Data processing method and device based on no-service architecture, medium and electronic equipment

Abstract

The invention discloses a data processing method and device based on a no-service architecture, a storage medium and electronic equipment, and the method comprises the steps: determining a tenant identifier of a target tenant, a function identifier and a database key of a target database according to a function call request initiated by the target tenant for a target tenant function in the no-service architecture; the target database belongs to an encrypted database and is a private database exclusive to the target tenant; a database key of the target database is stored in a hardware token held by the target tenant; based on the tenant identifier, the function identifier and a database key of a target database, calling an identity authentication interface to perform identity authentication on the target tenant; generating a data access key for the function call request under the condition that the identity verification is passed, and feeding back the data access key to the target tenant; wherein the data access key is used for authorizing storage or query of data in the target database. By executing the method and the device, the data security of the service-free architecture can be improved.

Description

Technical Field

[0001] This application relates to artificial intelligence technology, cloud technology and database technology, and can be applied to financial technology scenarios. This application specifically relates to a data processing method, device, storage medium and electronic device based on a serverless architecture. Background Art

[0002] Serverless architecture is a cloud computing execution model. It adopts an event-driven model, and data operations are executed through event-triggered functions. Serverless architecture completely entrusts server management to the cloud service provider.

[0003] Serverless architectures have unique data security characteristics. First, the storage and security of user data are entirely the responsibility of the cloud computing provider, making user data completely transparent to the cloud service provider, posing a potential risk of data leakage. Second, in a serverless architecture, user data is transmitted over the internet and stored on cloud servers, increasing the possibility of data interception. Third, the infrastructure in a serverless architecture is shared by multiple tenants, which can lead to cross-contamination of sensitive data.

[0004] Ensuring data security under a serverless architecture is of strategic significance for corporate compliance operations, maintaining customer trust, and sustainable business development. Summary of the Invention

[0005] The present application provides a data processing method, device, storage medium and electronic device based on a serverless architecture, which can achieve the purpose of improving the data security of the serverless architecture.

[0006] According to a first aspect of the present application, a data processing method based on a serverless architecture is provided, the method comprising:

[0007] Determining, based on a function call request initiated by a target tenant for a target tenant function in a serverless architecture, a tenant identifier of the target tenant, a function identifier, and a database key of a target database; wherein the target database is an encrypted database and is a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant;

[0008] Based on the tenant identifier, the function identifier, and the database key of the target database, calling an identity authentication interface to authenticate the target tenant;

[0009] If the identity authentication is passed, a data access key is generated for the function call request, and the data access key is fed back to the target tenant; wherein the data access key is used to authorize storage or query of data in the target database.

[0010] According to a second aspect of the present application, a data processing device based on a serverless architecture is provided, the device comprising:

[0011] an identity information determination module, configured to determine, based on a function call request initiated by a target tenant for a target tenant function in a serverless architecture, the tenant identifier of the target tenant, the function identifier, and the database key of the target database; wherein the target database is an encrypted database, being a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant;

[0012] An identity authentication module, configured to call an identity authentication interface to authenticate the target tenant based on the tenant identifier, the function identifier, and a database key of the target database;

[0013] A data access key generation module is used to generate a data access key for the function call request when the identity authentication is passed, and feed the data access key back to the target tenant; wherein, the data access key is used to authorize the storage or query of data in the target database.

[0014] According to the third aspect of the present invention, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the data processing method based on the serverless architecture as described in the embodiment of the present application.

[0015] According to the fourth aspect of the present invention, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the computer program, the data processing method based on the serviceless architecture as described in the embodiment of the present application is implemented.

[0016] According to the fifth aspect of the present application, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the data processing method based on the serverless architecture as described in the embodiment of the present application.

