Data processing method, device, system and equipment and storage medium
By deploying distributed cipher modules on the computing nodes of the data processing system, virtually outputting virtual cipher devices, and directly calling password services, the delay problem caused by remote calls to hardware cipher devices is solved, and efficient password computing and fast response are achieved.
Patent Information
- Application Number
- CN202411497214.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-24
- Publication Date
- 2025-03-04
AI Technical Summary
In the real-time processing scenario of big data, existing remote call hardware password devices need to transmit password application data through the network, resulting in an increase in delay, affecting the system efficiency, and unable to meet the needs of fast response.
A distributed cryptographic module is deployed on any computing node of the data processing system, virtualizes the virtual cryptographic equipment through virtualization technology, and directly calls the cryptographic service to achieve efficient cryptographic operations.
There is no need to directly call password services through the switching network, reducing latency, improving overall system efficiency, and meeting the needs of fast responses in real-time big data processing scenarios.
Smart Images
Figure CN119557896A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer application technology, and in particular to a data processing method, device, system, equipment and storage medium. Background Art
[0002] With the rapid development of information technology, big data has gradually become an important resource for the digital economy and information society because of its economic and social value. At the same time, it has also become a key target for various cyber attacks. If there is a lack of effective protection measures, the risk of leakage of high-value data will increase, which will in turn have an impact on the social security system. Therefore, the need for data protection is becoming more and more urgent.
[0003] Among the many data protection technologies, cryptographic technology is widely considered to be a more effective, reliable and basic means of data protection than traditional methods. Currently, information systems generally use hardware cryptographic devices such as remote call server cryptographic machines and signature verification servers to implement cryptographic protection of data.
[0004] However, this method of remotely calling hardware cryptographic devices requires transmitting cryptographic application data over the network, which increases latency and affects the overall efficiency of the system. This is particularly evident in real-time big data processing scenarios and cannot meet the needs of rapid response. Summary of the invention
[0005] The purpose of this application is to provide a data processing method, apparatus, system, device and storage medium, so as to be able to directly call cryptographic services without going through a switching network, realize efficient cryptographic operations, and improve the overall efficiency of the system.
[0006] In order to solve the above technical problems, this application provides the following technical solutions:
[0007] In a first aspect, a data processing method is provided, which is applied to a target computing node, wherein the target computing node is any computing node in a data processing system, and a distributed cryptographic module is deployed on the target computing node, and the method comprises:
[0008] Determine the cryptographic operation requirements for the target data;
[0009] Determine a target virtual cryptographic device that meets the cryptographic operation requirement in a virtual cryptographic device set, wherein the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module;
[0010] Sending a cryptographic operation request for the target data to the target virtual cryptographic device;
[0011] Receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0012] Optionally, a cryptographic application container is installed on the target computing node, and the step of sending a cryptographic operation request for the target data to the target virtual cryptographic device includes:
[0013] Sending a cryptographic operation request for the target data to the target virtual cryptographic device through the cryptographic application container;
[0014] The receiving the cryptographic operation result for the target data returned by the target virtual cryptographic device includes:
[0015] The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
[0016] Optionally, the virtual cryptographic device set includes at least one of the following virtual cryptographic devices:
[0017] Virtual server cryptographic machine;
[0018] Virtual signature verification server;
[0019] Virtual SSL Gateway;
[0020] Virtual timestamp server.
[0021] Optionally, the cryptographic operation requirement includes at least one of the following:
[0022] Data encryption requirements;
[0023] Data decryption requirements;
[0024] Data signature requirements;
[0025] Data verification requirements;
[0026] Hash operation requirements based on message authentication codes.
[0027] Optionally, the target data includes data that meets set protection conditions.
[0028] Optionally, the target computing node calls the distributed cryptographic module through a communication bus.
[0029] In a second aspect, a data processing device is provided, which is applied to a target computing node, wherein the target computing node is any computing node in a data processing system, and a distributed cryptographic module is deployed on the target computing node, wherein the device comprises:
[0030] A first determining unit is used to determine the cryptographic operation requirements for target data;
[0031] A second determining unit is used to determine a target virtual cryptographic device that meets the cryptographic operation requirement in a virtual cryptographic device set, wherein the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module;
[0032] A sending unit, used for sending a cryptographic operation request for the target data to the target virtual cryptographic device;
[0033] The receiving unit is used to receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0034] Optionally, a cryptographic application container is installed on the target computing node, and the sending unit is specifically used to:
[0035] Sending a cryptographic operation request for the target data to the target virtual cryptographic device through the cryptographic application container;
[0036] The receiving unit is specifically used for:
[0037] The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
[0038] Optionally, the virtual cryptographic device set includes at least one of the following virtual cryptographic devices:
[0039] Virtual server cryptographic machine;
[0040] Virtual signature verification server;
[0041] Virtual SSL Gateway;
[0042] Virtual timestamp server.
