Data processing method and device, electronic equipment and storage medium

Abstract

The invention provides a data processing method and device, electronic equipment and a storage medium, the method is applied to the field of drinkers, and the method comprises the following steps: obtaining a business processing request for target data sent by a client, and determining a processing type of the business processing request; obtaining a processing key corresponding to the target data from a preset cache; and calling the processing key based on the processing type to encrypt and decrypt the target data of the service processing request, and calling the encrypted and decrypted target data to execute the service processing flow corresponding to the service processing request, so that the data processing speed is improved while the processing key is prevented from being leaked.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to data processing methods, devices, electronic devices and storage media. Background Art

[0002] With the rapid development of computer technology, the attention paid to privacy data security is increasing. When dealing with business scenarios involving privacy data encryption, traditional technical solutions often choose to store encryption keys in service configuration files in the local business environment to implement data encryption and decryption operations. However, service configuration files are vulnerable to malicious attacks during the business execution process, resulting in data leakage and illegal acquisition of user privacy data, which cannot meet the user's requirements for high-intensity protection of privacy data. Summary of the invention

[0003] This application provides a data processing method, device, electronic device and storage medium, which aims to optimize the process of obtaining key processing in business services, thereby improving the security of private data. The technical solution is as follows:

[0004] In a first aspect, an embodiment of the present application provides a data processing method, including:

[0005] Obtaining a business processing request for target data sent by a client, and determining a processing type of the business processing request;

[0006] Obtaining a processing key corresponding to the target data from a preset cache, where the processing key is a key requested from a key server based on pre-generated key mapping information when the business server enters a running state, and the key mapping information is pre-stored information that has a mapping relationship with the processing key;

[0007] Based on the processing type, the processing key is called to encrypt and decrypt the target data of the business processing request, and the encrypted and decrypted target data is called to execute the business processing flow corresponding to the business processing request.

[0008] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0009] A request acquisition unit, used to acquire a business processing request for target data sent by a client, and determine a processing type of the business processing request;

[0010] A key acquisition unit, used to acquire a processing key corresponding to the target data from a preset cache, wherein the processing key is a key requested from a key server based on pre-generated key mapping information when the business server enters a running state, and the key mapping information is pre-stored information having a mapping relationship with the processing key;

[0011] The data processing unit is used to call the processing key based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and call the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request.

[0012] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, any of the above data processing methods is implemented.

[0013] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed, any of the above data processing methods is implemented.

[0014] In the above technical solution, by obtaining the business processing request sent by the client and determining the processing type corresponding to the business processing request, it is possible to ensure that the business processing request is correctly processed. By generating the mapping information corresponding to the processing key and saving the processing key to the key server in the cloud, the security of the processing key during the business execution process can be improved. When the business server starts processing, the processing key is dynamically obtained from the key server based on the pre-generated key mapping information and stored in the preset cache to perform encryption and decryption operations on the target data. By calling the processing key according to the processing type of the business processing request to perform encryption and decryption processing on the target data, the data processing speed is improved while preventing the leakage of the processing key. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 It is a system architecture diagram of a data processing method provided in an embodiment of the present application;

[0017] Figure 2 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0018] Figure 3 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0019] Figure 4 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0020] Figure 5It is a scenario schematic diagram of a data processing method provided in an embodiment of the present application;

[0021] Figure 6 It is a flowchart of a data processing method provided in an embodiment of the present application;

[0022] Figure 7 is a structural schematic diagram of a data processing device provided in an embodiment of the present application;

[0023] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0025] The technical solution in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0027] In order to improve the security of target data, the present application provides a data processing method, and the execution subject of the data processing method is an electronic device. The following is a detailed description. It should be noted that the description order of the following embodiments is not intended to limit the preferred order of the embodiments. Figure 1 , Figure 1 This is a system architecture diagram of a data processing method provided in an embodiment of the present application. The specific process of the data processing method can be as follows:

[0028] In order to provide entity support for the process of the above-mentioned data processing method, the embodiment of the present application provides a system architecture applied by the data processing method, please refer to Figure 1 , Figure 1 1 is a diagram of a system architecture used by the data processing method provided in the embodiment of the present application. The system architecture includes a terminal 140, the Internet 130, a gateway 120, a server 110, and the like.

[0029] The terminal 140 includes but is not limited to mobile phones, computers, intelligent interactive devices, etc. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, etc. In addition, it can be a single device or a combination of multiple devices. For example, multiple desktop computers are interconnected through a local area network, share a display, etc. to work together, and together constitute a terminal 140. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.

