Data processing method, device, equipment and medium used in electronic communication system

Abstract

The present invention discloses a data processing method, device, equipment and medium applied to a telecom system. The specific scheme is: receiving a data backup request sent by a first server, wherein the data backup request includes the data to be backed up and the hash value to be verified generated by the first server and corresponding to the data to be backed up; when the data to be backed up and the hash value to be verified meet the preset verification conditions, an encryption key corresponding to the data to be backed up is generated; after encrypting the data to be backed up based on the encryption key, the backup data is obtained, and the backup data is cached, and the encryption key is segmented and stored in the corresponding target location, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data. The present invention realizes the backup processing of data and ensures the consistency, security and accuracy of data backup.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data processing method, device, equipment and medium applied to a telecommunication system. Background Art

[0002] The Dianhong system is an industrial Internet of Things operating system for power equipment or power terminals. It is used to achieve interconnection between power equipment of different types and brands, thereby improving the intelligence and automation level of power grid operation.

[0003] At present, the Dianhong system lacks a unified data backup standard for the received data. This not only easily leads to confusion and inconsistency in data backup, but also the possibility that key data is not backed up in a timely and effective manner, which makes it difficult to restore key data in the event of a catastrophic failure, affecting business continuity. In addition, during the data transmission and backup process, there are also cases of data leakage and data tampering, and the security of data transmission and backup cannot be guaranteed. Summary of the invention

[0004] The present invention provides a data processing method, device, equipment and medium applied to a telecom system, which realizes data backup processing and ensures the consistency, security and accuracy of data backup.

[0005] According to one aspect of the present invention, there is provided a data processing method applied to a telecom system, the method comprising:

[0006] Receiving a data backup request sent by the first server, wherein the data backup request includes the data to be backed up and a hash value to be verified corresponding to the data to be backed up generated by the first server;

[0007] When the data to be backed up and the hash value to be verified meet a preset verification condition, an encryption key corresponding to the data to be backed up is generated;

[0008] After encrypting the backup data based on the encryption key, the backup data is obtained, the backup data is cached, and the encryption key is stored in segments at corresponding target locations, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data.

[0009] According to another aspect of the present invention, there is provided a data processing device applied to a telecom system, the device comprising:

[0010] A backup request receiving module, used to receive a data backup request sent by the first server, wherein the data backup request includes the data to be backed up and a hash value to be verified corresponding to the data to be backed up generated by the first server;

[0011] An encryption key generation module, used to generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet a preset verification condition;

[0012] The backup data caching module is used to obtain backup data after encrypting the backup data based on the encryption key, cache the backup data, and store the encryption key in segments at corresponding target locations, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the data processing method applied to the telecom system in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions, and the computer instructions are used to enable a processor to implement the data processing method applied to a telecom system according to any embodiment of the present invention when executed.

[0018] According to another aspect of the present invention, there is provided a computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, the computer program implements a data processing method applied to a telecom system as in any embodiment of the present invention.

[0019] The technical solution of the embodiment of the present invention is to perform verification processing on the data to be backed up and the hash value to be verified carried in the data backup request when receiving the data backup request sent by the first service end, and generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet the preset verification conditions. The data to be backed up is encrypted according to the encryption key to obtain the backup data, and the backup data is cached, and the encryption key is stored in segments to the corresponding target location, so that when the data retrieval request sent by the first service end is received, the corresponding segmented key is retrieved from at least one target location to process the backup data. Based on this, the backup processing of the data to be backed up is realized, so that the data can be quickly restored when the first service end fails, and the continuity of business processing is guaranteed. The security and flexibility of subsequent data acquisition are guaranteed by the segmented storage of the encryption key, so that when a target location partially storing the segmented key fails or is attacked, the generation of the complete key is realized according to the segmented key at at least one target location. The present invention solves the problem that data is difficult to recover and the security of data transmission and backup cannot be guaranteed in the prior art, realizes the backup processing of data, and ensures the consistency, security and accuracy of data backup.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a data processing method applied to a telecom system provided by an embodiment of the present invention;