[0043] Optionally, the cryptographic operation requirement includes at least one of the following:
[0044] Data encryption requirements;
[0045] Data decryption requirements;
[0046] Data signature requirements;
[0047] Data verification requirements;
[0048] Hash operation requirements based on message authentication codes.
[0049] Optionally, the target data includes data that meets set protection conditions.
[0050] Optionally, the target computing node calls the distributed cryptographic module through a communication bus.
[0051] In a third aspect, a data processing system is provided, comprising a plurality of computing nodes, each of which is deployed with a distributed cryptographic module, and a target computing node is any one of the plurality of computing nodes;
[0052] The target computing node is used to call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set;
[0053] It is also used to determine the cryptographic operation requirements for target data, determine a target virtual cryptographic device that meets the cryptographic operation requirements in the virtual cryptographic device set, send a cryptographic operation request for the target data to the target virtual cryptographic device, and receive a cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0054] In a fourth aspect, an electronic device is provided, including:
[0055] Memory for storing computer programs;
[0056] A processor is used to implement the steps of the data processing method as described in the first aspect when executing the computer program.
[0057] In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the data processing method described in the first aspect are implemented.
[0058] In a sixth aspect, a computer program product is provided, which includes computer instructions, which are stored in a computer-readable storage medium and are suitable for being read and executed by a processor, so that a computer device having the processor performs the steps of the data processing method as described in the first aspect.
[0059] By applying the technical solution provided by the embodiment of the present application, a distributed cryptographic module is deployed on any computing node of the data processing system, such as a target computing node. The target computing node can call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set. After determining the cryptographic operation requirements for the target data, the target virtual cryptographic device is determined in the virtual cryptographic device set according to the cryptographic operation requirements, a cryptographic operation request for the target data is sent to the target virtual cryptographic device, and the cryptographic operation result for the target data returned by the target virtual cryptographic device is received. The target computing node can directly call the cryptographic service without going through the switching network, realize efficient cryptographic operation, and improve the overall efficiency of the system.
[0060] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0062] Figure 1 This is a flow chart of an implementation of a data processing method in an embodiment of the present application;
[0063] Figure 2 This is a structural diagram of a data processing system in an embodiment of the present application;
[0064] Figure 3 This is a structural diagram of a data processing device in an embodiment of the present application;
[0065] Figure 4 This is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION
[0066] The technical solutions in the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of the present application.
[0067] The terms "first", "second", etc. of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of one type, and the number of objects is not limited, for example, the first object can be one or more. In addition, "or" in the present application represents at least one of the connected objects. For example, the protection scope of "A or B" covers at least three schemes, that is, scheme one: including A and excluding B; scheme two: including B and excluding A; scheme three: including both A and B. In addition, the terms "A and / or B", "at least one of A and B", and "at least one of A or B" also cover at least the above three schemes respectively. The character " / " generally indicates that the objects associated before and after are in an "or" relationship.
[0068] The core of this application is to provide a data processing method, which can be executed in various scenarios related to data processing, such as big data distributed cloud and other scenarios, and can be applied to target computing nodes. The target computing node is any computing node in the data processing system. The data processing system can be understood as a distributed computing platform, and the target computing node can be understood as a big data computing node or a big data computing node server. A distributed cryptographic module is deployed on the target computing node, and the target computing node can call the distributed cryptographic module to virtualize one or more virtual cryptographic devices to form a virtual cryptographic device set.
[0069] During the data processing process, after the target computing node determines the cryptographic operation requirements for the target data, it can determine the target virtual cryptographic device in the virtual cryptographic device set according to the cryptographic operation requirements, and send a cryptographic operation request for the target data to the target virtual cryptographic device. The target virtual cryptographic device responds to the cryptographic operation request, performs a cryptographic operation on the target data, and returns the cryptographic operation results for the target data. The target computing node receives the cryptographic operation results for the target data.
[0070] The target computing node can directly call the cryptographic service without going through the switching network, achieving efficient cryptographic operations and improving the overall efficiency of the system.
[0071] See also Figure 1 As shown, it is an implementation flow chart of a data processing method provided by an embodiment of the present application. The method can be applied to a target computing node, which is any computing node in a data processing system. A distributed cryptographic module is deployed on the target computing node. The method includes the following steps:
[0072] S110: Determine cryptographic operation requirements for target data.