[0030] The server 110 refers to a computer system that can provide certain services to the terminal 140. Compared with ordinary terminals 140, the server 110 has higher requirements in terms of stability, security, performance, etc. The server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0031] The gateway 120 is also called an internetwork connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a converter. The gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the terminal 140 to the server 110 must be sent to the corresponding server 110 through the gateway 120. The message sent by the server 110 to the terminal 140 must also be sent to the corresponding terminal 140 through the gateway 120.

[0032] In the embodiment of the present application, the business server focuses on processing various specific business logics, and is used to receive business processing requests from the terminal 140 via the Internet and the gateway, such as processing order transactions on e-commerce platforms, information interaction with social software, and other business processes, and managing and operating the business data related thereto, in order to ensure smooth business operation, meet the needs of end users, and ensure the integrity, availability, and confidentiality of data at the business level. The key server focuses on working around the key, that is, storing the key, and distributing the key to the business server in need according to the authorization mechanism and the preset key mapping information, and will also regularly update the key and maintain the key throughout its life cycle to ensure the confidentiality and integrity of the key.

[0033] In actual business scenarios, when it comes to operating on target data, a specific encryption algorithm is often selected to perform encryption and decryption operations on the target data. In the embodiments of the present application, the encryption algorithms used when operating on the target data include but are not limited to symmetric encryption algorithms, including the Symmetric Encryption Algorithm 4 (SM4). The encryption algorithm itself is just a framework and rules. To actually implement encryption or decryption operations on target data, the corresponding processing key must be involved. For symmetric encryption algorithms, only by using the correct processing key can the target data be encrypted into ciphertext data through the encryption algorithm. Similarly, this unique processing key is also required for decryption to restore the ciphertext to the original plaintext data.

[0034] Specifically, when the business server is in operation, a request for obtaining the processing key is sent to a third-party cloud server, namely, a key management server, through a preset key mapping service. The processing key is not directly stored on the business server, but is obtained through a pre-generated key mapping information. The key mapping information is pre-stored and has a mapping relationship with the processing key. In other words, the key mapping information contains instructions or paths on how to obtain the processing key. When the business server is running, it will request the key server to obtain the processing key according to this key mapping information. The key server will provide the corresponding processing key according to the request and the key mapping information.

[0035] It should be noted that in the embodiment of the present application, the client is the front-end entrance for the user to interact with the entire business service. For example, when a user initiates an operation through an application on a mobile phone or client software on a computer, these operations will be encapsulated as business processing requests and sent out. The business server is at the back end and is the core of the entire business process processing for receiving, parsing and processing business processing requests sent by the client. When the client initiates a business processing request, the business processing request will be transmitted to the business server through the network.

[0036] After receiving any business processing request sent by the client, the business server will take corresponding actions according to the specific content and type of the request. For example, when it is detected that there is a read or write operation on the target data in the business processing request sent by the client, a specific write operation business process will be triggered, and then the encryption algorithm and the corresponding processing key will be used to encrypt or decrypt the target data to ensure the security of the target data during the reading and writing process, and then the business logic processing corresponding to the entire business request will be completed and the corresponding processing results will be returned to the client.

[0037] based on Figure 1 The system architecture diagram shown below will be combined with Figure 2-Figure 6 , a data processing method provided in an embodiment of the present application is introduced in detail.

[0038] Based on the above situation, the present application embodiment proposes a data processing method. Figure 2 , Figure 2 is a flow chart of a data processing method provided in an embodiment of the present application. Figure 2 As shown, the method of the embodiment of the present application may include the following steps S101-S103.

[0039] S101, obtaining a business processing request for target data sent by a client, and determining a processing type of the business processing request.

[0040] In the embodiment of the present application, the client is the front-end entrance for the user to interact with the entire business service, and the business server will monitor in real time whether it receives various business processing requests sent from the client through the network monitoring mechanism. When the client initiates a business processing request for the target data, the business server will use network communication protocols, such as HyperText Transfer Protocol (HTTP), Transmission Control Protocol (TCP) and Internet Protocol (IP) and other related protocols to receive and obtain the data packets carried by the business processing request.

[0041] Specifically, when the business server receives any business processing request, it parses the business processing request to extract request information, wherein the request information includes the source of the business processing request, the target of the request, the business keywords carried by the request, etc., wherein different business keywords correspond to different business operation types. If the business keyword is to obtain target data, such as "query" or "search", it can be determined that the processing type corresponding to the business processing request is a read operation type. If the business keyword is a business keyword such as "update" and / or "modify", it can be determined that the processing type corresponding to the business processing request is a modification type.

[0042] S102, obtaining a processing key corresponding to the target data from a preset cache.

