Data processing method and device
By using heterogeneous data processing modules in the encryption and decryption process, combining the CPU instruction set and hardware encryption and decryption, and performing data comparison and verification, the encryption and decryption error problems caused by hardware failures are solved, and the encryption accuracy and system performance are improved.
Patent Information
- Application Number
- CN202410411823.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-07
- Publication Date
- 2025-10-14
AI Technical Summary
In the existing technology, hardware failures can easily lead to data errors during encryption and decryption operations, and the software cannot directly confirm the correctness of the operation, resulting in erroneous data being used, affecting data security.
Heterogeneous data processing modules are used for encryption, decryption and verification. The encrypted data is decrypted and compared with the original text using a combination of CPU instruction set and hardware encryption and decryption to ensure encryption correctness.
It improves the strength of encryption verification, avoids symmetry errors caused by single module errors, improves encryption accuracy and system bandwidth, and stabilizes operation time and performance fluctuations.
Smart Images
Figure CN120785550A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of encryption technology, in particular to a data processing method and device. BACKGROUND
[0002] With the gradual improvement of user requirements for data security, there is a demand for data encryption in many scenarios, such as encrypting data storage in cloud storage nodes (such as cloud disks) to improve data security.
[0003] However, the encryption and decryption operation is an opaque process, and it is difficult for the software itself to know whether the encryption and decryption calculation in this process is correct. For example, when using hardware for encryption, if the hardware itself has a fault, data errors may occur in the encryption and decryption operation process, thereby outputting incorrect results, and the software itself cannot directly confirm whether the operation is correct. If the wrong data is used, it will have a great impact. SUMMARY
[0004] In view of the above problems, a data processing method and device are provided to overcome the above problems or at least partially solve the above problems, comprising:
[0005] A data processing method, the method comprising:
[0006] Obtaining first data to be encrypted;
[0007] Using a first data processing module to encrypt the first data to obtain second data;
[0008] Using a second data processing module to decrypt the second data to obtain third data;
[0009] Using the first data to verify the third data to obtain a verification result; wherein the verification result is used to indicate whether the second data is encrypted correctly.
[0010] Optionally, using the first data to verify the third data to obtain a verification result comprises:
[0011] Determining whether the third data and the first data are the same;
[0012] According to the determination result, a verification result is generated to indicate whether the second data is encrypted correctly.
[0013] Optionally, the first data processing module uses CPU instruction set encryption or decryption, and the second encryption module uses hardware encryption or decryption.
[0014] Alternatively, the first data processing module adopts hardware encryption or decryption, and the second encryption module adopts CPU instruction set encryption or decryption.
[0015] Optionally, the method further comprises:
[0016] In a case where the check result indicates that the second data is encrypted correctly, the second data is stored to the cloud storage node.
[0017] Optionally, the first data is data sent by a virtual machine or a virtual machine platform deployed in the computing node.
[0018] A data processing method, applied to a storage client, the storage client being deployed in a computing node, the computing node performing data reading and writing operations on a cloud storage node through the storage client, the method comprising:
[0019] obtaining first data to be encrypted sent by a virtual machine or a virtual machine platform deployed in the computing node;
[0020] adopting a first data processing module to perform encryption processing on the first data to obtain second data;
[0021] adopting a second data processing module to perform decryption processing on the second data to obtain third data;
[0022] adopting the first data to perform checking on the third data to obtain a check result, wherein the check result is used to indicate whether the second data is encrypted correctly;
[0023] In a case where the check result indicates that the second data is encrypted correctly, the second data is stored to the cloud storage node.
[0024] A data processing system, configured to implement the method described above.
[0025] A data processing apparatus, configured to implement the method described above.
[0026] An electronic device, characterized by comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above.
[0027] A computer readable storage medium, storing a computer program, wherein the computer program, when executed by a processor, implements the method described above.
[0028] A computer program product, comprising a computer program, wherein the computer program, when executed by a processor, implements the method described above.
