Configuration data processing method, device, electronic device, storage medium and program product

Abstract

The present application provides a configuration data processing method, device, electronic device, storage medium and program product. The method includes: in response to the start of a target application, obtaining first configuration data corresponding to the target application, the first configuration data including a target placeholder; based on the mapping relationship between the placeholder and the encrypted data, determining the target encrypted data corresponding to the target placeholder; decrypting the target encrypted data to obtain target data, the target data being sensitive data in the configuration data of the application; replacing the target placeholder with the target data in the first configuration data to obtain target configuration data, and running the target application based on the target configuration data. The method of the present application can improve the security of sensitive data in the configuration data.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a configuration data processing method, device, electronic device, storage medium and program product. Background Art

[0002] The configuration data of an application usually contains sensitive information, such as username and password for database connection, authentication key, etc. If this information in the configuration data is not managed properly and leaked to the outside, it will cause serious production safety accidents.

[0003] In some configuration data processing methods, sensitive information is stored directly in the configuration data. This method has extremely low security and can easily be obtained by attackers. In other configuration data processing methods, sensitive information is protected by setting environment variables, but this method is inconvenient to manage and audit, and it is difficult to track the change history. Summary of the invention

[0004] The present application provides a configuration data processing method, device, electronic device, storage medium and program product to solve the problem that sensitive data in configuration data is easily leaked.

[0005] In a first aspect, the present application provides a configuration data processing method, comprising:

[0006] In response to starting a target application, acquiring first configuration data corresponding to the target application, wherein the first configuration data includes a target placeholder;

[0007] Determine the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data;

[0008] Decrypting the target encrypted data to obtain target data, where the target data is sensitive data in the configuration data of the application;

[0009] The target placeholder is replaced with the target data in the first configuration data to obtain target configuration data, and the target application is run based on the target configuration data.

[0010] Optionally, in the method described above, before acquiring the first configuration data corresponding to the target application in response to starting the target application, the method further includes:

[0011] generating a target placeholder based on a target encryption configuration request, wherein the target encryption configuration request is used to instruct encryption of target data in the configuration data of the target application, and different encryption configuration requests correspond to different placeholders;

[0012] Encrypting the target data based on the key corresponding to the target application to obtain the target encrypted data;

[0013] A mapping relationship between the target encrypted data and the target placeholder is established, and the target data is replaced with the target placeholder in the target configuration data of the target application.

[0014] Optionally, in the method as described above, decrypting the target encrypted data to obtain the target data includes:

[0015] Determine a target key corresponding to the target application, where different applications correspond to different keys;

[0016] The target encrypted data is decrypted based on the target key to determine the target data.

[0017] In one possible implementation, the method further includes:

[0018] Obtaining an update placeholder, and determining update encrypted data that has a mapping relationship with the update placeholder;

[0019] decrypting the updated encrypted data to obtain updated decrypted data;

[0020] Modifying the updated decrypted data to obtain modified updated decrypted data;

[0021] The modified update decrypted data is encrypted to obtain modified update encrypted data, and the mapping relationship between the update placeholder and the update encrypted data is updated to the mapping relationship between the modified update encrypted data and the update placeholder.

[0022] Optionally, in the above method, before determining the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data, the method further includes:

[0023] receiving encrypted data application information based on the encryption management module, the encrypted data application information is used to indicate a request to obtain the target encrypted data corresponding to the target placeholder, the encrypted data application information includes account information that issues the encrypted data application information;

[0024] Based on the encryption management module, authority matching is performed between the account information and preset account information, and the target encrypted data is obtained after the authority matching is successful.

[0025] Optionally, in the method as described above, running the target application based on the target configuration data includes:

[0026] Loading the target configuration data into a memory module;

[0027] Access the target configuration data in the memory module to run the target application.

[0028] In a second aspect, the present application provides a configuration data processing device, comprising:

[0029] A first data acquisition module, configured to acquire first configuration data corresponding to the target application in response to starting the target application, wherein the first configuration data includes a target placeholder;

[0030] An encrypted data acquisition module, used to determine the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data;

[0031] A decryption module, used to decrypt the target encrypted data to obtain target data, wherein the target data is sensitive data in the configuration data of the application;

[0032] A target data acquisition module is used to replace the target placeholder with the target data in the first configuration data to obtain target configuration data, and run the target application based on the target configuration data.

