

[0049] Further, in some of the embodiments, the above-mentioned encryption processing of the service data to achieve encryption of the service data throughout its entire life cycle, and the step of writing the encrypted service data into an encrypted data table that is mapped to the plaintext data table include: obtaining a data encryption key from a key management system; wherein the data encryption key includes a plaintext data key and a ciphertext data key; encrypting the service data according to the plaintext data key to achieve encryption of the service data throughout its entire life cycle to obtain encrypted data; and writing the encrypted data and the ciphertext data key into an encrypted data table that is mapped to the plaintext data table.

[0050] A specific implementation of an embodiment of the present invention provides an envelope encryption scheme, which obtains a data encryption key from a key management system, uses a plaintext data key in the data encryption key to encrypt service data, obtains ciphertext data, and writes the ciphertext data and the ciphertext data key in the data encryption key into an encrypted data table. Since the envelope encryption scheme has the characteristics of good encryption performance and low encryption cost, it further improves data security and reduces data processing costs.

[0051] In some of the embodiments, the step of encrypting the service data further includes: generating a corresponding data key according to the business type and receiving time of the service data, and encrypting the service data according to the data key.

[0052] In another specific implementation of the embodiment of the present invention, the data key can also be matched with the data type, receiving time, etc. of the service data to further improve the encryption effect and ensure the data security of the service data in the application service.

[0053] Exemplarily, in some of the embodiments, the method further includes: obtaining initial service data in a plain text data table, encrypting the initial service data and synchronizing the data to the encrypted data table.

[0054] For the service data stored in the plaintext data table, in order to ensure its data security, it can also be extracted, encrypted and synchronized to the encrypted data table to facilitate subsequent response to query requests and execution of related queries.

[0055] In some of the embodiments, the step of encrypting the initial service data and then synchronizing it to the encrypted data table includes: dividing the initial service data into data rows, creating multiple threads according to the division results, and concurrently executing encryption processing on the initial service data with multiple threads and synchronizing it to the encrypted data table.

[0056] Through the above settings, the initial service data can be divided according to data rows based on the data volume, and multiple threads can be created based on the division results. The encryption operation of the initial service data and the synchronization operation to the encrypted data table can be executed concurrently by multiple threads, which improves the data synchronization efficiency and data processing efficiency, ensures data security, and enhances the user experience.

[0057] Step S102, in response to the target service data query request, determine the data row corresponding to the target service data from the plaintext data table, and determine the encrypted row corresponding to the data row in the encrypted data table according to the mapping relationship, obtain the target service data in the encrypted row, decrypt the target service data, and send the decryption result to the request end corresponding to the target service data query request.

[0058] Through the above settings, the data row corresponding to the target service data is first determined from the plaintext data table according to the target service data query request, and then the encrypted row corresponding to the data row of the target service data in the encrypted data table is determined according to the mapping relationship between the plaintext data table and the encrypted data table. Then, the data in the encrypted row is obtained and decrypted to obtain the queried target service data, thereby realizing the associated query of encrypted data and improving data query efficiency.

[0059] In some embodiments, the step of decrypting the target service data includes:

[0060] Obtain the plaintext data key corresponding to the ciphertext data key from the key management system, decrypt the target service data according to the plaintext data key, and obtain the decryption result.

[0061] During the decryption process, the corresponding plaintext data key is first obtained from the key management system, avoiding data security risks caused by data key leakage and further ensuring the data security of service data.

[0062] The data processing method for the above-mentioned application service provided in the embodiment of the present invention is that for the service data in the process of application service operation, on the one hand, it is directly written into the plaintext data table, and on the other hand, it is written into the encrypted data table which is mapped with the plaintext data table after encryption processing. After receiving the target service data query request, the data row of the target service data is first determined from the plaintext data table, and then the encrypted row of the target service data in the encrypted data table is determined according to the mapping relationship, and the encrypted row data is decrypted and the decryption processing result is fed back. It realizes data encryption for the service data in the process of application service operation during the entire data life cycle of data generation, transmission, processing and storage, realizes parallel query for encrypted data, improves data query efficiency, improves data processing efficiency, improves user experience, and ensures data security of service data in application services.