[0023] Figure 2 is a flow chart of a data processing method applied to a telecom system provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural schematic diagram of a data processing device applied to a telecom system provided by an embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device for implementing the data processing method applied to a telecom system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1 This is a flow chart of a data processing method applied to a telecom system provided by the first embodiment of the present invention. This embodiment can be applied to the situation where a server deployed with the telecom system receives data to be backed up from other servers and performs secure backup processing on the data to be backed up. The method can be executed by a data processing device applied to the telecom system. The data processing device applied to the telecom system can be implemented in the form of hardware and / or software. The data processing device applied to the telecom system can be configured in electronic devices such as mobile phones, computers or servers. Figure 1 As shown, the method includes:

[0030] S110, receiving a data backup request sent by the first server, wherein the data backup request includes the data to be backed up and a hash value to be verified generated by the first server and corresponding to the data to be backed up.

[0031] When a server or IoT device currently deployed with the Dianhong system receives a data backup request sent by the first server, the data to be backed up in the data backup request is backed up. Among them, the server or IoT device currently deployed with the Dianhong system, that is, the current server, is used to back up the data to be backed up of the first server. The first server may be a server or IoT device deployed with the Dianhong system, which is a server that requires the current server to back up its data to be backed up. There may be one or more first servers. Based on this, the current server can back up the data to be backed up of at least one first server. The data backup request can be used to request the server or IoT device currently deployed with the Dianhong system to back up the data to be backed up. The data to be backed up is the data that is carried by the data backup request and currently needs to be backed up. For example, the data to be backed up may be data associated with business processing. The hash value to be verified may be a standard hash value obtained after the backup data is processed by a hash function. The hash function may be a function that maps data to be backed up of any length to output data of a fixed length. The output data is the hash value to be verified. The data integrity of the received data to be backed up can be determined by the hash value to be verified.

[0032] Specifically, when a server or IoT device currently deployed with the Dianhong system receives a data backup request sent by at least one first server, the data to be backed up is backed up according to the data to be backed up in the data backup request and the hash value to be verified corresponding to the data to be backed up.

[0033] Exemplarily, when a server or IoT device currently deployed with the Dianhong system receives a data backup request sent by the first server, the data backup request is authenticated based on attribute-based encryption (ABE) to verify the data source and legitimacy of the data backup request. If the data source authentication is successful, the data to be backed up and the hash value to be verified in the data backup request are received. If the data source authentication fails, the data to be backed up and the hash value to be verified in the data backup request are not received. The specific method may be: determine whether the attribute set carried by the data backup request corresponds to the access policy pre-stored in the current server or IoT device. If the attribute set corresponds to the access policy, the data source authentication is successful, and the data to be backed up and the hash value to be verified in the data backup request are received. If the attribute set does not correspond to the access policy, the data source authentication fails, and the data to be backed up and the hash value to be verified in the data backup request are not received. Among them, the attribute set may include the device features and device identity corresponding to the first server. The access policy may be a shared data policy pre-formulated by the first server through the ABE encryption technology and the device features and device identity corresponding to the first server, and sent to the current server. That is, attribute-based encryption technology enables the first server to specify fine-grained access policies.

[0034] In an embodiment of the present invention, the data to be backed up and the hash value to be verified are data encrypted by the first server. Before receiving the data backup request sent by the first server, the method also includes: determining the data to be backed up and determining the hash value to be verified corresponding to the data to be backed up in response to a trigger operation on the first server; generating a data backup request after encrypting the data to be backed up and the hash value to be verified based on the stored symmetric key; wherein the symmetric key is a key issued in advance.