[0073] In the embodiment of the present application, the data processing system includes multiple computing nodes, the target computing node is any one of the multiple computing nodes, and a distributed cryptographic module is deployed on the target computing node. It can be understood that a distributed cryptographic module is deployed on each computing node included in the data processing system.
[0074] In the embodiment of the present application, the distributed cryptographic module is fully called distributed cryptographic module, which can be understood as relatively independent hardware, firmware or a combination thereof that can be directly deployed on a business server, can realize cryptographic operation functions, and has a certain storage capacity.
[0075] The target data may be any data to be cryptographically operated. For example, the target data may be data to be stored and encrypted, or the target data may be data to be read and decrypted, or the target data may be data to be signed, or the target data may be data to be verified for signature.
[0076] The target computing node may determine the cryptographic operation requirements for the target data. Optionally, the cryptographic operation requirements may include at least one of the following:
[0077] Data encryption requirements;
[0078] Data decryption requirements;
[0079] Data signature requirements;
[0080] Data verification requirements;
[0081] Hash based Message Authentication Code (HMAC) calculation requirements.
[0082] For example, when the target computing node receives a write request for target data, it can obtain the request content or the type of target data carried in the write request based on the write request. If the request content includes an encryption operation request, the target computing node determines that the cryptographic operation requirement for the target data is a data encryption requirement. Alternatively, the target computing node determines that the cryptographic operation requirement for the target data is a data encryption requirement based on the type of the target data.
[0083] For another example, when receiving a read request for target data, the target computing node may determine whether the target data is encrypted data based on the read request. If it is encrypted data, the cryptographic operation requirement for the target data may be determined to be a data decryption requirement.
[0084] After determining the cryptographic operation requirements for the target data, you can proceed to the subsequent steps.
[0085] S120: Determine a target virtual cryptographic device that meets the cryptographic operation requirement in the virtual cryptographic device set.
[0086] The virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module.
[0087] In the embodiment of the present application, a distributed cryptographic module is deployed on the target computing node. The target computing node can call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set.
[0088] Optionally, the component installation of the supporting driver of the distributed cryptographic module can be completed in advance on the target computing node, and the target computing node can directly call the distributed cryptographic module and virtualize a virtual cryptographic device through the driver using virtualization technology.
[0089] Virtualization is a method that can more efficiently utilize physical computer hardware. Virtualization technology can create an abstraction layer on computer hardware, which can divide the hardware elements of a single computer into multiple virtual computers.
[0090] Virtualization technologies such as Single Root I / O Virtualization (SR-IOV) technology allow a single physical I / O device to be divided into multiple virtual devices or virtual ports for direct access by multiple virtual machines.
[0091] Optionally, a driver script may be installed on the target computing node, and the driver installation is automatically implemented when the target computing node is powered on.
[0092] A virtual cryptographic device may correspond to multiple underlying distributed cryptographic modules. A virtual cryptographic device set may include multiple types of virtual cryptographic devices, and each type of virtual cryptographic device may have one or more virtual cryptographic devices, so that large data can be processed in parallel.
[0093] Optionally, the virtual cryptographic device set may include at least one of the following virtual cryptographic devices:
[0094] Virtual server cryptographic machine;
[0095] Virtual signature verification server;
[0096] Virtual Secure Socket Layer (SSL) gateway;
[0097] Virtual timestamp server.
[0098] Among them, the virtual server cryptographic machine can be used to encrypt and decrypt data;
[0099] The virtual signature verification server can be used to sign and verify data;
[0100] Virtual SSL gateway is used to provide services such as encrypted connection and identity authentication for network applications. It can also be used to encrypt network traffic between the enterprise internal network and the public network to ensure that sensitive data will not be stolen or tampered with during transmission.
[0101] The virtual timestamp server is used to provide accurate timestamp services to ensure the integrity and security of data.
[0102] After the cryptographic operation requirements for the target data are determined, the target virtual cryptographic device can be determined in the virtual cryptographic device set according to the cryptographic operation requirements. Different types of virtual cryptographic devices can meet different cryptographic operation requirements, and the determined target virtual cryptographic device must meet the cryptographic operation requirements for the target data. For example, if the cryptographic operation requirements include data encryption requirements, the determined target virtual cryptographic device can be a virtual server cryptographic machine, and if the cryptographic operation requirements include data signature verification requirements, the determined target virtual cryptographic device can be a virtual signature verification server.
[0103] S130: Sending a cryptographic operation request for target data to the target virtual cryptographic device.
[0104] After determining the cryptographic operation requirements for the target data and determining the target virtual cryptographic device that meets the cryptographic operation requirements, a cryptographic operation request for the target data can be further sent to the target virtual cryptographic device, requesting the target virtual cryptographic device to perform corresponding cryptographic operations on the target data.
