Data processing method and device

Abstract

The embodiment of the invention provides a data processing method and device.The data processing method comprises the steps that after a data access request of a container packaging unit is obtained, access permission detection is conducted according to an identity identifier and a data object identifier contained in the data access request, and under the condition that the detection is passed, the data access request is sent to the container packaging unit; performing data object query in a middleware cache of the data access middleware based on the data object identifier, if the query fails, reading the data object in a container management tool to which the container packaging unit belongs based on the data object identifier, and performing sensitive field identification on the data object; and finally, performing desensitization processing on the identified sensitive field to obtain a desensitization field so as to configure the target data object containing the desensitization field in a container packaging unit.

Description

[0001] This application is a divisional application of the Chinese invention patent application with the application date of July 19, 2024, application number CN202410986019.1, and name “Data Processing Method and Device”. Technical Field

[0002] This document relates to the field of data processing, and in particular to a data processing method and device. Background Art

[0003] With the development of computers and the Internet, more and more services are provided online, and more and more data are maintained and provided online. As more and more data is maintained and interacted online, sensitive data, as data involving privacy, will be leaked if it is directly interacted with, which means it will lead to the leakage of private data. How to more effectively maintain sensitive data and interact with sensitive data is a focus of increasing attention for data providers and data requesters. Summary of the invention

[0004] One or more embodiments of the present specification provide a data processing method, which is applied to data access middleware, and the data access middleware is deployed between a container encapsulation unit and a container management tool. The method includes: performing access permission detection based on an identity identifier and a data object identifier contained in a data access request of the container encapsulation unit. If the detection passes, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read in the container management tool based on the data object identifier, and sensitive fields of the data object are identified. The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit.

[0005] One or more embodiments of the present specification provide a data processing device, which runs on a data access middleware, and the data access middleware is deployed between a container encapsulation unit and a container management tool, and the device includes: an access permission detection module, which is configured to perform access permission detection according to an identity identifier and a data object identifier contained in a data access request of the container encapsulation unit; if the detection passes, a data object query module is run, and the data object query module is configured to perform a data object query in a middleware cache of the data access middleware based on the data object identifier; if the query fails, a sensitive field identification module is run, and the sensitive field identification module is configured to read a data object in the container management tool based on the data object identifier and identify sensitive fields of the data object. A desensitization processing module is configured to perform desensitization processing on the identified sensitive fields to obtain desensitized fields, so as to configure the target data object containing the desensitized fields in the container encapsulation unit.

[0006] One or more embodiments of the present specification provide a data processing device, including: a processor; a memory configured to store computer-executable instructions, the processor executing the computer-executable instructions to implement: performing access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit. If the detection passes, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read in the container management tool based on the data object identifier, and sensitive fields of the data object are identified. The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit.

[0007] One or more embodiments of the present specification provide a computer-readable storage medium for storing computer-executable instructions, which implement the following process when executed: perform access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit. If the detection passes, perform a data object query in the middleware cache of the data access middleware based on the data object identifier. If the query fails, read the data object in the container management tool based on the data object identifier, and identify sensitive fields of the data object. Desensitize the identified sensitive fields to obtain desensitized fields, so that the target data object containing the desensitized fields can be configured in the container encapsulation unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate one or more embodiments of the present specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 A schematic diagram of an implementation environment of a data processing method provided for one or more embodiments of this specification; Figure 2 A data processing method processing flow chart provided for one or more embodiments of this specification; Figure 3 A processing schematic diagram of a data processing method applied to a secret processing scenario in a Kubernetes environment provided by one or more embodiments of this specification; Figure 4 A processing flow chart of a data processing method applied to a secret processing scenario in a Kubernetes environment provided by one or more embodiments of this specification; Figure 5 A schematic diagram of an embodiment of a data processing device provided for one or more embodiments of this specification; Figure 6 A schematic diagram of the structure of a data processing device provided for one or more embodiments of this specification. DETAILED DESCRIPTION

[0009] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0010] The data processing method provided in one or more embodiments of this specification may be applicable to the implementation environment of data processing, such as Figure 1 As shown, the implementation environment at least includes: A container management tool 101, a container encapsulation unit 102, and a data access middleware 103 between the container management tool 101 and the container encapsulation unit 102; The container management tool 101 may be a container orchestration and management platform for automating the deployment, expansion, and management of containerized applications, such as Kubernetes. The container encapsulation unit 102 may be a deployable and manageable unit in the container management tool 101 ; for example, a pod; The data access middleware 103 may be a middleware deployed between the container management tool 101 and the container encapsulation unit 102. The data access middleware implements the protection and access of the data objects in the container management tool 101 by the container encapsulation unit 102 through a proxy mechanism. In this implementation environment, during the data processing process, when the container encapsulation unit 102 requests access to the data object of the container management tool 101, the data access middleware 103 first performs access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit 102. If the detection passes, the data object is queried in the middleware cache of the data access middleware 103 based on the data object identifier. If the query fails, the data object is read in the tool cache of the container management tool 101 based on the data object identifier, and sensitive fields of the data object are identified. The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit 102.