[0043] In the embodiment of the present application, the processing key is the algorithm key corresponding to the data encryption algorithm used for the target data, wherein the processing key is not directly stored on the business server, but is obtained through a pre-generated key mapping information, which is pre-stored and has a mapping relationship with the processing key. In other words, the key mapping information contains instructions or paths on how to obtain the processing key. When the business server is running, it will request the key server to obtain the processing key according to this key mapping information. The key server will provide the corresponding processing key according to the request and the key mapping information.

[0044] Specifically, the processing key corresponding to the data encryption algorithm is obtained and the preset key mapping service is called to call the preset hash function to process the processing key, that is, the processing key is used as the input data of the hash function, and then the hash function outputs a key hash value of a fixed length. Then, a mapping relationship is established between the key hash value and the processing key according to the preset mapping rule, that is, the corresponding processing key can be found through the key hash value. The preset key mapping service saves the key hash value corresponding to the processing key, and sends the processing key to the cloud server, that is, sends it to the key server for storage and clears the processing key from the local environment of the business server.

[0045] When the business server is in operation, the preset key mapping service is called to obtain the key hash value corresponding to the processing algorithm in the mapping information, and a query statement for the processing key is generated according to the key hash value, and the query statement for the processing key is packaged into a query request and sent to the key server. After receiving the query request, the key server parses and executes the query statement for the processing key to obtain the processing key corresponding to the key hash value. The processing key is returned to the business server as response data, and after receiving the response data, the business server extracts the processing key and saves it to the preset cache.

[0046] S103, calling a processing key based on the business operation type to perform encryption and decryption processing on the target data of the business processing request, and calling the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request.

[0047] Specifically, the business operation types include read operation types and write operation types. If it is a read operation type, that is, the key ciphertext data in an encrypted state is read from the database storing the target data, the processing key is called and the key ciphertext data is decrypted based on the decryption rules of the encryption algorithm used to restore the key ciphertext data to key plaintext data, and then the decrypted key plaintext data is sorted and formatted according to the business processing request requirements and encapsulated into a response message and sent back to the client to complete the business process corresponding to the read operation type; if the business operation type is a write operation type, first obtain the key plaintext data to be written in the business processing request and verify whether its legality, format, etc. meet the business requirements, then obtain the processing key and encrypt the key plaintext data according to the encryption rules of the encryption algorithm to generate key ciphertext data, and write the key ciphertext data into a preset database.

[0048] As can be seen from the above, by obtaining the business processing request sent by the client and determining the processing type corresponding to the business processing request, it is possible to ensure that the business processing request is processed correctly. By generating the corresponding mapping information of the processing key and saving the processing key to the key server in the cloud, the security of the processing key during the business execution process can be improved. By dynamically obtaining the processing key from the key server based on the pre-generated key mapping information when the business server starts processing and storing it in the preset cache to perform encryption and decryption operations on the target data, the processing key is called according to the processing type of the business processing request to perform encryption and decryption processing on the target data, thereby preventing the leakage of the processing key while improving the data processing speed.

[0049] In actual application scenarios, multiple data encryption algorithms are used. If the processing keys corresponding to multiple data encryption algorithms are centrally saved in the local configuration file, it will cause security risks of data leakage. Figure 3 , Figure 3 is a flow chart of a data processing method provided in an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S201-S205.

[0050] S201, calling a preset function to perform data processing on a processing key to obtain key mapping information corresponding to the processing key.

[0051] In an embodiment of the present application, the processing key is generally a sequence of characters or a numerical value used for encryption, decryption or other data protection operations. For example, in a symmetric encryption algorithm, the sender and the receiver share the same processing key for encryption and decryption operations on data. A preset function refers to a predefined one or a group of mathematical formulas, algorithms or program logic for operating on processing keys. Preset functions may include encryption functions, hash functions, transformation functions and encoding functions, etc. The specific type of the preset function can be selected according to the actual business scenario and is not specifically limited here. The mapping information is used to quickly locate the processing key corresponding to the data encryption algorithm used by the business server in the key server.

[0052] In this embodiment, the above S201 is described in detail by taking the preset function as a hash function as an example. Please refer to the following steps:

[0053] The preset hash function is called to perform data mapping on the processing key to obtain a key hash value corresponding to the processing key (not shown in the figure).

[0054] Specifically, a preset hash function is called through a preset key mapping service, such as the Secure Hash Algorithm 256-bit (SHA-256), and the processing key is used as input data. The hash function performs operations such as padding, multi-round bit operations, and permutation on the processing key according to its internal established operation rules, and finally outputs a fixed-length key hash value.

[0055] Exemplarily, the SHA-256 hash function is used to encrypt the processing key to obtain a 256-bit binary data, and the 256-bit binary data is converted into a hexadecimal form for easy viewing and subsequent use.

[0056] Key mapping information corresponding to the processing key is generated based on the key hash value (not shown in the figure).