[0017] This application addresses the data security characteristics of a serverless architecture and proposes a data processing technology solution based on a serverless architecture. The technology solution of this application authenticates the target tenant by calling an authentication interface based on the tenant identifier, function identifier, and database key of the target database. If the authentication is successful, a data access key is generated for the function call request initiated by the target tenant, authorizing the storage or query of data in the target database. Encryption isolation is achieved at the function level, and a new data access key is generated for each call of a tenant function, thus avoiding attacks or injection vulnerabilities. The technology solution of this application creates a private database exclusively for the target tenant, allowing the target tenant to store data in the private database, thereby achieving data encryption and isolation, which is beneficial to ensuring data access security and improving the data security of the serverless architecture.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 This is a flow chart of a data processing method based on a serverless architecture according to the first embodiment;

[0021] Figure 2 This is a flow chart of a data processing method based on a serverless architecture according to the second embodiment;

[0022] Figure 3 This is a schematic diagram of the structure of a data processing system based on a serverless architecture according to an embodiment of the present application;

[0023] Figure 4 This is a schematic diagram of the structure of a data processing device based on a serverless architecture provided in Example 3 of the present application;

[0024] Figure 5 This is a structural diagram of an electronic device provided in Example 4 of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", "target" and "candidate" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Example 1

[0028] Figure 1 This is a flowchart of a data processing method based on a serverless architecture provided in accordance with the first embodiment. This embodiment is applicable to situations where financial data is processed, such as stored or queried, under a serverless architecture. The method is executed by a data processing model based on a serverless architecture and can be executed by a data processing device based on a serverless architecture configured in the data processing model based on a serverless architecture. The data processing device based on a serverless architecture is implemented in the form of hardware and / or software and can be integrated into an electronic device running this system.

[0029] like Figure 1 As shown, the method includes:

[0030] S110. Determine the tenant identifier, function identifier, and database key of the target database of the target tenant based on a function call request initiated by the target tenant for a target tenant function in the serverless architecture; wherein the target database is an encrypted database and is a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant.

[0031] S120: Based on the tenant identifier, the function identifier, and the database key of the target database, call an identity authentication interface to authenticate the target tenant.

[0032] S130. If the identity authentication is passed, generate a data access key for the function call request, and feed the data access key back to the target tenant; wherein the data access key is used to authorize storage or query of data in the target database.

[0033] In a serverless architecture, a tenant refers to an independent logical entity that shares the same serverless infrastructure, such as a cloud platform, function service, or interface gateway. The target tenant refers to the tenant that initiates a function call request. A function call request is a call request for a target tenant's function.

[0034] The target tenant function is created by the target tenant in a serverless environment within the serverless architecture. The target tenant function is the tenant function requested by the target tenant. The function identifier uniquely identifies the target tenant function within the serverless environment. The function identifier is used to distinguish between different tenant functions and is obtained after the tenant creates the tenant function within the serverless environment.

[0035] The tenant ID is assigned to a tenant when they first connect to the serverless architecture. It uniquely identifies a tenant within the serverless architecture and is used to distinguish between different tenants. The target database is a private database dedicated to the target tenant. The target database is an encrypted database that not only protects data security during storage and transmission but also helps financial institutions meet data security standards in the financial industry. The target database is created for the target tenant by adding a new database interface. Optionally, when the target tenant first connects to the serverless architecture, a private database dedicated to the target tenant can be created as the target database.

[0036] The database key of the target database is generated based on the database ID of the target database and the tenant ID of the target tenant. The database key is used to authorize the target user to create tenant functions in the serverless environment of the serverless architecture and is also used to authenticate the target tenant when initiating function call requests.

[0037] The database key for the target database is stored in a hardware token owned by the target tenant. A hardware token is a physical device designed specifically for tenants in a serverless architecture to store the database key. Hardware tokens secure user identity and data access through hardware-level encryption and physical isolation.

[0038] The identity authentication interface is used to authenticate the target tenant based on the identity authentication credentials to verify whether the target tenant's call to the target tenant function is compliant.

[0039] The target tenant's tenant ID, the target tenant's function ID, and the target database's database key serve as authentication credentials. The authentication API is called to authenticate the target tenant and obtain a verification result. The introduction of the authentication API establishes a unified authentication channel, while the addition of function IDs allows permissions to be precisely defined down to the specific function operation level.

[0040] Optional verification results include authentication passed or failed. If authentication passes, the target tenant's call to the target tenant's function is legal, and a data access key is generated for the function call request. In a serverless architecture, the target tenant's function relies on multi-tiered support from the provider's cloud services. To support the target tenant's function, the provider's cloud services must store or query data in the target database.