[0011] One or more embodiments of a data processing method provided in this specification are as follows: The present embodiment provides a data processing method, in which data access middleware is deployed between a container encapsulation unit and a container management tool. After detecting a data access request from the container encapsulation unit, the data access middleware first performs an access permission check according to an identity identifier and a data object identifier included in the data access request. If the check passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the sensitive field of the data object read from the container management tool is identified, and the sensitive field obtained by identification is desensitized to obtain a desensitized field, so that the target data object containing the desensitized field is configured in the container encapsulation unit. In this way, the data access request of the container encapsulation unit is processed by deploying the data access middleware. During the processing, dynamic access to the data object is achieved by performing access permission check, thereby improving the processing flexibility of the data access middleware. Furthermore, a middleware cache is introduced. Only when the query of the data object in the middleware cache fails, the original data object is read from the container management tool, thereby reducing the number of accesses to the original data object in the container management tool and improving the efficiency of the data object query. In the case of query failure, the sensitive field in the data object is desensitized in real time, thereby ensuring the real-time and accuracy of the desensitized field.

[0012] Reference Figure 2The data processing method provided in this embodiment can be applied to data access middleware, and the data access middleware is deployed between the container encapsulation unit and the container management tool, and specifically includes steps S202 to S208.

[0013] Step S202: Perform access permission detection according to the identity identifier and data object identifier included in the data access request of the container encapsulation unit.

[0014] In this embodiment, the container management tool includes a tool for automating the deployment, expansion and management of containerized applications, such as a Kubernetes cluster management tool; the container encapsulation unit includes a deployable and manageable unit in the container management tool, and the container encapsulation unit can represent a collection of one or more containers. The containers in the same collection share storage resources and network namespaces and are scheduled and managed as a whole; for example, the container encapsulation unit can be a pod in the Kubernetes cluster management tool; in addition, the container encapsulation unit can also act as a user; the container management tool can act as a data provider.

[0015] In actual applications, pods can access various types of data in Kubernetes according to pre-configuration. The data access request in this embodiment includes the request sent by the pod in the process of requesting Kubernetes for data access; optionally, the data access request contains at least one of the following identifiers: data object identifier, identity identifier; the data access request in this embodiment may be a pod request. The identity identifier includes an identifier that represents the identity of the pod; for example, UID (Unique Identifier, an unchanging identifier used to track and identify Pods), service account. Specifically, access rights are determined based on the identity identifier. The data object in this embodiment includes stored data; the data object identifier includes an identifier that identifies the uniqueness of the data object.

[0016] During specific implementation, the container encapsulation unit requests the container management tool to access the data object. In this embodiment, the data access request of the container encapsulation unit to the data object in the container management tool is obtained through the configured data access middleware. In order to ensure the security of the data object and avoid configuring the data object to an abnormal container encapsulation unit (that is, a container encapsulation unit that is not in the container management tool) to cause leakage of the data object, in this embodiment, after obtaining the data access request, the container encapsulation unit is firstly subjected to access detection based on the data access request. In an optional implementation manner provided by this embodiment, the container encapsulation unit is subjected to access detection in the following manner: Reading a unit identifier of at least one container encapsulation unit in the container management tool; Based on the unit identifier and the request unit identifier included in the data access request, detecting whether the container encapsulation unit is an access encapsulation unit of the container management tool; If so, executing step S202, performing access permission detection according to the identity identifier and data object identifier included in the data access request of the container encapsulation unit; If not, the data access request is intercepted.

[0017] Specifically, during the access detection process, it is detected whether the container encapsulation unit that submits the data access request is a container encapsulation unit in the container management tool. If so, it is determined that the access detection passes; if not, it is determined that the access detection fails.

[0018] In the specific execution process, if the access detection passes, the access permission detection is performed; in order to improve the effectiveness of the access permission detection, in an optional implementation manner provided in this embodiment, the process of performing the access permission detection according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit is implemented in the following manner: Reading, according to the data object identifier, the access identity of each data object in the at least one data object requested to be accessed; Based on the identity identifier and the access identity, detecting whether the container encapsulation unit meets the access conditions of each data object; If the container encapsulation unit satisfies the access conditions of the data objects, determining that the result of the access permission detection is a detection pass; If the container encapsulation unit does not meet the access condition of any data object, it is determined that the result of the access permission detection is detection failure.

[0019] Specifically, during the access permission detection process, the container encapsulation unit performs access permission detection on each data object requested for access. If the container encapsulation unit passes the permission detection on each data object, it is determined that the permission detection of the container encapsulation unit or the data access request passes.

[0020] For example, the identity of pod1 that submits a data access request is a second-level identity (wherein the identity permission level of the first-level identity is higher than the identity permission level of the second-level identity, and so on); the data objects to be accessed by the data access request include secret1 and secret2, where the access identity of secret1 is a second-level identity and the access identity of secret2 is a third-level identity. The identity of pod1 with a second-level identity is higher than or equal to the access identities of secret1 and secret2, and the detection result of the access permission detection for pod1's data access request is detection passed.