[0035] Among them, the trigger operation can be a trigger operation for the user to collect data. The data to be backed up can be data that needs to be backed up and is obtained from the first server based on a preset data collection protocol. Optionally, the data to be backed up can be various types of business processing data. The symmetric key can be a pre-set key for encrypting the data to be backed up and the hash value to be verified. The stored symmetric key can be a symmetric key stored in the first server, which is a key pre-sent to the first server based on the symmetric encryption technology by the current server. The corresponding symmetric key is stored in the current server and the first server. The symmetric key can be used to realize data encryption transmission between the first server and the current server. It can be understood that the symmetric key stored in the first server is used to encrypt the data to be backed up and the hash value to be verified. The symmetric key stored in the current server is used to decrypt the data to be backed up and the hash value to be verified in the received data backup request.

[0036] Specifically, before receiving the data backup request sent by the first server, the first server can generate a data backup request. That is, in response to the trigger operation on the first server, the data to be backed up of the first server is obtained. And the hash value to be verified of the data to be backed up is determined according to the hash function. The hash value to be verified and the data to be backed up are encrypted by the symmetric key pre-stored on the first server to obtain a data backup request, so that the first server sends a data backup request to the current server through the Dianhong system and based on a secure data transmission protocol. Optionally, a lightweight secure transmission protocol can be used to send the data backup request to the current server or IoT device.

[0037] Optionally, in order to realize encrypted data transmission between the first server and the current server, a symmetric encryption algorithm can be used to generate respective symmetric keys on the first server and the current server. The symmetric key includes a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data. That is, before sending the data to be backed up, the first server encrypts the data to be backed up and the hash value to be verified according to the public key in the symmetric key to obtain a data backup request. When the current server receives the data backup request transmitted by the first server through the TLS protocol secure channel, the data to be backed up and the hash value to be verified in the data backup request are decrypted according to the private key in the symmetric key for subsequent data backup processing. Based on this, the data to be backed up and the hash value to be verified can be prevented from being stolen and tampered with during the transmission process.

[0038] It should be noted that the symmetric encryption algorithm uses the same symmetric key for encryption and decryption. The encryption process is to divide the data to be backed up and the hash value to be verified into blocks of fixed length, and convert these blocks into corresponding ciphertext blocks through the key and encryption algorithm, that is, to obtain the encrypted data to be backed up and the hash value to be verified. The decryption process is to restore the ciphertext block to a plaintext block through the same key and decryption algorithm, that is, the encrypted data to be backed up and the hash value to be verified are decrypted by the symmetric key to obtain the decrypted data to be backed up and the hash value to be verified. The symmetric encryption algorithm can increase the speed of data encryption.

[0039] S120: When the data to be backed up and the hash value to be verified meet a preset verification condition, generate an encryption key corresponding to the data to be backed up.

[0040] The preset verification condition may be a condition that the hash value corresponding to the received data to be backed up is the same as the hash value to be verified. The encryption key may be a key for encrypting the received data to be backed up when backing up the data. The encryption key may ensure the data confidentiality of the backed-up data.

[0041] Specifically, the received data to be backed up is hashed using a hash function to obtain a hash value corresponding to the data to be backed up. When the hash value corresponding to the data to be backed up is consistent with the hash value to be verified, it means that the data to be backed up has not been lost or tampered with in the process of sending the data to be backed up from the first server to the current server, thereby ensuring the integrity of the data to be backed up. An encryption key corresponding to the data to be backed up is randomly generated to encrypt and back up the data to be backed up using the encryption key.

[0042] In an embodiment of the present invention, the encryption key may be generated by: generating a target hash value corresponding to the data to be backed up; when the target hash value and the hash value to be verified are the same, determining that a preset verification condition is satisfied; and randomly generating an encryption key corresponding to the data to be backed up.

[0043] The target hash value may be a hash value obtained by performing hash processing on the received data to be backed up. By comparing the target hash value with the hash value to be verified, the data integrity of the received data to be backed up may be determined.

[0044] Specifically, the received data to be backed up is hashed according to a hash function to obtain a target hash value. When the target hash value is the same as the hash value to be verified, it means that the received data to be backed up is complete data and has not been tampered with during the data transmission process. That is, the preset verification condition is met. An encryption key corresponding to the data to be backed up is randomly generated to perform encrypted backup processing on the data to be backed up through the encryption key. Correspondingly, when the target hash value is different from the hash value to be verified, it means that the data to be backed up has been tampered with during the transmission process, and a retransmission request can be sent to the first server end, so that the first server end resends the data backup request carrying the data to be backed up and the hash value to be verified.

