Storage system, data processing method, data processing unit and program product

Abstract

The present invention discloses a storage system, a data processing method, a data processing unit, and a program product, relating to the field of storage technology. The server, storage controller, and separate storage in this storage system have corresponding data processing units, and data encryption and decryption services can be offloaded to each data processing unit, freeing up computing resources of the server, storage controller, and separate storage, and enabling unified management and control of data encryption through the data processing unit. Furthermore, dynamic encryption in data transmission and static encryption in data storage can be implemented based on the data processing unit, thereby more effectively achieving full-link data encryption in the storage system.

Description

Technical Field

[0001] The present invention relates to the field of storage technology, and in particular to a storage system, a data processing method, a data processing unit and a program product. Background Art

[0002] In data centers, ensuring full encryption of data transmission and storage is crucial for effective data security. In related technologies, data encryption is typically implemented independently by each device in the storage chain (such as servers and storage controllers). However, data encryption consumes significant computing resources, potentially leading to significant performance degradation for these devices. Furthermore, having each device independently implement data encryption hinders inter-device connectivity and prevents unified management and control of data encryption.

[0003] In view of this, how to prevent each device in the storage link from implementing data encryption on its own is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0004] The present invention provides a storage system, a data processing method, a data processing unit, and a program product to offload data encryption and decryption services to a server, a storage controller, and a data processing unit in a separate storage. This can free up the computing resources of the server, the storage controller, and the separate storage, and is conducive to the unified management and control of data encryption.

[0005] To solve the above technical problems, the present invention provides a storage system, including a server, a storage controller, and a separate storage, wherein the server has a first data processing unit, the storage controller has a second data processing unit and a third data processing unit, and the separate storage has a fourth data processing unit;

[0006] One end of the first data processing unit and the second data processing unit is used to encrypt the interactive data between the server and the storage controller using the first preset key and the first preset encryption parameter, transmit the encrypted data to the other end of the first data processing unit and the second data processing unit, and decrypt the interactive data between the server and the storage controller sent by the other end;

[0007] One end of the third data processing unit and the fourth data processing unit is used to encrypt the interactive data between the storage controller and the separate storage using the second preset key and the second preset encryption parameter, and transmit the encrypted data to the other end of the third data processing unit and the fourth data processing unit, and decrypt the interactive data between the storage controller and the separate storage sent by the other end;

[0008] The fourth data processing unit is further configured to use the third preset key to encrypt the data written into the separate storage and to decrypt the data read out of the separate storage.

[0009] The present invention further provides a data processing method, which is applied to the first data processing unit in the above storage system, and the method includes:

[0010] Receiving first plaintext data sent by the server, encrypting the first plaintext data into first ciphertext data using a first preset key and a first preset encryption parameter, and sending the first ciphertext data to the second data processing unit;

[0011] The second ciphertext data sent by the second data processing unit is received, the second ciphertext data is decrypted into second plaintext data using the first preset key and the first preset encryption parameter, and the second plaintext data is sent to the server.

[0012] The present invention further provides a data processing method, which is applied to the second data processing unit in the above storage system, and the method comprises:

[0013] receiving first ciphertext data sent by the first data processing unit, decrypting the first ciphertext data into first plaintext data using a first preset key and a first preset encryption parameter, and sending the first plaintext data to the storage controller;

[0014] The second plaintext data sent by the storage controller is received, the second plaintext data is encrypting into second ciphertext data using the first preset key and the first preset encryption parameter, and the second ciphertext data is sent to the first data processing unit.

[0015] The present invention further provides a data processing method, which is applied to the third data processing unit in the above storage system, and the method includes:

[0016] receiving third plaintext data sent by the storage controller, encrypting the third plaintext data into third ciphertext data using the second preset key and the second preset encryption parameter, and sending the third ciphertext data to the fourth data processing unit;

[0017] Receive fourth ciphertext data sent by the fourth data processing unit, decrypt the fourth ciphertext data into fourth plaintext data using the second preset key and the second preset encryption parameter, and send the fourth plaintext data to the storage controller.

[0018] The present invention further provides a data processing method, which is applied to the fourth data processing unit in the above storage system, and the method includes:

[0019] receiving third ciphertext data sent by the third data processing unit, decrypting the third ciphertext data into third plaintext data using the second preset key and the second preset encryption parameter, encrypting the third plaintext data into fifth ciphertext data using the third preset key, and writing the fifth ciphertext data into the separate storage;

[0020] Receive the sixth ciphertext data sent by the separate storage, decrypt the sixth ciphertext data into fourth plaintext data using the third preset key, encrypt the fourth plaintext data into fourth ciphertext data using the second preset key and the second preset encryption parameter, and send the fourth ciphertext data to the third data processing unit.

[0021] The present invention also provides a data processing unit, comprising:

[0022] A processor module, the processor module having an encryptor;

[0023] A programmable logic device module having a network transmission module and connected to a server, a storage controller or a separate storage;

[0024] The processor module and the programmable logic device module are used to execute the above data processing method.

[0025] The present invention also provides a computer program product, comprising a computer program or instructions, which implements the above-mentioned data processing method when executed by a processor.

[0026] The present invention also provides a non-volatile computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the above-mentioned data processing method is implemented.

[0027] The beneficial effects of the present invention are as follows: In this storage system, the server, storage controller, and separate storage have corresponding data processing units, namely, the server has a first data processing unit, the storage controller has a second data processing unit and a third data processing unit, and the separate storage has a fourth data processing unit. Among them, either the first data processing unit and the second data processing unit are used to encrypt the interactive data between the server and the storage controller using a first preset key and a first preset encryption parameter, and transmit the data to the other end of the first data processing unit and the second data processing unit, and decrypt the interactive data between the server and the storage controller sent by the other end, so as to ensure the security of data transmission between the server and the storage controller. Either the third data processing unit and the fourth data processing unit are used to encrypt the interactive data between the storage controller and the separate storage using a second preset key and a second preset encryption parameter, and transmit the data to the other end of the third data processing unit and the fourth data processing unit, and decrypt the interactive data between the storage controller and the separate storage sent by the other end, so as to ensure the security of data transmission between the storage controller and the separate storage. The fourth data processing unit can also use the third preset key to encrypt data written to the separate storage and decrypt data read from the separate storage. In this way, the present invention can offload data encryption and decryption services to various data processing units, free up computing resources of servers, storage controllers, and separate storage, and enable unified management and control of data encryption through data processing units; in addition, dynamic encryption in data transmission and static encryption in data storage can be implemented based on the above-mentioned data processing units, thereby more effectively realizing full-link data encryption in the storage system.