[0021] For another example, the identity of pod2 that submits a data access request is a second-level identity, and the data objects to be accessed by the data access request include secret3 and secret4, among which the access identity of secret3 is a first-level identity, and the access identity of secret4 is a second-level identity. Since the identity of pod2 with the second-level identity is lower than the access identity of secret3, the result of the access permission check on pod2's data access request is failure, and pod2's data access request is intercepted.

[0022] Step S204: if the detection is passed, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier.

[0023] The data access middleware includes a middleware configured between the container encapsulation unit and the container management tool for processing a data access request from the container encapsulation unit to the container management tool for data access. Optionally, the data access middleware is configured with a middleware cache.

[0024] In specific implementation, when the access permission check is passed according to the identity identifier and data object identifier included in the data access request, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier; in this embodiment, by configuring the middleware cache of the data access middleware, desensitized data objects with high access frequency and / or desensitized data objects whose access time is less than the current time than other data objects are stored, so that when the access permission check is passed, a data object query is performed in the middleware cache of the data access middleware, thereby avoiding directly reading the original data object in the container management tool and then performing desensitization processing to affect the efficiency of data acquisition. It should be noted that the desensitized data objects stored in the middleware cache can be cached data objects; the middleware cache stores the most recently accessed and frequently accessed cached data objects. On the one hand, from the time dimension, it ensures that the stored cached data objects are cached data objects obtained by desensitizing based on the new desensitizing processing strategy, avoiding dependence on cached data objects in persistent storage, reducing the risk of data leakage, and ensuring the real-time and accuracy of the data; on the other hand, from the access frequency dimension, it gives priority to storing cached data objects with high access frequency, effectively reducing the access frequency to the original data objects (data objects in the container management tool), and improving the response speed and processing capability of data access requests under high concurrent access conditions.

[0025] In the specific execution process, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier; in addition to performing a data object query in the middleware cache of the data access middleware based on the data object identifier, container encapsulation units with different access rights, that is, container encapsulation units with different identities, can access different sensitive fields in the data object according to different access rights; therefore, a data object query can also be performed in the middleware cache of the data access middleware based on the data object identifier and the access rights of the container encapsulation unit to the data object. Optionally, the access rights of container encapsulation units with different identities to different data objects can be pre-configured, which is not limited in this embodiment.

[0026] For example, the access identity of secret1 is a second-level identity, which is pre-configured with a first-level identity that can access 50% of the sensitive fields in secret1, and a second-level identity that cannot access the sensitive fields in secret1. For another example, the access identity of secret2 is a third-level identity, which is pre-configured with a first-level identity that can access all sensitive fields in secret2, a second-level identity that can access 50% of the sensitive fields in secret2, and a third-level identity that cannot access the sensitive fields in secret2.

[0027] In this case, the cached data objects stored in the middleware cache, taking secret1 as an example, can be cached data objects of secret1 with 50% of sensitive fields desensitized and 50% of sensitive fields not desensitized, and are associated and stored by the first-level identity, and can be queried in the middleware cache based on both the access permission (identity identifier) ​​and the data object identifier. That is, in the process of querying data objects in the middleware cache of the data access middleware based on the access permission and the data object identifier, the candidate cached data objects can be queried in the middleware cache first according to the data object identifier; and then the cached data objects can be queried in the candidate cached data objects according to the access permission.

[0028] A data object query is performed in the middleware cache of the data access middleware based on the data object identifier. If the query is successful, that is, the cached data object is found in the middleware cache, optionally, the cached data object found in the middleware cache is configured in the container encapsulation unit.

[0029] In addition to the above-mentioned direct query of data objects in the middleware cache based on both access permissions and data object identifiers, in this embodiment, if a cached data object is queried in the middleware cache, the cached data object can be tested based on the access permissions of the container encapsulation unit. If the test passes, the cached data object can be configured in the container encapsulation unit. If the test fails, it is determined that the query has failed.

[0030] In the process of detecting cached data based on access rights, on the one hand, the access percentage corresponding to the identity identifier can be used. Here, the access percentage determined based on the identity identifier can be used as the access right to detect whether the proportion of the desensitized field in the sensitive field in the cached data object meets the access right. If so, it is determined that the detection is passed, and if not, it is determined that the detection fails. On the other hand, in order to further improve the accuracy of the detection, the sensitive field of the data object can be identified based on the access right and then detected. Here, the sensitive field identifier determined based on the identity identifier can be used as the access right. In an optional implementation provided by this embodiment, the data object is first read in the container management tool based on the data object identifier, and the sensitive field of the data object is identified based on the access right of the container encapsulation unit to obtain the sensitive field identifier, and then the sensitive field identifier is detected to be consistent with the desensitized field identifier in the cached data object. If so, it is determined that the detection is passed, and if not, it is determined that the detection fails. Among them, the association relationship between the sensitive field identifier of the data object and the identity identifier can be pre-configured, and then the sensitive field identifier is identified according to the identity identifier. In addition, other methods can be used to identify the sensitive field identifier based on the identity identifier, which is not limited in this embodiment.