[0105] The cryptographic operation request corresponds to the cryptographic operation requirement, and the cryptographic operation request can be generated according to the cryptographic operation requirement. The cryptographic operation request can carry the identification information of the target data, the path information of the target data, the cryptographic operation type information, and other contents.
[0106] S140: Receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0107] After the target computing node sends a cryptographic operation request for the target data to the target virtual device, the target virtual device can perform a corresponding cryptographic operation on the target data and return a cryptographic operation result. For example, the target virtual device performs an encryption operation or a signature operation on the target data.
[0108] The target computing node receives the cryptographic operation result for the target data returned by the target virtual cryptographic device, completes the cryptographic operation requirements for the target data, and can perform further operations on the target data.
[0109] For example, when a write request is received for target data, the target computing node determines that the cryptographic operation requirement for the target data is a data encryption requirement, determines a target virtual cryptographic device that meets the data encryption requirement, sends a data encryption request for the target data to the target virtual cryptographic device, and receives the data encryption result for the target data returned by the target virtual cryptographic device. The target computing node stores the encrypted target data to a set location.
[0110] For another example, when there is a read request for target data, the target computing node determines that the cryptographic operation requirement for the target data is a data decryption requirement, determines a target virtual cryptographic device that meets the data decryption requirement, sends a data decryption request for the target data to the target virtual cryptographic device, and receives the data decryption result for the target data returned by the target virtual cryptographic device. The target computing node returns the decrypted target data to the data requester.
[0111] By applying the method provided by the embodiment of the present application, a distributed cryptographic module is deployed on any computing node of the data processing system, such as a target computing node. The target computing node can call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set. After determining the cryptographic operation requirements for the target data, the target virtual cryptographic device is determined in the virtual cryptographic device set according to the cryptographic operation requirements, a cryptographic operation request for the target data is sent to the target virtual cryptographic device, and the cryptographic operation result for the target data returned by the target virtual cryptographic device is received. The target computing node can directly call the cryptographic service without going through the switching network, realize efficient cryptographic operation, and improve the overall efficiency of the system.
[0112] In some embodiments of the present application, a cryptographic application container is configured and installed on the target computing node, and a cryptographic operation request for target data is sent to the target virtual cryptographic device, including the following steps:
[0113] Sending a cryptographic operation request for target data to a target virtual cryptographic device through a cryptographic application container;
[0114] Receiving the cryptographic operation result for the target data returned by the target virtual cryptographic device includes the following steps:
[0115] The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
[0116] In an embodiment of the present application, a cryptographic application container may be pre-installed on the target computing node, and the cryptographic application container is used to abstract the algorithm interface of the virtual cryptographic device and assemble it into a universal and easy-to-use Hypertext Transfer Protocol (HTTP) interface.
[0117] After the target computing node determines the cryptographic operation requirements for the target data and determines the target virtual cryptographic device that meets the cryptographic operation requirements, it can send a cryptographic operation request for the target data to the target virtual cryptographic device through the cryptographic application container, and receive the cryptographic operation result for the target data returned by the target virtual cryptographic device through the cryptographic application container.
[0118] Optionally, the target computing node can send a cryptographic operation request for the target data to the cryptographic application container. The cryptographic application container calls the target virtual cryptographic device through a standard interface. The target virtual cryptographic device can rely on the computing power of the underlying distributed cryptographic module to complete the corresponding cryptographic operation and return the cryptographic operation result to the cryptographic application container. The cryptographic application container returns the cryptographic operation result to the target computing node.
[0119] The cryptographic application container is utilized to facilitate the communication between the target computing node and the target virtual cryptographic device.
[0120] In some embodiments of the present application, the target data includes data that meets set protection conditions.
[0121] In the embodiment of the present application, protection conditions can be set in advance, and data that meets the set protection conditions is considered to have cryptographic operation requirements, and the data that meets the set protection conditions can be used as target data. For example, important sensitive data such as mobile phone numbers, ID card numbers, etc. can be used as target data.
[0122] For data that does not meet the protection conditions, it can be considered that no cryptographic operations are required and it can be directly stored, read, authenticated, etc.
[0123] Performing cryptographic operations only on data that meets the set protection conditions can reduce resource consumption and improve data processing efficiency.
[0124] In some embodiments of the present application, the target computing node calls the distributed cryptographic module through a communication bus.
[0125] A communication bus such as a Peripheral Component Interconnect Express (PCIE) bus is a high-speed serial computer expansion bus.
[0126] The target computing node calls the distributed cryptographic module through the communication bus to virtualize the virtual cryptographic device without going through the switching network, which can reduce the dependence on the network.
