Data processing method and device, equipment and storage medium

Abstract

The application provides a data processing method and device, equipment and a storage medium. In the process of data processing, the first data block is processed in a corresponding manner according to the numerical value of the data included in the first data block. For the case that the first data block is a full target value data block, the first data block is directly stored in the storage space of the reduced volume. For the case that the first data block is a non-full target value data block, the first data block is encrypted to obtain a first ciphertext block, which is stored in the storage space of the reduced volume. On the basis of ensuring data security, the conversion between the full target value data block and the non-full target value data block is avoided, the confusion between the non-full target value data block and the full target value data block is avoided, the encrypted storage of business data is realized on the basis of maintaining the efficient storage resource utilization characteristics of the reduced volume, and the use efficiency of the storage space is improved.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a data processing method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] A thin volume is a commonly used volume management model in storage systems. Thin volumes allocate flexible storage space according to data storage needs. When a thin volume is created, the storage system creates a space pool and allocates a small amount of available space from the pool to the thin volume. As the amount of data written to the thin volume increases, the storage system allocates a small amount of available space from the space pool. This ensures that the storage space occupied by the thin volume is allocated according to the data storage needs of the thin volume, rather than a large, fixed storage space allocated at creation, thus achieving efficient use of storage space.

[0003] Within a thin volume, there exists a small amount of unused storage space. This unused storage space is typically filled with blocks of all zeros to distinguish it from the business data stored in the thin volume. When reading data from the thin volume, a zero-block determination method is used; if a data block containing all zeros is read, it is considered to be from unused storage space and will not be included in the business data processing.

[0004] In some data storage scenarios, data encryption is required. However, data encryption can interfere with the identification of all-zero data blocks. When reading encrypted data stored on a thin volume, the all-zero data blocks are decrypted, and the decrypted data is incorrectly used as part of the business data, affecting the normal processing of business data. This presents a conflict between the need for data encryption and the need to efficiently utilize storage resources using thin volumes. Summary of the Invention

[0005] In view of this, this application provides a data processing method, apparatus, device, storage medium, and computer program product that can achieve encrypted storage and normal retrieval of business data while maintaining the efficient utilization of storage resources of a streamlined volume, thereby ensuring data security and improving the efficiency of storage space utilization.

[0006] Firstly, this application provides a data processing method. This data processing method is applied to a computing device configured with a thin volume. Data processing during data storage is performed by the computing device, eliminating the need for data encryption by the storage device and masking differences between storage devices. The computing device acquires a first data block of target data. The target data includes at least one data block. The at least one data block includes a first data block to be stored in the storage space of the thin volume. The computing device determines whether the data values ​​included in the first data block are target values. The target value is a pre-defined value of data stored in unused storage space of the thin volume. If all data in the first data block is the target value, i.e., the first data block is a full target value data block, the first data block is directly stored in the storage space. If the first data block includes non-target values, i.e., the first data block is not a full target value data block, the first data block undergoes a first encryption process to obtain a first ciphertext block. The first ciphertext block is stored in the storage space. This allows for different storage methods to be used for non-full target value data blocks and full target value data blocks stored in the storage space. The first data block of a full-target-value data block remains a full-target-value data block after storage, allowing it to be distinguished from other non-full-target-value data blocks and avoiding the problem of a data block that was originally a full-target-value data block becoming a non-full-target-value data block after storage. The data processing method provided in this application embodiment can achieve the coexistence of the characteristics of a streamlined volume and data encryption, efficiently utilizing disk storage resources while ensuring data security, avoiding waste of disk storage resources, and saving storage costs.

[0007] In one possible implementation, the numerical values ​​of the data included in the first ciphertext block are determined. If all the data in the first ciphertext block consists of target values ​​(i.e., the first ciphertext block is a full target value data block), the first ciphertext block is processed to obtain the second ciphertext block. As an example, processing the first ciphertext block includes performing a second encryption process. As another example, processing the first ciphertext block includes setting the data at the target positions in the first ciphertext block to non-target values. The second ciphertext block contains non-target value data, making it a non-full target value data block. By processing the first ciphertext block, where all data consists of target values, the processed second ciphertext block is guaranteed to have the same data block type as the first data block—both are non-full target value data blocks. Storing the second ciphertext block in storage facilitates the differentiation between non-full target value data blocks and full target value data blocks when reading data, effectively avoiding data block type confusion and ensuring data consistency between storage and retrieval.