[0057] Specifically, after the key hash value is obtained to generate the corresponding key mapping information, the key mapping service will establish a mapping relationship between the key hash value and the processing key according to a pre-set association rule.

[0058] Exemplarily, there is a processing key for encrypting the user login password. After calling a SHA-256 hash function for data mapping in S203, a specific key hash value is obtained, such as "6a8c123d5e9f0b4" (hexadecimal representation for example only), and then a corresponding mapping relationship is established between the key hash value and the processing key.

[0059] S202: Store the processing key in the key server.

[0060] Specifically, the key hash value obtained in S201 is used as the key mapping information corresponding to the processing key. The processing key and the generated key mapping information are stored together in the key server, so that the processing key can be quickly located and used when it is needed later.

[0061] S203, generating a key query statement based on the key hash value.

[0062] S204: Execute a key query statement based on the key server to determine a processing key corresponding to the key hash value.

[0063] Specifically, when the business server is in processing operation status, it executes a preset key mapping service to obtain at least one key hash value from the mapping information, and generates a key query statement based on the key hash value to obtain from the key server the processing key required for encrypting and decrypting the target data based on a preset data encryption algorithm.

[0064] For example, assuming that the key hash value is "6a8c123d5e9f0b4a", the key query statement generated is "SELECT processing_key FROM key_table WHERE key_hash_value = '6a8c123d5e9f0b4a'", which means searching the processing key "processing_key" corresponding to the key hash value equal to "6a8c123d5e9f0b4a" from the key table named "key_table".

[0065] The key query statement is sent to the key server in the form of a request. After receiving the request, the key server executes the key query statement to perform the query operation in the key storage database managed by the key server to determine the processing key corresponding to the key hash value of "6a8c123d5e9f0b4a", and returns the processing key to the business server as response data.

[0066] S205: Save the processing key to a preset cache of the business server.

[0067] Specifically, after receiving the response data from the key server, the business server extracts the processing key from the response data, and loads the processing key into a preset cache unit for storage, so as to improve the encryption and decryption operations of the target data.

[0068] As can be seen from the above, by storing the processing key in the key server, the processing key can be prevented from being illegally obtained or tampered with in the business service environment. By using a preset hash function to generate a key hash value, a hash value with a fixed length and obvious uniqueness is easy to identify and index, and the key mapping information generated on this basis further improves the construction of the corresponding relationship. A query statement is generated based on the hash value and executed by the key server to determine the corresponding processing key, making the entire search process standardized and efficient. Finally, the processing key is saved to the preset cache of the business server, which reduces the number of times the key is frequently obtained from the key server and improves business processing efficiency.

[0069] To improve the processing speed of target data. Figure 4 , Figure 4 is a flow chart of a data processing method provided in an embodiment of the present application. Figure 4 As shown, the method of the embodiment of the present application may include the following steps S301-S307.

[0070] S301, calling a processing key based on a business operation type to perform encryption and decryption processing on target data of a business processing request, and calling the encrypted and decrypted target data to execute a business processing flow corresponding to the business processing request.

[0071] Specifically, the execution process of S301 please refer to the above S103, which will not be described in detail here.

[0072] S302: If the business operation type is a write operation type for target data, obtain key plaintext data carried in the business processing request.

[0073] In an embodiment of the present application, the Interceptor interceptor in the persistence layer framework MyBatis is used to intercept and process write operation type and read operation type operations, that is, when the target data is written to the database or read from the database, the execution process of the read and write operations is intercepted by the Interceptor interceptor, and when entering the data processing stage after the interception, the processing key is called to encrypt and decrypt the target data, so as to ensure the security of the target data during the database storage and reading process, and avoid the risk of leakage that may be caused by the target data existing in plain text.

[0074] Specifically, a business key field is extracted from the business processing request, and the business operation type of the business processing request is determined according to the business key field. For example, if the business key field includes business key fields such as "update", "insert" and "delete", the business operation type is determined to be a write operation type for target data. At this time, the key plaintext data that has not been encrypted is extracted from the business processing request.

[0075] S303, calling the processing key to encrypt the key plaintext data to generate key ciphertext data.

[0076] S304, storing the key ciphertext data in a database.

[0077] Specifically, in S303-S304, after determining that the business operation type is a write operation type and successfully extracting the key plaintext data, obtain the processing key from the cache and call the encryption algorithm that matches the processing key. Among them, common encryption algorithms include symmetric encryption algorithms such as Advanced Encryption Standard (AES) and block encryption algorithms (Symmetric Encryption Algorithm4, SM4), etc. The specific encryption algorithm to be selected will be determined according to the actual business scenario and is not specifically limited here. Then, the extracted key plaintext data is used as the input content of the encryption algorithm.