[0127] In a possible implementation, a distributed cryptographic module may be deployed in each computing node included in the data processing system, and components such as a cryptographic application container and a supporting driver for the distributed cryptographic module may be installed;
[0128] Each computing node directly calls the distributed cryptographic module through the PCIE bus (not through the switching network), and virtualizes various virtual cryptographic devices through the driver and virtualization technologies such as SR-IOV;
[0129] Any computing node, such as the target computing node, can send a cryptographic operation request to the cryptographic application container;
[0130] The cryptographic application container calls the virtual cryptographic device through a standard interface;
[0131] The virtual cryptographic device relies on the distributed cryptographic module computing power allocated by the underlying layer to complete the data cryptographic operation and return the cryptographic operation results to the cryptographic application container;
[0132] The cryptographic application container returns the calculation results to the target computing node.
[0133] Among them, the distributed cryptographic module supports virtualization, key caching, and cryptographic operations;
[0134] Virtual cryptographic devices include virtual server cryptographic machines, virtual signature verification servers, virtual SSL gateways, virtual timestamp servers, etc.
[0135] Cryptographic operations include data encryption, data decryption, data signing, data signature verification, HMAC operations and other cryptographic operations.
[0136] Corresponding to the above method embodiment, the embodiment of the present application further provides a data processing system, including multiple computing nodes, each computing node is deployed with a distributed cryptographic module, and the target computing node is any one of the multiple computing nodes;
[0137] The target computing node is used to call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set;
[0138] It is also used to determine the cryptographic operation requirements for target data, determine the target virtual cryptographic device that meets the cryptographic operation requirements in the virtual cryptographic device set, send a cryptographic operation request for the target data to the target virtual cryptographic device, and receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0139] Optionally, a cryptographic application container is installed on the target computing node, and the target computing node is further used to send a cryptographic operation request for target data to the target virtual cryptographic device through the cryptographic application container;
[0140] The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
[0141] Optionally, the virtual cryptographic device set includes at least one of the following virtual cryptographic devices:
[0142] Virtual server cryptographic machine;
[0143] Virtual signature verification server;
[0144] Virtual SSL Gateway;
[0145] Virtual timestamp server.
[0146] Optionally, the cryptographic operation requirement includes at least one of the following:
[0147] Data encryption requirements;
[0148] Data decryption requirements;
[0149] Data signature requirements;
[0150] Data verification requirements;
[0151] Hash operation requirements based on message authentication codes.
[0152] Optionally, the target data includes data that meets set protection conditions.
[0153] Optionally, the target computing node is used to call the virtual cryptographic device virtualized by the distributed cryptographic module through the communication bus to form a virtual cryptographic device set.
[0154] like Figure 2 As shown, the data processing system may include multiple computing nodes, such as big data computing node 1, big data computing node 2 (not shown in the figure), ..., big data computing node N. Among them, distributed cryptographic modules 11, distributed cryptographic modules 12 (not shown in the figure), ..., distributed cryptographic modules 1M are deployed on big data computing node 1. Distributed cryptographic modules N1, distributed cryptographic modules N2 (not shown in the figure), ..., distributed cryptographic modules NM' are deployed on big data computing node N.
[0155] Among them, the distributed cryptographic module 11, the distributed cryptographic module 12, etc. can be understood as one or more distributed cryptographic modules, respectively, and the distributed cryptographic module 11, the distributed cryptographic module 1M, the distributed cryptographic module N1, the distributed cryptographic module NM', etc. can be the same or different. Each distributed cryptographic module supports virtualization, supports key caching, and can perform cryptographic operations.
[0156] Cryptographic operations may include encryption operations, decryption operations, signature operations, signature verification operations, hash operations, etc. Specific algorithms may include commercial cryptographic algorithms such as SM2, SM3, SM4, etc.
[0157] Taking data processing by a big data computing node 1 as an example, the big data computing node 1 can call a distributed cryptographic module 11 and virtualize a virtual cryptographic device 11 using the SR-IOV virtualization technology.
[0158] A cryptographic application container is installed on the big data computing node 1, and it can be considered that each virtual machine of the big data computing node 1 is installed with a cryptographic application container. The big data computing node 1 calls the virtual cryptographic device 11 through the cryptographic application container to perform cryptographic operations. The cryptographic application container can call the virtual cryptographic device 11 through a standard interface, such as a secure device format (SDF) interface.
[0159] The data processing process of other big data computing nodes is similar to this and will not be repeated here.
[0160] The data processing system can be used to complete cryptographic protection of important sensitive data such as encrypted transmission, encrypted storage, access control, signature verification, HMAC-SM3 operation, etc. based on commercial cryptographic algorithms such as SM2, SM3, SM4, etc.