[0033] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0034] The memory stores computer-executable instructions;

[0035] The processor executes the computer-executable instructions stored in the memory to implement the method according to the first aspect.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to implement the method of the first aspect when executed by a processor.

[0037] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0038] The configuration data processing method, device, electronic device, storage medium and program product provided by the present application have a target placeholder in the first configuration data obtained when the target application is started. The target placeholder is used to replace the target data in the configuration data, that is, sensitive data. After the target application is started, the corresponding target encrypted data is determined by the target placeholder in the first configuration data, and the target encrypted data is decrypted to obtain the target data. The target data is replaced with the target placeholder in the first configuration data to obtain the target configuration data for running the target application. In this process, the sensitive data is replaced by the target placeholder and the sensitive data is encrypted, which can reduce the leakage of sensitive data in the configuration data of the target application and improve the security of the configuration data. Through the mapping relationship between the placeholder and the encrypted data, the encrypted data can be obtained to replace the placeholder when the application is started, so that the target application can be normally operated by replacing the obtained configuration data. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] Figure 1 is an implementation scenario diagram shown in an exemplary embodiment;

[0041] Figure 2 is a flow chart of a configuration data processing method shown in an exemplary embodiment;

[0042] Figure 3 is a structural diagram of a configuration data processing system shown in an exemplary embodiment;

[0043] Figure 4 is a flow chart of a configuration data processing method shown in another exemplary embodiment;

[0044] Figure 5 is a structural diagram of a configuration data processing device shown in an exemplary embodiment;

[0045] Figure 6 It is a block diagram of an electronic device shown in an exemplary embodiment.

[0046] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0047] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0048] It should be noted that the configuration data, sensitive data and other data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data understood and authorized by the relevant users or fully authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of the relevant data comply with the laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and comply with the principles of legality, legitimacy and necessity.

[0049] With the widespread application of microservice architecture, application configuration management has become increasingly complex, and configuration items often contain sensitive data, such as database connection usernames and passwords, authentication tokens (characters) and keys, etc. If this information is not encrypted or improperly managed and leaked to the outside, it may cause serious production safety accidents.

[0050] In some methods, configuration data is managed through hard coding, that is, sensitive data is directly stored in the code. This method has extremely low security and is easily obtained by attackers. Other configuration data management methods are implemented by setting environment variables. Although this method is relatively secure, it is inconvenient to manage and audit, and it is difficult to track the change history. There are also some methods that manage configuration data through centralized configuration management tools, such as Nacos (a configuration data management tool) and Apollo (a configuration data management tool). Although the tools provide centralized management functions, most tools use static encryption when processing sensitive information, and there is a risk of sensitive data leakage during the configuration update process.

[0051] The configuration data processing method, device, electronic device, storage medium and program product provided in this application are intended to solve the above technical problems in the prior art.

[0052] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0053] The configuration data processing method provided in this application can be implemented on any electronic device with data processing capabilities, or it can be a configuration data processing system. It should be noted that the configuration data processing system can be deployed separately on an electronic device in any environment (for example: deployed separately on an edge server in an edge environment), or it can be deployed entirely in a cloud environment, or it can be deployed in different environments in a distributed manner.

[0054] For example, the configuration data processing system can be logically divided into multiple parts, each with different functions. The various parts in the configuration data processing system can be deployed in any two or three of the electronic device (located on the user side, such as the client), the edge environment, and the cloud environment. The edge environment is an environment that includes a collection of edge electronic devices that are close to the electronic device. The edge electronic devices include: edge servers, edge stations with computing power, etc. The various parts of the configuration data processing system deployed in different environments or devices work together to realize the functions of the data processing platform.

[0055] It should be understood that this application does not make any restrictive division on which parts of the configuration data processing system are deployed and in what specific environment. In actual application, it can be adaptively deployed according to the computing power of the electronic device, the resource usage of the edge environment and the cloud environment, or the specific application requirements.

[0056] like Figure 1 It is an implementation scenario diagram shown in an exemplary embodiment. The configuration data processing system corresponding to the implementation scenario includes a client 10 and a server 11. The client 10 and the server 11 are connected via network communication.