[0078] In a symmetric encryption algorithm, the key is processed and the plaintext data is iterated multiple times according to the established substitution, obfuscation and other operation logics to convert the readable key plaintext data into key ciphertext data that cannot be directly identified, and the key ciphertext data is saved in a preset database for storage.

[0079] S305: If the business operation type is a read operation type for target data, obtain key ciphertext data requested by the business processing request.

[0080] In an embodiment of the present application, the Interceptor interceptor in the persistence layer framework MyBatis is used to intercept and process write operation type and read operation type operations. That is, when the target data is written to the database or read from the database, the execution process of the read and write operations is intercepted by the Interceptor interceptor, and the processing key is called in the data processing stage to encrypt and decrypt the target data, so as to ensure the security of data in the database storage and reading process, and avoid the risk of leakage that may be caused by the existence of data in plain text.

[0081] Specifically, a business key field is extracted from the business processing request, and the business operation type of the business processing request is determined according to the business key field. For example, if the business key field includes business key fields such as "query", the business operation type is determined to be a read operation type for target data. At this time, the encrypted key ciphertext data requested by the business processing request is extracted from the business processing request.

[0082] S306, calling the processing key to decrypt the key ciphertext data to generate key plaintext data.

[0083] S307, returning the key plaintext data as response data of the business processing request.

[0084] Specifically, in S306-S307, after determining that the business operation type is a read operation type and successfully extracting the key ciphertext data from the database, the processing key is obtained from the cache and the encryption algorithm matching the processing key is called. The encryption algorithm is not specifically limited here, and the extracted key ciphertext data is used as the input content of the encryption algorithm.

[0085] In a symmetric encryption algorithm, the key is processed and the plaintext data is iterated multiple times according to the established substitution, obfuscation and other operation logics to convert the key ciphertext data that cannot be directly identified into the key plaintext data that can be identified, and the key plaintext data is returned as the response data.

[0086] Please also read Figure 5 , Figure 5 Schematic diagram of a data processing method provided in an embodiment of the present application. Figure 5 As shown in the figure: For the read operation type, the key ciphertext data existing in the database is decrypted by calling the processing key, and the key plaintext data is generated and returned to the client. For the write operation type, the key plaintext data is encrypted by the processing key, and the key ciphertext data is generated and saved in the database. The whole process reflects that in database operations, whether it is a read operation or a write operation, the target data needs to be processed. The key plaintext data is encrypted and decrypted by the processing key to ensure the security of the data during storage and reading, prevent data leakage or tampering, and thus ensure the data security and integrity of the business processing request in the database operation.

[0087] As can be seen from the above, when the business operation type is a write operation type, the key plaintext data is obtained and encrypted into ciphertext data and then stored in the database, which can ensure the security of the target data. Even if the database is illegally accessed, the attacker only obtains ciphertext that cannot be directly deciphered, preventing the target data from being leaked. For the read operation type, the key ciphertext data is obtained and decrypted into key plaintext data as a response, which can meet the business needs under the premise of ensuring data security. Throughout the process, the confidentiality and integrity of the target data during the business processing process are ensured by processing the key for encryption and decryption operations.

[0088] To improve the overall business processing speed. Figure 6 , Figure 6 is a flow chart of a data processing method provided in an embodiment of the present application. Figure 6 As shown, the method of the embodiment of the present application may include the following steps S401-S405.

[0089] S401, obtaining request parameters carried by the business processing request.

[0090] S402: extracting a service keyword from the request parameter, and determining a processing type corresponding to the service processing request based on the service keyword.

[0091] Specifically, in S401-S402, when the business server receives the business processing request, it first parses the business processing request and obtains the request parameters carried therein, wherein the request parameters are contained in the request header, request body or uniform resource locator, depending on the transmission protocol and format of the business request. For example, in a request based on the HTTP protocol, the request parameters may exist in the form of form data, query string or custom HTTP header field.

[0092] The processing type corresponding to the business processing request is determined based on the extracted business keywords. If the business keywords contain words such as "query", "get", "retrieve" and the like that indicate the meaning of obtaining data, the processing type of the business processing request is determined to be a read operation type; if the business keywords contain words such as "update", "insert", "delete" and the like that indicate the meaning of modifying data, the processing type of the business processing request is determined to be a write operation type.

[0093] Exemplarily, if the extracted business keyword is "query_user_balance", the processing type is a read operation type, that is, reading user balance data from the database; if the business keyword is "update_user_password", the processing type is a write operation type, that is, modifying user password data.

[0094] S403, obtaining a processing key corresponding to the target data from a preset cache.

[0095] Specifically, the specific execution process of S403 please refer to the above step S102, which will not be repeated here.

[0096] S404, calling a processing key based on the business operation type to perform encryption and decryption processing on the target data of the business processing request, and calling the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request.