[0028] The present invention also provides a data processing method, a data processing unit, a computer program product, and a non-volatile computer-readable storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0030] Figure 1 A structural block diagram of a storage system provided by an embodiment of the present invention;

[0031] Figure 2 A structural block diagram of another storage system provided by an embodiment of the present invention;

[0032] Figure 3 A flowchart of a data processing method applied to a first data processing unit provided in an embodiment of the present invention;

[0033] Figure 4 A flowchart of a data processing method applied to a second data processing unit provided in an embodiment of the present invention;

[0034] Figure 5 A flowchart of a data processing method applied to a third data processing unit according to an embodiment of the present invention;

[0035] Figure 6 A flowchart of a data processing method applied to a fourth data processing unit provided in an embodiment of the present invention;

[0036] Figure 7 A structural block diagram of a data processing unit provided in an embodiment of the present invention;

[0037] Figure 8 A structural block diagram of another data processing unit provided in an embodiment of the present invention;

[0038] Figure 9 A processing flow chart of a data processing unit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0040] It should be noted that, in the description of the present invention, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. The terms "first," "second," etc., in the present invention are used to distinguish similar objects, and are not used to describe a particular order or precedence.

[0041] In order to enable those skilled in the art to better understand the solutions of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0042] In data centers, ensuring full encryption of data during transmission and storage is crucial for effective data security. Encrypting data during transmission is called dynamic encryption, while encrypting data during storage is called static encryption. In related technologies, data encryption is typically implemented independently by each device in the storage chain (such as servers and storage controllers). However, data encryption and decryption consume significant computing resources, potentially leading to significant performance degradation for these devices. Furthermore, having each device independently implement data encryption hinders inter-device connectivity and undermines unified data encryption management.

[0043] In view of this, in order to solve the technical problem of how to avoid each device in the storage link from implementing data encryption on its own, the present invention can provide a storage system that can set up data processing units for servers, storage controllers, and separate storage, can offload data encryption and decryption services to the data processing units, and can achieve unified management and control of data encryption based on these data units.

[0044] The following first introduces the specific structure of the storage system provided by this embodiment. Figure 1 , Figure 1 This is a block diagram of a storage system provided by an embodiment of the present invention. This storage system may include a server 1, a storage controller 2, and a separate storage 3. The following describes the purpose and internal structure of these three devices:

[0045] Server 1 is a client in the storage system, used to write data to or read data from the storage system. A processor 11 and a first data processing unit 11 may be provided therein. The processor 11 and the first data processing unit 11 may be connected using a bus structure, such as a PCIe bus (Peripheral Component Interconnect Express, a high-speed serial computer expansion bus standard).

[0046] The storage controller 2 is used to perform storage service processing, such as data compression, deduplication, caching, and RAID (Redundant Arrays of Independent Disks) processing. It may include a processor 21, a second data processing unit 22, and a third data processing unit 23. The processor 21 may be connected to the second and third data processing units 22 and 23 via a bus structure, such as a PCIe bus. A storage system may include multiple storage controllers 2 to meet multi-controller requirements.

[0047] Separate storage 3 is used for back-end data storage and may include one or more memories 31 and a fourth data processing unit 32. The memories 31 and fourth data processing unit 32 may be connected via a bus structure, such as a PCIe bus. The type of memory 31 can be selected based on actual needs, and may include, for example, a hard disk drive (HDD) or a solid-state drive (SSD).

[0048] Furthermore, in this storage system, the first data processing unit 12, the second data processing unit 22, the third data processing unit 23, and the fourth data processing unit 32 are all of the same type, and there is a communication connection between the first data processing unit 12 and the second data processing unit 22, and between the third data processing unit 23 and the fourth data processing unit 32, such as a network communication connection. The following describes the uses of the first data processing unit 12, the second data processing unit 22, the third data processing unit 23, and the fourth data processing unit 32:

[0049] One end of the first data processing unit 12 and the second data processing unit 22 is used to encrypt the interactive data between the server 1 and the storage controller 2 using the first preset key and the first preset encryption parameter, and transmit the encrypted data to the other end of the first data processing unit 12 and the second data processing unit 22, and decrypt the interactive data between the server 1 and the storage controller 2 sent by the other end;

[0050] One end of the third data processing unit 23 and the fourth data processing unit 32 is used to encrypt the interactive data between the storage controller 2 and the separate storage 3 using the second preset key and the second preset encryption parameter, and transmit the encrypted data to the other end of the third data processing unit 233 and the fourth data processing unit 32, and decrypt the interactive data between the storage controller 2 and the separate storage 3 sent by the other end;

[0051] The fourth data processing unit 32 is further configured to encrypt data written into the separate storage 3 and decrypt data read from the separate storage 3 using the third preset key.

[0052] The first data processing unit 12 and the second data processing unit 22 are both responsible for encryption, decryption and transmission of interactive data between the server 1 and the storage controller 2 .

[0053] Specifically, the first data processing unit 12 can execute: receiving the first plaintext data sent by the server, encrypting the first plaintext data into first ciphertext data using the first preset key and the first preset encryption parameter, and sending the first ciphertext data to the second data processing unit 22; receiving the second ciphertext data sent by the second data processing unit 22, decrypting the second ciphertext data into second plaintext data using the first preset key and the first preset encryption parameter, and sending the second plaintext data to the server 1.

[0054] The second data processing unit 22 can execute: receiving the first ciphertext data sent by the first data processing unit 12, decrypting the first ciphertext data into first plaintext data using the first preset key and the first preset encryption parameter, and sending the first plaintext data to the storage controller 2; receiving the second plaintext data sent by the storage controller 2, encrypting the second plaintext data into second ciphertext data using the first preset key and the first preset encryption parameter, and sending the second ciphertext data to the first data processing unit 12.

[0055] The third data processing unit 23 and the fourth data processing unit 32 are responsible for encrypting, decrypting, and transmitting data exchanged between the storage controller 2 and the separate storage 3. The fourth data processing unit 32 is also responsible for encrypting data written to the separate storage 3 and decrypting data read from the separate storage 3.

[0056] Specifically, the third data processing unit 23 can execute: receiving the third plaintext data sent by the storage controller 2, encrypting the third plaintext data into third ciphertext data using the second preset key and the second preset encryption parameter, and sending the third ciphertext data to the fourth data processing unit 32; receiving the fourth ciphertext data sent by the fourth data processing unit 32, decrypting the fourth ciphertext data into fourth plaintext data using the second preset key and the second preset encryption parameter, and sending the fourth plaintext data to the storage controller 2.

[0057] The fourth data processing unit 32 can execute: receiving the third ciphertext data sent by the third data processing unit 23, decrypting the third ciphertext data into third plaintext data using the second preset key and the second preset encryption parameter, encrypting the third plaintext data into fifth ciphertext data using the third preset key, and writing the fifth ciphertext data into the separate storage 3; receiving the sixth ciphertext data sent by the separate storage 3, decrypting the sixth ciphertext data into fourth plaintext data using the third preset key, encrypting the fourth plaintext data into fourth ciphertext data using the second preset key and the second preset encryption parameter, and sending the fourth ciphertext data to the third data processing unit 23.

[0058] It should be noted that the first and second preset encryption parameters are configuration parameters related to encryption and decryption, such as the encryption algorithm type, encryption mode, and data block size. The first and second preset encryption parameters can be preset within the data processing unit or issued by a device to which the data processing unit belongs. This embodiment does not limit the specific content of the first and second preset encryption parameters, and they can be set according to the specific needs of data transmission and data storage. The first and second preset encryption parameters can be different.