[0008] In one possible implementation, the first encryption algorithm used in the first encryption process is the same as the second encryption algorithm used in the second encryption process. The encryption key used in the first encryption process is the same as the encryption key used in the second encryption process. This reduces the operational cost of two encryption steps and simplifies the two-step encryption of the first data block.

[0009] In one possible implementation, the computing device can also read data from the storage space of the thin volume. The computing device retrieves a second data block from the storage space. The second data block is a data block containing the target data. The computing device determines the data values ​​included in the second data block. If all the data in the second data block contains the target values, the second data block is sent, thus achieving transparent transmission of the entire target value data block without processing it, effectively distinguishing between data blocks containing and not containing the target values. If the second data block contains data that does not contain the target values, a first decryption process is performed on the second data block to obtain a first plaintext block, which is then sent. The second data block containing data that does not contain the target values ​​is obtained after encryption during storage. By decrypting the second data block containing data that does not contain the target values, the unencrypted original data block can be obtained, enabling data to be read from the storage space. This allows for the distinction between data blocks containing and not containing the target values ​​before and after reading, enabling the use of a thin volume to store encrypted data, ensuring data security and improving the efficiency of storage space utilization.

[0010] In one possible implementation, the second data block undergoes a first decryption process, which includes processing the second data block to obtain a third data block. The decryption method is determined based on the numerical values ​​of the data included in the third data block. As an example, processing the second data block includes performing a second decryption process. As another example, processing the second data block includes setting the data at the target location included in the second data block to the target value. If all data in the third data block is the target value, it indicates that the first encryption process and other processes were performed when storing the second data block. When reading the data, a corresponding reverse operation is required. The third data block undergoes a first decryption process to obtain a first plaintext block. If the third data block includes data that is not the target value, it indicates that only the first encryption process was performed when storing the second data block. The second data block undergoes a first decryption process to obtain a first plaintext block. This ensures that the storage process corresponds to the reading process, and that the stored data and the read data are consistent, meeting the needs of data processing.

[0011] In one possible implementation, the second decryption process uses the same decryption algorithm as the first decryption process, and the first decryption process uses the same decryption key as the second decryption process, thereby reducing the complexity of the two decryption processes and lowering the operational costs.

[0012] Secondly, this application provides a data processing apparatus, which is applied to a computing device configured with a simplified volume, the apparatus comprising:

[0013] The first acquisition module is used to acquire a first data block including the target data, wherein the first data block is to be stored in the storage space of the simplified volume, the target data includes at least one data block, and the at least one data block includes the first data block;

[0014] The first storage module is configured to store the first data block into the storage space when all the data included in the first data block are target values, wherein the target value is a value of the data stored in the pre-set unused storage space;

[0015] The second storage module is configured to perform a first encryption process on the first data block when the first data block includes data that is not the target value, to obtain a first ciphertext block, and to store the first ciphertext block in the storage space.

[0016] In one possible implementation, the second storage module is used to store the first ciphertext block into the storage space, including:

[0017] The second storage module is configured to process the first ciphertext block to obtain a second ciphertext block and store the second ciphertext block in the storage space when all the data included in the first ciphertext block are the target values; and to store the first ciphertext block in the storage space when the first ciphertext block includes data that are not the target values.

[0018] In one possible implementation, the second storage module is used to process the first ciphertext block to obtain a second ciphertext block, including:

[0019] The second storage module is used to perform a second encryption process on the first ciphertext block to obtain a second ciphertext block.

[0020] In one possible implementation, the second storage module is used to process the first ciphertext block to obtain a second ciphertext block, including:

[0021] The second storage module is used to set the data at the target location included in the first ciphertext block to a non-target value to obtain a second ciphertext block.

[0022] In one possible implementation, the device further includes:

[0023] The second acquisition module is used to acquire the second data block from the storage space, wherein the at least one data block includes the second data block;

[0024] The first reading module is used to send the second data block when all the data included in the second data block are target values;

[0025] The second reading module is used to perform a first decryption process on the second data block to obtain a first plaintext block when the second data block includes data that is not the target value, and then send the first plaintext block.

[0026] In one possible implementation, the second reading module is used to perform a first decryption process on the second data block, including:

[0027] The second reading module is used to process the second data block to obtain a third data block; when all the data included in the third data block are the target values, the third data block is subjected to a first decryption process; when the third data block includes data that is not the target value, the second data block is subjected to a first decryption process.

