Data storage method, data reading method, data storage device, data reading device, equipment and medium

Abstract

The invention relates to a data storage and reading method, a data storage and reading device, equipment and a medium. The method comprises the steps that the encryption middleware receives a data writing request from an application program; the data writing request comprises a target writing address and plaintext writing data; the target write-in address is a sub-address of a mounting address pre-mounted in the application node by the encryption middleware; based on the plaintext write data of the data write-in request, determining to-be-stored data of the data write-in request; and sending the to-be-stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data. By adopting the method, the encryption protection middleware can be constructed in the application node, the object-oriented storage encryption protection function is realized on the premise of not invading and modifying the application program, and the plaintext data is ensured not to be out of the application node.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data storage and reading method, a data storage and reading device, equipment and medium. BACKGROUND

[0002] With the maturity and wide application of cloud computing technology, object storage services provided by cloud platforms are being adopted by more and more users due to their high flexibility, good scalability and low cost. However, with the explosive growth of data on the cloud, users' concerns about data security are also increasing. In addition to basic storage reliability and service availability, data confidentiality has become one of the most concerned issues for users, that is, how to ensure that private data stored in the cloud is not stolen or misused by unauthorized third parties.

[0003] In this context, effective encryption of data in object storage has become an urgent need to protect data confidentiality and user privacy. SUMMARY

[0004] Therefore, it is necessary to provide a data storage and reading method, a data storage and reading device, equipment and medium capable of improving data storage security in view of the above technical problems.

[0005] In a first aspect, the present application provides a data storage method applied to an encryption middleware, comprising:

[0006] receiving a data write request from an application program; the data write request comprising a target write address and plaintext write data; the target write address being a sub-address of a mounting address of the encryption middleware pre-mounted in the application node;

[0007] determining stored data of the data write request based on the plaintext write data of the data write request; the stored data comprising encrypted ciphertext write data of the plaintext write data and storage identification data corresponding to the ciphertext write data;

[0008] sending the stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

[0009] In one embodiment, the determination of the stored data of the data write request based on the plaintext write data of the data write request comprises:

[0010] processing the plaintext write data based on a preset block strategy to obtain a plurality of plaintext write data blocks;

[0011] performing parallel encryption processing on the plurality of plaintext write data blocks using a plurality of encryption threads to obtain a plurality of ciphertext write data blocks;

[0012] Determine the data to be stored in combination with the plurality of ciphertext data blocks and the plurality of storage identifier data respectively corresponding to the plurality of ciphertext data blocks.

[0013] In one embodiment, the data write request further includes identity data; and the method further includes:

[0014] Sending the identity data to the cloud storage system, so that the cloud storage system stores the data to be stored in a target storage area corresponding to the identity data under the condition that the identity data meets the storage permission; and the cloud storage system stores a correspondence between the identity and the storage area.

[0015] In a second aspect, the application further provides a data reading method applied to an encryption middleware, the method comprising:

[0016] In response to a data reading request from an application, obtaining storage identifier data corresponding to the data reading request; the data reading request at least includes a target reading address; the target reading address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; and the encryption middleware pre-stores a mapping relationship between the reading address and the storage identifier;

[0017] Based on the storage identifier data, obtaining ciphertext reading data matching the storage identifier data from a cloud storage system;

[0018] Sending plaintext reading data decrypted from the ciphertext reading data to the application.

[0019] In one embodiment, the obtaining of the ciphertext reading data matching the storage identifier data from the cloud storage system based on the storage identifier data comprises:

[0020] When the storage identifier data is multiple, obtaining multiple ciphertext data blocks matching the multiple storage identifier data from the cloud storage system;

[0021] Obtaining the ciphertext reading data according to the multiple ciphertext data blocks.

[0022] In one embodiment, after the obtaining of the ciphertext reading data matching the storage identifier data from the cloud storage system based on the storage identifier data, the method further comprises:

[0023] Using multiple decryption threads to perform parallel decryption processing on the multiple ciphertext data blocks to obtain multiple plaintext data blocks;

[0024] Obtaining the plaintext reading data in combination with the multiple plaintext data blocks.

