Data processing method and apparatus

Abstract

This specification provides a data processing method and apparatus. One data processing method includes: after obtaining a data access request from a container encapsulation unit, firstly performing access permission detection based on the identity identifier and data object identifier contained in the data access request; if the detection passes, querying the data object in the middleware cache of the data access middleware based on the data object identifier; if the query fails, then reading the data object from the container management tool to which the container encapsulation unit belongs based on the data object identifier, identifying sensitive fields in the data object, and finally de-identifying the identified sensitive fields to obtain de-identified fields, so as to configure the target data object containing the de-identified fields in the container encapsulation unit.

Description

[0001] This application is a divisional application of Chinese invention patent application filed on July 19, 2024, with application number CN202410986019.1 and title "Data Processing Method and Apparatus". Technical Field

[0002] This document relates to the field of data processing, and in particular to a data processing method and apparatus. Background Technology

[0003] With the development of computers and the Internet, more and more services are provided online, and more and more data is maintained and provided online. As the amount of data maintained and interacted online increases, sensitive data, which involves privacy, can be leaked if interacted directly, which in turn leads to the leakage of privacy data. How to more effectively maintain and interact with sensitive data is an increasingly important focus for both data providers and data requesters. Summary of the Invention

[0004] This specification provides one or more embodiments of a data processing method applied to a data access middleware deployed between a container encapsulation unit and a container management tool. The method includes: performing access permission detection based on an identity identifier and a data object identifier contained in a data access request from the container encapsulation unit; if the detection passes, querying the data object in the middleware cache of the data access middleware based on the data object identifier; if the query fails, reading the data object from the container management tool based on the data object identifier and identifying sensitive fields in the data object; and de-identifying the identified sensitive fields to obtain de-identified fields, thereby configuring the target data object containing the de-identified fields in the container encapsulation unit.

[0005] This specification provides one or more embodiments of a data processing apparatus that runs on a data access middleware deployed between a container encapsulation unit and a container management tool. The apparatus includes: an access permission detection module configured to perform access permission detection based on an identity identifier and a data object identifier contained in a data access request from the container encapsulation unit; if the detection passes, a data object query module configured to query for a data object in the middleware cache of the data access middleware based on the data object identifier; if the query fails, a sensitive field identification module configured to read a data object from the container management tool based on the data object identifier and identify sensitive fields in the data object; and a desensitization processing module configured to desensitize the identified sensitive fields to obtain desensitized fields, so as to configure a target data object containing the desensitized fields in the container encapsulation unit.

[0006] This specification provides one or more embodiments of a data processing device, including: a processor; and a memory configured to store computer-executable instructions, the processor executing the computer-executable instructions to: perform access permission detection based on an identity identifier and a data object identifier contained in a data access request from a container encapsulation unit; if the detection passes, perform a data object query in a middleware cache of a data access middleware based on the data object identifier; if the query fails, read the data object from a container management tool based on the data object identifier and identify sensitive fields in the data object; perform desensitization processing on the identified sensitive fields to obtain desensitized fields, so as to configure a target data object containing the desensitized fields in the container encapsulation unit.

[0007] This specification provides one or more embodiments of a computer-readable storage medium for storing computer-executable instructions that, when executed, implement the following process: Access permission detection is performed based on an identity identifier and a data object identifier contained in a data access request from a container encapsulation unit. If the detection passes, a data object is queried in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read from a container management tool based on the data object identifier, and sensitive fields are identified in the data object. The identified sensitive fields are then de-identified to obtain de-identified fields, so that the target data object containing the de-identified fields is configured in the container encapsulation unit. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in one or more embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 A schematic diagram illustrating the implementation environment of a data processing method provided in one or more embodiments of this specification;

[0010] Figure 2 A data processing method flowchart provided for one or more embodiments of this specification;

[0011] Figure 3 This specification provides a schematic diagram illustrating a data processing method for a secret processing scenario in a Kubernetes environment, as illustrated in one or more embodiments.

[0012] Figure 4 A flowchart illustrating a data processing method for a secret processing scenario in a Kubernetes environment, provided by one or more embodiments of this specification;

[0013] Figure 5 A schematic diagram of an embodiment of a data processing apparatus provided in one or more embodiments of this specification;

[0014] Figure 6 This is a schematic diagram of the structure of a data processing device provided for one or more embodiments of this specification. Detailed Implementation

[0015] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0016] The data processing methods provided in one or more embodiments of this specification are applicable to the data processing implementation environment, such as... Figure 1 As shown, the implementation environment includes at least:

[0017] Container management tool 101, container encapsulation unit 102, and data access middleware 103 between container management tool 101 and container encapsulation unit 102;

[0018] Among them, the container management tool 101 can be a container orchestration and management platform used to automate the deployment, scaling, and management of containerized applications; such as Kubernetes;

[0019] The container encapsulation unit 102 can be a deployable and manageable unit in the container management tool 101; for example, a pod.