[0057] The execution subject of the method of the embodiment of the present application is the server 11, and the client 10 can receive the startup information of the target application. The client 10 sends the startup information of the target application to the server 11 through the network. In response to the startup of the target application, the server 11 processes the configuration data, obtains the target configuration data, and runs the target application based on the target configuration data, and can feed back the running results to the client 10. The client 10 has a graphic user interface, and the running results of the target application can be displayed on the graphic user interface.

[0058] In some embodiments, after receiving the information of starting the target application, the server 11 obtains first configuration data corresponding to the target application in response to the start of the target application, the first configuration data including a target placeholder; based on the mapping relationship between the placeholder and the encrypted data, determines the target encrypted data corresponding to the target placeholder; decrypts the target encrypted data to obtain target data, the target data being sensitive data in the configuration data of the application; replaces the target placeholder with the target data in the first configuration data to obtain the target configuration data, and runs the target application based on the target configuration data.

[0059] It is understandable that the configuration data processing device can be set at Figure 1 In the server 11, but the example shown in this embodiment Figure 1 The implementation environment shown is only exemplary. In other embodiments, the configuration data processing method may also be applied to other implementation environments, and the configuration data processing device may also be set in other structures in other implementation environments, which is not specifically limited here.

[0060] In this embodiment, the client 10 is an electronic device on the user side, which can be a wired terminal with a visualization structure or a wireless terminal. In other embodiments, the terminal can be an electronic device with a visualization structure such as a mobile phone, a computer, a tablet, and a vehicle-mounted device.

[0061] The server 11 can be an edge environment and a cloud environment, such as a physical server, a server cluster, and a cloud server, etc., and no specific limitations are made here.

[0062] Figure 2 is a flowchart of a configuration data processing method shown in an exemplary embodiment, which is applied to Figure 1 The server 11 in Figure 2 As shown, the method includes steps S201 to S204, which are described in detail as follows:

[0063] S201. In response to starting a target application, obtain first configuration data corresponding to the target application, where the first configuration data includes a target placeholder.

[0064] In the embodiment of the present application, the target application may be any application program. When the target application is started, the configuration data of the target application is obtained to run the target application through the configuration data of the target application.

[0065] In one embodiment, when the target application is started, first configuration data corresponding to the target application can be obtained. The first configuration data includes a target placeholder. The position of the target placeholder in the first configuration data corresponds to the position of the sensitive data in the first configuration data.

[0066] In some embodiments, the number of target placeholders may be one or more, different target placeholders correspond to different characters or character strings, and different target placeholders correspond to different sensitive data.

[0067] In some embodiments, the target placeholder replaces the sensitive data in the target application.

[0068] In some embodiments, the server may be provided with an encryption management module, which generates a target placeholder corresponding to sensitive data in the configuration data of the target application.

[0069] In some embodiments, a configuration center may be set in the server, and the configuration center stores first configuration data corresponding to a target application. After the target application is started, the server obtains the first configuration data in the target center.

[0070] In some embodiments, the first configuration data may also be directly stored on the server, and when the target application is started, the first configuration data is obtained on the server.

[0071] S202: Determine target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data.

[0072] In some embodiments, a mapping relationship between placeholders and encrypted data is preset, so that the corresponding target encrypted data can be determined through the target placeholder.

[0073] In some embodiments, the mapping relationship between the placeholder and the encrypted data may be stored in the encryption management module, that is, the server may obtain the target encrypted data in the encryption management module.

[0074] In some embodiments, the server may automatically interact with the encryption management module through an extension point or an interceptor to obtain target encrypted data.

[0075] The encrypted data is data obtained by encrypting the sensitive data. Different target placeholders correspond to different target encrypted data, and different target encrypted data correspond to different types of sensitive data.

[0076] S203: decrypt the target encrypted data to obtain target data, where the target data is sensitive data in the configuration data of the application.

[0077] In some embodiments, the server may decrypt the target encrypted data to obtain target data, where the target data is the target placeholder that replaces the sensitive data in the configuration data of the target application.

[0078] In some embodiments, the key used for encryption or decryption of the target data can be pre-set, such as setting different keys for different users, or using the same key for one or more applications. The key can be a symmetric key or an asymmetric key, and there is no specific limitation here.