[0063] In order to solve the above problems, an embodiment of the present invention further provides a data processing method for application services, which is applied to encryption and decryption processing and query processing of service data during the operation of application services. Figure 2a As shown, the data processing method of the application service provided by the embodiment of the present invention mainly includes:

[0064] Step S201, receiving service data during the operation of the application service, and writing the service data into a plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage.

[0065] Among them, the service data provided by the embodiment of the present invention may be user personal information data, streaming media data and other data included in the application request, involving service data in the entire data life cycle of data collection / generation, transmission, processing, storage / storage.

[0066] First, the full amount of plaintext service data is written into the plaintext data table, which helps to realize the associated query of encrypted data by combining the mapping relationship between the plaintext data table and the encrypted data table when receiving data query requests later.

[0067] In some of the embodiments, Figure 2b The main process diagram of writing the service data received during the operation of the application service into the plaintext data table and the encrypted data table respectively is shown. In this example, the two data tables are stored in different databases, wherein the plaintext data table is stored in the source library and the encrypted data table is stored in the target library. In specific applications, the above two data tables can also be stored in the same database. According to a specific implementation method of an embodiment of the present invention, after receiving the service data during the operation of the application service, multiple threads can be pooled, and then a write task can be generated according to the number of rows in the data table, the service data is written to the plaintext data table, and after encryption processing, the encrypted service data is synchronized to the encrypted data table to ensure that the service data written in the plaintext data table and the encrypted data table are consistent.

[0068] Step S202: Determine the data to be desensitized from the service data according to the data type, and perform desensitization processing on the data to be desensitized.

[0069] Data desensitization refers to the deformation of certain sensitive information through desensitization rules to achieve reliable protection of sensitive privacy data. According to a specific implementation of an embodiment of the present invention, different desensitization rules can be adopted according to the data type of the service data. For example, static desensitization can be performed for static data, and dynamic desensitization can be performed for dynamic data. Through the above settings, in response to data query requests, encrypted data is obtained from the encrypted data table for decryption processing and then fed back to the corresponding query request end. Therefore, according to the data desensitization requirements, the desensitized data can be desensitized before the data encryption operation. According to a specific implementation of an embodiment of the present invention, different data desensitization rules can be set according to user viewing permissions to achieve data desensitization at different permission levels, which not only meets the data compliance requirements, but also can display the desensitized data after decryption according to the user's query permissions.

[0070] Step S203, obtaining a data encryption key from a key management system; wherein the data encryption key includes a plaintext data key and a ciphertext data key; encrypting the service data according to the plaintext data key to encrypt the service data over the entire life cycle to obtain encrypted data; writing the encrypted data and the ciphertext data key into an encrypted data table that is mapped to the plaintext data table.

[0071] The plaintext data table and the encrypted data table in a mapping relationship can be realized by associating the primary key, that is, the primary key of the plaintext data table is associated with the primary key of the encrypted data table. If the data table does not have a primary key, it can be realized by configuring the hash field, and each row of data is associated through the hash. When the encrypted data is subsequently associated with the query, the data row is first filtered through the plaintext data table, and then the table is merged with the encrypted data table, the target data is taken out from the encrypted data table, and then the decryption process is performed and the decryption result is fed back to the query request end.

[0072] A specific implementation of an embodiment of the present invention provides a KMS (Key Management Service) full life cycle data encryption solution, the data in the encrypted data table is ciphertext, and the encryption and decryption operations do not affect the normal operation of the application service. Specifically, the encryption method adopts an envelope encryption scheme, such as Figure 2c As shown, by obtaining a data encryption key from a key management system, the service data is encrypted using the plaintext data key in the data encryption key to obtain ciphertext data, and the ciphertext data and the ciphertext data key in the data encryption key are written into the encrypted data table. Since the envelope encryption scheme has the characteristics of good encryption performance and low encryption cost, data security is further improved and data processing costs are reduced. According to a specific implementation of an embodiment of the present invention, the data type to be encrypted can also be pre-configured, and then the data to be encrypted in the service data is determined in combination with the data type, and then the data to be encrypted is encrypted and written into the encrypted data table.