[0045] S130, after encrypting the backup data based on the encryption key, the backup data is obtained, the backup data is cached, and the encryption key is stored in segments at corresponding target locations, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data.

[0046] Among them, the backup data can be obtained after encrypting the data to be backed up. The target location can be at least one storage location for storing segmentation keys. The number of target locations is consistent with the number of segmentation keys. For example, if the encryption key is divided into 5 segmentation keys, 5 storage locations or storage devices for storing the segmentation keys can be selected. Correspondingly, if the encryption key is not divided, that is, the segmentation key is the encryption key, then a target location can be selected to store the encryption key. The segmentation key can be a partial key obtained by splitting the encryption key. The data retrieval request can be a request sent by the first server to obtain backup data. For example, when the data of the first server is damaged, the first server can send a data retrieval request to retrieve backup data from the current server.

[0047] Specifically, the backup data is encrypted according to the encryption key to obtain the backup data. The backup data is stored in a corresponding storage location or storage device. For example, the storage device may be a hard disk device or a solid state drive (SSD). Optionally, the backup data may be subjected to at least one of regular backup processing, incremental backup processing or differential backup processing according to the data type or business processing requirements corresponding to the backup data. Based on this, when a data retrieval request sent by the first server is received, the segmentation key can be obtained from at least one target location storing the segmentation key, and a decryption key can be obtained according to at least one segmentation key. Among them, the encryption key and the decryption key can be the same key, which is used to encrypt the backup data and decrypt the backup data. The backup data is decrypted by the decryption key, and the decrypted data is encrypted by the symmetric key and sent to the first server. It should be noted that after the backup data is decrypted, the decrypted backup data can also be subjected to integrity verification processing to determine the accuracy of the decrypted backup data.

[0048] Exemplarily, when the data to be backed up on the first server is damaged, the first server initiates a data recovery plan and sends a data retrieval request to the current server through the Dianhong system, so that the current server decrypts the backup data according to the segmentation key at at least one target location, obtains feedback data corresponding to the backup data, and feeds the feedback data back to the first server. When the first server receives the feedback data, it performs an integrity check on the feedback data to ensure the data consistency between the feedback data and the data to be backed up. The feedback data that passes the integrity check is used as the data to be backed up.

[0049] The technical solution of this embodiment is to verify the data to be backed up and the hash value to be verified carried in the data backup request when receiving the data backup request sent by the first server, and generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet the preset verification conditions. The data to be backed up is encrypted according to the encryption key to obtain the backup data, and the backup data is cached, and the encryption key is stored in segments to the corresponding target location, so that when the data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data. Based on this, the backup processing of the backup data is realized, so that the data can be quickly restored when the first server fails, and the continuity of business processing is guaranteed. The security and flexibility of subsequent data acquisition are guaranteed by the segmented storage of the encryption key, so that when a target location partially storing the segmented key fails or is attacked, the generation of the complete key is realized according to the segmented key at at least one target location. The present invention solves the problem that data is difficult to recover and the security of data transmission and backup cannot be guaranteed in the prior art, realizes the backup processing of data, and ensures the consistency, security and accuracy of data backup.

[0050] Embodiment 2

[0051] Figure 2 This is a flowchart of a data processing method applied to a telecom system provided by Embodiment 2 of the present invention. This embodiment is a preferred embodiment of the above embodiment. The specific implementation method can refer to the technical solution of this embodiment. Among them, the technical terms that are the same or corresponding to the above embodiment are not repeated here. Figure 2 As shown, the method includes:

[0052] S210, receiving a data backup request sent by the first server, and decrypting the data to be backed up and the hash value to be verified carried in the data backup request based on the stored symmetric key to obtain the decrypted data to be backed up and the hash value to be verified.