[0079] S204: Replace the target placeholder in the first configuration data with the target data to obtain the target configuration data, and run the target application based on the target configuration data.

[0080] In some embodiments, after the target data is determined, the target placeholder may be replaced with the target data in the first configuration data to obtain the target configuration data, which is the substantial configuration data of the target application.

[0081] In some embodiments, if there are multiple target placeholders, the corresponding target data are also multiple, and different target data may correspond to different target placeholders. Through the correspondence between the target placeholder and the target data, the target placeholder is replaced with the target data in the first configuration data to obtain the target configuration data.

[0082] In an embodiment of the present application, when the target application is started, a target placeholder exists in the first configuration data obtained, and the target placeholder is used to replace the target data in the configuration data, that is, sensitive data. After the target application is started, the corresponding target encrypted data is determined by the target placeholder in the first configuration data, and the target encrypted data is decrypted to obtain the target data, and the target data is replaced with the target placeholder in the first configuration data by the target data, so as to obtain the target configuration data for running the target application. In this process, the sensitive data is replaced by the target placeholder and the sensitive data is encrypted, so that the leakage of sensitive data in the configuration data of the target application can be reduced and the security of the configuration data can be improved. Through the mapping relationship between the placeholder and the encrypted data, when the application is started, the encrypted data can be obtained to replace the placeholder, so that the target application can be normally operated by replacing the obtained configuration data.

[0083] In some embodiments, Figure 3 As shown, a configuration data processing system is proposed, which may include a configuration center, an encryption management module and an encryption module. The configuration center, the encryption management module and the encryption module are arranged on the server side. The configuration center, the encryption management module and the encryption module realize the processing of configuration data. The configuration center can store the first configuration data of the target application. The encryption management module generates a target placeholder and stores the mapping relationship between the target placeholder and the target encrypted data.

[0084] In some embodiments, the configuration center is a system component that centrally manages and stores application configuration items, and can provide a unified interface for each application to read and update configurations, and usually supports multiple configuration formats. The configuration center can effectively manage the version control, dynamic update, and configuration management of distributed applications of configuration items. The configuration center stores the first configuration data, thereby ensuring the security of sensitive data in the configuration data of the target application. The configuration center works closely with the encryption client to achieve dynamic and imperceptible management of sensitive information.

[0085] In some embodiments, the encryption module is a component that runs with the target application. It can obtain first configuration data from the configuration center, and obtain corresponding target encryption data through the encryption management module to decrypt the target data to achieve imperceptible access, ensuring that the target application can use the encryption management function without modification.

[0086] In some embodiments, a method for generating first configuration data is also proposed: generating a target placeholder based on a target encryption configuration request, the target encryption configuration request is used to indicate that target data in the configuration data of the target application is encrypted, and different encryption configuration requests correspond to different placeholders; based on the key corresponding to the target application, the target data is encrypted to obtain target encrypted data; a mapping relationship between the target encrypted data and the target placeholder is established, and the target data is replaced with the target placeholder in the target configuration data of the target application.

[0087] In one embodiment, a target encryption configuration request may be initiated by a client, and the target encryption configuration request may reach a server, and the server generates a target placeholder.

[0088] In some embodiments, a target encryption configuration request may be initiated by a client, and the target encryption configuration request may reach a server, and the server may Figure 3 Generates a target placeholder for the encryption management module in .

[0089] In some embodiments, before generating the target placeholder, the encryption management module performs permission control and authentication on the target encryption configuration request, such as verifying the permission of the account information that initiates the target encryption configuration request. After the verification is successful, subsequent target placeholders are generated. In this way, changes in configuration data in the target application can be easily tracked and managed.

[0090] In some embodiments, the number of target encryption configuration requests may be multiple, and different target encryption configuration requests encrypt target data in the configuration data of the corresponding request target application.

[0091] The target placeholder is a unique identifier. Different encryption configuration requests correspond to different placeholders.

[0092] In some embodiments, after the target placeholder is generated, the target data may be encrypted.

[0093] In some embodiments, different applications correspond to different keys, so that the target data can be encrypted by the key corresponding to the target application to obtain target encrypted data, and the target encrypted data can be stored.

[0094] In some embodiments, the server Figure 3 The encryption management module in encrypts the target data to obtain target encrypted data.