[0073] In some of the embodiments, the step of encrypting the service data further includes: generating a corresponding data key according to the business type and receiving time of the service data, and encrypting the service data according to the data key.

[0074] The specific encryption method is not limited in the embodiment of the present invention, and different encryption strategies can be implemented in combination with the data type. For example, when the data type of the service data is a plain text password (such as a database connection password; various plain text passwords in xml configuration files, properties (a property file that stores content in key-value format), yml (a file format corresponding to YAML (YAML Aint Markup Language, an intuitive data serialization format that can be recognized by a computer)), KMS credentials can also be added when writing to the encrypted data table. In another specific implementation of the embodiment of the present invention, the data key can also be matched with the data type, receiving time, etc. of the service data to further enhance the encryption effect and ensure the data security of the service data in the application service.

[0075] Exemplarily, in some of the embodiments, the method further includes: obtaining initial service data in a plain text data table, encrypting the initial service data and synchronizing the data to the encrypted data table.

[0076] For the service data stored in the plaintext data table, in order to ensure its data security, it can also be extracted, encrypted and synchronized to the encrypted data table to facilitate subsequent response to query requests and execution of related queries.

[0077] In some of the embodiments, the step of encrypting the initial service data and then synchronizing it to the encrypted data table includes: dividing the initial service data into data rows, creating multiple threads according to the division results, and concurrently executing encryption processing on the initial service data with multiple threads and synchronizing it to the encrypted data table.

[0078] Through the above settings, the initial service data can be divided according to data rows based on the data volume, and multiple threads can be created based on the division results. The encryption operation of the initial service data and the synchronization operation to the encrypted data table can be executed concurrently by multiple threads, which improves the data synchronization efficiency and data processing efficiency, ensures data security, and enhances the user experience.

[0079] Step S204, in response to the target service data query request, determine the data row corresponding to the target service data from the plaintext data table, and determine the encrypted row corresponding to the data row in the encrypted data table according to the mapping relationship, and obtain the target service data in the encrypted row.

[0080] Through the above settings, the data row corresponding to the target service data is first determined from the plaintext data table according to the target service data query request, and then the encrypted row corresponding to the data row of the target service data in the encrypted data table is determined according to the mapping relationship between the plaintext data table and the encrypted data table. Then, the data in the encrypted row is obtained and decrypted to obtain the queried target service data, thereby realizing the associated query of encrypted data and improving data query efficiency.

[0081] Step S205, obtaining the plaintext data key corresponding to the ciphertext data key from the key management system, decrypting the target service data according to the plaintext data key, and sending the decryption result to the request end corresponding to the target service data query request.

[0082] like Figure 2c As shown, during the decryption process, the corresponding plaintext data key is first obtained from the key management system, avoiding data security risks caused by data key leakage and further ensuring the data security of service data.

[0083] According to a specific implementation of an embodiment of the present invention, for user personal information data such as name, address, bank card number, telephone number, address, etc., after desensitization is performed, the desensitized user personal information data can be displayed to the requesting end after responding to the query. If the user needs to further obtain the real plaintext data (i.e., the original data before desensitization), it is necessary to perform another verification operation, such as obtaining the corresponding real plaintext data from the plaintext data table through an email verification code or displaying it to the requesting end through a desensitization recovery solution. According to a specific implementation of an embodiment of the present invention, a user IV (Initialization Vector) can also be introduced in the encryption and decryption process. In the decryption process, it is necessary to cooperate with the user's proprietary IV encryption and decryption vector to ensure that when the data key is lost, the user data cannot be decrypted, avoid the risk of data leakage, and ensure the data security of service data.

[0084] In some of the embodiments, Figure 2dAs shown, the business system in the data processing device of the application service obtains service data from the application service in operation. On the one hand, the obtained business data is directly written into the plaintext data table, so that when the encrypted data is subsequently queried in parallel, the data row corresponding to the target query data in the encrypted data table can be accurately determined. On the other hand, after the service data is desensitized, it is encrypted by the encryption module, and then the encrypted service data is written into the encrypted data table. When the target service data query request is received, the data row corresponding to the target service data is determined from the plaintext data table, and the encrypted row corresponding to the data row in the encrypted data table is determined according to the mapping relationship, the target service data in the encrypted row is obtained, and then the target service data is decrypted by the decryption module and fed back to the querying party, realizing the parallel query of encrypted data, improving the query efficiency, and ensuring data security.