[0031] It should be noted that if the cached data object corresponding to the data object identifier is not found in the middleware cache, the following step S206 is executed.

[0032] Step S206: If the query fails, read the data object in the container management tool based on the data object identifier, and identify sensitive fields of the data object.

[0033] In the above steps, after the data object is queried in the middleware cache of the data access middleware based on the data object identifier, in this step, if the query fails, the data object is read in the container management tool based on the data object identifier, and sensitive fields of the data object are identified. The sensitive fields include passwords, certificates, etc.

[0034] During the specific execution process, the data object is read in the tool cache of the container management tool based on the data object identifier, and sensitive fields of the data object are identified; in the process of sensitive field identification, the data object can be input into a pre-configured sensitive field identification engine for sensitive field identification to obtain sensitive fields.

[0035] In addition, after the data object is read from the tool cache of the container management tool based on the data object identifier, subsequent processing can also be determined based on the access rights; for example, if the access rights of the container encapsulation unit are plaintext access rights (that is, all sensitive fields of the data object can be viewed), the data object is configured in the container encapsulation unit; if the access rights of the container encapsulation unit are ciphertext access rights, sensitive fields of the data object can be identified; in the process of identifying sensitive fields of the data object, sensitive fields of the data object can be identified based on the access rights; in the specific process of identifying sensitive fields of the data object based on the access rights, sensitive fields can be identified according to the access percentage corresponding to the access rights and / or the pre-configured sensitive field identifiers; for example, the access percentage is 50%, secret1 is "password is: 123456, certificate is abcdef", then "123" and "abc" are determined as sensitive fields according to the access percentage of 50% and the sensitive field identifiers "password, certificate".

[0036] Step S208, performing desensitization processing on the identified sensitive fields to obtain desensitized fields, so as to configure the target data object including the desensitized fields in the container encapsulation unit.

[0037] In the above steps, after the container management tool reads the data object based on the data object identifier and identifies the sensitive fields of the data object to obtain the sensitive fields, in this step, the desensitized fields are obtained by desensitizing the sensitive fields, and the target data object containing the desensitized fields is configured in the container encapsulation unit.

[0038] The target data object includes a data object in which sensitive fields in the data object are replaced with corresponding desensitized fields.

[0039] In a specific implementation, in order to improve the flexibility of desensitization processing, in an optional implementation manner provided in this embodiment, in the process of desensitizing the identified sensitive fields to obtain desensitized fields, the following operations are performed: Reading a desensitization processing strategy for desensitizing the sensitive field according to the data category of the sensitive field; The sensitive field is desensitized according to the desensitization processing strategy to obtain the desensitized field.

[0040] Specifically, different desensitization processing strategies can be flexibly configured for different data categories, and the sensitive fields are desensitized according to the desensitization processing strategy corresponding to the data category to which the sensitive fields belong, so as to obtain desensitized fields.

[0041] After obtaining the desensitized field, the desensitized field is updated to the data object, the target data object is obtained, and the target data object is configured in the container encapsulation unit.

[0042] Using the above example, "123" and "abc" are sensitive fields, 123 is a number, and the pre-configured desensitization processing strategy for sensitive fields of the number category is "Convert numbers to *". Then, according to the desensitization processing strategy, "123" is desensitized to obtain "***". abc is a letter, and the pre-configured desensitization processing strategy for sensitive fields of the letter category is "Convert numbers to #". Then, according to the desensitization processing strategy, "abc" is desensitized to obtain "###". The desensitized field is updated to the data object, and the target data object obtained is "Password: ***456, Certificate: ###def".

[0043] For another example, access rights are not introduced in the process of determining sensitive fields. The sensitive fields of secret1 "password: 123456, certificate: abcdef" are identified to obtain "123456" and "abcdef". The pre-configured corresponding desensitization processing strategy is "convert some characters in numbers or letters to *". Then, according to the desensitization processing strategy, "123456" and "abcdef" are desensitized respectively, and the desensitized fields include "1*34**" and "ab***f". The desensitized fields are updated to secret1 to obtain the target secret1 as "password: 1*34**, certificate: ab***f".

[0044] It should be noted that the process of identifying sensitive fields of data objects in step S206 and desensitizing the identified sensitive fields in step S208 can be performed by a desensitizing processing engine. Specifically, after reading the data object in the container management tool based on the data object identifier, the data object or both the data object and the access rights can be input into the desensitizing processing engine for data desensitization processing to obtain the target data object; specifically, the desensitizing processing engine can perform data desensitization processing through the sensitive field identification method and desensitization processing method provided above, which will not be described in detail in this embodiment. It should also be noted that the desensitizing processing engine can be configured according to environmental requirements and actual application requirements, which is not limited in this embodiment.