[0053] Among them, the stored symmetric key can be understood as the key stored by the current server for decrypting the data backup request. The symmetric key stored by the current server and the symmetric key used by the first server when encrypting the data to be backed up and the data to be verified can be a key pair generated based on the same symmetric encryption algorithm. Symmetric keys are generated on the first server and the current server respectively based on the symmetric encryption algorithm. The symmetric key stored in the first server is used to encrypt the data to be backed up and the hash value to be verified to obtain the data backup request. The symmetric key stored in the current server is used to decrypt the data to be backed up and the hash value to be verified in the data backup request to obtain the decrypted data to be backed up and the hash value to be verified.

[0054] Specifically, the data to be backed up and the data to be verified carried in the data backup request may be data encrypted by the first server. When receiving the data backup request sent by the first server, the data to be backed up and the hash value to be verified carried in the data backup request may be encrypted according to the symmetric algorithm currently stored in the server to obtain the decrypted data to be backed up and the hash value to be verified, so as to perform data backup processing through the decrypted data to be backed up.

[0055] S220: When the data to be backed up and the hash value to be verified meet a preset verification condition, generate an encryption key corresponding to the data to be backed up.

[0056] S230, after encrypting the backup data based on the encryption key, the backup data is obtained, and the backup data is cached, and the encryption key is divided into at least one segment key according to a preset key division rule, and the at least one segment key is stored in a corresponding target location, so that when a data retrieval request sent by the first server is received, the corresponding segment key is retrieved from the at least one target location to process the backup data.

[0057] The preset key division rule may be a pre-set rule for segmented storage and management of the encryption key. The preset key division rule may be used to determine the number of segmented keys into which the encryption key is divided. For example, the encryption key may be divided into five segmented keys by the preset key division rule, or the encryption key may be not divided by the preset key division rule, and the obtained segmented keys are the encryption key.

[0058] Specifically, according to the preset encryption algorithm and security requirements, an encryption key corresponding to the data to be backed up is randomly generated. The backup data is encrypted by the encryption key and the preset encryption algorithm to obtain the backup data, thereby ensuring the confidentiality of the data storage. The backup data is cached, and the encryption key is divided into at least one segment key according to the preset key division rule, and the at least one segment key is stored in at least one target location, so that when a data retrieval request sent by the first server is received, the corresponding segment key is obtained from at least one target location, and a decryption key is generated according to the at least one segment key to decrypt the backup data, and the decrypted backup data is fed back to the first server. Among them, the decryption key and the encryption key can be the same key. Optionally, the encryption key is updated regularly, and when the backup data corresponding to the encryption key is fed back to the first server, the encryption key is destroyed.

[0059] Exemplarily, the preset encryption algorithm is the Advanced Encryption Standard (AES) encryption algorithm as an example for explanation. An encryption key with a preset key length is generated according to security requirements and the AES encryption algorithm. For example, the key length of the encryption key can be 128 bits, 192 bits, and 256 bits. The backup data is encrypted according to the encryption key and the AES encryption algorithm to obtain backup data. The backup data is stored in a storage device such as a hard disk or a solid-state drive. The encryption key is divided into at least one segment key according to a preset key division rule, and the at least one segment key is stored at a target location.

[0060] Optionally, the preset key division rule can be determined by a distributed key management system based on threshold cryptography. The encryption key is divided into one or more fragments through a distributed key management system based on threshold cryptography to obtain at least one segmented key. And at least one segmented key is stored at at least one target location of the current server or IoT device. When the number of keys of the acquired segmented keys reaches a key number threshold, the key can be reconstructed based on the acquired segmented keys. In a distributed key management system based on threshold cryptography, operations such as key generation, distribution, update, and destruction follow the protocols and algorithms set by the distributed key management system to ensure the security and availability of the keys. The distributed key management system also has fault tolerance, which can ensure the integrity and availability of the keys even if some target locations fail or are attacked.