[0020] The data access middleware 103 can be a middleware deployed between the container management tool 101 and the container encapsulation unit 102. The data access middleware uses a proxy mechanism to enable the container encapsulation unit 102 to protect and access data objects in the container management tool 101.

[0021] In this implementation environment, during data processing, when the container encapsulation unit 102 requests access to the data object of the container management tool 101, the data access middleware 103 first performs access permission checks based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit 102. If the check passes, the data object is queried in the middleware cache of the data access middleware 103 based on the data object identifier. If the query fails, the data object is read from the tool cache of the container management tool 101 based on the data object identifier, and sensitive fields are identified in the data object. The identified sensitive fields are then de-identified to obtain de-identified fields, so that the target data object containing the de-identified fields is configured in the container encapsulation unit 102.

[0022] One or more embodiments of a data processing method provided in this specification are as follows:

[0023] This embodiment provides a data processing method that deploys a data access middleware between a container encapsulation unit and a container management tool. Upon detecting a data access request from the container encapsulation unit, it first performs access permission checks based on the identity identifier and data object identifier contained in the data access request. If the check passes, it queries the data object in the middleware cache based on the data object identifier. If the query fails, it identifies sensitive fields in the data object read from the container management tool and performs desensitization processing on the identified sensitive fields to obtain desensitized fields. The target data object containing the desensitized fields is then configured in the container encapsulation unit. Thus, by deploying the data access middleware, it processes data access requests from the container encapsulation unit. During processing, access permission checks enable dynamic access to data objects, improving the processing flexibility of the data access middleware. Furthermore, a middleware cache is introduced, so that the original data object is read from the container management tool only if a data object query in the middleware cache fails, reducing the number of accesses to the original data object in the container management tool and improving the efficiency of data object queries. In the event of a query failure, real-time desensitization processing of sensitive fields in the data object ensures the real-time nature and accuracy of the desensitized fields.

[0024] Reference Figure 2 The data processing method provided in this embodiment can be applied to a data access middleware, which is deployed between a container encapsulation unit and a container management tool, specifically including steps S202 to S208.

[0025] Step S202: Perform access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit.

[0026] In this embodiment, the container management tool includes tools for automating the deployment, scaling, and management of containerized applications, such as a Kubernetes cluster management tool; the container packaging unit includes deployable and manageable units within the container management tool, and the container packaging unit can represent a collection of one or more containers. Containers in the same collection share storage resources and network namespaces and are scheduled and managed as a whole; for example, the container packaging unit can be a pod in a Kubernetes cluster management tool; furthermore, the container packaging unit can also act as a user; and the container management tool can act as a data provider.

[0027] In practical applications, pods can access various types of data in Kubernetes according to pre-configured settings. In this embodiment, the data access request includes requests sent by the pod to Kubernetes during the process of requesting data access. Optionally, the data access request includes at least one of the following identifiers: a data object identifier and an identity identifier. In this embodiment, the data access request can be a pod request. The identity identifier includes an identifier representing the pod's identity; for example, a UID (Unique Identifier, an immutable identifier used to track and identify pods) or a service account. Specifically, access permissions are determined based on the identity identifier. In this embodiment, the data object includes stored data; the data object identifier includes an identifier that identifies the uniqueness of the data object.

[0028] In specific implementation, the container encapsulation unit requests access to data objects from the container management tool. In this embodiment, the configured data access middleware obtains the data access request from the container encapsulation unit to the data objects in the container management tool. To ensure the security of the data objects and avoid data object leakage caused by configuring data objects to abnormal container encapsulation units (i.e., container encapsulation units not in the container management tool), in this embodiment, after obtaining the data access request, the container encapsulation unit first performs admission detection based on the data access request. In an optional implementation provided in this embodiment, the admission detection of the container encapsulation unit is performed in the following manner:

[0029] Read the unit identifier of at least one container encapsulation unit in the container management tool;

[0030] Based on the unit identifier and the request unit identifier contained in the data access request, detect whether the container encapsulation unit is the admission encapsulation unit of the container management tool;

[0031] If so, proceed to step S202, and perform access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit;

[0032] If not, the data access request will be intercepted.

[0033] Specifically, during the access control process, it checks whether the container encapsulation unit submitting the data access request is a container encapsulation unit in the container management tool. If it is, the access control is deemed to have passed; otherwise, the access control is deemed to have failed.

[0034] In the specific execution process, after the access detection is passed, access permission detection is performed. To improve the effectiveness of access permission detection, in an optional implementation method provided in this embodiment, the process of performing access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit is implemented in the following way:

[0035] Based on the data object identifier, read the access permission identity of each data object in at least one data object requested for access;

[0036] Based on the identity identifier and the access identity, detect whether the container encapsulation unit meets the access conditions of each data object;

[0037] If the container encapsulation unit meets the access conditions of each data object, the access permission detection result is determined to be a successful detection;

[0038] If the container encapsulation unit does not meet the access conditions of any data object, the access permission detection result is determined to be a failed detection.

[0039] Specifically, during the access permission detection process, the container encapsulation unit performs access permission detection on each data object requested for access. If the container encapsulation unit passes the access permission detection on each data object, it is determined that the access permission detection of the container encapsulation unit or the data access request has passed.