[0041] The data access key is used to authorize the storage or query of data in the target database. Specifically, the data access key is used to authorize the provider cloud service that supports the operation of the target tenant function to store or query data in the target database.

[0042] If the authentication fails, it means that the target tenant's call to the target tenant function is not compliant. In this case, the data access key cannot be generated for the function call request, and an error message indicating that the call is not compliant must be fed back for the function call request.

[0043] Related technologies generally use direct data encryption and decryption to encrypt data, or perform double encryption and decryption for transmission security to achieve data security. In the financial sector, this cannot meet the data security needs of the financial industry. This application designs the private database as an encrypted database, which not only ensures the security of data during storage and transmission, but also prevents unauthorized tenants from accessing the database and reading the data within. The technical solution provided by this application can also meet the data security requirements of the financial sector by applying it to the financial sector.

[0044] This application addresses the data security characteristics of a serverless architecture and proposes a data processing technology solution based on a serverless architecture. The technology solution of this application authenticates the target tenant by calling an authentication interface based on the tenant identifier, function identifier, and database key of the target database. If the authentication is successful, a data access key is generated for the function call request initiated by the target tenant, authorizing the storage or query of data in the target database. Encryption isolation is achieved at the function level, and a new data access key is generated for each call of a tenant function, thus avoiding attacks or injection vulnerabilities. The technology solution of this application creates a private database exclusively for the target tenant, allowing the target tenant to store data in the private database, thereby achieving data encryption and isolation, which is beneficial to ensuring data access security and improving the data security of the serverless architecture.

[0045] In an optional embodiment, the method further includes: in response to a function creation request of the target tenant, determining the tenant identifier of the target tenant and the database key of the target database; based on the database key and the tenant identifier, generating a function identifier for the target tenant function created by the target tenant in the serverless architecture and feeding it back to the target tenant.

[0046] The function creation request is initiated by the target tenant and is used to request the creation of a tenant function in a serverless environment within the serverless architecture. The function creation request is generated based on the target tenant's tenant ID and the database key of the target database.

[0047] After creating a private database dedicated to the target tenant, the target tenant is eligible to create tenant functions in the serverless environment. After the target tenant creates the target tenant function in the serverless environment under the serverless architecture, a function identifier is generated for the target tenant function based on the target tenant's tenant identifier and the database key of the target database. The function identifier uniquely identifies the target tenant function.

[0048] The target tenant's function ID is fed back to the target tenant, who can then use it as an authentication credential. When calling the target tenant's function, the target tenant's compliance with the call is verified. This allows permissions to be accurately assigned to specific function operations.

[0049] The above technical solution provides a practical method for determining function identifiers. Based on the target tenant's tenant identifier and the target database's database key, a function identifier is generated for the target tenant's function created in a serverless architecture and fed back to the target tenant. This provides data support for adding function identifiers to authentication credentials, enabling permissions to be precisely defined at the level of specific function operations.

[0050] In an optional embodiment, the method further includes: in response to a service call request initiated by the target tenant function, determining the data access key corresponding to the target tenant function and the target service to be called; and calling the data processing interface through the target service to be called based on the data access key to store or query the data in the target database.

[0051] In a serverless architecture, the operation of target tenant functions relies on multi-level support from the provider's cloud services, mainly including computing services, event services, storage services, network services, and monitoring services.

[0052] A service call request is initiated by the target tenant function. In a serverless architecture, tenant function-initiated service calls are a core mechanism for building distributed applications. The target service to be called is the service in the provider's cloud service that the target tenant function needs to call. To support the target tenant function's operation, the target service needs to store or query data in the target database.

[0053] The data processing interface is used to store or query data in a private database based on a data access key. Standardized calls to the data processing interface unify access specifications for different services. The data access key is used by the target service to store or query data in the target database. The target service invokes the data processing interface based on the data access key. Data in the target database can then be stored or queried using the data processing interface.

[0054] This technical solution uses data access keys to authorize the target tenant's function to call services and data processing interfaces, allowing it to store or query data in the target database. This achieves encryption isolation at the function level, improving data security in serverless architectures.