[0059] It should also be noted that the first preset key and the second preset key are communication keys used during data communication, and the third preset key is a storage key used during data storage. The first preset key, the second preset key, and the third preset key may be different. In addition, the first preset key, the second preset key, and the third preset key may be preset keys within each data processing unit, or may be provided by other devices. For example, the first preset key may be a hardware built-in key of server 1 and storage controller 2, the second preset key may be a hardware built-in key of storage controller 2 and separate storage 3, and the third preset key may be a hardware built-in key of separate storage 3. In this case, each data processing unit needs to obtain the preset key from the device to which it belongs. For another example, a unified management server may be set up to allocate and manage the first preset key, the second preset key, and the third preset key, and then each data processing unit needs to request the corresponding preset key from the management server.

[0060] As can be seen from the above embodiment, data encryption in motion and data encryption at rest on the storage link between server 1, storage controller 2, and separate storage 3 can be offloaded to the data processing unit (DPU) in each device. Specifically, the first data processing unit 12 and the second data processing unit 22 are responsible for encrypting and decrypting data exchanged between server 1 and storage controller 2, as well as for encrypted transmission. The third data processing unit 23 and the fourth data processing unit 32 are responsible for encrypting and decrypting data exchanged between storage controller 2 and separate storage 3, as well as for encrypted transmission. Furthermore, the fourth data processing unit 32 can also independently encrypt data written to separate storage 3 and decrypt data read from separate storage 3. This ensures that data is encrypted during both transmission and storage, achieving full-link encryption for data storage and ensuring secure data transmission and storage. Furthermore, offloading the heavy data encryption and decryption tasks to dedicated hardware devices (i.e., data processing units) reduces the burden on server 1, storage controller 2, and separate storage 3. Most importantly, by offloading the data encryption and decryption tasks to the data processing unit, unified management and control of the data encryption and decryption business can be achieved through the data processing unit, and scalability can be improved. For example, operation and maintenance personnel can flexibly manage and adjust the first preset key, the first preset encryption parameter, the second preset key, the second preset encryption parameter and the third preset key based on the above data processing unit to meet different security requirements. In addition, the first data processing unit, the second data processing unit 22, the third data processing unit 23 and the fourth data processing unit 32 are all the same, which means that the functions of each data processing unit can be uniformly upgraded, such as the types of encryption algorithms that can be supported by the data processing unit. Therefore, this embodiment can not only effectively avoid using the server 1, storage controller 2 and separate storage 3 to perform data encryption and decryption themselves, but also improve the unified management and control of data encryption and decryption business and flexibility.

[0061] It should be noted that Figure 1 The illustrated structure is the simplest possible one. In other cases, the storage system may include other devices, and server 1, storage controller 2, and separate storage 3 may also have other components within them. These components can be configured based on actual application requirements. For example, server 1 and storage controller 2 may also include memory (DRAM, Dynamic Random Access Memory).

[0062] In another embodiment, in order to facilitate the management and control of data encryption and decryption services, a management server may be further provided in the storage system, which is used to manage at least the first preset key, the second preset key and the third preset key. Figure 2 , Figure 2This is a structural block diagram of another storage system provided by an embodiment of the present invention. Figure 2 In the embodiment, the system may further include a management server 4, and the first data processing unit 12, the second data processing unit 22, the third data processing unit 23 and the fourth data processing unit 32 establish communication connections with the management server 4. At this time:

[0063] The first data processing unit 12 is further configured to obtain a first preset key from the management server 4 according to the communication information of the second data processing unit 22;

[0064] The second data processing unit 22 is further configured to obtain a first preset key from the management server 4 according to the communication information of the first data processing unit 12;

[0065] The third data processing unit 23 is further configured to obtain a second preset key from the management server 4 according to the communication information of the fourth data processing unit 32;

[0066] The fourth data processing unit 32 is further configured to obtain the second preset key from the management server 4 according to the communication information of the third data processing unit 23 , and obtain the third preset key from the management server 4 .

[0067] As can be seen, in this embodiment, the first, second, and third preset keys are all allocated by management server 4. In this case, each data processing unit no longer needs to request keys from its respective devices. Furthermore, server 1, storage controller 2, and separate storage 3 no longer need to consider providing keys for the data processing units. Instead, they only need to distribute the preset encryption parameters that represent the encryption requirements to each data processing unit. This further decouples data encryption and decryption services from server 1, storage controller 2, and separate storage 3.

[0068] It is worth noting that, unlike traditional communication methods, the first preset key and the second preset key used for data transmission in this embodiment are not negotiated between the data processing units, but can be requested from the management server 4. In this way, the data processing units can avoid negotiating communication keys, which can improve the communication efficiency between the data processing units, for example, improving the efficiency of reestablishing communication after a device disconnection.

[0069] At the same time, when requesting a preset key, the data processing unit can use the communication information of the communication peer to request the preset key from the management server 4, so that the management server 4 can perceive the communication relationship between the data processing units and assign a preset key to the communication relationship. In this way, the management server 4 can effectively manage the communication relationship between the data processing units and the communication key of the communication relationship, which can improve the uniformity of management and control.

[0070] For example, in an initial situation, when the first data processing unit 12 is about to communicate with the second data processing unit 22, it can obtain the first preset key from the management server 4 based on the communication information (such as the IP address) of the second data processing unit 22. At this point, the management server 4 can sense that the first data processing unit 12 is about to communicate with the second data processing unit 22, and can then record the communication relationship between the first data processing unit 12 and the second data processing unit 22, assign the first preset key to the communication relationship, and send the first preset key to the first data processing unit 12. The first data processing unit 12 can then use the obtained first preset key to send encrypted data to the second data processing unit 22.

[0071] Subsequently, upon receiving the ciphertext data, the second data processing unit 22 can obtain the first preset key from the management server 4 based on the communication information of the first data processing unit. At this point, since the management server 4 has already allocated the first preset key for communication between the first data processing unit 12 and the second data processing unit 22, it can directly send the first preset key to the second data processing unit 22. The second data processing unit 22 can then use the obtained first preset key to decrypt the ciphertext data.

[0072] Of course, in addition to allocating keys to data processing units, the management server 4 can also perform other processing operations. For example, the management server 4 can detect the validity period of the preset key and, when it determines that the preset key has expired, re-issue the preset key to the corresponding data processing unit. In addition, the management server 4 can also manage and control the preset encryption parameters used between data processing units to further separate the data encryption and decryption services from the server 1, storage controller 2, and separate storage 3. In addition, when the management server 4 receives a key request sent by a data processing unit, it can also detect whether the communication relationship between the data processing units is prohibited. If it is not prohibited, the key can be allocated; otherwise, the key allocation can be refused.