[0085] The data processing method for the above-mentioned application service provided in the embodiment of the present invention is that for the service data in the application service operation process, on the one hand, it is directly written into the plaintext data table, and on the other hand, it is written into the encrypted data table that is mapped to the plaintext data table after encryption processing. After receiving the target service data query request, the data row of the target service data is first determined from the plaintext data table, and then the encrypted row of the target service data in the encrypted data table is determined according to the mapping relationship, and the encrypted row data is decrypted and the decryption processing result is fed back. The encryption and decryption operations of the service data in the application service operation process are realized throughout the life cycle, and the parallel query of the encrypted data is realized, which improves the data query efficiency, improves the data processing efficiency, improves the user experience, and ensures the data security of the service data in the application service.

[0086] Based on the data processing method for the application service provided in the embodiment of the present invention, the embodiment of the present invention further provides a data processing device for the application service, which is applied in the field of computer technology. The data processing device 300 for the application service includes:

[0087] The encryption processing module 301 is used to receive service data during the operation of the application service, write the service data into a plaintext data table, and encrypt the service data to encrypt the service data throughout its entire life cycle, and write the encrypted service data into an encrypted data table that is mapped to the plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage.

[0088] Among them, the service data provided by the embodiment of the present invention is the encryption and decryption object, and the application service operation process includes the service data of the whole life cycle of data generation, data transmission, data processing and data storage. After obtaining the service data in the application service operation process and encrypting it, the encryption operation of the service data in the whole life cycle is realized, so that the service data is in an encrypted state during the application service operation process. The above service data may include user personal information data, streaming media data, etc.

[0089] Through the above settings, after receiving the service data within the application service operation cycle, on the one hand, the full amount of plaintext service data can be directly written into the plaintext data table, and on the other hand, the service data can be encrypted and then written into the encrypted data table. The process of encrypting the above service data throughout the process is imperceptible to the application service, which ensures the normal operation of the application service during the execution of encryption operations, improves data security, and expands the applicable scenarios of the data processing solution of the application service. At the same time, since there is a mapping relationship between the plaintext data table and the encrypted data table, the associated query of the encrypted data can be implemented according to the mapping relationship in the future, thereby improving the query efficiency.

[0090] In some of the embodiments, before the step of encrypting the service data, the data processing device 300 of the above-mentioned application service also includes a data desensitizing module, which is used to: determine the data to be desensitized from the service data according to the data type, and desensitize the data to be desensitized.

[0091] Data desensitization refers to the deformation of certain sensitive information through desensitization rules to achieve reliable protection of sensitive privacy data. Through the above settings, in response to data query requests, encrypted data is obtained from the encrypted data table for decryption processing and then fed back to the corresponding query request end. Therefore, according to the data desensitization requirements, the desensitized data can be desensitized before the data encryption operation, which can not only meet the data compliance requirements, but also display the desensitized data after decryption according to the user's query permissions.

[0092] Furthermore, in some of the embodiments, the encryption processing module 301 is also used to: obtain a data encryption key from a key management system; wherein the data encryption key includes a plaintext data key and a ciphertext data key; encrypt the service data according to the plaintext data key to obtain encrypted data; and write the encrypted data and the ciphertext data key into an encrypted data table that is mapped to the plaintext data table.

[0093] A specific implementation of an embodiment of the present invention provides an envelope encryption scheme, which obtains a data encryption key from a key management system, uses the plaintext data key in the data encryption key to encrypt service data to encrypt service data throughout its life cycle, obtains ciphertext data, and writes the ciphertext data and the ciphertext data key in the data encryption key into an encrypted data table. Since the envelope encryption scheme has the characteristics of good encryption performance and low encryption cost, it further improves data security and reduces data processing costs.