[0029] The embodiment of the present application has the following advantages:
[0030] In the embodiment of the present application, by acquiring the first data to be encrypted, the first data is encrypted by using the first data processing module to obtain the second data, the second data is decrypted by using the second data processing module to obtain the third data, the third data is verified by using the first data to obtain the verification result, and the verification result is used to indicate whether the second data is encrypted correctly. The data encryption and verification are implemented by using the heterogeneous data processing modules, the verification strength is improved, and the encryption accuracy is ensured, and especially, the situation that a certain data processing module generates symmetric error and cannot be verified is avoided. BRIEF DESCRIPTION OF DRAWINGS
[0031] In order to more clearly illustrate the technical solutions of the present application, the drawings needed to be used in the description of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the premise of the drawings.
[0032] Figure 1 is a step flow chart of a data processing method provided by an embodiment of the present application;
[0033] Figure 2 is a step flow chart of another data processing method provided by an embodiment of the present application. DETAILED DESCRIPTION
[0034] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0035] In actual application, the encryption and decryption operation is an opaque process, and a data is input and a ciphertext is obtained. It is difficult for the software itself to know whether the encryption and decryption calculation in the process is correct. For example, when encryption is performed by using hardware, if the hardware itself has a fault, data error may occur in the encryption and decryption operation process, so that an incorrect result is output, and the software itself cannot directly confirm whether the operation is correct. If the incorrect data is used, a great influence will be caused.
[0036] In some scenarios, the decrypted or decrypted data result can be checked again to determine whether the encryption and decryption result is correct. Taking encryption as an example, the following method can be used for secondary check:
[0037] 1. The original text A1 is input to hardware or a CPU (Central Processing Unit) for encryption to obtain ciphertext B1.
[0038] 2. The ciphertext B1 is input to the hardware or the CPU for decryption to obtain the original text A2.
[0039] 3. The A1 and A2 data are compared, and if they are completely identical, it is determined that the data is correct, and the ciphertext B1 is used as the result.
[0040] However, the above scheme cannot rule out symmetric errors, that is, the encryption result is incorrect, but the correct plaintext can be restored after decryption, and the same plaintext is found when comparing two plaintexts, so it cannot be determined whether the encryption is incorrect.
[0041] Since encryption and decryption are inverse operations, if the hardware error position is coincidentally correct, this situation may occur. For example, there is a single-bit error in the key recorded by the hardware, and the incorrect key is used to calculate the incorrect ciphertext when inputting the plaintext. However, the incorrect key can obtain the original plaintext when decrypting the incorrect ciphertext. Alternatively, the hardware used for encryption and decryption itself fails, and it outputs without any operation on the input, which is also a special symmetric error, and the above scheme cannot check it.
[0042] Therefore, an embodiment of the present application proposes a method of mutual check using two different data processing modules, one for encryption and the other for check, to check the correctness of the data.
[0043] For example, the software supports both CPU instruction set encryption and decryption and a hardware encryption and decryption scheme, such as hardware encryption and decryption including intel QAT (Quick Assist Technology) hardware offload technology and FPGA (Field Programmable Gate Array) computing card encryption and decryption. The following method can be used:
[0044] 1. The original text A1 is input to hardware for encryption to obtain ciphertext B1.
[0045] 2. The B1 is decrypted by using the CPU instruction set decryption method to obtain plaintext A2.
[0046] 3. Check whether A1 and A2 are the same to check whether the ciphertext B1 is correct.
[0047] In the embodiment of the present application, the form of heterogeneous encryption is adopted, the check strength is enhanced, and through two different data processing modules, it is ensured that the error cannot be detected due to the symmetry error of one of the modules.
[0048] Moreover, the computing power of the two modules is used at the same time in one encryption, the bandwidth bottleneck of a single module is broken, and greater encryption and decryption bandwidth is provided for the whole system. For example, if the encryption card has only 1 GB bandwidth, and if the encryption card is used for encryption or decryption check, the data bandwidth that can be provided is only 1 GB / 2=500 MB, and the embodiment of the present application can theoretically provide complete 1 GB bandwidth, and the overall bandwidth of the system is improved.