[0073] Based on the above embodiment, in this storage system, the server, storage controller, and separate storage have corresponding data processing units, that is, the server has a first data processing unit, the storage controller has a second data processing unit and a third data processing unit, and the separate storage has a fourth data processing unit. Among them, either the first data processing unit or the second data processing unit is used to encrypt the interactive data between the server and the storage controller using a first preset key and a first preset encryption parameter, and transmit it to the other end of the first data processing unit or the second data processing unit, and decrypt the interactive data between the server and the storage controller sent by the other end, so as to ensure the security of data transmission between the server and the storage controller. Either the third data processing unit or the fourth data processing unit is used to encrypt the interactive data between the storage controller and the separate storage using a second preset key and a second preset encryption parameter, and transmit it to the other end of the third data processing unit or the fourth data processing unit, and decrypt the interactive data between the storage controller and the separate storage sent by the other end, so as to ensure the security of data transmission between the storage controller and the separate storage. The fourth data processing unit can also use the third preset key to encrypt data written to the separate storage and decrypt data read from the separate storage. In this way, the present invention can offload data encryption and decryption services to various data processing units, free up computing resources of servers, storage controllers, and separate storage, and enable unified management and control of data encryption through data processing units; in addition, dynamic encryption in data transmission and static encryption in data storage can be implemented based on the above-mentioned data processing units, thereby more effectively realizing full-link data encryption in the storage system.

[0074] Based on the above embodiment, the execution logic of the first data processing unit is described in detail below. Figure 3 , Figure 3 Flowchart of a data processing method applied to a first data processing unit provided in an embodiment of the present invention. This method may include:

[0075] S31. Receive first plaintext data sent by a server, encrypt the first plaintext data into first ciphertext data using a first preset key and a first preset encryption parameter, and send the first ciphertext data to a second data processing unit.

[0076] S32: Receive second ciphertext data sent by the second data processing unit, decrypt the second ciphertext data into second plaintext data using the first preset key and the first preset encryption parameter, and send the second plaintext data to the server.

[0077] It should be noted that the second plaintext data is sent from the storage controller to the second data processing unit.

[0078] In this embodiment, the interactive data between the server and the storage controller is related to the data storage service. For example, the first plaintext data sent by the server can be a read request or a write request, and the second plaintext data returned by the storage controller can be a request response to the read request or the write request. The first preset encryption parameters are parameters required for data encryption and decryption, such as algorithm type, algorithm mode, data block size, etc. The first preset encryption parameters can be built into the first data processing unit, or provided by the server or the management server. The first preset key is a communication key used for encrypted transmission of interactive data, which can be built into the first data processing unit, or provided by the server or the management server.

[0079] In this step, upon receiving plaintext data from the server, the first data processing unit may encrypt the plaintext data into ciphertext data using the first preset key and the first preset encryption parameters, and then send the ciphertext data to the second data processing unit. Furthermore, upon receiving ciphertext data from the second data processing unit, the first data processing unit may decrypt the ciphertext data into plaintext data using the first preset key and the first preset encryption parameters, and then send the plaintext data to the server. This ensures secure data transmission between the server and the storage controller.

[0080] It should be noted that in actual application scenarios, steps S31 and S32 may be executed out of order.

[0081] Furthermore, considering the correlation between data encryption and storage performance, in order to facilitate the user to manually optimize the encryption and decryption method, the first preset encryption parameter of the first data processing unit may be issued by the server.

[0082] Based on this, the method may further include:

[0083] S331. Receive and save the first preset encryption parameter sent by the server.

[0084] In this step, the first data processing unit may receive the first preset encryption parameter sent by the server to understand how the server wishes to perform encrypted communication with the storage controller.

[0085] It should be noted that the above-mentioned first preset encryption parameters can be dynamically adjusted by the server. Furthermore, in order to separate the data encryption and decryption services from the server, the storage system may also include a management server, which can provide the first preset key for the first data processing unit. Specifically, the first data processing unit can use its own first identity authentication information and the communication information of the second data processing unit to request the first preset key from the management server. The first identity authentication information is used to indicate the identity of the first data processing unit, and the communication information of the second data processing unit is used to indicate that the first data processing unit requests to communicate with the second data processing unit. Furthermore, the management server can use the first identity authentication information to verify the identity of the first data processing unit, and use the communication information to assign the first preset key and return it after the identity authentication is passed.

[0086] Based on this, the method may further include:

[0087] S341: Sending its own first identity authentication information and the communication information of the second data processing unit to the management server, so that the management server uses the first identity authentication information to verify the identity of the first data processing unit and uses the communication information to distribute the first preset key after the identity authentication is passed;

[0088] S342: Receive and save the first preset key sent by the management server.

[0089] It should be noted that this embodiment does not limit the specific form of the first identity verification information, which can be set according to actual application requirements. For example, the first identity verification information can be a CA certificate (Certificate Authority), identity token information, etc.

[0090] Furthermore, to enhance data transmission security, the first preset key may include validity period information. When the first preset key expires, the first data processing unit will be unable to use the key for data encryption. Therefore, the first data processing unit can determine whether the first preset key has expired based on the validity period information. If it is determined that the key has expired, it can request a new key from the management server.

[0091] Based on this, the first preset key includes validity period information. The method may also include:

[0092] S351: Determine whether the first preset key has expired according to the validity period information;

[0093] S352: If it is determined that the first preset key has expired, the process proceeds to the step of sending the first identity authentication information and the communication information of the second data processing unit to the management server.

[0094] It should be noted that this embodiment does not limit the specific validity period of the first preset key, which can be set according to actual application requirements.

[0095] Based on the above embodiment, the execution logic of the second data processing unit is described in detail below. Figure 4 , Figure 4 Flowchart of a data processing method applied to a second data processing unit provided in an embodiment of the present invention. This method may include:

[0096] S41. Receive first ciphertext data sent by a first data processing unit, decrypt the first ciphertext data into first plaintext data using a first preset key and a first preset encryption parameter, and send the first plaintext data to a storage controller.

[0097] S42: Receive second plaintext data sent by the storage controller, encrypt the second plaintext data into second ciphertext data using the first preset key and the first preset encryption parameter, and send the second ciphertext data to the first data processing unit.

[0098] It should be pointed out that the first plaintext data is sent by the server to the first data processing unit. In this embodiment, the interactive data between the server and the storage controller is related to the data storage service. The first plaintext data sent by the server can be a read request or a write request, and the second plaintext data returned by the storage controller can be a request response to the read request or the write request. The first preset encryption parameters are parameters required for data encryption and decryption, such as algorithm type, algorithm mode, data block size, etc. The first preset encryption parameters can be built into the second data processing unit, or provided by the storage controller or the management server. The first preset key is the communication key used for encrypted transmission of interactive data, which can be built into the second data processing unit, or provided by the storage controller or the management server.

[0099] In this step, upon receiving ciphertext data from the first data processing unit, the second data processing unit may decrypt the ciphertext data into plaintext data using the first preset key and the first preset encryption parameters, and then send the plaintext data to the storage controller. Furthermore, upon receiving plaintext data from the storage controller, the second data processing unit may encrypt the plaintext data into ciphertext data using the first preset key and the first preset encryption parameters, and then send the ciphertext data to the first data processing unit. This ensures the security of data transmission between the server and the storage controller.

[0100] It's worth noting that the second data processing unit sends plaintext data to the storage controller for processing, rather than ciphertext data. Therefore, the storage controller can process the plaintext data according to mechanisms such as data caching, data organization, and data protection, preventing data encryption from damaging the plaintext data's characteristics and, consequently, preventing the storage controller from being unable to perform normal storage service processing due to data encryption.