[0045] In order to improve the effectiveness and flexibility of the data access middleware's management of the target data object, in an optional implementation provided by this embodiment, after the target data object is configured in the container encapsulation unit, the target data object can also be stored in the middleware cache based on the data object identifier. Specifically, in order to avoid the inability to store the target data object in the middleware cache when the number of cached data objects that can be cached by the middleware cache is limited, and to ensure that the cached data objects stored in the middleware cache meet the requirements of cached data objects with high access frequency and / or access time less than the current time from other data objects, in an optional implementation provided by this embodiment, in the process of storing the target data object in the middleware cache, the following operations are performed: Calculating the number of data objects cached in the middleware cache; When the number of data objects of the cached data object is equal to a preset threshold, reading the historical access count of the data object; Based on the historical access times, detecting whether the target data object satisfies a cache condition of the middleware cache; If so, deleting the target cache data object in the middleware cache, and storing the target data object in the middleware cache; If not, no action is required.

[0046] Specifically, in the process of storing the target data object in the middleware cache, it is first detected whether the number of cached data objects in the middleware cache reaches a preset threshold. If not, the target data object is stored in the middleware cache based on the data object identifier; if so, the target cache data object in the middleware cache can be directly deleted, and the target data object is stored in the middleware cache; in addition, it is also possible to detect whether the target data object meets the cache conditions of the middleware cache. If the cache conditions are met, the target cache data object in the middleware cache is deleted, and the target data object is stored in the middleware cache.

[0047] Optionally, the cache condition may be that the number of historical accesses to the target data object is greater than a threshold value, and the cache condition may also be configured from other dimensions according to actual configuration, which is not limited in this embodiment. The target cache data object includes a cache data object to be deleted determined from the middleware cache.

[0048] In order to ensure the validity of the cached data objects stored in the middleware cache, so that the middleware cache can effectively reduce the direct access to the original data objects in the container management tool, in an optional implementation manner provided by this embodiment, the target cache object is determined in the following manner: (1) calculating the access index of each cache data object in the middleware cache according to the access parameter of each cache data object; In the specific execution process, the access index of each cached data object can be calculated from at least one of the two dimensions of access interval duration and access frequency. In an optional implementation provided by this embodiment, the process of calculating the access index of each cached data object according to the access parameters of each cached data object can be implemented in the following manner: Reading target historical access requests of each cached data object, and reading historical access time in the target historical access requests; Calculate the access interval duration of each cached data object based on the historical access time of each cached data object and the current time; and / or, Calculating the access frequency of each cache data object according to the historical access count of each cache data object in the historical time interval; Based on the access interval duration and / or the access frequency of each cache data object, an access index of each cache data object is calculated.

[0049] Optionally, the target historical access request includes the last data access request of the cached data object; the historical access time includes the last access time of the cached data object.

[0050] Specifically, on the one hand, the access interval duration of each cached data object is calculated based on the historical access time and current time of each cached data object; on the other hand, the access frequency of each cached data object is calculated based on the historical number of accesses to each cached data object within the historical time interval; based on the access interval duration and / or access frequency of each cached data object, the access index of each cached data object is calculated.

[0051] Taking three cached data objects as an example, the access interval between the last access time of cached data object 1 and the current time is t1, and the number of historical accesses in the past T time is c1. The access interval between the last access time of cached data object 2 and the current time is t2, and the number of historical accesses in the past T time is c2. The access interval between the last access time of cached data object 3 and the current time is t3, and the number of historical accesses in the past T time is c3. The access index of cached data object 1 is calculated as follows: , the access index of cache data object 2 is , the access index of cache data object 3 is .in, and The duration weight and frequency weight are pre-configured.

[0052] It should be noted that if the access metric is determined only by the access interval duration or the access frequency, the access interval duration or the access frequency can be used as the access metric.

[0053] (2) Ascendingly sort at least one cached data object based on the access metric, and determine the cached data object in the first position in the sorting result as the target cached data object.

[0054] After calculating the access metrics of each cached data object, ascendingly sort at least one cached data object based on the access metric, and determine the cached data object in the first position in the sorting result as the target cached data object.

[0055] Continuing with the above example, if the calculated m2 < m3 < m1, then the cached data object 2 corresponding to m2 is determined as the target cached data object.

[0056] To further ensure the validity of the cached data objects stored in the middleware cache, and to avoid the situation where the data objects stored in the tool cache of the container management tool are updated, but the cached data objects in the middleware cache are not updated in a timely manner, resulting in incorrect target data objects configured in the container encapsulation unit and affecting the configuration experience. In an optional implementation manner provided in this embodiment, taking the update of the target data object as an example, the update process of the cached data objects in the middleware cache is specifically described as follows: Based on the data object identifier, perform an update detection on the data object in the tool cache of the container management tool; If it is detected that the data object in the tool cache is updated, read the updated data object in the tool cache; Input the updated data object into a desensitization processing engine to desensitize the sensitive fields in the updated data object to obtain a target updated data object; Based on the data object identifier, update the target data object in the middleware cache to the target updated data object.