[0055] In an optional embodiment, the target database is used for the target tenant to store financial data with a data confidentiality level greater than a set level.

[0056] Optionally, the target tenant belongs to the financial sector, and the data stored in the target database is financial data with a data confidentiality level greater than a set level. The data confidentiality level is a reference for matching protection intensity with risk. Data confidentiality levels in the financial sector are primarily determined based on the impact and extent of any data security breach, taking into account data characteristics, business scenarios, compliance requirements, and technical implementation capabilities. Preset levels are used to determine which financial data should be stored in the target database. These levels are determined based on actual business and compliance requirements and are not defined here.

[0057] The above technical solution is applicable to the financial field. By storing financial data with a data confidentiality level greater than the set level in a target database, the target database protects the security of this financial data during storage and transmission, which helps financial institutions meet the data security standards of the financial industry.

[0058] Example 2

[0059] Figure 2 This is a flow chart of a data processing method based on a serverless architecture according to Example 2. This embodiment is further optimized based on the above embodiment.

[0060] like Figure 2 As shown, the method includes:

[0061] S210: In response to a tenant access request from a target tenant, determine whether the target tenant is a newly added tenant.

[0062] S220: When the target tenant is the newly added tenant, call a new tenant interface to allocate the tenant identifier to the target tenant.

[0063] S230: Based on the tenant identifier of the target tenant, create a private database exclusively belonging to the target tenant as the target database for the target tenant.

[0064] S240: Generate a database key of the target database based on the tenant identifier and the database identifier of the target database, and store the database key in the hardware token held by the target tenant.

[0065] The tenant access request is generated when the tenant requests to access the serverless architecture. Based on the tenant access request, it can be determined whether the target tenant is a new tenant, wherein the new tenant refers to a tenant that has never accessed the serverless architecture before.

[0066] If the target tenant is the newly added tenant, a new tenant interface is called, wherein the new tenant interface is used to assign a tenant identifier to the target tenant, create a private database dedicated to the target tenant as the target database, and generate a database key for the target database.

[0067] The tenant ID uniquely identifies the target tenant. After the target tenant is assigned a tenant ID, a new tenant interface creates a private database dedicated to the target tenant as the target database based on the target tenant ID. After the target database is successfully created, a database key is generated based on the tenant ID and the target database's database ID and fed back to the target tenant. A hardware token exclusive to the target tenant is obtained after the target database is successfully created. The hardware token is used to store the database key generated for the target database based on the tenant ID and the target database's database ID.

[0068] The embodiment of the present application sets up a new tenant interface, allocates a tenant ID to the new tenant connected to the serverless architecture through the new tenant interface, and creates a private database dedicated to the target tenant as the target database for the target tenant based on the tenant ID of the target tenant, thereby achieving data isolation and ensuring data access security. The present application generates a database key of the target database based on the tenant ID and the database ID of the target database, and provides a feasible database key determination scheme, which provides data support for verifying the compliance of the target tenant's call to the target tenant function when the target tenant function is called. The present application stores the database key in a hardware token held by the target tenant, and protects user identity and data access security through hardware-level encryption and physical isolation mechanisms, which is conducive to improving the data security of the serverless architecture.

[0069] In an optional embodiment, generating the database key of the target database based on the tenant identifier and the database identifier of the target database, and storing the database key in the hardware token held by the target tenant, includes: using a hardware security module to generate the database key of the target database based on the tenant identifier and the database identifier of the target database; transmitting the database key of the target database to the target tenant through an encrypted communication channel, and storing the database key in the hardware token held by the target tenant.

[0070] The hardware security module (HSM) is used to encrypt the tenant ID of the target tenant and the database ID of the target database. A HSM is a dedicated cryptographic computing device whose core value lies in removing sensitive operations such as key management and cryptographic operations from the general computing environment, ensuring that even if the system is compromised, core security assets cannot be stolen or tampered with.

[0071] The target database's database key is derived by encrypting the target tenant's tenant ID and the target database's database ID. The target database's database key is used to verify the target tenant's compliance with the target tenant's function calls.