[0161] Compliant distributed cryptographic modules are deployed on big data computing nodes. Big data computing nodes can directly call distributed cryptographic modules on native servers without going through a switching network. Various virtual cryptographic devices are virtualized through virtualization technology to complete cryptographic operations. Efficient cryptographic operations are achieved, improving the overall efficiency of the system.
[0162] It should be noted that in the embodiments of the present application, as the business develops, there may be more types of cryptographic computing needs. The target computing node can call the distributed cryptographic module to virtualize more types of virtual cryptographic devices to meet more types of cryptographic computing needs.
[0163] For ease of understanding, the technical solution provided in the embodiment of the present application is explained below using a big data computing node processing encrypted storage of important sensitive data as an example.
[0164] First, deploy a distributed cryptographic module on each big data computing node, and install components such as the cryptographic application container and the driver that supports the distributed cryptographic module.
[0165] Each big data computing node directly calls the distributed cryptographic module through the PCIE bus (not through the switching network), and virtualizes the virtual server cryptographic machine through the driver and virtualization technologies such as SR-IOV;
[0166] When important sensitive data, such as user mobile phone number and ID card number, is stored in the big data computing node 1, the big data computing node 1 first sends a storage encryption operation request to the password application container;
[0167] The cryptographic application container calls the virtual server cryptographic machine through a standard interface;
[0168] The virtual server cryptographic machine relies on the distributed cryptographic module computing power allocated at the bottom layer to perform SM2 encryption on important sensitive data and returns the encryption result to the cryptographic application container;
[0169] The cryptographic application container returns the encryption result to the big data computing node 1, completing the storage of the ciphertext of important sensitive data.
[0170] The embodiments of the present application implement native server calls of cryptographic services while ensuring the security and compliance of cryptographic applications on the big data platform, which can reduce cryptographic operation delays, improve efficiency, and improve security.
[0171] The advantages of the technical solution provided in the embodiment of the present application are explained below by comparison with related technologies.
[0172] In the related technology, hardware cryptographic devices such as remotely calling server cryptographic machines and signature verification servers are used to implement cryptographic protection of data. The problems are as follows:
[0173] High latency and low efficiency: Remotely calling hardware cryptographic devices requires transmitting cryptographic application data over the network, which increases latency and affects the overall efficiency of the system. This is particularly evident in real-time processing of big data, which cannot meet the needs of rapid response;
[0174] Complex hardware stacking: Relying on the stacking of different underlying hardware cryptographic devices to meet diverse cryptographic function and performance requirements. This complex hardware architecture not only increases the system maintenance cost, but also reduces the system's adaptability, making it difficult to flexibly respond to changing business needs;
[0175] Unsuitable for distributed cloud architecture: With the popularity of cloud computing, more and more companies are migrating their data and applications to the cloud. However, the password protection methods in related technologies are difficult to adapt to the distributed system architecture on the cloud and cannot achieve efficient password operations, which limits the further development of big data applications;
[0176] Lack of local calling capabilities: There is a lack of solutions in related technologies that can directly call cryptographic services on big data native servers, resulting in high latency and low efficiency when performing cryptographic operations in big data environments.
[0177] In contrast, the embodiments of the present application realize that big data can directly perform cryptographic operations on native servers without the need to remotely call cryptographic devices through the network, thus reducing network transmission delays, improving cryptographic operation efficiency, adapting to the distributed cloud deployment mode of big data systems, supporting real-time business scenarios of big data, and effectively solving the functional, performance, security, and compliance issues existing in the protection of big data cryptographic applications. It supports the large-scale application of cryptographic computing power and ensures the authenticity, confidentiality, integrity, and non-repudiation of important data. The specific advantages are:
[0178] High efficiency and low latency: It adopts a distributed cryptographic computing mode to adapt to the cloud-native architecture. The big data computing nodes directly call the distributed cryptographic modules locally without going through the switching network, which effectively reduces latency and improves computing efficiency.
[0179] Comprehensive coverage of cryptographic functions: Distributed cryptographic modules can virtualize multiple (16 / 32) virtual cryptographic devices, such as virtual server cryptographic machines, virtual signature verification servers, virtual timestamp servers, etc., to realize the functions of various cryptographic devices. At the same time, they can realize elastic expansion and on-demand scheduling of cryptographic services. A set of distributed cryptographic modules can be used in multiple scenarios.
[0180] Security and compliance: The distributed cryptographic module is compliant cryptographic hardware (such as cryptographic cards, etc.) deployed on big data computing nodes. It has a high security level and supports multiple national cryptographic algorithms such as SM2, SM3, SM4, etc. to meet compliance requirements.