[0057] Specifically, perform an update detection on the data object in the tool cache of the container management tool. If it is detected that the data object in the tool cache is updated, read the updated data object in the tool cache, input the updated object into a desensitization processing engine to desensitize the sensitive fields in the updated data object to obtain a target updated data object, and finally update the target data object in the middleware cache to the target data object.

[0058] That is, if it is detected that the data object corresponding to any cache data object stored in the middleware cache stored in the tool cache is updated, the corresponding cache data object in the middleware cache is updated based on the updated data object in the tool cache; in addition to updating the corresponding cache data object in the middleware cache based on the updated data object in the tool cache, when it is detected that the data object corresponding to any cache data object stored in the middleware cache stored in the tool cache is updated, the corresponding cache data object in the middleware cache may be deleted or invalidated.

[0059] In summary, in one or more data processing methods provided by the present embodiment, the data access middleware deployed between the container encapsulation unit and the container management tool first performs access verification on the container encapsulation unit that submits the data access request during data processing. If the access verification passes, the access permission detection is performed according to the identity identifier and the data object identifier contained in the data access request. In this way, after obtaining the data access request, the access permission of the container encapsulation unit is dynamically evaluated, and not only the access permission of different container encapsulation units is dynamically adjusted based on the identity identifier of the container encapsulation unit and the data access request, but also the environment change and the update of the access policy can be responded to in real time, so that the access policy, that is, the access condition, can be configured or adjusted for different data objects, thereby improving the flexibility and security of data access. Secondly, when the access permission detection is passed, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read from the container management tool based on the data object identifier. In this way, by configuring the middleware cache to store data objects with a short time interval between the access time and the current time and / or a high access frequency, the reading of original data objects in the container management tool is reduced, and the response speed and processing capability to data access requests are improved by storing commonly used anonymized data objects in the middleware cache, thereby improving the performance in high-concurrency access scenarios. Finally, the sensitive fields of the data object are identified, the identified sensitive fields are desensitized to obtain desensitized fields, and the target data object containing the desensitized fields is configured in the container encapsulation unit. In this way, through real-time desensitization processing, the desensitization strategy is dynamically applied to desensitize the data object at the moment the data object is accessed, rather than relying on pre-processed or persistently stored desensitized data objects, which reduces the risk of data object leakage and ensures the real-time and accuracy of the data. This not only improves the security and flexibility of data objects, but also improves the efficiency and flexibility of managing and protecting sensitive information in the Kubernetes environment.

[0060] The following takes the application of a data processing method provided in this embodiment in a secret processing scenario in a Kubernetes environment as an example. Figure 3 and Figure 4 For further explanation of the data processing method provided in this embodiment, see Figure 4 , a data processing method applied to secret processing scenarios in Kubernetes environment, specifically includes the following steps.

[0061] like Figure 3 As shown in the figure, in the secret processing scenario in the Kubernetes environment, after the data access middleware between the secret storage of Kubernetes and the pod obtains the secret access request of the pod, it first performs access verification and access permission detection on the secret request through the dynamic access control module. If the access verification and access permission detection pass, the secret is queried in the middleware cache. If the query is successful, the queried secret is output; if the query fails, the secret is read from the secrets cache of the Kubernetes environment, and the sensitive fields in the secret are desensitized through the real-time desensitization module to obtain the desensitized field, and the target secret containing the desensitized field is returned to the pod requesting access, and the target secret is stored in the middleware cache.

[0062] Step S402, obtaining a data access request from the pod for data access, and performing Kubernetes admission verification on the pod.

[0063] Step S404: When the verification is successful, the access permission is checked according to the identity identifier and the data object identifier included in the data access request.

[0064] Step S406: if the detection is passed, a data object query is performed in the middleware cache of the data access middleware based on the data object identifier.

[0065] If the query is successful, the data object obtained by the query is returned to the pod.

[0066] In addition, step S406 may also be replaced by, when the detection is passed, performing a data object query in the middleware cache of the data access middleware based on the data object identifier and the access permission.

[0067] Step S408: If the query fails, read the data object in the data object cache of Kubernetes based on the data object identifier.

[0068] In addition, step S408 may also be replaced by, if the query fails, reading the data object in the data object cache of Kubernetes based on the data object identifier and access rights.

[0069] Step S410, identifying sensitive fields of the data object to obtain sensitive fields, and desensitizing the sensitive fields according to the data desensitization strategy corresponding to the data category to which the sensitive fields belong, to obtain desensitized fields.

[0070] Step S412, update the desensitized field to the data object to obtain the target data object.

[0071] In addition, steps S410 to S412 may also be replaced by inputting the data object into a desensitizing processing engine for desensitizing processing to obtain a target data object.

[0072] Step S414: Return the target data object to the pod.

[0073] Optionally, the method further includes storing the target data object in a middleware cache.