[0101] It should be noted that in actual application scenarios, steps S41 and S42 may be executed out of order. Furthermore, considering the correlation between data encryption services and storage service performance, to facilitate manual optimization of encryption and decryption methods by users, the first preset encryption parameters of the second data processing unit may be issued by the storage controller.

[0102] Based on this, the method may further include:

[0103] S431: Receive and save the first preset encryption parameter sent by the storage controller.

[0104] In this step, the second data processing unit may receive the first preset encryption parameter sent by the storage controller to understand how the storage controller wishes to perform encrypted communication with the server.

[0105] It should be noted that the above-mentioned first preset encryption parameters can be dynamically adjusted by the storage controller. Furthermore, in order to separate the data encryption and decryption services from the server, the storage system may also include a management server, which can provide the first preset key for the second data processing unit. Specifically, the second data processing unit can use its own second identity authentication information and the communication information of the first data processing unit to request the first preset key from the management server. The second identity authentication information is used to indicate the identity of the second data processing unit, and the communication information of the first data processing unit is used to indicate that the second data processing unit requests to communicate with the first data processing unit. Furthermore, the management server can use the second identity authentication information to verify the identity of the second data processing unit, and use the communication information to assign the first preset key and return it after the identity authentication is passed.

[0106] Based on this, the method may further include:

[0107] S441: Sending the second identity authentication information of the user and the communication information of the first data processing unit to the management server, so that the management server uses the second identity authentication information to verify the identity of the second data processing unit and uses the communication information to distribute the first preset key after the identity authentication is passed;

[0108] S442: Receive and save the first preset key sent by the management server.

[0109] It should be noted that this embodiment does not limit the specific form of the second identity verification information, which can be set according to actual application requirements. For example, the second identity verification information can be a CA certificate (Certificate Authority, certificate authorization), identity token information, etc.

[0110] Furthermore, to enhance data transmission security, the first preset key may include validity period information. When the first preset key expires, the second data processing unit will be unable to use it for data encryption. Therefore, the second data processing unit can determine whether the first preset key has expired based on the validity period information. If it determines that the key has expired, it can request a new key from the management server.

[0111] Based on this, the first preset key includes validity period information; the method may further include:

[0112] S451: Determine whether the first preset key has expired according to the validity period information;

[0113] S452: If it is determined that the first preset key has expired, the process proceeds to the step of sending the second identity authentication information and the communication information of the first data processing unit to the management server.

[0114] Based on the above embodiment, the execution logic of the third data processing unit is described in detail below. Figure 5 , Figure 5 Flowchart of a data processing method applied to a third data processing unit provided in an embodiment of the present invention. This method may include:

[0115] S51: Receive third plaintext data sent by the storage controller, encrypt the third plaintext data into third ciphertext data using a second preset key and a second preset encryption parameter, and send the third ciphertext data to a fourth data processing unit.

[0116] S52: Receive fourth ciphertext data sent by the fourth data processing unit, decrypt the fourth ciphertext data into fourth plaintext data using the second preset key and the second preset encryption parameter, and send the fourth plaintext data to the storage controller.

[0117] It should be noted that the fourth plaintext data is sent from the separate storage to the fourth data processing unit.

[0118] In this embodiment, the data exchanged between the storage controller and the separate storage is related to the data storage service, and may be, for example, data to be written to the separate storage or data to be read from the separate storage. The first preset encryption parameters are parameters required for data encryption and decryption, such as the algorithm type, algorithm mode, data block size, etc. The second preset encryption parameters may be built into the third data processing unit or provided by the storage controller or management server. The second preset key is a communication key used to encrypt and transmit the exchanged data between the storage controller and the separate storage, and may be built into the third data processing unit or provided by the storage controller or management server.

[0119] In this step, upon receiving plaintext data from the storage controller, the third data processing unit may encrypt the plaintext data into ciphertext data using the second preset key and the second preset encryption parameters, and then send the ciphertext data to the fourth data processing unit. Furthermore, upon receiving ciphertext data from the fourth data processing unit, the third data processing unit may decrypt the ciphertext data into plaintext data using the second preset key and the second preset encryption parameters, and then send the plaintext data to the storage controller. This ensures secure data transmission between the storage controller and the separate storage.

[0120] It should be noted that in actual application scenarios, steps S51 and S52 may be executed out of order.

[0121] Furthermore, considering the correlation between data encryption and storage performance, in order to facilitate the user to manually optimize the encryption and decryption method, the second preset encryption parameter of the third data processing unit may be issued by the storage controller.

[0122] Based on this, the method may further include:

[0123] S531: Receive and save the second preset encryption parameter sent by the storage controller.

[0124] In this step, the third data processing unit may receive the second preset encryption parameter sent by the storage controller to understand how the storage controller wishes to perform encrypted communication with the separate storage.

[0125] It should be noted that the second preset encryption parameter can be dynamically adjusted by the storage controller.

[0126] Furthermore, in order to separate the data encryption and decryption services from the server, the storage system may also include a management server that can provide a second preset key to the third data processing unit. Specifically, the third data processing unit can use its own third identity authentication information and the communication information of the fourth data processing unit to request the second preset key from the management server. The third identity authentication information is used to indicate the identity of the third data processing unit, and the communication information of the fourth data processing unit is used to indicate that the third data processing unit requests to communicate with the fourth data processing unit. Furthermore, the management server can use the third identity authentication information to verify the identity of the third data processing unit, and after the identity authentication is passed, use the communication information to assign the second preset key and return it.

[0127] Based on this, the method may further include:

[0128] S541: Sending the third identity authentication information and the communication information of the fourth data processing unit to the management server, so that the management server uses the third identity authentication information to verify the identity of the third data processing unit and uses the communication information to distribute the second preset key after the identity authentication is passed;

[0129] S542: Receive and save the second preset key sent by the management server.

[0130] It should be noted that this embodiment does not limit the specific form of the third identity verification information, which can be set according to actual application requirements. For example, the third identity verification information can be a CA certificate (Certificate Authority, certificate authorization), identity token information, etc.

[0131] Furthermore, to enhance data transmission security, the second preset key may include validity period information. When the second preset key expires, the third data processing unit will be unable to use it for data encryption. Therefore, the third data processing unit can determine whether the second preset key has expired based on the validity period information. If it determines that the key has expired, it can request a new key from the management server.

[0132] Based on this, the second preset key includes validity period information. The method may also include:

[0133] S551: Determine whether the second preset key has expired according to the validity period information;

[0134] S552: If it is determined that the second preset key has expired, the process proceeds to the step of sending the third identity authentication information and the communication information of the fourth data processing unit to the management server.

[0135] It should be noted that this embodiment does not limit the specific validity period of the second preset key, which can be set according to actual application requirements.

[0136] Based on the above embodiment, the execution logic of the fourth data processing unit is described in detail below. Figure 6 , Figure 6 Flowchart of a data processing method applied to a fourth data processing unit provided in an embodiment of the present invention. This method may include:

[0137] S61: Receive the third ciphertext data sent by the third data processing unit, decrypt the third ciphertext data into third plaintext data using the second preset key and the second preset encryption parameter, encrypt the third plaintext data into fifth ciphertext data using the third preset key, and write the fifth ciphertext data into separate storage.