[0025] In a third aspect, the present application provides a data storage apparatus, comprising:

[0026] a storage receiving module configured to receive a data write request from an application program; the data write request comprising a target write address and plaintext write data; the target write address being a sub-address of a mounting address of the encryption middleware pre-mounted in the application node;

[0027] a storage determining module configured to determine, based on the plaintext write data of the data write request, to-be-stored data of the data write request; the to-be-stored data comprising ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data;

[0028] a storage sending module configured to send the to-be-stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

[0029] In a fourth aspect, the present application provides a data reading apparatus, comprising:

[0030] a reading obtaining module configured to, in response to a data read request from an application program, obtain storage identification data corresponding to the data read request; the data read request comprising at least a target read address; the target read address being a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; the encryption middleware pre-storing a mapping relationship between a read address and storage identification;

[0031] a reading ciphertext module configured to, based on the storage identification data, obtain ciphertext read data matching the storage identification data from a cloud storage system;

[0032] a reading sending module configured to send, to the application program, plaintext read data obtained by decrypting the ciphertext read data.

[0033] In a fifth aspect, the present application provides a computer device, comprising a memory and a processor; the memory stores a computer program; and the processor, when executing the computer program, implements the steps of the data storage method provided in the first aspect of the present application or the steps of the data reading method provided in the second aspect of the present application.

[0034] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program; and the computer program, when executed by a processor, implements the steps of the data storage method provided in the first aspect of the present application or the steps of the data reading method provided in the second aspect of the present application.

[0035] In a seventh aspect, the present application also provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the data storage method according to the first aspect of the present application or the steps of the data reading method according to the second aspect of the present application.

[0036] The data storage and reading method, the data storage and reading device, the equipment, and the medium described above, the encryption middleware mounts the mounting address to the application node in advance, when the application program requests to write data to the sub-address of the mounting address, the encryption middleware receives the data write request from the application program, determines the to-be-stored data of the data write request based on the plaintext write data of the data write request, the to-be-stored data comprises the ciphertext write data obtained by encrypting the plaintext write data and the storage identification data corresponding to the ciphertext write data, and the encryption middleware sends the to-be-stored data to the cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data. The present application sets the encryption middleware in the application node, the encryption middleware mounts the object storage as a local path through the mounting address, the application program can write data to the local path through plaintext, the encryption middleware receives the data write request of the application program through the mounting address, and encrypts the plaintext write data to obtain the ciphertext write data, the encryption middleware sends the ciphertext write data and the storage identification data corresponding to the ciphertext write data to the object storage service of the cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data. By constructing the encryption protection middleware in the application node, the encryption protection function for the object storage is realized without modifying the application program, and the plaintext data is ensured not to go out of the application node, so that the plaintext data is protected from being stolen and misused. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0038] Figure 1 A flowchart of the object storage method in one embodiment;

[0039] Figure 2 An application environment diagram of the data storage method and the data reading method in one embodiment;

[0040] Figure 3 A flowchart of the data storage method in one embodiment;

[0041] Figure 4A structural block diagram of encryption middleware in one embodiment;

[0042] Figure 5 A flowchart of a data storage method in another embodiment;

[0043] Figure 6 A flowchart of encryption middleware block and encryption in one embodiment;

[0044] Figure 7 A flowchart of a data reading method in one embodiment;

[0045] Figure 8 A flowchart of a data reading method in another embodiment;

[0046] Figure 9 A structural block diagram of a data storage device in one embodiment;

[0047] Figure 10 A structural block diagram of a data reading device in one embodiment;

[0048] Figure 11 An internal structural diagram of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not to limit the present application.

[0050] As shown in Figure 1 the current data encryption protection for object storage can include the following two implementation schemes: the first scheme is to provide encryption and decryption functions by the object storage service software itself on the cloud platform, and the second scheme is to implement data encryption and decryption by the application software on the client side.

[0051] The key of the above-mentioned first scheme is usually managed by the key management service (KMS) of the cloud platform, and its limitation is that it mainly protects the state after the data is landed. In the network path from the application end to the storage service, and in the process of the storage service interface processing authentication information, the data may exist in plaintext form. If the network message is eavesdropped, or the authentication information of the storage service interface is stolen, the plaintext data of the user is at risk of leakage.