[0181] Corresponding to the above method embodiment, the embodiment of the present application also provides a data processing device, which is applied to a target computing node, the target computing node is any computing node in the data processing system, and a distributed cryptographic module is deployed on the target computing node. The data processing device described below and the data processing method described above can be referenced to each other.
[0182] See also Figure 3 As shown, the data processing device 300 includes the following units:
[0183] A first determining unit 310, configured to determine a cryptographic operation requirement for target data;
[0184] A second determining unit 320 is used to determine a target virtual cryptographic device that meets the cryptographic operation requirements in a virtual cryptographic device set, where the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module;
[0185] The sending unit 330 is used to send a cryptographic operation request for target data to the target virtual cryptographic device;
[0186] The receiving unit 340 is used to receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0187] In an embodiment of the present application, a data processing system includes multiple computing nodes, a target computing node is any one of the multiple computing nodes, a distributed cryptographic module is deployed on the target computing node, and the target computing node calls the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set.
[0188] The first determination unit 310 may determine a cryptographic operation requirement for the target data, and transmit information of the determined cryptographic operation requirement to the second determination unit 320 .
[0189] The second determining unit 320 determines a target virtual cryptographic device that meets the cryptographic operation requirement in the virtual cryptographic device set, and transmits information of the target virtual cryptographic device to the sending unit 330 .
[0190] The sending unit 330 sends a cryptographic operation request for target data to the target virtual cryptographic device.
[0191] The receiving unit 340 receives the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0192] By using the device provided by the embodiment of the present application, a distributed cryptographic module is deployed on any computing node of the data processing system, such as a target computing node. The target computing node can call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set. After determining the cryptographic operation requirements for the target data, the target virtual cryptographic device is determined in the virtual cryptographic device set according to the cryptographic operation requirements, and a cryptographic operation request for the target data is sent to the target virtual cryptographic device, and the cryptographic operation result for the target data returned by the target virtual cryptographic device is received. Without going through a switching network, the cryptographic service can be directly called to achieve efficient cryptographic operations and improve the overall efficiency of the system.
[0193] In some embodiments of the present application, a cryptographic application container is installed on the target computing node, and the sending unit 330 is specifically used to:
[0194] Sending a cryptographic operation request for target data to a target virtual cryptographic device through a cryptographic application container;
[0195] The receiving unit 340 is specifically configured to:
[0196] The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
[0197] In an embodiment of the present application, a cryptographic application container may be pre-installed on the target computing node.
[0198] After the first determination unit 310 determines the cryptographic operation requirements for the target data and the second determination unit 320 determines the target virtual cryptographic device that meets the cryptographic operation requirements, the sending unit 330 can send a cryptographic operation request for the target data to the target virtual cryptographic device through the cryptographic application container, and the receiving unit 340 can receive the cryptographic operation result for the target data returned by the target virtual cryptographic device through the cryptographic application container.
[0199] Optionally, the sending unit 330 can send a cryptographic operation request for the target data to the cryptographic application container. The cryptographic application container calls the target virtual cryptographic device through a standard interface. The target virtual cryptographic device can rely on the computing power of the underlying distributed cryptographic module to complete the corresponding cryptographic operation and return the cryptographic operation result to the cryptographic application container. The cryptographic application container returns the cryptographic operation result to the receiving unit 340.
[0200] The cryptographic application container is used to facilitate the communication between the data processing apparatus 300 applied to the target computing node and the target virtual cryptographic device.
[0201] In some embodiments of the present application, the virtual cryptographic device set includes at least one of the following virtual cryptographic devices:
[0202] Virtual server cryptographic machine;
[0203] Virtual signature verification server;
[0204] Virtual SSL Gateway;
[0205] Virtual timestamp server.
[0206] In some embodiments of the present application, the cryptographic operation requirement includes at least one of the following:
[0207] Data encryption requirements;
[0208] Data decryption requirements;
[0209] Data signature requirements;
[0210] Data verification requirements;
[0211] Hash operation requirements based on message authentication codes.
[0212] In some embodiments of the present application, the target data includes data that meets set protection conditions.
[0213] In some embodiments of the present application, the target computing node calls the distributed cryptographic module through a communication bus.
[0214] Regarding the device in the above embodiment, the specific manner in which each unit performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.
[0215] Corresponding to the above method embodiment, the present application embodiment further provides an electronic device, including:
[0216] Memory for storing computer programs;
[0217] A processor is used to implement the steps of the above data processing method when executing a computer program.
[0218] like Figure 4 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.
[0219] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.
[0220] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the data processing method.