[0138] S62: Receive the sixth ciphertext data sent by the separate storage, decrypt the sixth ciphertext data into fourth plaintext data using the third preset key, encrypt the fourth plaintext data into fourth ciphertext data using the second preset key and the second preset encryption parameter, and send the fourth ciphertext data to the third data processing unit.

[0139] It should be noted that the third plaintext data is sent from the storage controller to the third data processing unit.

[0140] In this embodiment, the interactive data between the storage controller and the separate storage is related to the data storage business, for example, it can be data to be written to the separate storage, or it can be data read from the separate storage. The second preset encryption parameters are parameters required for data encryption and decryption, such as algorithm type, algorithm mode, data block size, etc. The second preset encryption parameters can be built into the fourth data processing unit, or provided by the separate storage or management server. The second preset key is the communication key used to encrypt and transmit the interactive data between the storage controller and the separate storage, which can be built into the fourth data processing unit, or provided by the storage controller or management server. The third preset key is the storage key used to encrypt the data in the separate storage, which can be built into the fourth data processing unit, or provided by the storage controller or management server.

[0141] In this step, upon receiving the ciphertext data sent by the third data processing unit, the fourth data processing unit can decrypt the ciphertext data into plaintext data using the second preset key and the second preset encryption parameters. Subsequently, the plaintext data can be encrypted again using the third preset key and written to the separated storage. In addition, when reading the ciphertext data from the separated storage, the fourth data processing unit can decrypt the ciphertext data into plaintext data using the third preset key, and then encrypt the plaintext data into ciphertext data using the second preset key and the second preset encryption parameters, and send the ciphertext data to the third data processing unit. In this way, the data transmission security between the storage controller and the separated storage can be guaranteed, and the secure storage of data in the separated storage can also be guaranteed. Of course, since some memories support self-encryption, that is, the memories will automatically encrypt the data written to them. Therefore, the fourth data processing unit can determine whether the separated storage supports self-encryption and can only encrypt the data written to the separated storage using the third preset key if it does not support self-encryption.

[0142] Based on this, before encrypting the third plaintext data into fifth ciphertext data using the third preset key and writing the fifth ciphertext data into the separate storage, the method may further include:

[0143] S6211: Determine whether the separate storage is set to self-encryption;

[0144] S6212: If self-encryption is set, the third plaintext data is sent to the separate storage;

[0145] S6213: If self-encryption is not set, the process proceeds to the step of using a third preset key to encrypt the third plaintext data into fifth ciphertext data, and writing the fifth ciphertext data into separate storage.

[0146] Before receiving the sixth ciphertext data sent by the separate storage and encrypting the fifth plaintext data into fourth plaintext data using the third preset key, the method may further include:

[0147] S6221: Determine whether the separate storage is set to self-encryption;

[0148] S6222: If self-encryption is set, receive the fourth plaintext data sent by the separate storage;

[0149] S6223: If self-encryption is not set, the process proceeds to the step of receiving the sixth ciphertext data sent by the separate storage, and decrypting the sixth ciphertext data into the fourth plaintext data using the third preset key.

[0150] It should be noted that in actual application scenarios, steps S41 and S42 may be executed out of order.

[0151] Furthermore, considering the correlation between data encryption and storage performance, in order to facilitate manual optimization of encryption and decryption methods by users, the second preset encryption parameter of the fourth data processing unit may be distributed by separate storage.

[0152] Based on this, the method may further include:

[0153] S631: Receive and save the second preset encryption parameter sent by the separate storage.

[0154] In this step, the fourth data processing unit may receive the second preset encryption parameter sent by the separate storage to understand how the separate storage wishes to perform encrypted communication with the storage controller.

[0155] It should be noted that the second preset encryption parameter can be dynamically adjusted by the storage controller.

[0156] Furthermore, in order to separate the data encryption and decryption services from the server, the storage system may also include a management server that can provide a second preset key for the fourth data processing unit. Specifically, the fourth data processing unit can use its own fourth identity authentication information and the communication information of the third data processing unit to request the second preset key from the management server. The fourth identity authentication information is used to indicate the identity of the fourth data processing unit, and the communication information of the third data processing unit is used to indicate that the fourth data processing unit requests to communicate with the third data processing unit. Furthermore, the management server can use the fourth identity authentication information to verify the identity of the fourth data processing unit, and after the identity authentication is passed, use the communication information to assign the second preset key and return it.

[0157] Based on this, the method may further include:

[0158] S641: Send the fourth identity authentication information of the user and the communication information of the third data processing unit to the management server, so that the management server uses the fourth identity authentication information to verify the identity of the fourth data processing unit. After the identity authentication is successful, the management server uses the communication information to assign a second preset key and returns the key.

[0159] S642: Receive and save the second preset key sent by the management server.

[0160] It should be noted that this embodiment does not limit the specific form of the fourth identity verification information, which can be set according to actual application requirements. For example, the fourth identity verification information can be a CA certificate (Certificate Authority, certificate authorization), identity token information, etc.

[0161] Furthermore, to enhance data transmission security, the second preset key may include validity period information. When the second preset key expires, the fourth data processing unit will be unable to use it for data encryption. Therefore, the fourth data processing unit can determine whether the second preset key has expired based on the validity period information. If it determines that the key has expired, it can request a new key from the management server.

[0162] Based on this, the second preset key includes validity period information; the method may further include:

[0163] S651: Determine whether the second preset key has expired according to the validity period information;

[0164] S652: If it is determined that the second preset key has expired, the process proceeds to the step of sending the fourth identity authentication information and the communication information of the third data processing unit to the management server.

[0165] Based on the above embodiment, the above data processing process is introduced below based on the specific data writing process and data reading process.

[0166] 1) Data writing process The specific steps of the entire data writing process are as follows:

[0167] 1. The server sends the plaintext data and encryption instructions to the first data processing unit installed in the server, where the encryption instructions include encryption algorithm, encryption mode, and data block size.

[0168] 2. After step 1 is completed, the first data processing unit in the server obtains a built-in key from the server; or obtains a key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0169] 3. The first data processing unit encrypts the data, instructions and key obtained in steps 1 and 2 to generate ciphertext.

[0170] 4. The first data processing unit sends the ciphertext generated in step 3 to the ciphertext data receiving and storage controller.

[0171] 5. The second data processing unit in the storage controller receives the encrypted data from the server.

[0172] 6. The second data processing unit in the storage controller obtains the key from the key management inside the storage controller; or obtains the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0173] 7. The second data processing unit in the storage controller decrypts the ciphertext into plaintext data.

[0174] 8. The storage controller processes the plaintext data according to mechanisms such as data caching, data organization, and data protection.

[0175] 9. The storage controller sends the plaintext data and encryption instruction generated in step 8 to the third data processing unit installed in the storage controller, where the encryption instruction includes the encryption algorithm, encryption mode, and data block size.

[0176] 10. After step 9 is completed, the third data processing unit in the storage controller obtains a built-in key from the storage controller; or obtains a key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0177] 11. The third data processing unit encrypts the data based on the data, instructions and key obtained in steps 9 and 10 to generate ciphertext.