[0097] Specifically, the specific execution process of S403 please refer to the above step S103, which will not be repeated here.

[0098] S405: If the business server enters a stopped state, the processing key corresponding to the target data is deleted from a preset cache.

[0099] Specifically, when the business server is running, the operating status of the server is monitored in real time by calling the preset monitoring mechanism. When the business server is detected to be in a stopped state, whether the stopped state is caused by a normal shutdown operation or an unexpected failure (such as a server hardware failure that causes the server to stop normally, a server program downtime or a service crash, etc.), or it is in a planned maintenance shutdown phase, the location of the processing key required to process the target data will be located in the preset cache and a deletion operation will be performed. The purpose of this is to prevent the processing key from remaining in the cache and being accidentally obtained. At the same time, the system will also clear all reference records and index information related to it, such as the pointer to the key in the cache, the metadata recording its cache location, etc., to avoid any data residue, thereby eliminating security vulnerabilities that may be caused by residual data in the future.

[0100] As can be seen from the above, by obtaining the request parameters of the business processing request and then extracting the business keywords to determine the processing type, we can accurately distinguish between read and write operations so that the business process can be followed up in an orderly and efficient manner, avoiding waste of resources and data processing confusion caused by misjudgment. By deleting the processing key corresponding to the target data when the business server enters the stopped state, data security is guaranteed while freeing up cache space to avoid useless data occupation. In subsequent scenarios such as server restart, the cache can better serve new business requests and improve overall operating efficiency.

[0101] based on Figure 1 The following is a schematic diagram of the scene. Figure 7 , the data processing device provided in the embodiment of the present application is introduced in detail. It should be noted that, Figure 7 The data processing device in the present application is used to execute Figure 2-Figure 6 For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the present application. Figure 2-Figure 6 In the embodiment shown, the data processing device 500 may include a request acquisition unit 501, a key acquisition unit 502, and a data processing unit 503, as follows:

[0102] The request acquisition unit 501 is used to acquire the service processing request for the target data sent by the client and determine the processing type of the service processing request;

[0103] The key acquisition unit 502 is used to acquire the processing key corresponding to the target data from the preset cache. The processing key is the key requested from the key server based on the pre-generated key mapping information when the business server enters the running state. The key mapping information is pre-stored information that has a mapping relationship with the processing key;

[0104] The data processing unit 503 is used to call the processing key based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and call the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request.

[0105] In some embodiments, the request obtaining unit 501 further includes a function calling unit and a first storage unit.

[0106] A function calling unit, used for calling a preset function to perform data processing on a processing key, and obtaining key mapping information corresponding to the processing key;

[0107] The first storage unit is used to store the processing key in the key server.

[0108] In some embodiments, the request acquisition unit 501 further includes a function execution unit and an information generation unit.

[0109] A function execution unit, used for calling a preset hash function to perform data mapping on the processing key to obtain a key hash value corresponding to the processing key;

[0110] The information generating unit is used to generate key mapping information corresponding to the processing key based on the key hash value.

[0111] In some embodiments, the request acquisition unit 501 further includes a statement generation unit, a statement execution unit, and a second storage unit.

[0112] A statement generating unit, used for generating a key query statement based on a key hash value;

[0113] A statement execution unit, configured to execute a key query statement based on a key server to determine a processing key corresponding to a key hash value;

[0114] The second storage unit is used to save the processing key to a preset cache of the business server.

[0115] In some embodiments, the data processing unit 503 further includes a first determining unit, a first calling unit and a third storage unit.

[0116] A first determination unit, configured to obtain key plaintext data carried in the business processing request if the processing type is a write operation type for target data;

[0117] A first calling unit, used for calling a processing key to encrypt key plaintext data to generate key ciphertext data;

[0118] The third storage unit is used to store the key ciphertext data in the database.

[0119] In some embodiments, the request data processing unit 503 further includes a second determination unit, a second calling unit, and a data returning unit.

[0120] A second determination unit is configured to obtain key ciphertext data requested by the business processing request if the processing type is a read operation type for target data;

[0121] A second calling unit, used for calling a processing key to decrypt key ciphertext data to generate key plaintext data;

[0122] The data return unit is used to return the key plaintext data as the response data of the business processing request.

[0123] In some embodiments, the request acquisition unit 501 also includes a graph request parameter acquisition unit and a type determination unit.

[0124] A request parameter acquisition unit, used to acquire the request parameters carried by the business processing request;

[0125] The type determination unit is used to extract the service keyword from the request parameter and determine the processing type corresponding to the service processing request based on the service keyword.

[0126] In some embodiments, the data processing unit 503 further includes a third determination unit.