[0049] Furthermore, in the embodiment of the present application, the operation time of each request is more stable, and the performance fluctuation is smaller. For example, in the related double-module scheme, half of the requests go through the CPU instruction set, and the other half of the requests go through the encryption card. Due to the unequal performance of the two modules, half of the requests are processed quickly, and the other half are processed slowly. The embodiment of the present application can make each request use the two modules uniformly, and the processing path of each request is the same, so the processing time of each request is more uniform.
[0050] The present application will be further described below with reference to the accompanying drawings:
[0051] Referring to Figure 1 , a step flowchart of a data processing method provided by an embodiment of the present application is shown, and the method can specifically include the following steps:
[0052] Step 101, first data to be encrypted is obtained.
[0053] When data needs to be encrypted, the first data to be encrypted, i.e., the original text of the data, can be obtained.
[0054] Step 102, a first data processing module is used to encrypt the first data to obtain second data.
[0055] The data processing module can be an encryption and decryption module, and can be used for encrypting and decrypting data.
[0056] In actual application, the first data processing module and the second data processing module can be set in advance, and the first data processing module and the second data processing module can be heterogeneous modules, i.e., different encryption and decryption methods are used. Then the first data processing module can be used to encrypt the first data to obtain the second data, i.e., the ciphertext.
[0057] In some embodiments of the present application, the first data processing module uses CPU instruction set encryption or decryption, and the second encryption module uses hardware encryption or decryption; or, the first data processing module uses hardware encryption or decryption, and the second encryption module uses CPU instruction set encryption or decryption.
[0058] Wherein, the encryption and decryption is a mathematical transformation operation, which obtains ciphertext after a series of operations such as addition, subtraction, multiplication, division, transposition, etc. on plaintext according to a preset algorithm, and the CPU instruction set encryption and decryption is that a series of operations are all executed by the CPU, and the hardware encryption and decryption is that a special hardware chip is designed to handle the above series of operations, and a circuit process is specially designed in the hardware for the series of operations, which has the advantages of faster speed and larger data volume processed in parallel at the same time, etc. For example, the hardware encryption includes intel QAT hardware offload technology and FPGA computing card encryption and decryption.
[0059] In step 103, the second data is decrypted by using the second data processing module to obtain third data.
[0060] In actual application, since the same data processing module is used for self-checking, it is impossible to exclude symmetric errors, i.e. the encryption result is wrong, but the correct plaintext can be restored after decryption, and the same plaintext is found when comparing two plaintexts, so it is impossible to determine whether the encryption is wrong.
[0061] Since encryption and decryption are inverse operations, if the hardware error position is coincidentally, i.e. this situation may occur. For example, there is a single-bit error in the key recorded by the hardware, and the input plaintext will use the wrong key to calculate the wrong ciphertext, but the error key can get the original plaintext after decrypting the error ciphertext. Or, the hardware module itself is invalid, and it outputs without any operation on the input, which is also a special symmetric error and cannot be checked.
[0062] In the embodiments of the present application, the second data processing module which is heterogeneous with the first data processing module can be used to check the second data to obtain a check result, i.e. whether the second data is encrypted correctly.
[0063] In actual application, since the second data is ciphertext obtained by encrypting the first data by using the first data processing module, the second data processing module can be used to decrypt the second data to obtain third data, i.e. the third data is plaintext. In some examples, the second data processing module can also be used to encrypt the first data to obtain the second data, and the first data processing module can be used to decrypt the second data to obtain the third data.
[0064] In step 104, the third data is checked by using the first data to obtain a checking result, wherein the checking result is used to indicate whether the second data is encrypted correctly.
[0065] After the third data is obtained, the third data can be checked to be consistent with the first data to obtain a checking result.
[0066] In some embodiments of the present application, the checking of the third data by using the first data to obtain a checking result comprises:
[0067] determining whether the third data and the first data are the same, and generating a checking result used to indicate whether the second data is encrypted correctly according to the determination result.
[0068] After the third data is obtained, the third data and the first data are both plaintexts, so it can be determined whether the third data and the first data are the same, and then a checking result used to indicate whether the second data is encrypted correctly can be generated according to the determination result.
[0069] In some examples, the second data processing module needs to obtain the key used by the first data processing module when performing the encryption processing when performing the decryption processing, and then the same key is used to perform the decryption processing.