[0028] In one possible implementation, the second reading module is used to process the second data block to obtain a third data block, including:

[0029] The second reading module is used to perform a second decryption process on the second data block to obtain a third data block.

[0030] In one possible implementation, the second reading module is used to process the second data block to obtain a third data block, including:

[0031] The second reading module is used to set the data at the target location included in the second data block as the target value to obtain the third data block.

[0032] Thirdly, this application provides a computing device, which includes a processor and a memory. The memory stores instructions, and when the computing device is running, the processor executes the instructions stored in the memory to cause the computing device to perform the operation steps of the method described in the first aspect or any possible implementation thereof. It should be noted that the memory can be integrated into the processor or can be independent of the processor. Each computing device may also include a bus. The processor is connected to the memory via the bus. The memory may include readable storage and random access memory.

[0033] Fourthly, this application provides a computing device cluster, which includes at least one computing device, each computing device including a processor and a memory. The memory is used to store instructions. When the computing device cluster is running, the processor in each computing device executes the instructions stored in the memory to cause the computing device cluster to perform the operation steps of the method in the first aspect or any possible implementation of the first aspect. It should be noted that the memory can be integrated into the processor or can be independent of the processor. Each computing device may also include a bus. The processor is connected to the memory via the bus. The memory may include readable storage memory and random access memory.

[0034] Fifthly, this application provides a chip system including a processor and a power supply circuit, the power supply circuit being used to supply power to the processor, and the processor being used for the operation steps of the method in the first aspect or any possible implementation of the first aspect.

[0035] In a sixth aspect, this application provides a computer-readable storage medium storing instructions that, when executed on a computing device cluster (which includes at least one computing device), cause the computing device cluster to perform the operational steps of the method described in the first aspect or any implementation thereof.

[0036] In a seventh aspect, this application provides a computer program product containing instructions that, when run on a computing device cluster (which includes at least one computing device), causes the computing device cluster to perform the operational steps of the method described in the first aspect or any implementation thereof.

[0037] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0038] Figure 1 This is a schematic diagram illustrating a method for reading data from a simplified volume in an encrypted scenario.

[0039] Figure 2 This is a schematic diagram illustrating an application scenario of a data processing method provided in an embodiment of this application;

[0040] Figure 3 A flowchart illustrating a data processing method provided in an embodiment of this application;

[0041] Figure 4 A flowchart illustrating a method for processing a first data block provided in an embodiment of this application;

[0042] Figure 5A flowchart illustrating the processing of a first data block is provided for an embodiment of this application;

[0043] Figure 6 A schematic diagram illustrating the correspondence of encrypted data provided in an embodiment of this application;

[0044] Figure 7 A flowchart illustrating another data processing method provided in an embodiment of this application;

[0045] Figure 8 A flowchart illustrating a method for processing a second data block provided in an embodiment of this application;

[0046] Figure 9 A flowchart illustrating the processing of a second data block is provided for an embodiment of this application.

[0047] Figure 10 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0048] Figure 11 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0049] Figure 12 This is a schematic diagram of the structure of a computing device cluster provided in an embodiment of this application;

[0050] Figure 13 This is a schematic diagram of another computing device cluster provided in an embodiment of this application. Detailed Implementation

[0051] The solutions in the embodiments provided in this application will now be described with reference to the accompanying drawings.

[0052] The terms "first," "second," etc., used in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application.

[0053] In cloud and big data scenarios, thin volumes are used as the volume management mode for storage systems to achieve efficient utilization of storage space. The storage space occupied by a thin volume is flexibly allocated based on the amount of business data that needs to be stored. Typically, a small amount of storage space is allocated to a thin volume when it is created. As more data is written to the thin volume, when the storage space of the thin volume is insufficient, a small amount of new available space is allocated to the thin volume, enabling flexible adjustment of the storage space of the thin volume according to the storage data requirements.

[0054] After the business data is stored, the thin volume may also contain a small amount of unused storage space. This unused storage space can be used and allocated later. It stores data blocks consisting of specific numerical values, typically 0. When retrieving data from the thin volume, data blocks containing these specific numerical values ​​are identified as being from unused storage space, thus confirming that the data in these blocks is not business data. This distinction between data in unused storage space and business data facilitates accurate retrieval of business data.