[0127] The third determination unit is configured to delete the processing key corresponding to the target data from the preset cache if the service server enters a stopped state.

[0128] In the embodiment of the present application, by obtaining the business processing request sent by the client and determining the processing type corresponding to the business processing request, it is possible to ensure that the business processing request is correctly processed. By generating the mapping information corresponding to the processing key and saving the processing key to the key server in the cloud, the security of the processing key during the business execution process can be improved. By dynamically obtaining the processing key from the key server based on the pre-generated key mapping information when the business server starts the processing and storing it in the preset cache to perform encryption and decryption operations on the target data, the processing key is called according to the processing type of the business processing request to perform encryption and decryption processing on the target data, thereby preventing the leakage of the processing key while improving the data processing speed.

[0129] In addition, the data processing device provided in the above embodiment and a data processing method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0130] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0131] See also Figure 8 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 8 As shown, the electronic device 600 includes a processor 601 and a memory 602. The processor 601 is electrically connected to the memory 602.

[0132] The processor 601 is the control center of the electronic device 600 and may include one or more processing cores. The processor 601 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions of the electronic device and processes data by running or calling computer programs stored in the memory 602, and calling data stored in the memory 602, so as to control the electronic device as a whole. Optionally, the processor 601 can be implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 601 can integrate one or a combination of CPU, graphics processing unit (GPU), modem, etc. Among them, the CPU mainly processes the operating system, user pages, and applications; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 601, and may be implemented separately through a communication chip.

[0133] The memory 602 may be used to store software programs and modules, and the processor 601 executes various functional applications and data processing by running computer programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, a computer program required for at least one function, etc.; the data storage area may store data created according to the use of the electronic device, etc.

[0134] In addition, the memory 602 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.

[0135] In the embodiment of the present application, the processor 601 in the electronic device 600 loads instructions corresponding to the processes of one or more computer programs into the memory 602 according to the following steps, and the processor 601 runs the computer program stored in the memory 602, thereby realizing various functions, as follows:

[0136] Obtaining a business processing request for target data sent by a client, and determining a processing type of the business processing request;

[0137] Obtaining a processing key corresponding to the target data from a preset cache, where the processing key is a key requested from a key server based on pre-generated key mapping information when the business server enters a running state, and the key mapping information is pre-stored information that has a mapping relationship with the processing key;

[0138] Based on the processing type, the processing key is called to encrypt and decrypt the target data of the business processing request, and the encrypted and decrypted target data is called to execute the business processing flow corresponding to the business processing request.

[0139] Optionally, before obtaining the processing key corresponding to the target data from the preset cache, the processor 601 specifically executes: calling a preset function to perform data processing on the processing key to obtain key mapping information corresponding to the processing key; and storing the processing key in the key server.

[0140] Optionally, the processor 601 executes calling a preset function to perform data processing on the processing key to obtain key mapping information corresponding to the processing key, and specifically executes: calling a preset hash function to perform data mapping on the processing key to obtain a key hash value corresponding to the processing key; and generating key mapping information corresponding to the processing key based on the key hash value.

[0141] Optionally, the processor 601 obtains the processing key corresponding to the target data from the preset cache by: generating a key query statement based on the key hash value; executing the key query statement based on the key server to determine the processing key corresponding to the key hash value; and saving the processing key to the preset cache of the business server.

[0142] Optionally, the processor 601 performs encryption and decryption processing on the target data of the business processing request based on the processing type by calling the processing key, and calls the target data after the encryption and decryption processing to execute the business processing flow corresponding to the business processing request, specifically performing: if the processing type is a write operation type for the target data, then obtaining the key plaintext data carried in the business processing request; calling the processing key to encrypt the key plaintext data to generate key ciphertext data; and storing the key ciphertext data in the database.

[0143] Optionally, the processor 601 performs encryption and decryption processing on the target data of the business processing request by calling the processing key based on the processing type, and calls the target data after the encryption and decryption processing to execute the business processing flow corresponding to the business processing request, specifically performing: if the processing type is a read operation type for the target data, then obtaining the key ciphertext data requested by the business processing request; calling the processing key to decrypt the key ciphertext data to generate key plaintext data; and returning the key plaintext data as response data of the business processing request.

[0144] Optionally, the processor 601 obtains the business processing request for the target data sent by the client and determines the processing type of the business processing request. Specifically, it performs: obtaining the request parameters carried by the business processing request; extracting business keywords from the request parameters, and determining the processing type corresponding to the business processing request based on the business keywords.

[0145] Optionally, after executing the business processing flow corresponding to the business processing request for the target data after the encryption and decryption processing, the processor 601 is also used to specifically execute: if the business server enters a stopped state, the processing key corresponding to the target data is deleted from a preset cache.