[0095] In some embodiments, the encryption management module also stores the target encrypted data and the corresponding target placeholder, and establishes a mapping relationship between the target encrypted data and the target placeholder, so that after determining the target placeholder, the corresponding target encrypted data can be obtained.

[0096] In some embodiments, the target data in the configuration data is replaced with the target placeholder to obtain the replaced configuration data, such as the first configuration data shown above. The replaced configuration data can be stored in the configuration center, and the sensitive data in the configuration data is replaced with the target placeholder, which can reduce the leakage of sensitive data in the configuration data.

[0097] In some embodiments, other applications can also use the same method to replace sensitive data in the corresponding application with placeholders, encrypt the sensitive data, and obtain encrypted data. At the same time, the mapping relationship between the encrypted data and the placeholder can be written into the encryption management module to facilitate the subsequent application startup to determine the encrypted data corresponding to the placeholder in the configuration data after the application is replaced, so that the corresponding encrypted data can be decrypted and the corresponding placeholder can be replaced to obtain the complete configuration data of the application to run the application.

[0098] In some embodiments, a method for decrypting target encrypted data is also proposed: determining a target key corresponding to a target application, with different applications corresponding to different keys; decrypting the target encrypted data based on the target key to determine the target data.

[0099] In some embodiments, different keys can be set to correspond to different applications. For example, if a symmetric key is set, then for one application, the encrypted data corresponding to its different placeholders can be encrypted or decrypted by the symmetric key; if an asymmetric key is set, then the encrypted data corresponding to its different placeholders can be encrypted by the public key of the asymmetric key, and decrypted by the private key of the asymmetric key.

[0100] In one embodiment, if the target application needs to decrypt the target encrypted data, the target key corresponding to the target application can be obtained in the encryption management module, so that the target encrypted data can be decrypted based on the target key to determine the target data.

[0101] In an embodiment of the present application, each application corresponds to a different key, and the encryption and decryption information between different applications is isolated from each other, which can ensure that even if the key of one application is leaked, it will not affect the security of other applications, thereby further improving the security of sensitive data in the configuration data.

[0102] Figure 4 is a flowchart of a configuration data processing method shown in another exemplary embodiment, which is applied to Figure 1 The server 11 in Figure 4 As shown, the method includes steps S401 to S404, which are described in detail as follows:

[0103] S401: Acquire an update placeholder, and determine update encrypted data that has a mapping relationship with the update placeholder.

[0104] In this embodiment, the encrypted data in the encryption management module can be directly modified, that is, the sensitive data can be updated.

[0105] In some embodiments, an update placeholder corresponding to the sensitive data to be modified is determined, and the update encrypted data is determined based on a mapping relationship between the placeholder and the encrypted data.

[0106] S402: Decrypt the updated encrypted data to obtain updated decrypted data.

[0107] The encrypted update data is encrypted data, so that the application corresponding to the update placeholder can be determined and the key corresponding to the application can be obtained, so as to decrypt the updated encrypted data and obtain the updated decrypted data.

[0108] The updated decrypted data is the sensitive data that needs to be modified.

[0109] S403: modify the updated decrypted data to obtain modified updated decrypted data.

[0110] In some embodiments, the updated decrypted data is modified, such as deleting some data, adding some data, or updating some data, etc., which is not specifically limited here.

[0111] S404: Encrypt the modified update decrypted data to obtain modified update encrypted data, and update the mapping relationship between the update placeholder and the update encrypted data to the mapping relationship between the modified update encrypted data and the update placeholder.

[0112] In this embodiment, the modified updated decrypted data is the updated sensitive data, and the modified updated decrypted data is encrypted. To encrypt the updated sensitive data, the modified updated decrypted data may be encrypted by applying a corresponding key.

[0113] In some embodiments, the modified updated encrypted data replaces the updated encrypted data, and the mapping relationship between the update placeholder and the updated encrypted data is updated to the mapping relationship between the modified updated encrypted data and the update placeholder, so that the modified updated encrypted data is obtained when the corresponding encrypted data is subsequently obtained based on the update placeholder.