[0040] For example, if pod1 submitting the data access request has a second-level identity (where the first-level identity has a higher permission level than the second-level identity, and so on), and the data objects to be accessed in the data access request include secret1 and secret2, where secret1 has a second-level admission identity and secret2 has a third-level admission identity, then pod1, with its second-level identity, has an admission identity that is higher than or equal to the admission identities of secret1 and secret2. In this case, the access permission check result for pod1's data access request is "passed".

[0041] For example, if pod2 submits a data access request with a second-level identity, and the data objects to be accessed in the data access request include secret3 and secret4, where secret3 has a first-level admission identity and secret4 has a second-level admission identity, then since pod2's second-level identity is lower than secret3's admission identity, the access permission check result for pod2's data access request will be a failed check, and pod2's data access request will be blocked.

[0042] Step S204: If the detection passes, perform a data object query in the middleware cache of the data access middleware based on the data object identifier.

[0043] The data access middleware includes middleware configured between the container packaging unit and the container management tool for processing data access requests from the container packaging unit to the container management tool. Optionally, the data access middleware is configured with a middleware cache.

[0044] In specific implementation, if the access permission check based on the identity identifier and data object identifier contained in the data access request passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier. In this embodiment, by configuring the middleware cache of the data access middleware to store de-identified data objects with high access frequency and / or de-identified data objects whose access time is less than the current time of other data objects, the data object is queried in the middleware cache of the data access middleware when the access permission check passes, thus avoiding the impact on the efficiency of data acquisition by directly reading the original data object from the container management tool and then performing de-identification processing. It should be noted that the anonymized data objects stored in the middleware cache can be cached data objects. By storing recently accessed and frequently accessed cached data objects, the middleware cache ensures, from a time perspective, that the stored cached data objects are obtained by anonymizing them based on the new anonymization strategy, avoiding dependence on persistent cached data objects, reducing the risk of data leakage, and ensuring the real-time performance and accuracy of the data. From an access frequency perspective, it prioritizes storing cached data objects with high access frequency, effectively reducing the access frequency to the original data objects (data objects in the container management tool), and improving the response speed and processing capacity of data access requests under high concurrency.

[0045] In the specific execution process, data object queries are performed in the middleware cache of the data access middleware based on the data object identifier. Besides querying data objects in the middleware cache based solely on the data object identifier, container encapsulation units with different access permissions—that is, container encapsulation units with different identities—can access different sensitive fields within the data object according to their access permissions. Therefore, data object queries can also be performed in the middleware cache of the data access middleware based on the data object identifier and the access permissions granted to the data object by the container encapsulation unit. Optionally, the access permissions granted to different data objects by container encapsulation units with different identities can be pre-configured; this embodiment does not impose any limitations on this.

[0046] For example, the access permission for secret1 is a level 2 identity, pre-configured so that level 1 identities can access 50% of the sensitive fields in secret1, while level 2 identities cannot access the sensitive fields in secret1; as another example, the access permission for secret2 is a level 3 identity, pre-configured so that level 1 identities can access all the sensitive fields in secret2, level 2 identities can access 50% of the sensitive fields in secret2, while level 3 identities cannot access the sensitive fields in secret2.

[0047] In this scenario, the cached data object stored in the middleware cache, taking `secret1` as an example, can be a cached data object of `secret1` where 50% of the sensitive fields have been anonymized and 50% have not. It is associated with a first-level identity and can be queried in the middleware cache based on both access permissions (identity identifier) ​​and data object identifier. That is, during the process of querying data objects in the middleware cache of the data access middleware based on access permissions and data object identifier, one can first query candidate cached data objects in the middleware cache based on the data object identifier; then, based on the access permissions, query the cached data object from among the candidate cached data objects.

[0048] Based on the data object identifier, the data object is queried in the middleware cache of the data access middleware. If the query is successful, that is, the cached data object is found in the middleware cache, the cached data object obtained from the middleware cache is optionally configured in the container encapsulation unit.

[0049] In addition to directly querying data objects in the middleware cache based on access permissions and data object identifiers as described above, in this embodiment, if a cached data object is obtained in the middleware cache, the cached data object can be checked based on the access permissions of the container encapsulation unit. If the check passes, the cached data object is then configured in the container encapsulation unit; if the check fails, the query is determined to have failed.

[0050] In the process of detecting cached data based on access permissions, on the one hand, the access percentage corresponding to the identity identifier can be used as the access permission. Here, the access percentage determined based on the identity identifier can be used as the access permission to detect whether the proportion of de-identified fields in the cached data object among the sensitive fields meets the access permission. If yes, the detection is considered passed; otherwise, the detection is considered failed. On the other hand, to further improve the accuracy of the detection, sensitive fields of the data object can be identified based on access permissions for detection. Here, the sensitive field identifier determined based on the identity identifier can be used as the access permission. In one optional implementation provided in this embodiment, the data object is first read by the container management tool based on the data object identifier, and sensitive fields of the data object are identified based on the access permissions of the container encapsulation unit to obtain the sensitive field identifier. Then, it is detected whether the sensitive field identifier is consistent with the de-identified field identifier in the cached data object. If yes, the detection is considered passed; otherwise, the detection is considered failed. The association between the sensitive field identifier and the identity identifier of the data object can be pre-configured, and then the sensitive field identifier can be identified based on the identity identifier. In addition, other methods can be used to identify sensitive field identifiers based on the identity identifier, which is not limited in this embodiment.