[0061] Optionally, when a data retrieval request sent by the first server is received, the data to be retrieved is determined according to the request identifier in the data retrieval request; based on the data identifier of the data to be retrieved, the corresponding segmented key is retrieved from at least one target location storing the segmented key of the data to be retrieved; by concatenating at least one segmented key, a target key for decrypting the data to be retrieved is obtained, and the data to be retrieved is decrypted based on the target key and then fed back to the first server.

[0062] Among them, the data retrieval request may be a request for retrieving backup data. Optionally, when the data of the first server is damaged, the first server may send a data retrieval request to the current server to obtain the backup data. The request identifier may be used to characterize the backup data that currently needs to be retrieved. The request identifier may be used to obtain the data to be retrieved corresponding to the request identifier at the corresponding storage location. The data identifier may be used to characterize the segmented key corresponding to the data to be retrieved. The data identifier may be used to determine the segmented key at at least one target location corresponding to the data to be retrieved. The target key may be a key obtained by splicing at least one segmented key. The target key is used to decrypt the backup data encrypted by the encryption key. Optionally, the target key may be the same key as the encryption key, used to encrypt the backup data and decrypt the backup data.

[0063] Specifically, when receiving a data retrieval request sent by the first server, the backup data to be retrieved, that is, the data to be retrieved, is determined according to the request identifier of the data retrieval request. According to the data identifier of the data to be retrieved, the corresponding segmented key is retrieved from at least one target location storing the segmented key of the data to be retrieved. When the number of segmented keys obtained reaches a preset number threshold, at least one segmented key is concatenated to obtain a target key. The data to be retrieved is decrypted by the target key, and the decrypted data to be retrieved is fed back to the first server.

[0064] In an embodiment of the present invention, the method of regenerating the target key can be: when the number of at least one segmented key is different from the number in the preset key division rule, the target key is regenerated based on at least one segmented key; when the number of at least one segmented key is the same as the number in the preset key division rule, the target key is generated by splicing at least one segmented key.

[0065] The number in the preset key division rule may be understood as the number of keys of all segmented keys divided from the encryption key.

[0066] Specifically, when the number of at least one segment key is different from the number in the preset key division rule, when the number of the segment key reaches the preset number of keys, the target key can be regenerated according to the at least one segment key. When the number of at least one segment key is the same as the number in the preset key division rule, the at least one segment key is concatenated to obtain the target key. It should be noted that when the encryption key corresponds to only one segment key, the segment key is the target key.

[0067] For example, if the number of keys into which the encryption key is divided according to the preset key division rule is 5 and the number of preset keys is 3, then when 3 segmentation keys are obtained, the target key can be regenerated according to the 3 segmentation keys. If the number of keys into which the encryption key is divided according to the preset key division rule is 1, the segmentation key is the encryption key, and the encryption key can be obtained at the target location where the encryption key is stored.

[0068] The technical solution of this embodiment receives a data backup request sent by the first server, and decrypts the data to be backed up and the hash value to be verified carried in the data backup request based on the stored symmetric key to obtain the decrypted data to be backed up and the hash value to be verified. The decrypted data to be backed up and the hash value to be verified are verified, and when the data to be backed up and the hash value to be verified meet the preset verification conditions, an encryption key corresponding to the data to be backed up is generated. After encrypting the data to be backed up based on the encryption key, the backup data is obtained, and the backup data is cached, and the encryption key is divided into at least one segment key according to the preset key division rule, and at least one segment key is stored in the corresponding target location, so that when the data retrieval request sent by the first server is received, the corresponding segment key is retrieved from at least one target location to process the backup data. Based on this, the backup processing of the data to be backed up is realized, so that the data can be quickly restored when a failure occurs in the first server, and the continuity of business processing is guaranteed. The security and flexibility of subsequent data acquisition are guaranteed by storing the encryption key in segments, so that when a target location where the segmented key is partially stored fails or is attacked, the generation of a complete key is achieved based on the segmented key at at least one target location. The present invention solves the problem of data being difficult to recover and the inability to ensure the security of data transmission and backup in the prior art, realizes the backup processing of data, and ensures the consistency, security and accuracy of data backup.