[0052] The above-mentioned second scheme implements data encryption and decryption by the application software on the client side, and its disadvantage is that it has strong invasiveness to the application program, and needs to integrate the encryption and decryption module in each application that needs to access the object storage, which involves extensive application modification and high adaptation cost, and it is difficult to promote the application on a large scale.

[0053] The data storage method and the data reading method provided by the embodiments of the present application can be applied to an application environment as shown in Figure 2 The application node communicates with the cloud storage system through a network, and the application node is internally deployed with an encryption middleware, which is used to connect with an application program in the application node. The encryption middleware can realize the encryption protection function for object storage without modifying the application program, so as to ensure that the plaintext data does not go out of the application node.

[0054] The application program can be a business application program of a user, such as a database software, a Web server, a data analysis program, a file synchronization tool, etc. The application node can be a computing resource environment running the application program, which can be but is not limited to a server or a virtual machine instance running the application program or a specific component of the application program.

[0055] In an exemplary embodiment, as shown in Figure 3 A data storage method is provided, which is taken as an example of the encryption middleware in Figure 2 The method includes the following steps 302 to 306. Wherein:

[0056] Step 302, receiving a data write request from an application program, the data write request including a target write address and plaintext write data.

[0057] The plaintext write data refers to the original data in the application program that has not been encrypted, and the target write address refers to the position or address where the data is to be stored as specified by the application program when issuing the data write request.

[0058] The target write address of the embodiments of the present application is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node. The mounting address is a specified address pre-mounted by the encryption middleware on the application node, which is a specific position controlled by the encryption middleware. When the application program attempts to write data to the mounting address, the encryption middleware can intercept the data write request.

[0059] Exemplarily, the mounting address can be a root directory or a root file path, which is used to represent a virtual file system entry pre-created and controlled by the encryption middleware on the application node running the application program. File operations through the file system entry can be intercepted and processed by the encryption middleware. When the application program issues a data write request, the data write request indicates that the plaintext write data is written to a certain subdirectory or subfile of the mounting address, and the encryption middleware intercepts and receives the data write request.

[0060] Step 304, determining the data to be stored of the data write request based on the plaintext write data of the data write request.

[0061] The to-be-stored data includes the ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data. The storage identification data is a unique identification of the ciphertext write data in the object storage allocated by the encryption middleware, and the encryption middleware can locate the ciphertext write data corresponding to the storage identification data in the object storage according to the storage identification data.

[0062] Exemplarily, after receiving the data write request, the encryption middleware encrypts the plaintext write data carried by the data write request to obtain ciphertext write data corresponding to the plaintext write data. The encryption middleware generates storage identification data corresponding to the ciphertext write data based on a predetermined rule, and obtains to-be-stored data by combining the ciphertext write data and the storage identification data. The encryption middleware stores the mapping relationship between the target write address and the storage identification data.

[0063] In step 306, the to-be-stored data is sent to the cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

[0064] Exemplarily, the encryption middleware sends the to-be-stored data to the object storage service of the cloud storage system, the cloud storage system stores the ciphertext write data, and associates the physical storage location of the ciphertext write data with the storage identification data.

[0065] In the above data storage method, the encryption middleware mounts the mounting address in the application node in advance. When the application program requests to write data to a sub-address of the mounting address, the encryption middleware receives the data write request from the application program, determines to-be-stored data of the data write request based on plaintext write data of the data write request, the to-be-stored data includes ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data, and the encryption middleware sends the to-be-stored data to the cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data. The encryption middleware is arranged in the application node, the object storage is mounted as a local path through the mounting address, the application program can write data to the local path in plaintext, the encryption middleware receives the data write request of the application program through the mounting address, encrypts the plaintext write data to obtain the ciphertext write data, and sends the ciphertext write data and the storage identification data corresponding to the ciphertext write data to the object storage service of the cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data. By constructing the encryption protection middleware in the application node, the encryption protection function for the object storage is realized without modifying the application program, and the plaintext data is ensured not to go out of the application node, so that the plaintext data is protected from being stolen and misused.

[0066] In one example embodiment, a data storage method is provided, comprising the steps of:

[0067] Step A1, the encryption middleware sends a mounting request to the application node, the mounting request being used to request mounting the target file directory as a mounting address on the application node.

[0068] The encryption middleware of the embodiments of the present application can send the mounting request to the application node through a Filesystem in Userspace (FUSE).