[0074] It should be noted that any one of steps S402 to S414 or any combination of multiple steps can be replaced by the corresponding technical means provided in the above steps S202 to S208 according to the needs of implementation and deployment, and will not be described one by one here.

[0075] One or more embodiments of a data processing device provided in this specification are as follows: In the above-mentioned embodiment, a data processing method is provided, and correspondingly, a data processing device is also provided, which will be described below with reference to the accompanying drawings.

[0076] Reference Figure 5 , which shows a schematic diagram of an embodiment of a data processing device provided by this embodiment.

[0077] Since the device embodiment corresponds to the method embodiment, the description is relatively simple, and the relevant parts can refer to the corresponding description of the method embodiment provided above. The device embodiment described below is only illustrative.

[0078] This embodiment provides a data processing device, which runs on a data access middleware, wherein the data access middleware is deployed between a container encapsulation unit and a container management tool, and the device includes: An access permission detection module 502 is configured to perform access permission detection according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit; If the detection is passed, the data object query module 504 is run, and the data object query module 504 is configured to perform a data object query in the middleware cache of the data access middleware based on the data object identifier; If the query fails, the sensitive field identification module 506 is run, and the sensitive field identification module 506 is configured to read the data object in the container management tool based on the data object identifier and identify sensitive fields of the data object; The desensitization processing module 508 is configured to perform desensitization processing on the identified sensitive fields to obtain desensitized fields, so as to configure the target data object containing the desensitized fields in the container encapsulation unit.

[0079] One or more embodiments of a data processing device provided in this specification are as follows: Corresponding to the data processing method described above, based on the same technical concept, one or more embodiments of this specification further provide a data processing device, which is used to execute the data processing method provided above. Figure 6 A schematic diagram of the structure of a data processing device provided for one or more embodiments of this specification.

[0080] This embodiment provides a data processing device, including: like Figure 6 As shown, the data processing device may have relatively large differences due to different configurations or performances, and may include one or more processors 601 and memory 602, and the memory 602 may store one or more storage applications or data. Among them, the memory 602 may be a short-term storage or a persistent storage. The application stored in the memory 602 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the data processing device. Furthermore, the processor 601 may be configured to communicate with the memory 602 and execute a series of computer executable instructions in the memory 602 on the data processing device. The data processing device may also include one or more power supplies 603, one or more wired or wireless network interfaces 604, one or more input / output interfaces 605, one or more keyboards 606, etc.

[0081] In a specific embodiment, a data processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the data processing device, and the one or more programs configured to be executed by one or more processors include computer-executable instructions for performing the following: Perform access permission detection according to the identity identifier and data object identifier contained in the data access request of the container encapsulation unit; In the case of passing the detection, performing a data object query in a middleware cache of the data access middleware based on the data object identifier; If the query fails, the data object is read in the container management tool based on the data object identifier, and sensitive fields of the data object are identified; The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit.

[0082] One or more embodiments of a computer-readable storage medium provided in this specification are as follows: Corresponding to the data processing method described above, based on the same technical concept, one or more embodiments of this specification also provide a computer-readable storage medium.

[0083] The computer-readable storage medium provided in this embodiment is used to store computer-executable instructions, and the computer-executable instructions implement the following process when executed: Perform access permission detection according to the identity identifier and data object identifier contained in the data access request of the container encapsulation unit; In the case of passing the detection, performing a data object query in a middleware cache of the data access middleware based on the data object identifier; If the query fails, the data object is read in the container management tool based on the data object identifier, and sensitive fields of the data object are identified; The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit.

[0084] It should be noted that the embodiments of the computer-readable storage medium in this specification and the embodiments of the data processing method in this specification are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the corresponding method mentioned above, and the repeated parts will not be repeated.

[0085] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. For example, the device embodiment, equipment embodiment and readable storage medium embodiment are similar to the method embodiment, so the description is relatively simple. To read the relevant contents in the device embodiment, equipment embodiment and readable storage medium embodiment, please refer to the partial description of the method embodiment.

[0086] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0087] In the 1930s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many of today's method flow improvements can be regarded as direct improvements to hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using hardware entity modules. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask chip manufacturers to design and produce dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0088] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0089] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by software with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0090] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing the embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0091] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as methods, systems or computer program software. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present specification may take the form of a computer program software implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program software according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0093] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0095] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0096] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0097] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0098] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0099] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0100] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0101] The above description is only an embodiment of this document and is not intended to limit this document. For those skilled in the art, this document may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this document should be included in the scope of the claims of this document.

Claims

1. A data processing method, applied to a data access middleware, wherein the data access middleware is deployed between a container encapsulation unit and a container management tool, the method comprising: In the case where the access permission detection performed according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit passes, performing a data object query in the middleware cache of the data access middleware based on the data object identifier; If the query fails, the data object is read in the container management tool based on the data object identifier, and if the access permission of the container encapsulation unit is a plain text access permission, the data object is configured in the container encapsulation unit.