[0178] 12. The third data processing unit sends the ciphertext generated in step 11 to the ciphertext data receiving and separating storage.

[0179] 13. The fourth data processing unit in the separate storage receives the ciphertext data from the storage controller.

[0180] 14. The fourth data processing unit in the separate storage obtains the key from the key management within the separate storage; or obtains the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0181] 15. The fourth data processing unit in the separate storage decrypts the ciphertext into plaintext data.

[0182] 16. Separate storage processes plaintext data according to the original logic of the storage software, including protocol analysis, data distribution organization, etc.

[0183] 17.1 If the separated storage uses a self-encrypting disk (SED), the keys used for data encryption and decryption do not need to be obtained from the key management server. The keys are stored in ciphertext form in the SED.

[0184] 17.2 If the separated storage uses an SSD without encryption function, the fourth data processing unit needs to be used to continue the data encryption operation.

[0185] 18. Based on step 17.2, the fourth data processing unit encrypts the data using the XTS mode, obtaining the key from the key management within the separated storage; or obtaining the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0186] 19. The fourth data processing unit writes the generated ciphertext into the separate storage internal SSD.

[0187] 2) Data reading process The specific steps of the entire data reading process are as follows:

[0188] 1. The server sends an I / O request for reading data through the first data processing unit.

[0189] 2. The second data processing unit in the storage controller receives an I / O request from the server.

[0190] 3. The storage controller processes the I / O request according to mechanisms such as data caching, data organization, and data protection to obtain the location information of the data to be read.

[0191] 4. The storage controller sends the address information of the I / O request to the fourth data processing unit of the separate storage through the third data processing unit.

[0192] 5. The fourth data processing unit of the separate storage reads the corresponding data according to the I / O address information.

[0193] 6.1 In separate storage, if a self-encrypting SSD (SED) is used, the data obtained by the DPU is decrypted plaintext data.

[0194] 6.2 In separate storage, if SED is not used, the DPU uses XTS mode to decrypt the data and obtain the plaintext data.

[0195] 7. In the separated storage, the above plaintext data is encapsulated into a data message sent over the network.

[0196] 8. The fourth data processing unit in the separate storage obtains the key from the key management inside the separate storage; or obtains the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0197] 9. The fourth data processing unit in the separate storage encrypts the plaintext into ciphertext data.

[0198] 10. The storage controller receives the encrypted data through the third data processing unit and obtains the key from the key management inside the storage controller; or obtains the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0199] 11. The storage controller decrypts the encrypted data.

[0200] 12. The storage controller processes the plaintext data according to mechanisms such as data caching, data organization, and data protection.

[0201] 13. The storage controller encrypts the plaintext data processed in step 12 through the second data processing unit. The storage controller obtains the key from an internal key management system or an external key management server. The specific method used depends on whether the system configuration includes an external key management server.

[0202] 14. The server receives the encrypted data sent by the storage controller through the first data processing unit, and obtains the key through the key management inside the storage controller; or obtains the key from an external key management server; the specific method adopted depends on whether the system configuration includes an external key management server.

[0203] 15. The server decrypts the ciphertext data through the first data processing unit to obtain the plaintext data.

[0204] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0205] The embodiment of the present invention also provides a data processing unit. Figure 7 , Figure 7 This is a structural block diagram of a data processing unit provided by an embodiment of the present invention. The data processing unit 5 may include:

[0206] Processor module 51, the processor module has an encryptor;

[0207] Programmable logic device module 52, the programmable logic device module has a network transmission module and is connected to a server, a storage controller or a separate storage;

[0208] The processor module and the programmable logic device module are used to execute the above data processing method.

[0209] It should be noted that this embodiment does not limit how the programmable logic device module 52 is connected to the server, storage controller, or separate storage. For example, the connection can be based on a bus interface (such as a PCIe bus). In addition, the network transmission module can support TCP and RDMA (RoCEv2) protocols.

[0210] Please refer to Figure 8 , Figure 8This is a block diagram of another data processing unit provided by an embodiment of the present invention. The processor module 51 may include a processor 511, an encryptor 512, and memory 513, and the programmable logic device 52 may include a programmable logic device 521 (FPGA). The programmable logic device 521 and the processor 511 may be connected via a bus structure (such as a PCIe bus). Furthermore, the data processing unit 5 also includes a network port 54 and a bus interface 53, with the programmable logic device 521 connected to the network port 54 and bus interface 53. The network port 54 is used for network data transmission, and the bus interface 53 is used to connect to a server, storage controller, or separate storage.

[0211] Please refer to Figure 9 , Figure 9 This is a processing flow chart of a data processing unit provided by an embodiment of the present invention. Taking writing data as an example, the data processing flow within the data processing unit is as follows:

[0212] 1. The programmable logic device notifies the processor to write data;

[0213] 2. The processor uses DMA (Direct Memory Access) to move raw data to memory;

[0214] 3. Data is transferred to CPU memory via DMA;

[0215] 4. CPU performs data encryption and decryption + data packaging;

[0216] 5. The processor notifies the programmable logic device to complete data encryption and decryption, and returns the data address, etc.

[0217] 6. The processor notifies the programmable logic device to read the data;

[0218] 7. The programmable logic device reads data from the memory and completes data writing.

[0219] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above data processing method embodiments when running.

[0220] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0221] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above data processing method embodiments are implemented.

[0222] An embodiment of the present invention further provides another computer program product, comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned data processing method embodiments are implemented.

[0223] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0224] The above is a detailed introduction to a storage system, a data processing method, a data processing unit, and a program product provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified in a number of ways, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A storage system, characterized in that: The system comprises a server, a storage controller, and a separated storage, wherein the server has a first data processing unit, the storage controller has a second data processing unit and a third data processing unit, and the separated storage has a fourth data processing unit; One end of the first data processing unit and the second data processing unit is configured to encrypt the interactive data between the server and the storage controller using a first preset key and a first preset encryption parameter, transmit the encrypted data to the other end of the first data processing unit and the second data processing unit, and decrypt the interactive data between the server and the storage controller sent by the other end; Any one of the third data processing unit and the fourth data processing unit is configured to encrypt the interactive data between the storage controller and the separate storage using a second preset key and a second preset encryption parameter, transmit the encrypted data to the other one of the third data processing unit and the fourth data processing unit, and decrypt the interactive data between the storage controller and the separate storage sent by the other one; The fourth data processing unit is further configured to use a third preset key to encrypt data written into the separate storage and to decrypt data read from the separate storage.

2. The storage system according to claim 1, wherein: Also includes management server; The first data processing unit is further configured to obtain the first preset key from the management server according to the communication information of the second data processing unit; The second data processing unit is further configured to obtain the first preset key from the management server according to the communication information of the first data processing unit; The third data processing unit is further configured to obtain the second preset key from the management server according to the communication information of the fourth data processing unit; The fourth data processing unit is further configured to obtain the second preset key from the management server according to the communication information of the third data processing unit, and to obtain the third preset key from the management server.