[0069] For example, referring to Figure 4 The encryption middleware can include a FUSE module, a metadata management module, a local cache module, and a storage encryption module, the FUSE module being connected with the metadata management module and the local cache module respectively, the local cache module being connected with the storage encryption module, and the storage encryption module being connected with the object storage of the cloud storage system. The encryption middleware sends a mounting request to the operating system kernel of the application node through the built-in FUSE module, the mounting request specifying the target file directory as a mounting address. The operating system kernel of the application node establishes an association between the target file directory and the encryption middleware in response to the mounting request, so that the operating kernel of the application node forwards the file system request for the target file directory and its sub-path to the encryption middleware associated with the target file directory through the FUSE mechanism.

[0070] Step A2, the application program sends a data write request to the application node where the application program is located.

[0071] The data write request includes a target write address and plaintext write data, and the target write address can refer to a target file path, which is a sub-address of the target file directory corresponding to the mounting address.

[0072] The data write request can further include identity data of the operation of initiating the data write request, a write offset of the plaintext write data, and a write data amount. The write offset refers to the starting position of the plaintext write data in the target write address, such as the byte position from which the plaintext write data is written; and the write data amount refers to the data length or data size of the plaintext write data, such as the amount of data in bytes to be written.

[0073] Step A3, the encryption middleware receives the data write request.

[0074] For example, referring to Figure 5In a POSIX (Portable Operating System Interface) compatible file system environment, an application sends a data write request to a POSIX compatible protocol, which can include a target write address, plaintext write data, and authentication information of an identity of a tenant initiating the data write request operation. After the operating system kernel of the application node receives the request, it identifies that the target file path requested by the application is located under the mounting address. The operating system kernel sends a data write request to the encryption middleware corresponding to the mounting address, so that the encryption middleware receives and processes the data write request. Specifically, the encryption middleware can forward the data write request to the encryption middleware FUSE module running in the user space and listening to the channel according to the FUSE mechanism through the FUSE communication channel.

[0075] Step A4, the encryption middleware processes the plaintext write data based on a preset block strategy to obtain a plurality of plaintext write data blocks, and uses a plurality of encryption threads to perform parallel encryption processing on the plurality of plaintext write data blocks to obtain a plurality of ciphertext write data blocks.

[0076] The preset block strategy refers to a logical division manner of the plaintext write data according to a pre-set rule or size.

[0077] Exemplarily, please refer to Figure 6 After the encryption middleware receives the data write request, the local cache module divides the plaintext write data into a plurality of plaintext write data blocks, for example, according to the write order of the data stream, based on a preset block size. For example, the preset block size is 4 MB, the encryption middleware divides the plaintext write data into N plaintext write data blocks, and then simultaneously encrypts the N plaintext write data blocks through N encryption thread pools to obtain a plurality of ciphertext write data blocks. The sequential write data stream of the application is converted into a concurrent write data stream, which can reduce the performance loss caused by the encryption algorithm, and the concurrent write object can significantly improve the write performance.

[0078] After the encryption middleware of the embodiment of the present application divides the plaintext write data into a plurality of independent plaintext write data blocks, it determines a plurality of logical identification data and a plurality of storage identification data respectively corresponding to the plurality of plaintext write data blocks or the plurality of ciphertext write data blocks corresponding thereto. The logical identification data is used to indicate the logical order of each plaintext write data block or ciphertext write data block, such as the logical block serial number, i.e., the order in the plaintext write data. The storage identification data is used to indicate the unique address of the ciphertext data block in the cloud storage. The encryption middleware can store the mapping relationship between the target write address, the logical identification data, and the storage identification data in the metadata management module.

[0079] In a possible implementation, in the case that the data write request sent by the application program is used for modifying the stored data, the encryption middleware determines the logical identification data associated with the current plaintext write data according to the write offset and the write data amount of the current plaintext write data. When the write offset and the write data amount of the plaintext write data are aligned with the preset block size of the encryption middleware, that is, the plaintext write data can completely cover one or more stored plaintext write data blocks corresponding to the logical identification data, the encryption middleware can divide and encrypt the plaintext write data to obtain a new ciphertext write data block, and then send the new ciphertext write data block and the storage identification data corresponding to the logical identification data to the cloud storage system. The cloud storage system stores the storage identification data and the previous ciphertext write data block. After receiving the new ciphertext write data block, the cloud storage system replaces the previous ciphertext write data block with the new ciphertext write data block.