[0069] Embodiment 3

[0070] Figure 3 1 is a schematic diagram of the structure of a data processing device applied to a telecom system provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a backup request receiving module 310, an encryption key generating module 320 and a backup data caching module 330.

[0071] The backup request receiving module 310 is used to receive a data backup request sent by the first server, wherein the data backup request includes the data to be backed up and the hash value to be verified generated by the first server and corresponding to the data to be backed up; the encryption key generating module 320 is used to generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet a preset verification condition; the backup data caching module 330 is used to obtain the backup data after encrypting the data to be backed up based on the encryption key, cache the backup data, and store the encryption key in segments at corresponding target locations, so that when receiving the data retrieval request sent by the first server, the corresponding segmented key can be retrieved from at least one target location to process the backup data.

[0072] The technical solution of this embodiment is to verify the data to be backed up and the hash value to be verified carried in the data backup request when receiving the data backup request sent by the first server, and generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet the preset verification conditions. The data to be backed up is encrypted according to the encryption key to obtain the backup data, and the backup data is cached, and the encryption key is stored in segments to the corresponding target location, so that when the data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data. Based on this, the backup processing of the backup data is realized, so that the data can be quickly restored when the first server fails, and the continuity of business processing is guaranteed. The security and flexibility of subsequent data acquisition are guaranteed by the segmented storage of the encryption key, so that when a target location partially storing the segmented key fails or is attacked, the generation of the complete key is realized according to the segmented key at at least one target location. The present invention solves the problem that data is difficult to recover and the security of data transmission and backup cannot be guaranteed in the prior art, realizes the backup processing of data, and ensures the consistency, security and accuracy of data backup.

[0073] On the basis of the above embodiment, optionally, the device also includes: a backup request generation module, which is used to determine the data to be backed up and the hash value to be verified corresponding to the data to be backed up in response to a trigger operation on the first server; after encrypting the data to be backed up and the hash value to be verified based on the stored symmetric key, a data backup request is generated; wherein the symmetric key is a pre-issued key.

[0074] Optionally, the device also includes: a data decryption module, which is used to decrypt the data to be backed up and the hash value to be verified carried in the data backup request based on the stored symmetric key after receiving the data backup request sent by the first server, so as to obtain the decrypted data to be backed up and the hash value to be verified.

[0075] Optionally, an encryption key generation module is used to generate a target hash value corresponding to the data to be backed up; when the target hash value and the hash value to be verified are the same, determine that a preset verification condition is met; and randomly generate an encryption key corresponding to the data to be backed up.

[0076] Optionally, storing the encryption key in segments at corresponding target locations includes: dividing the encryption key into at least one segment key according to a preset key division rule, and storing the at least one segment key at the corresponding target location.

[0077] Optionally, the device also includes: a data retrieval module, including: a data to be retrieved determination unit, used to determine the data to be retrieved according to the request identifier in the data retrieval request when receiving the data retrieval request sent by the first server; a segmented key retrieval unit, used to retrieve the corresponding segmented key from at least one target location storing the segmented key of the data to be retrieved according to the data identifier of the data to be retrieved; a key splicing unit, used to obtain a target key for decrypting the data to be retrieved by splicing at least one segmented key, and to decrypt the data to be retrieved based on the target key and feed it back to the first server.

[0078] Optionally, a key splicing unit is used to regenerate a target key based on at least one segmented key when the number of at least one segmented key is different from the number in the preset key division rule; and to generate a target key after splicing at least one segmented key when the number of at least one segmented key is the same as the number in the preset key division rule.

[0079] The data processing device applied to the telecom system provided by the embodiment of the present invention can execute the data processing method applied to the telecom system provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0080] Embodiment 4

[0081] Figure 4 1 is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0082] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0083] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0084] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as a data processing method applied to a telecom system.

[0085] In some embodiments, the data processing method applied to the electronic communication system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the data processing method applied to the electronic communication system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the data processing method applied to the electronic communication system in any other appropriate manner (e.g., by means of firmware).