[0072] After the database key is generated, it is transmitted to the target tenant via an encrypted communication channel. An encrypted communication channel uses cryptographic techniques to encrypt the data between communicating parties, ensuring that the information cannot be eavesdropped, tampered with, or forged during transmission. Optionally, the encrypted communication channel utilizes technologies such as forward secrecy, key isolation, and a zero-round-trip-time handshake to ensure data security and improve performance.

[0073] The database key of the target database is transmitted to the target tenant through the encrypted communication channel and stored in the hardware token held by the target tenant.

[0074] The above technical solution, by using a hardware security module to generate database keys, an encrypted communication channel to transmit database keys, and a hardware token to store database keys, achieves the full life cycle security of database key generation, transmission, and storage, thereby improving the compatibility of the technical solution of this application with financial scenarios.

[0075] In an optional embodiment, the method further includes: enabling audit logs in response to the identity authentication interface, the new tenant interface or the data processing interface being called; and recording data processing operations associated with the identity authentication interface, the new tenant interface or the data processing interface based on the log configuration parameters of the audit log.

[0076] Audit logging is enabled when calls to the authentication interface, new tenant interface, or data processing interface are detected. Audit logging provides structured operational logs for security monitoring and compliance review. Log configuration parameters dynamically control logging policies, balancing storage costs, compliance requirements, and performance overhead. Optionally, these parameters include basic control parameters such as logging granularity and log retention period, as well as sensitive information processing parameters such as fields to be desensitized and desensitization rules.

[0077] Based on the log configuration parameters of the audit log, data processing operations associated with the identity authentication interface, the new tenant interface, or the data processing interface are recorded.

[0078] The above technical solution records the data processing operations associated with the identity authentication interface, the new tenant interface or the data processing interface through the audit log, which can meet the financial regulatory traceability requirements and improve the compatibility of the technical solution of this application with the financial scenario.

[0079] Figure 3 This is a structural diagram of a data processing system based on a serverless architecture provided according to an embodiment of the present application. Figure 3This application creates a public encryption module within a serverless architecture. As a core component, the public encryption module is responsible for data encryption, decryption, and storage. The public encryption module uses an encrypted database to ensure data security. Each tenant has its own private database, achieving data isolation and secure access. The public encryption module provides interfaces for authentication, adding new tenants, and data processing.

[0080] The identity authentication interface is used to authenticate the target tenant based on the authentication credentials to verify compliance with the target tenant's function call. The introduction of the identity authentication interface establishes a unified authentication channel. The newly added tenant interface is used to assign a tenant ID to the target tenant, create a private database dedicated to the target tenant as the target database, and generate a database key for the target database. The data processing interface is used to store or query data in the private database based on the data access key. The standardized calling of the data processing interface unifies the access specifications of different services.

[0081] The serverless architecture includes at least 2 tenants. Figure 3 The three tenants shown are for illustration purposes only and do not limit the technical solution of this application. The data processing method based on a serverless architecture provided in this embodiment is executed by a public encryption module. The specific details of the data processing method based on a serverless architecture are not repeated here; please refer to the above embodiment for details.

[0082] Example 3

[0083] Figure 4 This is a structural diagram of a data processing device based on a serverless architecture provided in Example 3 of the present application. This embodiment can be applied to situations where financial data is processed, such as stored or queried, under a serverless architecture. The device can be configured in a data processing model based on a serverless architecture, implemented by software and / or hardware, and can be integrated into electronic devices such as smart terminals.

[0084] like Figure 4 As shown, the data processing device 300 based on the serverless architecture may include:

[0085] The identity information determination module 410 is configured to determine the tenant identifier, function identifier, and database key of the target database based on a function call request initiated by the target tenant for a target tenant function in the serverless architecture; wherein the target database is an encrypted database that is a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant.

[0086] An identity authentication module 420 is configured to call an identity authentication interface to authenticate the target tenant based on the tenant identifier, the function identifier, and the database key of the target database;

[0087] The data access key generation module 430 is used to generate a data access key for the function call request when the identity authentication is passed, and feed the data access key back to the target tenant; wherein, the data access key is used to authorize the storage or query of data in the target database.