[0114] In an embodiment of the present application, based on the placeholder between the placeholder and the encrypted data, the data encrypted by the encrypted data can be directly modified. In this way, there is no need to modify the configuration data, and the encrypted data can be directly modified. After the subsequent application is started, the modified encrypted data is obtained, and the modified sensitive data is obtained by decrypting the modified encrypted data. The modified sensitive data replaces the corresponding placeholder, so that when the application is subsequently run, it is run based on the modified configuration data, ensuring that the application always uses the latest sensitive data.

[0115] In some embodiments, an authentication method is also proposed: based on the encryption management module, encrypted data application information is received, the encrypted data application information is used to indicate a request to obtain the target encrypted data corresponding to the target placeholder, and the encrypted data application information includes the account information that issues the encrypted data application information; based on the encryption management module, a permission match is performed between the account information and the preset account information, and the target encrypted data is obtained after the permission match is successful.

[0116] In some embodiments, the encrypted data application information may be automatically generated after the target application is started, and the encrypted data application information is used to indicate a request to obtain the target encrypted data corresponding to the target placeholder.

[0117] In some embodiments, the encrypted data application information includes the account information that issues the encrypted data application information, so that the encryption management module can perform permission matching based on the account, and only after the permission matching is successful can the target encrypted data be obtained.

[0118] In this embodiment, before obtaining the target encrypted data, permission matching is performed first, thereby improving the security of the target encrypted data.

[0119] In other embodiments, before the encryption management module obtains an encryption configuration request to generate a placeholder, such as a target encryption configuration request to generate a target placeholder, the encryption configuration request may also include the account information that issues the encryption configuration request to perform permission matching on the account information, and then generate the corresponding placeholder after the permission matching is successful.

[0120] In some embodiments, a method for running an application is also proposed: loading target configuration data into a memory module; and accessing the target configuration data in the memory module to run a target application.

[0121] In some embodiments, after obtaining the target configuration data, the target configuration data will be loaded into the memory module for use by the target application. The sensitive data will only be loaded into the memory module along with the target configuration data and will not appear in the configuration file. The configuration file only stores the first configuration data. In this way, the security of the sensitive data can be improved and the leakage of sensitive data can be reduced.

[0122] Figure 5 is a structural diagram of a configuration data processing device shown in an exemplary embodiment. The configuration data processing device 500 may include:

[0123] A first data acquisition module 510, configured to acquire first configuration data corresponding to the target application in response to the start of the target application, wherein the first configuration data includes a target placeholder;

[0124] The encrypted data acquisition module 530 is used to determine the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data;

[0125] The decryption module 550 is used to decrypt the target encrypted data to obtain the target data, where the target data is sensitive data in the configuration data of the application;

[0126] The target data acquisition module 570 is used to replace the target placeholder in the first configuration data with the target data to obtain the target configuration data, and run the target application based on the target configuration data.

[0127] In one possible implementation, configuring the data processing device further includes:

[0128] A placeholder generation module, used to generate a target placeholder based on a target encryption configuration request, the target encryption configuration request is used to indicate encryption of target data in the configuration data of the target application, and different encryption configuration requests correspond to different placeholders;

[0129] An encryption module, used to encrypt target data based on a key corresponding to a target application to obtain target encrypted data;

[0130] A mapping module is used to establish a mapping relationship between target encrypted data and target placeholders, and replace the target data with the target placeholders in target configuration data of a target application.

[0131] In one possible implementation, the decryption module includes:

[0132] A key determination unit, used to determine a target key corresponding to a target application, where different applications correspond to different keys;

[0133] The decryption unit is used to decrypt the target encrypted data based on the target key to determine the target data.

[0134] In one possible implementation, configuring the data processing device further includes:

[0135] An update data acquisition module, used to acquire the update placeholder and determine the update encrypted data that has a mapping relationship with the update placeholder;

[0136] An update decryption module, used for decrypting the update encrypted data to obtain update decrypted data;

[0137] An update module, used for modifying the update decrypted data to obtain modified update decrypted data;

[0138] The update encryption module is used to encrypt the modified update decrypted data to obtain the modified update encrypted data, and update the mapping relationship between the update placeholder and the update encrypted data to the mapping relationship between the modified update encrypted data and the update placeholder.