3. A data processing method, characterized in that: Applied to the first data processing unit in the storage system according to claim 1 or 2, the method comprises: receiving first plaintext data sent by the server, encrypting the first plaintext data into first ciphertext data using a first preset key and a first preset encryption parameter, and sending the first ciphertext data to the second data processing unit; Receive second ciphertext data sent by the second data processing unit, decrypt the second ciphertext data into second plaintext data using the first preset key and the first preset encryption parameter, and send the second plaintext data to the server.

4. The data processing method according to claim 3, wherein: Also includes: Receive and save the first preset encryption parameter sent by the server.

5. The data processing method according to claim 3 or 4, characterized in that: The storage system further includes a management server; The method further comprises: Sending its own first identity authentication information and the communication information of the second data processing unit to the management server, so that the management server uses the first identity authentication information to verify the identity of the first data processing unit and uses the communication information to distribute the first preset key after the identity authentication is passed; Receive and save the first preset key sent by the management server.

6. The data processing method according to claim 5, characterized in that: The first preset key includes validity period information; The method further comprises: Determining whether the first preset key has expired according to the validity period information; If it is determined that the first preset key has expired, the process proceeds to the step of sending the first identity authentication information thereof and the communication information of the second data processing unit to the management server.

7. A data processing method, characterized in that: Applied to the second data processing unit in the storage system according to claim 1 or 2, the method comprises: receiving first ciphertext data sent by the first data processing unit, decrypting the first ciphertext data into first plaintext data using a first preset key and a first preset encryption parameter, and sending the first plaintext data to the storage controller; Receive second plaintext data sent by the storage controller, encrypt the second plaintext data into second ciphertext data using the first preset key and the first preset encryption parameter, and send the second ciphertext data to the first data processing unit.

8. The data processing method according to claim 7, characterized in that: Also includes: Receive and save the first preset encryption parameter sent by the storage controller.

9. The data processing method according to claim 7 or 8, characterized in that: The storage system further includes a management server; The method further comprises: Sending its own second identity authentication information and the communication information of the first data processing unit to the management server, so that the management server uses the second identity authentication information to verify the identity of the second data processing unit and uses the communication information to distribute the first preset key after the identity authentication is passed; Receive and save the first preset key sent by the management server.

10. The data processing method according to claim 9, characterized in that: The first preset key includes validity period information; The method further comprises: Determining whether the first preset key has expired according to the validity period information; If it is determined that the first preset key has expired, the process proceeds to the step of sending the second identity authentication information thereof and the communication information of the first data processing unit to the management server.

11. A data processing method, characterized in that: Applied to the third data processing unit in the storage system according to claim 1 or 2, the method comprises: receiving third plaintext data sent by the storage controller, encrypting the third plaintext data into third ciphertext data using a second preset key and a second preset encryption parameter, and sending the third ciphertext data to a fourth data processing unit; Receive fourth ciphertext data sent by the fourth data processing unit, decrypt the fourth ciphertext data into fourth plaintext data using the second preset key and the second preset encryption parameter, and send the fourth plaintext data to the storage controller.

12. The data processing method according to claim 11, characterized in that: Also includes: Receive and save the second preset encryption parameter sent by the storage controller.

13. The data processing method according to claim 11 or 12, characterized in that: The storage system further includes a management server; The method further comprises: Sending its own third identity authentication information and the communication information of the fourth data processing unit to the management server, so that the management server uses the third identity authentication information to verify the identity of the third data processing unit and uses the communication information to distribute the second preset key after the identity authentication is passed; Receive and save the second preset key sent by the management server.

14. The data processing method according to claim 13, wherein: The second preset key includes validity period information; The method further comprises: Determining whether the second preset key has expired according to the validity period information; If it is determined that the second preset key has expired, the process proceeds to the step of sending its own third identity authentication information and the communication information of the fourth data processing unit to the management server.

15. A data processing method, characterized in that: Applied to the fourth data processing unit in the storage system according to claim 1 or 2, the method comprises: receiving third ciphertext data sent by the third data processing unit, decrypting the third ciphertext data into third plaintext data using the second preset key and the second preset encryption parameter, encrypting the third plaintext data into fifth ciphertext data using the third preset key, and writing the fifth ciphertext data into the separate storage; Receive the sixth ciphertext data sent by the separate storage, decrypt the sixth ciphertext data into fourth plaintext data using the third preset key, encrypt the fourth plaintext data into fourth ciphertext data using the second preset key and the second preset encryption parameter, and send the fourth ciphertext data to the third data processing unit.

16. The data processing method according to claim 15, characterized in that: Also includes: Receive and save the second preset encryption parameter sent by the separate storage.

17. The data processing method according to claim 15, characterized in that: Before encrypting the third plaintext data into fifth ciphertext data using the third preset key and writing the fifth ciphertext data into the separate storage, the method further includes: Determining whether the separate storage is configured with self-encryption; If self-encryption is set, sending the third plaintext data to the separate storage; If self-encryption is not set, the process proceeds to the step of encrypting the third plaintext data into fifth ciphertext data using a third preset key, and writing the fifth ciphertext data into the separate storage; Before receiving the sixth ciphertext data sent by the separate storage and decrypting the sixth ciphertext data into fourth plaintext data using the third preset key, the method further includes: Determining whether the separate storage is configured with self-encryption; If self-encryption is set, receiving the fourth plaintext data sent by the separate storage; If self-encryption is not set, the process proceeds to the step of receiving the sixth ciphertext data sent by the separate storage, and decrypting the sixth ciphertext data into fourth plaintext data using the third preset key.

18. The data processing method according to any one of claims 15 to 17, characterized in that: The storage system further includes a management server; The method further comprises: Sending its own fourth identity authentication information and the communication information of the third data processing unit to the management server, so that the management server uses the fourth identity authentication information to verify the identity of the fourth data processing unit, and after the identity authentication is passed, uses the communication information to assign the second preset key and return it; Receive and save the second preset key sent by the management server.

19. The data processing method according to claim 18, characterized in that: The second preset key includes validity period information; The method further comprises: Determining whether the second preset key has expired according to the validity period information; If it is determined that the second preset key has expired, the process proceeds to the step of sending its own fourth identity authentication information and the communication information of the third data processing unit to the management server.

20. A data processing unit, characterized in that: include: a processor module having an encryptor; A programmable logic device module, wherein the programmable logic device module has a network transmission module and is connected to a server, a storage controller or a separate storage; The processor module and the programmable logic device module are used to execute the data processing method according to any one of claims 3 to 6, or the data processing method according to any one of claims 7 to 10, or the data processing method according to any one of claims 11 to 14, or the data processing method according to any one of claims 15 to 19.

21. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, it implements the data processing method according to any one of claims 3 to 6, or the data processing method according to any one of claims 7 to 10, or the data processing method according to any one of claims 11 to 14, or the data processing method according to any one of claims 15 to 19.

22. A non-volatile computer-readable storage medium, characterized in that The non-volatile computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are loaded and executed by the processor, the data processing method according to any one of claims 3 to 6, or the data processing method according to any one of claims 7 to 10, or the data processing method according to any one of claims 11 to 14, or the data processing method according to any one of claims 15 to 19 is implemented.

Images