[0088] This application addresses the data security characteristics of a serverless architecture and proposes a data processing technology solution based on a serverless architecture. The technology solution of this application authenticates the target tenant by calling an authentication interface based on the tenant identifier, function identifier, and database key of the target database. If the authentication is successful, a data access key is generated for the function call request initiated by the target tenant, authorizing the storage or query of data in the target database. Encryption isolation is achieved at the function level, and a new data access key is generated for each call of a tenant function, thus avoiding attacks or injection vulnerabilities. The technology solution of this application creates a private database exclusively for the target tenant, allowing the target tenant to store data in the private database, thereby achieving data encryption and isolation, which is beneficial to ensuring data access security and improving the data security of the serverless architecture.

[0089] Optionally, the device also includes: a new user identification module, used to respond to the tenant access request of the target tenant to determine whether the target tenant is a new tenant; a tenant identification allocation module, used to call the new tenant interface to allocate the tenant identification to the target tenant when the target tenant is the new tenant; a database creation module, used to create a private database exclusively for the target tenant as the target database for the target tenant based on the tenant identification of the target tenant; a database key generation module, used to generate a database key of the target database based on the tenant identification and the database identification of the target database, and store the database key in the hardware token held by the target tenant.

[0090] Optionally, the database key generation module includes: a database key generation submodule, used to use a hardware security module to generate a database key of the target database based on the tenant identifier and the database identifier of the target database; a database key transmission submodule, used to transmit the database key of the target database to the target tenant through an encrypted communication channel, and store the database key in the hardware token held by the target tenant.

[0091] Optionally, the device also includes: an identification generation data determination module, used to determine the tenant identification of the target tenant and the database key of the target database in response to the function creation request of the target tenant; a function identification generation module, used to generate a function identification for the target tenant function created by the target tenant in the serviceless architecture based on the database key and the tenant identification and feed it back to the target tenant.

[0092] Optionally, the device also includes: a data access key determination module, used to determine the data access key corresponding to the target tenant function and the target service to be called in response to the service call request initiated by the target tenant function; a data processing interface calling module, used to call the data processing interface based on the data access key through the target service to be called to store or query the data in the target database.

[0093] Optionally, the target database is used for the target tenant to store financial data with a data confidentiality level greater than a set level.

[0094] Optionally, the device also includes an audit log enabling module for enabling the audit log in response to the identity authentication interface, the new tenant interface or the data processing interface being called; and a processing operation recording module for recording the data processing operations associated with the identity authentication interface, the new tenant interface or the data processing interface based on the log configuration parameters of the audit log.

[0095] The data processing device based on the serverless architecture provided by the embodiment of the invention can execute the data processing method based on the serverless architecture provided by any embodiment of the present application, and has the corresponding performance modules and beneficial effects for executing the data processing method based on the serverless architecture.

[0096] In the technical solution of this application, the financial data and other user data involved are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0097] Example 4

[0098] According to embodiments of the present application, the present application also provides an electronic device, a readable storage medium, and a computer program product.

[0099] Figure 5The structure diagram of the electronic device 510 that can be used to implement the embodiment is shown. The electronic device 510 includes at least one processor 511 and a memory connected to the at least one processor 511 in communication, such as a read-only memory (ROM) 512, a random access memory (RAM) 513, etc., wherein the memory stores a computer program that can be executed by the at least one processor, and the processor 511 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 512 or the computer program loaded from the storage unit 518 into the random access memory (RAM) 513. Various programs and data required for the operation of the electronic device 510 can also be stored in the RAM 513. The processor 511, ROM 512 and RAM 513 are connected to each other via a bus 514. An input / output (I / O) interface 515 is also connected to the bus 514.

[0100] Multiple components in the electronic device 510 are connected to the I / O interface 515, including an input unit 516, such as a keyboard, a mouse, etc.; an output unit 517, such as various types of displays, speakers, etc.; a storage unit 518, such as a magnetic disk, an optical disk, etc.; and a communication unit 519, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 519 allows the electronic device 510 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0101] The processor 511 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 511 executes the various methods and processes described above, such as the data processing method based on the serverless architecture.