[0051] It should be noted that if the cached data object corresponding to the data object identifier is not found in the middleware cache, then the following step S206 is executed.

[0052] Step S206: If the query fails, read the data object from the container management tool based on the data object identifier, and identify sensitive fields of the data object.

[0053] In the steps described above, after querying the data object in the middleware cache of the data access middleware based on the data object identifier, in this step, if the query fails, the data object is read from the container management tool based on the data object identifier, and sensitive fields are identified within the data object. These sensitive fields include, for example, passwords and certificates.

[0054] In the actual execution process, the data object is read from the tool cache of the container management tool based on the data object identifier, and sensitive fields are identified on the data object. In the process of sensitive field identification, the sensitive fields can be obtained by inputting the data object into a pre-configured sensitive field identification engine.

[0055] Furthermore, after a data object is read from the tool cache of the container management tool based on its data object identifier, subsequent processing can be determined based on access permissions. For example, if the access permission of the container encapsulation unit is plaintext access (i.e., it can view all sensitive fields of the data object), the data object is configured in the container encapsulation unit. If the access permission of the container encapsulation unit is encrypted access, sensitive fields of the data object can be identified. During the process of identifying sensitive fields of the data object, sensitive fields can be identified based on access permissions. In the specific process of identifying sensitive fields of the data object based on access permissions, sensitive fields can be identified according to the access percentage corresponding to the access permission and / or the pre-configured sensitive field identifiers. For example, if the access percentage is 50% and secret1 is "password: 123456, certificate: abcdef", then "123" and "abc" are identified as sensitive fields according to the access percentage of 50% and the sensitive field identifiers "password, certificate".

[0056] Step S208: Desensitize the identified sensitive fields to obtain desensitized fields, and configure the target data object containing the desensitized fields in the container encapsulation unit.

[0057] In the above steps, after reading the data object based on the data object identifier and identifying the sensitive fields of the data object in the container management tool, in this step, the sensitive fields are de-identified to obtain the de-identified fields, and the target data object containing the de-identified fields is configured in the container encapsulation unit.

[0058] The target data object includes the data object after replacing the sensitive fields in the data object with the corresponding desensitized fields.

[0059] In practical implementation, to improve the flexibility of the desensitization process, in one optional implementation method provided in this embodiment, the following operations are performed during the process of desensitizing the identified sensitive fields to obtain the desensitized fields:

[0060] Based on the data category of the sensitive field, read the desensitization processing strategy for the sensitive field;

[0061] The sensitive fields are desensitized according to the desensitization strategy to obtain the desensitized fields.

[0062] Specifically, different desensitization strategies can be flexibly configured for different data categories. Sensitive fields are desensitized according to the desensitization strategy corresponding to the data category to which the sensitive field belongs, and the desensitized fields are obtained.

[0063] After obtaining the de-identified fields, update the de-identified fields to the data object to obtain the target data object, and configure the target data object in the container encapsulation unit.

[0064] Using the previous example, "123" and "abc" are sensitive fields. "123" is a number, and the pre-configured desensitization strategy for sensitive fields of the number category is "convert numbers to *". Therefore, "123" is desensitized according to this strategy to obtain "***". "abc" is a letter, and the pre-configured desensitization strategy for sensitive fields of the letter category is "convert numbers to #". Therefore, "abc" is desensitized according to this strategy to obtain "###". The desensitized fields are updated to the data object, and the target data object is obtained as "Password: ***456, Certificate: ###def".

[0065] For example, without introducing access permissions during the process of identifying sensitive fields, the sensitive fields of secret1 "password is: 123456, certificate is abcdef" are identified as "123456" and "abcdef". The pre-configured corresponding desensitization policy is "convert some characters in numbers or letters to *". Then, according to this desensitization policy, "123456" and "abcdef" are desensitized respectively, and the desensitized fields are "1*34**" and "ab***f". The desensitized fields are then updated to secret1, and the target secret1 is "password is: 1*34**, certificate is ab***f".

[0066] It should be noted that the process of identifying sensitive fields in the data object in step S206 and de-identifying the identified sensitive fields in step S208 can be executed by the de-identification processing engine. Specifically, after reading the data object based on the data object identifier in the container management tool, either the data object or both the data object and access permissions can be input into the de-identification processing engine for data de-identification processing to obtain the target data object. Specifically, the de-identification processing engine can perform data de-identification processing through the sensitive field identification and de-identification processing methods provided above, which will not be elaborated further in this embodiment. It should also be noted that the de-identification processing engine can be configured according to environmental requirements and actual application requirements, which is not limited in this embodiment.