[0080] In another possible implementation, in the case that the data write request sent by the application program is used for modifying the stored data, the encryption middleware determines the logical identification data associated with the current plaintext write data according to the write offset and the write data amount of the current plaintext write data. In the case that the current plaintext write data partially covers the previously stored data block, the encryption middleware obtains the storage object identification corresponding to the logical identification data, and obtains the previous ciphertext write data block corresponding to the storage object identification from the cloud storage system, to obtain the original plaintext write data block after decryption. The encryption middleware replaces the corresponding position of the original plaintext write data block with the current plaintext write data, and then encrypts to update the cloud storage system.

[0081] For example, the document.docx file has been stored as two ciphertext data blocks in the cloud, respectively storage identifier key0 and storage identifier key1. The encryption middleware stores the mapping relationship between the file address document.docx, the logical block sequence number block_0 (0-4MB range in the file logic based on the block strategy), and the storage identifier key0, and the mapping relationship between the file address document.docx, the logical block sequence number block_1 (4-8MB range in the file logic based on the block strategy), and the storage identifier key1. When the encryption middleware receives the plaintext write data with a write offset of 5MB and a write data amount of 1MB, it determines that the associated logical identifier is the logical block sequence number block_1, and partially covers the data block block_1. The encryption middleware sends an acquisition request carrying the storage identifier key1 to the cloud storage system. After the encryption middleware receives the previous ciphertext write data block corresponding to key1, it is decrypted to obtain the original plaintext data in the range of 4MB to 8MB of the document.docx file. The encryption middleware replaces the current 1MB new plaintext write data to the corresponding offset position to obtain the updated plaintext write data block, which is encrypted and sent to the cloud storage system with the storage identifier key1 for updating.

[0082] Step A5, the encryption middleware combines the plurality of ciphertext write data blocks and the plurality of storage identifier data corresponding to the plurality of ciphertext write data blocks respectively, determines the to-be-stored data, and sends the to-be-stored data to the cloud storage system, so that the cloud storage system stores the plurality of ciphertext write data blocks based on the plurality of storage identifier data.

[0083] Please continue to refer to Figure 5 The encryption middleware can also send the identity identifier data to the cloud storage system, so that the cloud storage system stores the to-be-stored data in the target storage area corresponding to the identity identifier data under the condition that the identity identifier data meets the storage permission. The cloud storage system stores the correspondence between the identity identifier and the storage area.

[0084] The embodiments of the present application can solve the problems of low encryption and decryption efficiency and strong application intrusion of object-oriented storage encryption protection, design a multi-threaded encryption and decryption architecture, convert sequential read and write into multi-threaded concurrent read and write, improve encryption and decryption and object storage read and write performance, provide transparent encryption and decryption capability to the application through the POSIX protocol, ensure that the plaintext data does not leave the application node, and effectively protect the confidentiality of the application data.

[0085] In one exemplary embodiment, as Figure 7 shown, a data reading method is provided, which is applied to the encryption middleware in Figure 2 for example, and includes the following steps 702 to 706. Wherein:

[0086] Step 702, in response to a data read request from an application program, obtaining storage identification data corresponding to the data read request.

[0087] The data read request at least includes a target read address; the target read address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; and the encryption middleware pre-stores a mapping relationship between a read address and a storage identification.

[0088] For example, in the data read process, the encryption middleware responds to a data read request from an application program. The request at least includes a target read address, which is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node. The data read request can also include a read offset and a read data amount. Please refer to the above data write process. After the application program sends a read request through the POSIX compatible protocol, the operating system kernel of the application node identifies that the target read address is located below the mounting point of the encryption middleware, and forwards the request to the FUSE module of the encryption middleware according to the FUSE mechanism. The encryption middleware uses its internally pre-stored metadata, such as the mapping relationship between the file address and the storage identification, such as the mapping relationship between the file address, the logical identification, and the storage identification. The encryption middleware determines the associated logical identification according to the target read address and / or the read offset and the read data amount to obtain the storage identification data associated with this data read.