[0070] In some embodiments of the present application, the generating of the checking result used to indicate whether the second data is encrypted correctly according to the determination result comprises:
[0071] In the case that the third data and the first data are the same, a checking result used to indicate that the second data is encrypted correctly is generated, and in the case that the third data and the first data are not the same, a checking result used to indicate that the second data is encrypted incorrectly is generated.
[0072] In the case that the encryption is correct, the third data obtained by the second data processing module should be the same as the first data, so in the case that the third data and the first data are the same, it can be determined that the encryption is correct, and a checking result used to indicate that the second data is encrypted correctly is generated, and in the case that the third data and the first data are not the same, it can be determined that the encryption is incorrect, and a checking result used to indicate that the second data is encrypted incorrectly is generated.
[0073] In some embodiments of the present application, it further comprises: in the case that the checking result indicates that the second data is encrypted correctly, the second data is stored to a cloud storage node.
[0074] In the case that the encryption is correct, the second data can be stored to a cloud storage node (such as a cloud disk).
[0075] In some storage systems, such as block storage systems, transparent encryption services can be provided for cloud storage nodes, and users can provide or use the key management services of public clouds to maintain corresponding keys in the storage systems. The data is encrypted at the bottom layer in the storage systems, and the data is in plaintext form when the user writes and reads the data, and thus the data needs to be encrypted before storage and decrypted after retrieval.
[0076] In actual applications, a storage client can be deployed on a computing node, such as by installing block storage terminal software on the computing node. The storage client provides read and write functions for the computing node, and the storage client is an interface of the storage system for users, and the input and output data of the storage client are in plaintext. Specifically, the storage client can implement the function of a forwarding module, forwards the read and write requests issued by an upper virtual machine or virtualization platform to a back-end service module of the storage system according to a corresponding address rule, and then implements the reading and writing of the cloud storage node.
[0077] The computing node can be a physical server, and a virtualization software can be allowed on the computing node to create a virtual machine or virtualization platform for users to use. When the upper virtual machine or virtualization platform needs to use the cloud storage node, the storage client deployed in the computing node can be used for processing.
[0078] In some embodiments of the present application, the method can be applied to a storage client, and the storage client can be deployed on a computing node. The computing node performs data reading and writing operations on the cloud storage node through the storage client. The first data can be data sent by a virtual machine or virtual machine platform deployed in the computing node. Specifically, the virtual machine or virtual machine platform deployed in the computing node sends data to the storage client deployed in the computing node, encrypts the first data through the storage client, writes the second data obtained by encryption to the cloud storage node, and the specific process is as follows:
[0079] a. Obtain a request list (i.e., a data write request queue for the cloud storage node) to be processed from a request queue of each cloud disk (i.e., the cloud storage node) of the upper virtual machine or virtualization platform.
[0080] b. Process each request in the request list, and the processing procedure is as follows:
[0081] 1. Perform other basic processing on the request, such as unpacking and packet header filling according to the requirements of a network protocol.
[0082] 2. If the cloud disk to be written is an encrypted cloud disk (i.e., the data needs to be encrypted for storage), encrypt the data part of the request to ensure that the data sent below is ciphertext.
[0083] c. deliver the processed request to the corresponding backend service module for sending to the cloud disk for encrypted storage.
[0084] In the embodiment of the application, by acquiring first data to be encrypted, the first data is encrypted by using a first data processing module to obtain second data, the second data is decrypted by using a second data processing module to obtain third data, the third data is verified by using the first data to obtain a verification result, and the verification result is used to indicate whether the second data is encrypted correctly, so that the data encryption and verification are implemented by using heterogeneous data processing modules, the verification strength is improved, and the encryption accuracy is ensured, and especially, the case that a symmetric error of a certain data processing module cannot be verified is avoided.
[0085] Referring to Figure 2 , a step flowchart of another data processing method provided by an embodiment of the application is shown, the method is applied to a storage client, the storage client is deployed on a computing node, and the computing node performs data reading and writing operations on a cloud storage node through the storage client.