[0067] To improve the effectiveness and flexibility of the data access middleware's management of target data objects, in one optional implementation of this embodiment, after configuring the target data object in the container encapsulation unit, the target data object can also be stored in the middleware cache based on the data object identifier. Specifically, to avoid the situation where the number of cacheable data objects in the middleware cache is limited, preventing the target data object from being stored in the middleware cache, and to ensure that the cached data objects stored in the middleware cache meet the criteria of high access frequency and / or access time less than other data objects from the current time, in one optional implementation of this embodiment, the following operations are performed during the process of storing the target data object in the middleware cache:

[0068] Calculate the number of data objects cached in the middleware cache;

[0069] If the number of data objects in the cached data object is equal to a preset threshold, the historical access count of the data object is read.

[0070] Based on the historical access count, detect whether the target data object meets the caching conditions of the middleware cache;

[0071] If so, delete the target cache data object from the middleware cache and store the target data object in the middleware cache;

[0072] If not, no action needs to be taken.

[0073] Specifically, during the process of storing the target data object in the middleware cache, it is first checked whether the number of cached data objects in the middleware cache has reached a preset threshold. If not, the target data object is stored in the middleware cache based on the data object identifier. If so, the target cached data object can be directly deleted from the middleware cache and stored in the middleware cache. In addition, it can also be checked whether the target data object meets the caching conditions of the middleware cache. If the caching conditions are met, the target cached data object is deleted from the middleware cache and stored in the middleware cache.

[0074] Optionally, the caching condition may be that the historical access count of the target data object is greater than a threshold, or the caching condition may be configured from other dimensions according to the actual configuration. This embodiment does not limit this. The target cached data object includes cached data objects determined from the middleware cache that are to be deleted.

[0075] To ensure the validity of cached data objects stored in the middleware cache and to effectively reduce direct access to the original data objects in the container management tool through the middleware cache, in an optional implementation of this embodiment, the target cache object is determined in the following manner:

[0076] (1) Calculate the access index of each cached data object based on the access parameters of each cached data object in the middleware cache;

[0077] In the specific execution process, the access metrics of each cached data object can be calculated from at least one of the two dimensions: access interval duration and access frequency. In an optional implementation provided in this embodiment, the process of calculating the access metrics of each cached data object based on its access parameters can be implemented in the following way:

[0078] Read the target historical access requests for each cached data object, and read the historical access time in the target historical access requests;

[0079] Based on the historical access time and current time of each cached data object, calculate the access interval duration of each cached data object;

[0080] And / or,

[0081] The access frequency of each cached data object is calculated based on the number of historical accesses of each cached data object within the historical time interval.

[0082] Based on the access interval and / or access frequency of each cached data object, calculate the access index of each cached data object.

[0083] Optionally, the target historical access request includes the last data access request for the cached data object; the historical access time includes the last access time of the cached data object.

[0084] Specifically, on the one hand, the access interval of each cached data object is calculated based on the historical access time and the current time; on the other hand, the access frequency of each cached data object is calculated based on the historical access count within the historical time interval, and the access metrics of each cached data object are calculated based on the access interval and / or access frequency.

[0085] Taking three cached data objects as an example, the access interval duration between the last access time of cached data object 1 and the current time is t1, the historical access count within the past T time is c1, the access interval duration between the last access time of cached data object 2 and the current time is t2, the historical access count within the past T time is c2, the access interval duration between the last access time of cached data object 3 and the current time is t3, and the historical access count within the past T time is c3. Then, the access metric of cached data object 1 is calculated as , the access metric of cached data object 2 is , and the access metric of cached data object 3 is . Among them, and are the preconfigured duration weight and frequency weight.

[0086] It should be noted that if the access metric is determined only by the access interval duration or the access frequency, then the access interval duration or the access frequency can be used as the access metric.

[0087] (2) Ascendingly sort at least one cached data object based on the access metric, and determine the cached data object in the first position in the sorting result as the target cached data object.

[0088] After calculating the access metrics of each cached data object, ascendingly sort at least one cached data object based on the access metric, and determine the cached data object in the first position in the sorting result as the target cached data object.

[0089] Continuing with the above example, if m2 < m3 < m1 is calculated, then the cached data object 2 corresponding to m2 is determined as the target cached data object.

[0090] To further ensure the validity of the cached data objects stored in the middleware cache, and to avoid the data objects stored in the tool cache of the container management tool being updated while the cached data objects in the middleware cache are not updated in a timely manner, resulting in incorrect target data objects configured in the container encapsulation unit and affecting the configuration experience. In an optional implementation manner provided in this embodiment, taking the update of the target data object as an example, the update process of the cached data objects in the middleware cache is specifically described as follows:

[0091] Based on the data object identifier, perform an update detection on the data object in the tool cache of the container management tool;

[0092] If it is detected that the data object in the tool cache is updated, read the updated data object in the tool cache;

[0093] The updated data object is input into the desensitization processing engine to desensitize the sensitive fields in the updated data object, thereby obtaining the target updated data object;

[0094] Based on the data object identifier, the target data object in the middleware cache is updated to the target updated data object.