[0086] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0087] The computer program for implementing the data processing method applied to the telecom system of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0088] Embodiment 5

[0089] Embodiment 5 of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to execute a data processing method applied to a telecom system, the method comprising:

[0090] A data backup request is received from a first server, wherein the data backup request includes data to be backed up and a hash value to be verified generated by the first server and corresponding to the data to be backed up; when the data to be backed up and the hash value to be verified meet a preset verification condition, an encryption key corresponding to the data to be backed up is generated; after encrypting the data to be backed up based on the encryption key, the backup data is obtained, the backup data is cached, and the encryption key is segmented and stored in corresponding target locations, so that when a data retrieval request is received from the first server, the corresponding segmented key is retrieved from at least one target location to process the backup data.

[0091] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0092] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0093] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0094] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0095] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0096] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A data processing method applied to a telecom system, characterized in that: include: Receiving a data backup request sent by a first server, wherein the data backup request includes data to be backed up and a hash value to be verified corresponding to the data to be backed up and generated by the first server; When the data to be backed up and the hash value to be verified meet a preset verification condition, generating an encryption key corresponding to the data to be backed up; After encrypting the data to be backed up based on the encryption key, backup data is obtained, the backup data is cached, and the encryption key is stored in segments at corresponding target locations, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data.

2. The method according to claim 1, characterized in that The data to be backed up and the hash value to be verified are data encrypted by the first server. Before receiving the data backup request sent by the first server, the method further includes: In response to a trigger operation on the first server, determine data to be backed up, and determine a hash value to be verified corresponding to the data to be backed up; After encrypting the data to be backed up and the hash value to be verified based on the stored symmetric key, generating the data backup request; The symmetric key is a pre-issued key.

3. The method according to claim 1, characterized in that After receiving the data backup request sent by the first server, the method further includes: The data to be backed up and the hash value to be verified carried in the data backup request are decrypted based on the stored symmetric key to obtain the decrypted data to be backed up and the hash value to be verified.

4. The method according to claim 1, characterized in that: The step of generating an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet a preset verification condition comprises: Generate a target hash value corresponding to the data to be backed up; When the target Hash value and the Hash value to be verified are the same, determining that the preset verification condition is satisfied; and, An encryption key corresponding to the data to be backed up is randomly generated.

5. The method according to claim 1, characterized in that The storing the encryption key segments to corresponding target locations includes: The encryption key is divided into at least one segment key according to a preset key division rule, and the at least one segment key is stored in a corresponding target location.

6. The method according to claim 1, characterized in that The method further comprises: When receiving the data retrieval request sent by the first server, determining the data to be retrieved according to the request identifier in the data retrieval request; According to the data identifier of the data to be retrieved, retrieve the corresponding segment key from at least one target location storing the segment key of the data to be retrieved; By concatenating at least one segment key, a target key for decrypting the data to be retrieved is obtained, and the data to be retrieved is decrypted based on the target key and then fed back to the first server.

7. The method according to claim 6, characterized in that The step of obtaining a target key for decrypting the data to be retrieved by concatenating at least one segment key comprises: When the number of the at least one segment key is different from the number in the preset key division rule, regenerating the target key based on the at least one segment key; When the number of the at least one segment key is the same as the number in the preset key division rule, the at least one segment key is concatenated to generate the target key.

8. A data processing device used in a telecom system, characterized in that: include: A backup request receiving module, configured to receive a data backup request sent by a first server, wherein the data backup request includes data to be backed up and a hash value to be verified corresponding to the data to be backed up and generated by the first server; An encryption key generation module, configured to generate an encryption key corresponding to the data to be backed up when the data to be backed up and the hash value to be verified meet a preset verification condition; A backup data caching module is used to encrypt the data to be backed up based on the encryption key to obtain backup data, cache the backup data, and store the encryption key in segments at corresponding target locations, so that when a data retrieval request sent by the first server is received, the corresponding segmented key is retrieved from at least one target location to process the backup data.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the data processing method applied to the telecom system as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data processing method applied to a telecom system as described in any one of claims 1 to 7 when executed.

Images