[0086] In some storage systems, such as a block storage system, a transparent encryption service can be provided for a cloud storage node, a user can provide or use a key management service of a public cloud to maintain a corresponding key in the storage system, the data is encrypted at a bottom layer, and when the user writes or reads data, the data is in a plaintext form, and the data needs to be encrypted before storage and decrypted after storage.
[0087] In actual application, the storage client can be deployed on the computing node, such as by installing a block storage terminal software on the computing node to deploy the storage client, the storage client provides the computing node with data reading and writing functions, and the storage client is an interface of the storage system for the user, and the input and output data of the storage client are in a plaintext form. Specifically, the storage client can implement a forwarding module function, forwards a read-write request issued by an upper virtual machine or virtualization platform to a backend service module of the storage system according to a corresponding address rule, and then implements reading and writing of the cloud storage node.
[0088] The computing node can be a physical server, and a virtualization software can be allowed on the computing node to create a virtual machine or virtualization platform for the user to use, and when the upper virtual machine or virtualization platform needs to use the cloud storage node, the storage client deployed in the computing node can be used for processing.
[0089] Specifically, the method can include the following steps:
[0090] Step 201, obtaining first data to be encrypted sent by a virtual machine or a virtual machine platform deployed in the computing node.
[0091] When the data needs to be encrypted, the first data to be encrypted, i.e., the original data, can be obtained.
[0092] In actual application, the first data can be data sent by a virtual machine or a virtual machine platform deployed in the computing node, i.e., the virtual machine or the virtual machine platform deployed in the computing node sends the data to a storage client deployed in the computing node.
[0093] Step 202, using a first data processing module to perform encryption processing on the first data to obtain second data.
[0094] The data processing module can be an encryption and decryption module and can be used to perform encryption and decryption processing on the data.
[0095] In actual application, the first data processing module and the second data processing module can be pre-set, and the first data processing module and the second data processing module can be heterogeneous modules, i.e., different encryption and decryption modes are used, then the first data processing module can be used to perform encryption processing on the first data to obtain the second data, i.e., the data ciphertext.
[0096] In some embodiments of the application, the first data processing module uses CPU instruction set encryption or decryption, and the second encryption module uses hardware encryption or decryption; or the first data processing module uses hardware encryption or decryption, and the second encryption module uses CPU instruction set encryption or decryption.
[0097] The encryption and decryption is a mathematical transformation operation, which obtains ciphertext by performing a series of operations such as addition, subtraction, multiplication, division, and transposition on plaintext according to a preset algorithm, the CPU instruction set encryption and decryption is that a series of operations are performed by the CPU, the hardware encryption and decryption is that a hardware chip is specially designed to handle the above series of operations, and a circuit process is specially designed in the hardware for the series of operations, which has the advantages of faster speed and larger data volume processed in parallel at the same time, etc., such as the hardware encryption including intel QAT hardware offload technology and FPGA computing card encryption and decryption.
[0098] Step 203, using a second data processing module to perform decryption processing on the second data to obtain third data.
[0099] In actual application, since the same data processing module is used to verify itself, it is impossible to exclude symmetric errors, i.e., the encryption result is wrong, but the correct plaintext can still be restored after decryption, and when two plaintexts are compared, it is found that they are the same, and it is impossible to judge whether the encryption is wrong.
[0100] Because encryption and decryption are inverse operations, if the hardware error position is coincidentally, it may appear this case. For example, the hardware record key has a single bit error, input a plaintext will use the error key to calculate the error ciphertext, but the error key decrypts the error ciphertext, and the original plaintext can be obtained. Or, the hardware module itself fails, and it outputs without any operation on the input, which is also a special symmetric error and cannot be checked.
[0101] In the embodiments of the present application, the second data can be checked by using the second data processing module which is heterogeneous with the first data processing module, to obtain a check result, i.e., whether the second data is encrypted correctly.
[0102] In actual application, because the second data is ciphertext obtained by encrypting the first data by using the first data processing module, the second data processing module can be used to decrypt the second data to obtain the third data, i.e., the third data is plaintext. In some examples, the second data processing module can also be used to encrypt the first data to obtain the second data, and the first data processing module can be used to decrypt the second data to obtain the third data.