[0095] Specifically, update detection is performed on the data objects in the tool cache of the container management tool. If an update is detected in the tool cache, the updated data object is read from the tool cache, and the updated object is input into the desensitization processing engine to desensitize the sensitive fields in the updated data object to obtain the target updated data object. Finally, the target data object in the middleware cache is updated to the target data object.

[0096] In other words, if it is detected that the data object corresponding to any cached data object stored in the middleware cache in the tool cache has been updated, the corresponding cached data object in the middleware cache will be updated based on the updated data object in the tool cache. In addition to updating the corresponding cached data object in the middleware cache based on the updated data object in the tool cache, the corresponding cached data object in the middleware cache can also be deleted or invalidated if it is detected that the data object corresponding to any cached data object stored in the middleware cache in the tool cache has been updated.

[0097] In summary, the data processing method provided in this embodiment, deployed in the data access middleware between the container encapsulation unit and the container management tool, first performs access verification on the container encapsulation unit submitting the data access request during the data processing process. If the access verification passes, access permission detection is performed based on the identity identifier and data object identifier contained in the data access request. Thus, after obtaining the data access request, the access permission of the container encapsulation unit is dynamically evaluated. This not only dynamically adjusts the access permissions of different container encapsulation units based on the identity identifier of the container encapsulation unit and the data access request, but also responds in real time to environmental changes and access policy updates. This allows access policies, i.e., access conditions, to be configured or adjusted for different data objects, thereby improving the flexibility and security of data access.

[0098] Secondly, if the access permission check passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is then read from the container management tool based on the data object identifier. In this way, by configuring the middleware cache to store data objects whose access time is close to the current time and / or whose access frequency is high, the reading of the original data objects in the container management tool is reduced. The middleware cache also stores commonly used de-identified data objects to improve the response speed and processing capacity of data access requests, thereby improving the performance in high-concurrency access scenarios.

[0099] Finally, sensitive fields are identified in the data objects, and the identified sensitive fields are de-identified to obtain de-identified fields. The target data objects containing the de-identified fields are then configured in the container encapsulation unit. In this way, through real-time de-identification processing, the de-identification strategy is dynamically applied to the data objects the moment they are accessed, rather than relying on pre-processed or persistently stored de-identified data objects. This reduces the risk of data object leakage and ensures the real-time performance and accuracy of the data.

[0100] This not only improves the security and flexibility of data objects, but also enhances the efficiency and flexibility of managing and protecting sensitive information in the Kubernetes environment.

[0101] The following example illustrates the application of a data processing method provided in this embodiment in a secret processing scenario within a Kubernetes environment. Figure 3 and Figure 4 For further explanation of the data processing method provided in this embodiment, please refer to [link / reference]. Figure 4 This is a data processing method applied to secret processing scenarios in a Kubernetes environment, which includes the following steps.

[0102] like Figure 3 As shown, in the Kubernetes environment, in the context of secret processing, the data access middleware between the Kubernetes secret storage and the pod, after receiving a pod's secret access request, first performs admission verification and access permission checks on the secret request through the dynamic access control module. If the admission verification and access permission checks pass, the middleware cache queries the secret. If the query is successful, the retrieved secret is output; if the query fails, the secret is read from the Kubernetes environment's secrets cache, and the sensitive fields in the secret are de-identified through the real-time de-identification module to obtain the de-identified fields. The target secret containing the de-identified fields is then returned to the requesting pod, and the target secret is stored in the middleware cache.

[0103] Step S402: Obtain the data access request from the pod and perform Kubernetes admission verification on the pod.

[0104] Step S404: If the verification is successful, perform access permission checks based on the identity identifier and data object identifier contained in the data access request.

[0105] Step S406: If the detection passes, perform a data object query in the middleware cache of the data access middleware based on the data object identifier.

[0106] If the query is successful, the retrieved data object will be returned to the pod.

[0107] In addition, step S406 can be replaced by, if the detection passes, querying the data object in the middleware cache of the data access middleware based on the data object identifier and access permissions.

[0108] Step S408: If the query fails, read the data object from the Kubernetes data object cache based on the data object identifier.

[0109] In addition, step S408 can be replaced by reading the data object from the Kubernetes data object cache based on the data object identifier and access permissions if the query fails.

[0110] Step S410: Identify sensitive fields in the data object, obtain sensitive fields, and perform desensitization processing on the sensitive fields according to the data desensitization strategy corresponding to the data category to which the sensitive fields belong, to obtain desensitized fields.

[0111] Step S412: Update the de-identified fields to the data object to obtain the target data object.

[0112] In addition, steps S410 to S412 can be replaced by inputting the data object into the desensitization processing engine for desensitization processing to obtain the target data object.

[0113] Step S414: Return the target data object to the pod.

[0114] Optionally, it also includes storing the target data object in the middleware cache.