[0221] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:
[0222] Determine the cryptographic operation requirements for the target data;
[0223] Determine a target virtual cryptographic device that meets the cryptographic operation requirements in a virtual cryptographic device set, where the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by calling a distributed cryptographic module;
[0224] Sending a cryptographic operation request for target data to a target virtual cryptographic device;
[0225] Receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
[0226] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use, etc.
[0227] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.
[0228] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.
[0229] Of course, it should be noted that Figure 4 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 4More or fewer components than shown, or combinations of certain components.
[0230] Corresponding to the above method embodiment, the embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above data processing method are implemented.
[0231] In addition, it should be noted that: the embodiment of the present application also provides a computer program product or a computer program, which may include computer instructions, which may be stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor may execute the computer instructions so that the computer device executes the description of the data processing method in the corresponding embodiment above, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer program product or computer program embodiment involved in this application, please refer to the description of the method embodiment of this application.
[0232] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0233] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.
[0234] In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. In addition, features described with reference to certain examples may be combined in other examples.
[0235] Through the description of the above implementation methods, those skilled in the art can also clearly understand that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.
[0236] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be directly implemented using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a register, a hard disk, a removable disk, a compact disc read-only memory (CD-ROM), or any other form of storage medium known in the art, including several instructions to execute the methods described in the various embodiments of the present application.
[0237] The embodiments of the present application are described above in conjunction with the accompanying drawings, and the description of the above embodiments is only used to help understand the technical solution and its core idea of the present application. It should be pointed out that the present application is not limited to the above-mentioned specific implementation methods, which are merely illustrative and not restrictive. For ordinary technicians in this field, many forms of implementation methods can be made without departing from the scope of protection of the purpose of the present application and the claims, and the present application can also be improved and modified in a number of ways, and these implementation methods, improvements and modifications are all within the scope of protection of the present application.
Claims
1. A data processing method, characterized in that: Applied to a target computing node, the target computing node is any computing node in a data processing system, and a distributed cryptographic module is deployed on the target computing node. The method includes: Determine the cryptographic operation requirements for the target data; Determine a target virtual cryptographic device that meets the cryptographic operation requirement in a virtual cryptographic device set, wherein the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module; Sending a cryptographic operation request for the target data to the target virtual cryptographic device; Receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
2. The method according to claim 1, characterized in that The target computing node is equipped with a cryptographic application container, and the sending of a cryptographic operation request for the target data to the target virtual cryptographic device includes: Sending a cryptographic operation request for the target data to the target virtual cryptographic device through the cryptographic application container; The receiving the cryptographic operation result for the target data returned by the target virtual cryptographic device includes: The cryptographic operation result for the target data returned by the target virtual cryptographic device is received through the cryptographic application container.
3. The method according to claim 1, characterized in that The virtual cryptographic device set includes at least one of the following virtual cryptographic devices: Virtual server cryptographic machine; Virtual signature verification server; Virtual SSL Gateway; Virtual timestamp server.
4. The method according to claim 1, characterized in that The cryptographic operation requirements include at least one of the following: Data encryption requirements; Data decryption requirements; Data signature requirements; Data verification requirements; Hash operation requirements based on message authentication codes.
5. The method according to claim 1, characterized in that The target data includes data that meets the set protection conditions.
6. The method according to any one of claims 1 to 5, characterized in that The target computing node calls the distributed cryptographic module through a communication bus.
7. A data processing device, characterized in that: Applied to a target computing node, the target computing node is any computing node in a data processing system, a distributed cryptographic module is deployed on the target computing node, and the device comprises: A first determining unit, used to determine a cryptographic operation requirement for target data; A second determining unit is used to determine a target virtual cryptographic device that meets the cryptographic operation requirement in a virtual cryptographic device set, wherein the virtual cryptographic device set is a set of virtual cryptographic devices virtualized by the target computing node calling the distributed cryptographic module; A sending unit, used for sending a cryptographic operation request for the target data to the target virtual cryptographic device; The receiving unit is used to receive the cryptographic operation result for the target data returned by the target virtual cryptographic device.
8. A data processing system, characterized in that: It includes multiple computing nodes, each of which is deployed with a distributed cryptographic module, and the target computing node is any one of the multiple computing nodes; The target computing node is used to call the distributed cryptographic module to virtualize a virtual cryptographic device to form a virtual cryptographic device set; It is also used to determine the cryptographic operation requirements for target data, determine a target virtual cryptographic device that meets the cryptographic operation requirements in the virtual cryptographic device set, send a cryptographic operation request for the target data to the target virtual cryptographic device, and receive a cryptographic operation result for the target data returned by the target virtual cryptographic device.
9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data processing method according to any one of claims 1 to 6 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 6 are implemented.