[0089] Step 704, based on the storage identification data, obtaining ciphertext read data matching the storage identification data from the cloud storage system.

[0090] For example, the encryption middleware sends a read request to the cloud storage system based on the storage identification data. After receiving the request, the cloud storage system searches and returns the ciphertext read data (i.e., the encrypted data block) matching the storage identification data according to the provided storage identification data.

[0091] Step 706, sending the plaintext read data decrypted from the ciphertext read data to the application program.

[0092] For example, when there are multiple storage identification data, multiple ciphertext data blocks matching the multiple storage identification data are obtained from the cloud storage system; and the ciphertext read data is obtained according to the multiple ciphertext data blocks. Multiple decryption threads are used to perform parallel decryption processing on the multiple ciphertext data blocks to obtain multiple plaintext data blocks; and the plaintext read data is obtained by combining the multiple plaintext data blocks.

[0093] Please refer to Figure 8Further, when reading data, on one hand, the performance loss caused by repeated decryption of hot data frequently used by the application is avoided through the local read cache, and on the other hand, the reading performance from the object storage is improved through data pre-reading and multi-threaded decryption.

[0094] For example, the FUSE module of the encryption middleware monitors the read behavior of the application program. If it is found that the application program is reading data blocks in sequence (for example, block A and block B are continuously requested), the middleware can predict the subsequent behavior of the application program, such as continuously requesting block C and block D. Once the sequential pattern is detected, the middleware can proactively initiate a request to the cloud storage system to download the subsequent ciphertext data blocks in advance (for example, when the application program requests block B, the middleware can request the cloud storage system to obtain the ciphertext of block C and block D).

[0095] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0096] It can be understood that the term "based on" used in the present application is used to describe one or more factors that affect the determination, and does not exclude other factors that can affect the determination. For example, the phrase "determining A based on B" means that the determination of A can be based entirely or at least partially on factor B, that is, B is one factor that affects the determination of A, but does not exclude that the determination of A is also based on C.

[0097] Based on the same inventive concept, the embodiments of the present application also provide a data storage device for implementing the above-mentioned data storage method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more data storage device embodiments provided below can refer to the limitations of the data storage method described above, which will not be repeated here.

[0098] In one exemplary embodiment, as shown in Figure 9 a data storage device is provided, comprising: a storage receiving module 902, a storage determining module 904, and a storage sending module 906, wherein:

[0099] The storage receiving module 902 is configured to receive a data write request from an application program, wherein the data write request comprises a target write address and plaintext write data, and the target write address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node.

[0100] The storage determining module 904 is configured to determine to-be-stored data of the data write request based on the plaintext write data of the data write request, wherein the to-be-stored data comprises ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data.

[0101] The storage sending module 906 is configured to send the to-be-stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

[0102] Based on the same inventive concept, the embodiments of the present application also provide a data reading device for implementing the data reading method described above. The implementation scheme of the device for solving the problem is similar to the implementation scheme described in the above method, so the specific limitations in one or more data reading device embodiments provided below can refer to the limitations of the data reading method in the above text, which will not be repeated here.

[0103] In one exemplary embodiment, as shown in Figure 10 A data reading device is provided, comprising: a reading obtaining module 1002, a reading ciphertext module 1004, and a reading sending module 1006, wherein:

[0104] The reading obtaining module 1002 is configured to obtain storage identification data corresponding to a data reading request in response to the data reading request from an application program, wherein the data reading request at least comprises a target reading address, the target reading address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node, and the encryption middleware pre-stores a mapping relationship between reading addresses and storage identifications.

[0105] The reading ciphertext module 1004 is configured to obtain ciphertext read data matched with the storage identification data from a cloud storage system based on the storage identification data.

[0106] The reading sending module 1006 is configured to send plaintext read data obtained by decrypting the ciphertext read data to the application program.

[0107] Each of the above data storage apparatus and data reading apparatus can be implemented by software, hardware and combinations thereof in whole or in part. The above modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in a computer device in software form, so as to be invoked by the processor to perform the operations corresponding to the above modules.

[0108] In an exemplary embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in Figure 11 The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with terminals outside through network connection. The computer program is executed by the processor to implement a data storage method or a data reading method.