[0103] In step 204, the third data is checked by using the first data to obtain a check result; wherein the check result is used to indicate whether the second data is encrypted correctly.
[0104] After obtaining the third data, whether the third data is consistent with the first data can be checked to obtain a check result.
[0105] In some embodiments of the present application, the third data is checked by using the first data to obtain a check result, comprising:
[0106] determining whether the third data and the first data are the same; and generating a check result used to indicate whether the second data is encrypted correctly according to the determination result.
[0107] After obtaining the third data, the third data and the first data are both plaintext, whether the third data and the first data are the same can be determined, and then a check result used to indicate whether the second data is encrypted correctly can be generated according to the determination result.
[0108] In some examples, when the second data processing module performs decryption processing, the key used by the first data processing module when performing encryption processing needs to be obtained, and then the same key is used for decryption processing.
[0109] In some embodiments of the present application, the check result used to indicate whether the second data is encrypted correctly is generated according to the determination result, comprising:
[0110] In a case where the third data is identical to the first data, a check result indicating that the second data is encrypted correctly is generated; in a case where the third data is not identical to the first data, a check result indicating that the second data is encrypted incorrectly is generated.
[0111] In a case where the encryption is correct, the third data obtained by decrypting the second data by the second data processing module should be identical to the first data, and thus in a case where the third data is identical to the first data, it is determined that the encryption is correct, and a check result indicating that the second data is encrypted correctly is generated; in a case where the third data is not identical to the first data, it is determined that the encryption is incorrect, and a check result indicating that the second data is encrypted incorrectly is generated.
[0112] Step 205, in a case where the check result indicates that the second data is encrypted correctly, the second data is stored to the cloud storage node.
[0113] In a case where the check result indicates that the second data is encrypted correctly, the encrypted second data can be written to the cloud storage node, and the specific process is as follows:
[0114] a. A request list (i.e., a data write request queue for the cloud storage node) to be processed is obtained from a request queue of each cloud disk (i.e., the cloud storage node) of a virtual machine or a virtualization platform of an upper layer.
[0115] b. Each request in the request list is processed, and the processing procedure is as follows:
[0116] 1. Other basic processing is performed on the request, such as packet disassembly and packet header filling according to the requirements of a network protocol.
[0117] 2. If the cloud disk to be written is an encrypted cloud disk (i.e., the data carried needs to be encrypted and stored), the data part of the request is encrypted to ensure that the data sent downward is ciphertext.
[0118] c. The processed request is delivered to a corresponding backend service module to be sent to the cloud disk for encrypted storage.
[0119] It should be noted that, for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited to the order of the actions described, because according to the embodiments of the present application, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily essential for the embodiments of the present application.
[0120] An embodiment of the present application also provides a data processing system, which is used to implement the above method.
[0121] An embodiment of the present application further provides a data processing device for implementing the method.
[0122] An embodiment of the present application further provides an electronic device, which can comprise a processor, a memory and a computer program stored in the memory and capable of running on the processor, and the computer program is executed by the processor to implement the method.
[0123] An embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method.
[0124] An embodiment of the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the method.
[0125] In some embodiments of the present application, the method specifically comprises:
[0126] Obtaining first data to be encrypted;
[0127] Encrypting the first data by using a first data processing module to obtain second data;
[0128] Decrypting the second data by using a second data processing module to obtain third data;
[0129] Verifying the third data by using the first data to obtain a verification result, wherein the verification result is used to indicate whether the second data is encrypted correctly.
[0130] In some embodiments of the present application, the verifying the third data by using the first data to obtain a verification result comprises:
[0131] Judging whether the third data is same as the first data;
[0132] Generating a verification result used to indicate whether the second data is encrypted correctly according to the judgment result.
[0133] In some embodiments of the present application, the first data processing module uses CPU instruction set encryption or decryption, and the second encryption module uses hardware encryption or decryption.
[0134] Or, the first data processing module uses hardware encryption or decryption, and the second encryption module uses CPU instruction set encryption or decryption.
[0135] In some embodiments of the present application, further comprising:
[0136] In a case where the check result indicates that the second data is encrypted correctly, the second data is stored to a cloud storage node.