[0115] It should be noted that any one or any combination of steps S402 to S414 can be replaced by the corresponding technical means provided in steps S202 to S208 as needed for implementation and deployment, which will not be elaborated here.

[0116] This specification provides one or more embodiments of a data processing device as follows:

[0117] In the above embodiments, a data processing method is provided, and correspondingly, a data processing device is also provided, which will be described below with reference to the accompanying drawings.

[0118] Reference Figure 5 This illustration shows a schematic diagram of an embodiment of a data processing device provided in this embodiment.

[0119] Since the apparatus embodiments correspond to the method embodiments, the descriptions are relatively simple. For relevant parts, please refer to the corresponding descriptions of the method embodiments provided above. The apparatus embodiments described below are merely illustrative.

[0120] This embodiment provides a data processing apparatus that runs on a data access middleware, the data access middleware being deployed between a container packaging unit and a container management tool. The apparatus includes:

[0121] The access permission detection module 502 is configured to perform access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit.

[0122] If the detection passes, the data object query module 504 is run. The data object query module 504 is configured to perform a data object query in the middleware cache of the data access middleware based on the data object identifier.

[0123] If the query fails, the sensitive field identification module 506 is run. The sensitive field identification module 506 is configured to read the data object from the container management tool based on the data object identifier and perform sensitive field identification on the data object.

[0124] The desensitization processing module 508 is configured to perform desensitization processing on the identified sensitive fields to obtain desensitized fields, so as to configure the target data object containing the desensitized fields in the container encapsulation unit.

[0125] This specification provides one or more embodiments of a data processing device as follows:

[0126] Corresponding to the data processing method described above, based on the same technical concept, one or more embodiments of this specification also provide a data processing apparatus for performing the data processing method provided above. Figure 6 This is a schematic diagram of the structure of a data processing device provided for one or more embodiments of this specification.

[0127] This embodiment provides a data processing device, including:

[0128] like Figure 6 As shown, data processing devices can vary significantly due to differences in configuration or performance. They may include one or more processors 601 and memory 602, with memory 602 storing one or more application programs or data. Memory 602 can be temporary or persistent storage. The application programs stored in memory 602 may include one or more modules (not shown), each module including a series of computer-executable instructions from the data processing device. Furthermore, processor 601 may be configured to communicate with memory 602, executing the series of computer-executable instructions stored in memory 602 on the data processing device. The data processing device may also include one or more power supplies 603, one or more wired or wireless network interfaces 604, one or more input / output interfaces 605, one or more keyboards 606, etc.

[0129] In one specific embodiment, the data processing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions for the data processing device, and is configured to be executed by one or more processors. The one or more programs include computer-executable instructions for performing the following:

[0130] Access permissions are checked based on the identity and data object identifiers contained in the data access requests of the container encapsulation unit.

[0131] If the detection passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier;

[0132] If the query fails, the data object is read from the container management tool based on the data object identifier, and sensitive fields of the data object are identified.

[0133] The identified sensitive fields are de-identified to obtain de-identified fields, and the target data object containing the de-identified fields is configured in the container encapsulation unit.

[0134] This specification provides one or more embodiments of a computer-readable storage medium as follows:

[0135] Corresponding to the data processing method described above, and based on the same technical concept, one or more embodiments of this specification also provide a computer-readable storage medium.

[0136] The computer-readable storage medium provided in this embodiment is used to store computer-executable instructions, which, when executed, implement the following process:

[0137] Access permissions are checked based on the identity and data object identifiers contained in the data access requests of the container encapsulation unit.

[0138] If the detection passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier;

[0139] If the query fails, the data object is read from the container management tool based on the data object identifier, and sensitive fields of the data object are identified.

[0140] The identified sensitive fields are de-identified to obtain de-identified fields, and the target data object containing the de-identified fields is configured in the container encapsulation unit.

[0141] It should be noted that the embodiments of computer-readable storage media in this specification and the embodiments of data processing methods in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can be referred to the implementation of the corresponding method described above, and the repeated parts will not be described again.

[0142] The various embodiments in this specification are described in a progressive manner. For the same or similar parts between the various embodiments, please refer to each other. Each embodiment focuses on describing the differences from other embodiments. For example, the device embodiment, equipment embodiment, and readable storage medium embodiment are all similar to the method embodiment, so the description is relatively simple. For reading the relevant content of the device embodiment, equipment embodiment, and readable storage medium embodiment, please refer to the description of the method embodiment.

[0143] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0144] In the 1930s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many improvements to the methodology today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that an improvement to the methodology cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0145] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0146] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by software with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0147] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing the embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0148] Those skilled in the art will understand that one or more embodiments of this specification can be provided as methods, systems, or computer program software. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of computer program software embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0149] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program software according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0150] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0151] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0152] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0153] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0154] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0155] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0156] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0157] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0158] The above description is merely an embodiment of this document and is not intended to limit the scope of this document. Various modifications and variations can be made to this document by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this document should be included within the scope of the claims of this document.