2. The data processing method according to claim 1, further comprising: Reading a unit identifier of at least one container encapsulation unit in the container management tool; Based on the unit identifier and the request unit identifier included in the data access request, detecting whether the container encapsulation unit is an access encapsulation unit of the container management tool; If so, the step of detecting access rights according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit is executed.

3. The data processing method according to claim 1, wherein the step of performing access permission detection according to the identity identifier and the data object identifier contained in the data access request of the container encapsulation unit comprises: Reading, according to the data object identifier, the access identity of each data object in the at least one data object requested to be accessed; Based on the identity identifier and the access identity, detecting whether the container encapsulation unit meets the access conditions of each data object; If the container encapsulation unit satisfies the access conditions of the data objects, it is determined that the result of the access permission detection is a detection pass.

4. The data processing method according to claim 1, after the container management tool reads the data object based on the data object identifier, further comprising: If the access permission of the container encapsulation unit is a ciphertext access permission, identifying sensitive fields of the data object; The identified sensitive fields are desensitized to obtain desensitized fields, so that the target data object containing the desensitized fields is configured in the container encapsulation unit.

5. The data processing method according to claim 4, wherein the step of performing desensitization processing on the identified sensitive fields to obtain desensitized fields comprises: Reading a desensitization processing strategy for desensitizing the sensitive field according to the data category of the sensitive field; The sensitive field is desensitized according to the desensitization processing strategy to obtain the desensitized field.

6. The data processing method according to claim 1, if the result of executing the data object query operation in the middleware cache of the data access middleware based on the data object identifier is that the query is successful, then executing the following operations: The cache data object obtained by searching in the middleware cache is configured in the container encapsulation unit.

7. The data processing method according to claim 6, wherein the step of configuring the cache data object obtained by searching in the middleware cache before the container encapsulation unit operation is executed further comprises: Reading the data object in the container management tool based on the data object identifier, and identifying sensitive fields of the data object based on the access rights of the container encapsulation unit to obtain a sensitive field identifier; Detecting whether the sensitive field identifier is consistent with the desensitized field identifier in the cached data object; If so, the operation of configuring the cache data object obtained by searching in the middleware cache in the container encapsulation unit is performed.

8. The data processing method according to claim 1, wherein the step of configuring the data object after the container encapsulation unit operation is performed further comprises: Based on the data object identifier, the data object is stored in the middleware cache.

9. The data processing method according to claim 8, wherein based on the data object identifier, storing the target data object in the middleware cache comprises: Calculating the number of data objects cached in the middleware cache; When the number of data objects of the cached data object is equal to a preset threshold, reading the historical access count of the data object; Based on the historical access count, detecting whether the data object satisfies a cache condition of the middleware cache; If so, the target cache data object in the middleware cache is deleted, and the data object is stored in the middleware cache.

10. The data processing method according to claim 9, wherein the target cache data object is determined in the following manner: Calculating access indexes of each cached data object according to access parameters of each cached data object in the middleware cache; At least one cache data object is arranged in ascending order based on the access index, and the cache data object with the first rank in the arrangement result is determined as the target cache data object.

11. The data processing method according to claim 10, wherein the step of calculating the access index of each cached data object according to the access parameter of each cached data object in the middleware cache comprises: Reading target historical access requests of each cached data object, and reading historical access time in the target historical access requests; Calculate the access interval duration of each cached data object based on the historical access time of each cached data object and the current time; and / or, Calculating the access frequency of each cache data object according to the historical access count of each cache data object in the historical time interval; Based on the access interval duration and / or the access frequency of each cache data object, an access index of each cache data object is calculated.

12. The data processing method according to claim 8, further comprising: Based on the data object identifier, performing update detection on the data object in the tool cache of the container management tool; If it is detected that the data object in the tool cache is updated, reading the updated data object in the tool cache; Inputting the updated data object into a desensitization processing engine to perform desensitization processing on sensitive fields in the updated data object to obtain a target updated data object; Based on the data object identifier, the data object in the middleware cache is updated to the target updated data object.

13. A data processing device, running on a data access middleware, wherein the data access middleware is deployed between a container encapsulation unit and a container management tool, the device comprising: a data object query module configured to query the data object in the middleware cache of the data access middleware based on the data object identifier when the access permission detection performed according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit passes the detection; If the query fails, the data object is read in the container management tool based on the data object identifier, and if the access permission of the container encapsulation unit is a plain text access permission, the data object is configured in the container encapsulation unit.

14. A data processing device comprising: processor; and a memory configured to store computer executable instructions, wherein the processor executes the computer executable instructions to implement the following process: In the case where the access permission detection performed according to the identity identifier and the data object identifier included in the data access request of the container encapsulation unit passes, performing a data object query in the middleware cache of the data access middleware based on the data object identifier; If the query fails, the data object is read in the container management tool based on the data object identifier, and if the access permission of the container encapsulation unit is a plain text access permission, the data object is configured in the container encapsulation unit.

15. A computer-readable storage medium for storing computer-executable instructions, wherein the computer-executable instructions implement the steps of the method according to claim 1 when executed.

Images