[0146] In the embodiment of the present application, by obtaining the business processing request sent by the client and determining the processing type corresponding to the business processing request, it is possible to ensure that the business processing request is correctly processed. By generating the mapping information corresponding to the processing key and saving the processing key to the key server in the cloud, the security of the processing key during the business execution process can be improved. By dynamically obtaining the processing key from the key server based on the pre-generated key mapping information when the business server starts the processing and storing it in the preset cache to perform encryption and decryption operations on the target data, the processing key is called according to the processing type of the business processing request to perform encryption and decryption processing on the target data, thereby preventing the leakage of the processing key while improving the data processing speed.

[0147] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is run on a computer, the computer executes the above-mentioned related method steps to implement a data processing method provided by the above-mentioned embodiment.

[0148] In addition, the device provided in the embodiment of the present application may specifically be a chip, component or module, and the chip may include a connected processor and memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a data processing method provided in the above embodiment.

[0149] An embodiment of the present application also provides a computer-readable storage medium, in which a computer program code is stored. When the computer program code is executed on a computer, the computer executes the above-mentioned related method steps to implement a data processing method provided by the above-mentioned embodiment.

[0150] An embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is enabled to execute the above-mentioned related steps to implement a data processing method provided by the above-mentioned embodiment.

[0151] Among them, the device, computer-readable storage medium, computer program product or chip provided in the embodiments of the present application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0152] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0153] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between the related ones shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0154] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: Applied to a business server, the method comprises: Obtaining a business processing request for target data sent by a client, and determining a processing type of the business processing request; Obtaining a processing key corresponding to the target data from a preset cache, wherein the processing key is a key requested from a key server based on pre-generated key mapping information when the business server enters a running state, wherein the key mapping information is pre-stored information having a mapping relationship with the processing key; The processing key is called based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and the encrypted and decrypted target data is called to execute the business processing flow corresponding to the business processing request.

2. The method according to claim 1, characterized in that Before obtaining the processing key corresponding to the target data from the preset cache, the method includes: Calling a preset function to perform data processing on the processing key to obtain key mapping information corresponding to the processing key; The processing key is stored in a key server.

3. The method according to claim 2, characterized in that The calling of a preset function to perform data processing on the processing key to obtain key mapping information corresponding to the processing key includes: Calling a preset hash function to perform data mapping on the processing key to obtain a key hash value corresponding to the processing key; The key mapping information corresponding to the processing key is generated based on the key hash value.

4. The method according to any one of claims 1 to 3, characterized in that: The obtaining the processing key corresponding to the target data from the preset cache includes: Generate a key query statement based on the key hash value; Executing the key query statement based on the key server to determine the processing key corresponding to the key hash value; The processing key is saved in a preset cache of the service server.

5. The method according to claim 1, characterized in that: The calling of the processing key based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and calling the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request, includes: If the processing type is a write operation type for the target data, obtaining key plaintext data carried in the business processing request; Calling the processing key to encrypt the key plaintext data to generate key ciphertext data; The key ciphertext data is stored in a database.

6. The method according to claim 5, characterized in that The calling of the processing key based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and calling the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request, includes: If the processing type is a read operation type for the target data, obtaining the key ciphertext data requested by the business processing request; Calling the processing key to decrypt the key ciphertext data to generate the key plaintext data; The key plaintext data is returned as response data of the business processing request.

7. The method according to claim 1, characterized in that The obtaining of the service processing request for the target data sent by the client and determining the processing type of the service processing request includes: Obtaining request parameters carried by the business processing request; A service keyword is extracted from the request parameter, and the processing type corresponding to the service processing request is determined based on the service keyword.

8. The method according to claim 1, characterized in that After calling the encrypted and decrypted target data to execute the business processing flow corresponding to the business processing request, the method further includes: If the service server enters a stopped state, the processing key corresponding to the target data is deleted from the preset cache.

9. A data processing device, characterized in that: Applied to business servers, including: A request acquisition unit, used to acquire a service processing request for target data sent by a client, and determine a processing type of the service processing request; A key acquisition unit, used to acquire a processing key corresponding to the target data from a preset cache, wherein the processing key is a key requested from a key server based on pre-generated key mapping information when the business server enters a running state, wherein the key mapping information is pre-stored information having a mapping relationship with the processing key; The data processing unit is used to call the processing key based on the processing type to perform encryption and decryption processing on the target data of the business processing request, and call the target data after encryption and decryption processing to execute the business processing flow corresponding to the business processing request.

10. An electronic device, characterized in that: The electronic device comprises: A memory for storing executable program codes; A processor, configured to call and run the executable program code from the memory, so that the electronic device executes the data processing method as claimed in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the data processing method according to any one of claims 1 to 8 is implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 8 is implemented.

Images