Claims

1. A data processing method applied to a data access middleware, the data access middleware being deployed between a container encapsulation unit and a container management tool, the method comprising: If the access permission check based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read from the container management tool based on the data object identifier. If the access permission of the container encapsulation unit is plaintext access permission, the data object is configured in the container encapsulation unit.

2. The data processing method according to claim 1 further includes: Read the unit identifier of at least one container encapsulation unit in the container management tool; Based on the unit identifier and the request unit identifier contained in the data access request, detect whether the container encapsulation unit is the admission encapsulation unit of the container management tool; If so, perform the access permission detection step based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit.

3. The data processing method according to claim 1, wherein the access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit includes: Based on the data object identifier, read the access permission identity of each data object in at least one data object requested for access; Based on the identity identifier and the access identity, detect whether the container encapsulation unit meets the access conditions of each data object; If the container encapsulation unit meets the access conditions of each data object, the access permission detection result is determined to be a successful detection.

4. The data processing method according to claim 1, further comprising, after the data object read operation is executed by the container management tool based on the data object identifier: If the access permission of the container encapsulation unit is encrypted access permission, then the sensitive field identification is performed on the data object; The identified sensitive fields are de-identified to obtain de-identified fields, and the target data object containing the de-identified fields is configured in the container encapsulation unit.

5. The data processing method according to claim 4, wherein the step of de-identifying the identified sensitive fields to obtain de-identified fields includes: Based on the data category of the sensitive field, read the desensitization processing strategy for the sensitive field; The sensitive fields are desensitized according to the desensitization strategy to obtain the desensitized fields.

6. The data processing method according to claim 1, if the execution result of the data object query operation based on the data object identifier in the middleware cache of the data access middleware is a successful query, then the following operation is performed: The cached data object obtained from the middleware cache is configured in the container encapsulation unit.

7. The data processing method according to claim 6, wherein configuring the cached data object obtained by querying the middleware cache before the container encapsulation unit operation is executed, further includes: Based on the data object identifier, the container management tool reads the data object and identifies sensitive fields of the data object based on the access permissions of the container encapsulation unit to obtain sensitive field identifiers; Check whether the sensitive field identifier is consistent with the de-identified field identifier in the cached data object; If so, perform the operation of configuring the cached data object obtained from the middleware cache into the container encapsulation unit.

8. The data processing method according to claim 1, further comprising, after the operation of configuring the data object in the container encapsulation unit is executed: Based on the data object identifier, the data object is stored in the middleware cache.

9. The data processing method according to claim 8, wherein storing the data object in the middleware cache based on the data object identifier comprises: Calculate the number of data objects cached in the middleware cache; If the number of data objects in the cached data object is equal to a preset threshold, the historical access count of the data object is read. Based on the historical access count, detect whether the data object meets the caching conditions of the middleware cache; If so, delete the target cached data object from the middleware cache and store the data object in the middleware cache.

10. The data processing method according to claim 9, wherein the target cached data object is determined in the following manner: Calculate the access index of each cached data object based on the access parameters of each cached data object in the middleware cache; Based on the access metrics, at least one cached data object is sorted in ascending order, and the first cached data object in the sorting result is determined as the target cached data object.

11. The data processing method according to claim 10, wherein calculating the access index of each cached data object based on the access parameters of each cached data object in the middleware cache includes: Read the target historical access requests for each cached data object, and read the historical access time in the target historical access requests; Based on the historical access time and current time of each cached data object, calculate the access interval duration of each cached data object; And / or, The access frequency of each cached data object is calculated based on the number of historical accesses of each cached data object within the historical time interval. Based on the access interval and / or access frequency of each cached data object, calculate the access index of each cached data object.

12. The data processing method according to claim 8, further comprising: Based on the data object identifier, update detection is performed on the data object in the tool cache of the container management tool; If an update to the data object in the tool cache is detected, the updated data object is read from the tool cache; The updated data object is input into the desensitization processing engine to desensitize the sensitive fields in the updated data object, thereby obtaining the target updated data object; Based on the data object identifier, the data object in the middleware cache is updated to the target updated data object.

13. A data processing apparatus, operating on a data access middleware, the data access middleware being deployed between a container packaging unit and a container management tool, the apparatus comprising: The data object query module is configured to perform a data object query in the middleware cache of the data access middleware based on the data object identifier, if the access permission detection based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit passes; If the query fails, the data object is read from the container management tool based on the data object identifier. If the access permission of the container encapsulation unit is plaintext access permission, the data object is configured in the container encapsulation unit.

14. A data processing apparatus, comprising: processor; And a memory configured to store computer-executable instructions, which the processor executes to implement the following process: If the access permission check based on the identity identifier and data object identifier contained in the data access request of the container encapsulation unit passes, the data object is queried in the middleware cache of the data access middleware based on the data object identifier. If the query fails, the data object is read from the container management tool based on the data object identifier. If the access permission of the container encapsulation unit is plaintext access permission, the data object is configured in the container encapsulation unit.

15. A computer-readable storage medium for storing computer-executable instructions that, when executed, implement the steps of the method of claim 1.

Images