[0139] In one possible implementation, configuring the data processing device further includes:

[0140] A request information acquisition module, used to receive encrypted data application information based on the encryption management module, the encrypted data application information is used to indicate a request to obtain target encrypted data corresponding to the target placeholder, and the encrypted data application information includes account information that issues the encrypted data application information;

[0141] The authentication module is used to perform authority matching between the account information and the preset account information based on the encryption management module, and obtain the target encrypted data after the authority matching is successful.

[0142] In one possible implementation, the target data acquisition module includes:

[0143] A loading unit, used for loading target configuration data into a memory module;

[0144] The running unit is used to access the target configuration data in the memory module to run the target application.

[0145] The configuration data processing device provided in this embodiment can be used to execute the above configuration data processing method. Its implementation principle and technical effects are similar, and this embodiment will not be repeated here.

[0146] Figure 6 is a block diagram of an electronic device shown in an exemplary embodiment, see Figure 6 The electronic device 600 may include: a processor 61 and a memory 62, wherein the processor 61 and the memory 62 can communicate; illustratively, the processor 61 and the memory 62 communicate via a communication bus 63, the memory 62 is used to store computer execution instructions, and the processor 61 is used to call the computer execution instructions in the memory to execute the configuration data processing method shown in any of the above method embodiments.

[0147] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0148] The present application provides a computer-readable storage medium, on which computer-executable instructions are stored; when the computer-executable instructions are executed by a processor, they are used to implement the configuration data processing method as described in any of the above embodiments.

[0149] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above-mentioned configuration data processing method is implemented.

[0150] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0151] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0152] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0153] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0154] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0155] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0156] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0158] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A configuration data processing method, characterized in that: include: In response to starting a target application, acquiring first configuration data corresponding to the target application, wherein the first configuration data includes a target placeholder; Determine the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data; Decrypting the target encrypted data to obtain target data, where the target data is sensitive data in the configuration data of the application; The target placeholder is replaced with the target data in the first configuration data to obtain target configuration data, and the target application is run based on the target configuration data.

2. The method according to claim 1, characterized in that Before acquiring first configuration data corresponding to the target application in response to starting the target application, the method further includes: generating a target placeholder based on a target encryption configuration request, wherein the target encryption configuration request is used to instruct encryption of target data in the configuration data of the target application, and different encryption configuration requests correspond to different placeholders; Encrypting the target data based on the key corresponding to the target application to obtain the target encrypted data; A mapping relationship between the target encrypted data and the target placeholder is established, and the target data is replaced with the target placeholder in the target configuration data of the target application.

3. The method according to claim 1, characterized in that The decrypting the target encrypted data to obtain the target data includes: Determine a target key corresponding to the target application, where different applications correspond to different keys; The target encrypted data is decrypted based on the target key to determine the target data.

4. The method according to claim 1, characterized in that The method further comprises: Obtaining an update placeholder, and determining update encrypted data that has a mapping relationship with the update placeholder; decrypting the updated encrypted data to obtain updated decrypted data; Modifying the updated decrypted data to obtain modified updated decrypted data; The modified update decrypted data is encrypted to obtain modified update encrypted data, and the mapping relationship between the update placeholder and the update encrypted data is updated to the mapping relationship between the modified update encrypted data and the update placeholder.

5. The method according to claim 1, characterized in that Before determining the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data, the method further includes: receiving encrypted data application information based on an encryption management module, the encrypted data application information being used to indicate a request to obtain target encrypted data corresponding to the target placeholder, the encrypted data application information including account information that issues the encrypted data application information; Based on the encryption management module, authority matching is performed between the account information and preset account information, and the target encrypted data is obtained after the authority matching is successful.

6. The method according to claim 1, characterized in that Running the target application based on the target configuration data includes: Loading the target configuration data into a memory module; Access the target configuration data in the memory module to run the target application.

7. A configuration data processing device, characterized in that: include: A first data acquisition module, configured to acquire first configuration data corresponding to the target application in response to starting the target application, wherein the first configuration data includes a target placeholder; An encrypted data acquisition module, used to determine the target encrypted data corresponding to the target placeholder based on the mapping relationship between the placeholder and the encrypted data; A decryption module, used to decrypt the target encrypted data to obtain target data, wherein the target data is sensitive data in the configuration data of the application; A target data acquisition module is used to replace the target placeholder with the target data in the first configuration data to obtain target configuration data, and run the target application based on the target configuration data.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images