[0102] In some embodiments, the data processing method based on the serverless architecture can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 518. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 510 via the ROM 512 and / or the communication unit 519. When the computer program is loaded into the RAM 513 and executed by the processor 511, one or more steps of the data processing method based on the serverless architecture described above can be performed. Alternatively, in other embodiments, the processor 511 can be configured to execute the data processing method based on the serverless architecture by any other appropriate means (e.g., by means of firmware).

[0103] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0104] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable serverless architecture-based data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0105] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0106] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0107] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data processing server based on a serverless architecture), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0108] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0109] The present application also discloses a computer program product, comprising a computer program that, when executed by a processor, implements the serverless data processing method provided in any of the embodiments of the present application. This program product and the serverless data processing method disclosed in each embodiment of the present application share the same inventive concept and are therefore not described in detail here.

[0110] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this application can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of this application can be achieved. This is not limited herein.

[0111] The above specific embodiments do not constitute a limitation on the scope of protection of this application. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application shall be included within the scope of protection of this application.

Claims

1. A data processing method based on a serverless architecture, characterized in that: The method comprises: Determining, based on a function call request initiated by a target tenant for a target tenant function in a serverless architecture, a tenant identifier of the target tenant, a function identifier, and a database key of a target database; wherein the target database is an encrypted database and is a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant; Based on the tenant identifier, the function identifier, and the database key of the target database, calling an identity authentication interface to authenticate the target tenant; If the identity authentication is passed, a data access key is generated for the function call request, and the data access key is fed back to the target tenant; wherein the data access key is used to authorize storage or query of data in the target database.

2. The method according to claim 1, characterized in that The method further comprises: In response to a tenant access request from a target tenant, determining whether the target tenant is a newly added tenant; In a case where the target tenant is the newly added tenant, calling a new tenant interface to allocate the tenant identifier to the target tenant; Based on the tenant identifier of the target tenant, creating a private database exclusively belonging to the target tenant as the target database for the target tenant; A database key of the target database is generated based on the tenant identifier and the database identifier of the target database, and the database key is stored in the hardware token held by the target tenant.

3. The method according to claim 2, characterized in that The step of generating a database key of the target database based on the tenant identifier and the database identifier of the target database, and storing the database key in the hardware token held by the target tenant, includes: Using a hardware security module to generate a database key of the target database based on the tenant identifier and the database identifier of the target database; The database key of the target database is transmitted to the target tenant through an encrypted communication channel, and the database key is stored in the hardware token held by the target tenant.

4. The method according to claim 1, wherein The method further comprises: In response to a function creation request of a target tenant, determining a tenant identifier of the target tenant and a database key of the target database; Based on the database key and the tenant identifier, a function identifier is generated for a target tenant function created by the target tenant in the serverless architecture and fed back to the target tenant.

5. The method according to claim 1, wherein The method further comprises: In response to a service call request initiated by the target tenant function, determining a data access key corresponding to the target tenant function and a target service to be called; The target service to be called calls a data processing interface based on the data access key to store or query the data in the target database.

6. The method according to claim 1, characterized in that The target database is used for the target tenant to store financial data with a data confidentiality level greater than a set level.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: In response to the identity authentication interface, new tenant interface, or data processing interface being called, audit logs are enabled; Based on the log configuration parameters of the audit log, data processing operations associated with the identity authentication interface, the new tenant interface, or the data processing interface are recorded.

8. A data processing device based on a serverless architecture, characterized in that: The device comprises: an identity information determination module, configured to determine, based on a function call request initiated by a target tenant for a target tenant function in a serverless architecture, the tenant identifier of the target tenant, the function identifier, and the database key of the target database; wherein the target database is an encrypted database, being a private database exclusively belonging to the target tenant; and the database key of the target database is stored in a hardware token held by the target tenant; An identity authentication module, configured to call an identity authentication interface to authenticate the target tenant based on the tenant identifier, the function identifier, and a database key of the target database; A data access key generation module is used to generate a data access key for the function call request when the identity authentication is passed, and feed the data access key back to the target tenant; wherein, the data access key is used to authorize the storage or query of data in the target database.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data processing method based on a serverless architecture as described in any one of claims 1 to 7 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein: When the processor executes the computer program, the data processing method based on the serverless architecture is implemented as described in any one of claims 1 to 7.

Images