[0137] In some embodiments of the present application, the first data is data sent by a virtual machine or a virtual machine platform deployed in the computing node.
[0138] In the embodiments of the present application, the first data to be encrypted is obtained, the first data is encrypted by using the first data processing module to obtain second data, the second data is decrypted by using the second data processing module to obtain third data, and the third data is checked by using the first data to obtain a check result, which is used to indicate whether the second data is encrypted correctly. Thus, the data encryption and checking are implemented by using heterogeneous data processing modules, the checking strength is improved, and the encryption accuracy is ensured, and especially, the case that a symmetric error of a data processing module cannot be checked out is avoided.
[0139] For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts refer to the parts described in the method embodiments.
[0140] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for the user to select authorization or refusal.
[0141] Each embodiment in the present specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts of each embodiment can be referred to each other.
[0142] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device or computer program product. Therefore, the embodiments of the present application can be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, compact disc read-only memory, optical storage, etc.) containing computer usable program code.
[0143] The embodiments of the present application are described with reference to the flowchart illustrations and / or block diagrams of the methods, terminal devices (systems) and computer program products according to the embodiments of the present application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing terminal devices to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal devices, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0144] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing terminal devices to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0145] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal devices, such that a series of operational steps are performed on the computer or other programmable terminal devices to produce a computer implemented process so that the instructions which execute on the computer or other programmable terminal devices provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.
[0146] Although preferred embodiments of the present application have been described, those skilled in the art will be able to make additional modifications and variations to the embodiments without departing from the scope of the present application. Accordingly, the appended claims are intended to encompass all such modifications and variations as falling within the scope of the embodiments of the present application.
[0147] Finally, it needs to be pointed out that in this document, relational terms such as first and second and the like can only be intended to distinguish one entity or operation from another entity or operation without necessarily requiring or implying any such actual relationship or order between such entities or operations. Moreover, the terms "comprising", "including", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the statement "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus including the stated element.
[0148] The above provides a detailed description of a method and device for data processing. The principles and implementation of the present application are described using specific examples. The above examples are used to help understand the method and core idea of the present application. For those skilled in the art, the specific implementation and application range can be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.
Claims
1. A data processing method, characterized in that: The method comprises: Obtaining first data to be encrypted; Using a first data processing module, encrypting the first data to obtain second data; Using a second data processing module, decrypting the second data to obtain third data; The third data is verified using the first data to obtain a verification result; wherein the verification result is used to indicate whether the second data is encrypted correctly.
2. The method according to claim 1, characterized in that The verifying the third data using the first data to obtain a verification result includes: determining whether the third data is identical to the first data; Based on the judgment result, a verification result is generated to indicate whether the second data is encrypted correctly.
3. The method according to any one of claims 1 to 2, characterized in that The first data processing module uses CPU instruction set encryption or decryption, and the second encryption module uses hardware encryption or decryption; Alternatively, the first data processing module adopts hardware encryption or decryption, and the second encryption module adopts CPU instruction set encryption or decryption.
4. The method according to claim 1, wherein Also includes: When the verification result indicates that the second data is encrypted correctly, the second data is stored in a cloud storage node.
5. The method according to claim 4, characterized in that The first data is data sent by a virtual machine or a virtual machine platform deployed in the computing node.
6. A data processing method, characterized in that: The method is applied to a storage client, which is deployed on a computing node. The computing node performs data reading and writing operations on a cloud storage node through the storage client. The method includes: Obtaining first data to be encrypted sent by a virtual machine or a virtual machine platform deployed in the computing node; Using a first data processing module, encrypting the first data to obtain second data; Using a second data processing module, decrypting the second data to obtain third data; Using the first data, verifying the third data to obtain a verification result; wherein the verification result is used to indicate whether the second data is encrypted correctly; When the verification result indicates that the second data is encrypted correctly, the second data is stored in the cloud storage node.
7. A data processing system, characterized in that: The system is used to implement the method according to any one of claims 1 to 5.
8. A data processing device, characterized in that: The device is used to implement the method according to any one of claims 1 to 5.
9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 5 when executed by the processor.
10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.
11. A computer program product, characterized in that The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 5.