[0094] In some of the embodiments, the encryption processing module 301 is further used to generate a corresponding data key according to the business type and receiving time of the service data, and encrypt the service data according to the data key.

[0095] In another specific implementation of the embodiment of the present invention, the data key can also be matched with the data type, receiving time, etc. of the service data to further improve the encryption effect and ensure the data security of the service data in the application service.

[0096] Exemplarily, in some of the embodiments, the data processing device 300 for the application service further includes a synchronization module for obtaining initial service data in a plain text data table, encrypting the initial service data, and synchronizing the data to the encrypted data table.

[0097] For the service data stored in the plaintext data table, in order to ensure its data security, it can also be extracted, encrypted and synchronized to the encrypted data table to facilitate subsequent response to query requests and execution of related queries.

[0098] In some of the embodiments, the synchronization module is further used to: divide the initial service data into data rows, create multiple threads according to the division results, and concurrently execute encryption processing on the initial service data with the multiple threads and synchronize them to the encrypted data table.

[0099] Through the above settings, the initial service data can be divided according to data rows based on the data volume, and multiple threads can be created based on the division results. The encryption operation of the initial service data and the synchronization operation to the encrypted data table can be executed concurrently by multiple threads, which improves the data synchronization efficiency and data processing efficiency, ensures data security, and enhances the user experience.

[0100] The decryption processing module 302 is used to respond to the target service data query request, determine the data row corresponding to the target service data from the plaintext data table, and determine the encrypted row corresponding to the data row in the encrypted data table according to the mapping relationship, obtain the target service data in the encrypted row, decrypt the target service data, and send the decryption processing result to the request end corresponding to the target service data query request.

[0101] Through the above settings, the data row corresponding to the target service data is first determined from the plaintext data table according to the target service data query request, and then the encrypted row corresponding to the data row of the target service data in the encrypted data table is determined according to the mapping relationship between the plaintext data table and the encrypted data table. Then, the data in the encrypted row is obtained and decrypted to obtain the queried target service data, thereby realizing the associated query of encrypted data and improving data query efficiency.

[0102] In some of the embodiments, the decryption processing module 302 is further used to: obtain a plaintext data key corresponding to the ciphertext data key from a key management system, decrypt the target service data according to the plaintext data key, and obtain a decryption processing result.

[0103] During the decryption process, the corresponding plaintext data key is first obtained from the key management system, avoiding data security risks caused by data key leakage and further ensuring the data security of service data.

[0104] The data processing method and device for the above-mentioned application service provided in the embodiment of the present invention, for the service data in the process of application service operation, on the one hand, directly writes into the plaintext data table, and on the other hand, writes into the encrypted data table which is mapped with the plaintext data table after encryption processing. After receiving the target service data query request, the data row of the target service data is first determined from the plaintext data table, and then the encrypted row of the target service data in the encrypted data table is determined according to the mapping relationship, and the encrypted row data is decrypted and the decryption processing result is fed back. It realizes data encryption for the service data in the process of application service operation during the entire data life cycle of data generation, transmission, processing and storage, realizes parallel query for encrypted data, improves data query efficiency, improves data processing efficiency, improves user experience, and ensures data security of service data in application services.

[0105] An embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory in communication with the at least one processor. The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the electronic device executes the method of the embodiment of the present invention.

[0106] An embodiment of the present invention further provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to execute the method of the embodiment of the present invention.

[0107] An embodiment of the present invention further provides a computer program product, including a computer program, wherein the computer program, when executed by a processor of a computer, is used to enable the computer to execute the method of the embodiment of the present invention.

[0108] refer to Figure 4 , a block diagram of an electronic device that can be used as a server or client of an embodiment of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. Electronic devices are intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0109] like Figure 4 As shown, the electronic device includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In RAM 403, various programs and data required for the operation of the electronic device can also be stored. The computing unit 401, ROM 402, and RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0110] Multiple components in the electronic device are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 can be any type of device that can input information to the electronic device, and the input unit 406 can receive input digital or character information, and generate key signal input related to user settings and / or function control of the electronic device. The output unit 407 can be any type of device that can present information, and can include but is not limited to a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 can include but is not limited to a disk, an optical disk. The communication unit 409 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include but is not limited to a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0111] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a CPU, a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention may be implemented as a computer program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be stored in a ROM.