[0109] Those skilled in the art can understand that Figure 11 The structure shown in the above

[0110] In an exemplary embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the data storage method or the data reading method provided in the embodiments of the present application.

[0111] In an embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps of the data storage method or the data reading method provided in the embodiments of the present application.

[0112] In an embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps of the data storage method or the data reading method provided in the embodiments of the present application.

[0113] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0114] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, it can include the processes of the above-mentioned embodiments of each method. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0115] The technical features of the above embodiments can be combined in any way. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present disclosure.

[0116] The above-described embodiments are merely illustrative of several embodiments of the present application, which are described in more detail and in a specific manner, but should not be construed as limiting the scope of the patent of the present application. It should be noted that, for those of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A data storage method, characterized by, The application is applied to an encryption middleware deployed in an application node, and the method comprises the following steps: receiving a data write request from an application program; the data write request comprises a target write address and plaintext write data; the target write address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; determining to-be-stored data of the data write request based on the plaintext write data of the data write request; the to-be-stored data comprises ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data; sending the to-be-stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

2. The method of claim 1, wherein, The method comprises the following steps: processing the plaintext write data based on a preset block strategy to obtain a plurality of plaintext write data blocks; performing parallel encryption processing on the plurality of plaintext write data blocks by using a plurality of encryption threads to obtain a plurality of ciphertext write data blocks; determining the to-be-stored data in combination with the plurality of ciphertext write data blocks and a plurality of storage identification data corresponding to the plurality of ciphertext write data blocks.

3. The method of claim 2, wherein, The data write request further comprises identity identification data; the method further comprises the following steps: sending the identity identification data to the cloud storage system, so that the cloud storage system stores the to-be-stored data in a target storage area corresponding to the identity identification data under the condition that the identity identification data satisfies a storage permission; the cloud storage system stores a corresponding relationship between an identity identification and a storage area.

4. A data reading method characterized by, The application is applied to an encryption middleware deployed in an application node, and the method comprises the following steps: obtaining storage identification data corresponding to a data read request in response to the data read request from an application program; the data read request at least comprises a target read address; the target read address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; the encryption middleware pre-stores a mapping relationship between a read address and a storage identification; obtaining ciphertext read data matched with the storage identification data from a cloud storage system based on the storage identification data; sending plaintext read data obtained by decrypting the ciphertext read data to the application program.

5. The method of claim 4, wherein, The method comprises the following steps: when the storage identification data is multiple, obtaining a plurality of ciphertext data blocks matched with the plurality of storage identification data from the cloud storage system; obtaining the ciphertext read data based on the plurality of ciphertext data blocks.

6. The method of claim 5, wherein, After the step of obtaining the ciphertext read data matched with the storage identification data from the cloud storage system based on the storage identification data, the method comprises the following steps: performing parallel decryption processing on the plurality of ciphertext data blocks by using a plurality of decryption threads to obtain a plurality of plaintext data blocks; obtaining the plaintext read data in combination with the plurality of plaintext data blocks.

7. A data storage device, characterized by The application is applied to an encryption middleware deployed in an application node, and the device comprises the following steps: The storage receiving module is configured to receive a data write request from an application program; the data write request comprises a target write address and plaintext write data; the target write address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; The storage determining module is configured to determine to-be-stored data of the data write request based on the plaintext write data of the data write request; the to-be-stored data comprises ciphertext write data obtained by encrypting the plaintext write data and storage identification data corresponding to the ciphertext write data; The storage sending module is configured to send the to-be-stored data to a cloud storage system, so that the cloud storage system stores the ciphertext write data based on the storage identification data.

8. A data reading device, characterized by comprising: The encryption middleware is deployed in an application node; the device comprises: The reading obtaining module is configured to obtain storage identification data corresponding to a data read request from an application program in response to the data read request; the data read request at least comprises a target read address; the target read address is a sub-address of a mounting address of the encryption middleware pre-mounted in the application node; the encryption middleware pre-stores a mapping relationship between a read address and storage identification; The reading ciphertext module is configured to obtain ciphertext read data matched with the storage identification data from a cloud storage system based on the storage identification data; The reading sending module is configured to send plaintext read data obtained by decrypting the ciphertext read data to the application program. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 6.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 6.

Images