[0112] 402 and / or the communication unit 409 are loaded and / or installed on the electronic device. In some embodiments, the computing unit 401 can be configured to execute the above method in any other appropriate manner (for example, by means of firmware).

[0113] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0114] In the context of an embodiment of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] It should be noted that the term "including" and its variations used in the embodiments of the present invention are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0116] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present invention are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0117] The various steps described in the method implementation methods provided in the embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method implementation methods may include additional steps and / or omit the steps shown. The scope of protection of the present invention is not limited in this respect.

[0118] The term "embodiment" in this specification refers to specific features, structures or characteristics described in conjunction with the embodiment that can be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor does it mean that it is mutually exclusive with other embodiments and is independent or optional. The various embodiments in this specification are described in a related manner, and the same or similar parts between the various embodiments refer to each other. In particular, for the device, equipment, and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment.

[0119] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of patent protection. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the attached claims.

Claims

1. A data processing method for an application service, comprising: Receive service data during the operation of the application service, write the service data into a plaintext data table, encrypt the service data to encrypt the service data over the entire life cycle, and write the encrypted service data into an encrypted data table that is mapped to the plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage; In response to a target service data query request, the data row corresponding to the target service data is determined from the plaintext data table, and the encrypted row corresponding to the data row in the encrypted data table is determined according to the mapping relationship, the target service data in the encrypted row is obtained, the target service data is decrypted, and the decryption result is sent to the request end corresponding to the target service data query request.

2. The method according to claim 1, wherein: Before the step of encrypting the service data, the method further includes: Determine the data to be desensitized from the service data according to the data type, and perform desensitization processing on the data to be desensitized.

3. The method according to claim 1, wherein: The step of encrypting the service data to encrypt the service data over the entire life cycle, and writing the encrypted service data into an encrypted data table that is mapped to the plaintext data table includes: Obtaining a data encryption key from a key management system; wherein the data encryption key includes a plaintext data key and a ciphertext data key; Encrypting the service data according to the plaintext data key to encrypt the service data over the entire life cycle to obtain encrypted data; The encrypted data and the ciphertext data key are written into an encrypted data table that is in a mapping relationship with the plaintext data table.

4. The method according to claim 3, wherein: The step of decrypting the target service data comprises: A plaintext data key corresponding to the ciphertext data key is obtained from the key management system, and the target service data is decrypted according to the plaintext data key to obtain a decryption result.

5. The method according to claim 3, wherein: The step of encrypting the service data further includes: A corresponding data key is generated according to the business type and receiving time of the service data, and the service data is encrypted according to the data key.

6. The method according to claim 1, wherein: The method further comprises: The initial service data in the plaintext data table is obtained, and the initial service data is encrypted and then synchronized to the encrypted data table.

7. The method according to claim 6, wherein: The step of encrypting the initial service data and then synchronizing the data to the encrypted data table comprises: The initial service data is divided into data rows, and a plurality of threads are created according to the division result. The encryption processing of the initial service data is concurrently executed by the plurality of threads and synchronized to the encryption data table.

8. A data processing device for an application service, comprising: An encryption processing module is used to receive service data during the operation of the application service, write the service data into a plaintext data table, encrypt the service data to encrypt the service data over the entire life cycle, and write the encrypted service data into an encrypted data table that is mapped to the plaintext data table; wherein the entire life cycle corresponding to the service data includes a data generation stage, a data transmission stage, a data processing stage, and a data storage stage; A decryption processing module is used to respond to a target service data query request, determine the data row corresponding to the target service data from the plaintext data table, and determine the encrypted row corresponding to the data row in the encrypted data table according to the mapping relationship, obtain the target service data in the encrypted row, decrypt the target service data, and send the decryption processing result to the request end corresponding to the target service data query request.

9. An electronic device, comprising: A processor, and a memory storing a program, wherein the program comprises instructions which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory machine-readable medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.

Images