[0055] In business scenarios with high data security requirements, business data often needs to be encrypted. Encrypted business data exhibits randomness, potentially resulting in data blocks composed of specific numerical values. When reading data from a thin volume, it's impossible to effectively distinguish between encrypted business data and data from unused storage space based on the numerical values ​​within each data block.

[0056] In one implementation, encrypted business data is written to a thin volume. Unused storage space in the thin volume still consists of data blocks composed of specific values ​​(e.g., 0 values).

[0057] See Figure 1 As shown in the diagram, this is a schematic diagram of a method for reading data from a thin volume in an encrypted scenario. If data is read from unused storage space, such as from both used and unused storage space, the read data undergoes decryption. Decrypting a block of all zeros obtained from unused storage space may result in non-zero data. This non-zero data may be mistakenly identified as business data, leading to it being treated as part of subsequent business data processing. This results in a discrepancy between the business data read from the thin volume and the business data written to the thin volume, causing a data read error.

[0058] To avoid the aforementioned data read errors, another implementation involves a full overwrite of unused storage areas. For example, a user requests a 200GB thin volume. Only 100GB is actually needed for storing business data. The entire 200GB storage space is then overwritten. For instance, data with a value of 0 is added to the business data. This added data is then encrypted, resulting in encrypted data occupying 200GB of storage space. This encrypted data is written to the 200GB storage space, effectively overwriting the existing storage. The size of the added data is determined by the difference between the thin volume's storage size and the required storage space for the business data. This allows for accurate reading of business data by decrypting the encrypted data after reading from the storage space and distinguishing between the business data and the added data. However, a full overwrite of unused storage space can lead to insufficient storage space utilization based on the needs of the business data, resulting in excessive storage space usage. This negates the efficient storage resource utilization characteristic of thin volumes, reducing storage space utilization and increasing storage costs.

[0059] In summary, there is a certain conflict between the need for data encryption and the need to efficiently utilize storage resources using thin volumes. Currently, there is a lack of methods that satisfy both data encryption requirements and the need to store data using thin volumes.

[0060] Based on this, this application provides a data processing method. During data storage, data blocks are divided into full-target-value data blocks or non-full-target-value data blocks according to the numerical values ​​of the data they contain. A full-target-value data block refers to a data block whose data consists entirely of target values. A non-full-target-value data block refers to a data block that includes data that does not contain target values. Corresponding processing methods are used for different types of data blocks. For full-target-value data blocks, they are stored directly during data storage to avoid encryption, which could lead to the conversion of full-target-value data blocks into non-full-target-value data blocks and cause confusion between them, thus achieving the distinction between full-target-value data blocks and non-full-target-value data blocks in business data. For non-full-target-value data blocks, encryption is performed during data storage to obtain ciphertext blocks, ensuring data security.

[0061] Full-target-value data blocks and non-full-target-value data blocks are processed separately. While ensuring data security, this avoids converting full-target-value data blocks into non-full-target-value data blocks, preventing confusion between the two types of data. This facilitates appropriate processing during data retrieval, ensuring consistency between stored and retrieved business data. This approach eliminates the need to overwrite unused storage space to guarantee data consistency, enabling thin volumes and data encryption to coexist. It efficiently utilizes disk storage resources while ensuring data security, avoiding waste and saving storage costs.

[0062] This application provides a data processing method applicable to computing devices. The computing device can be a physical device or a virtual device. For example, a computing device can be a virtual machine (VM). A VM refers to a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment. The computing device can be a computing node belonging to a computing cluster or an independent device. This application does not limit its scope.

[0063] The data processing method provided in this application is not limited to any particular application scenario. For example, it can be applied to cloud computing scenarios, big data scenarios, and general application business scenarios.

[0064] As an example, see Figure 2 As shown, Figure 2 This is a schematic diagram illustrating an application scenario of a data processing method provided in an embodiment of this application. The computing device 201 is connected to the storage device 202. The storage device 202 is, for example, a disk for creating a thin volume. The storage device 202 is also, for example, a high-density storage device. In some possible implementations, the computing device 201 includes a virtual machine, and the storage device 202 is a virtual disk. The virtual disk is created using a Logical Unit Number (LUN).

[0065] During the data storage process, computing device 201 acquires the first data block of the target data that needs to be encrypted and stored.

[0066] For each first data block, the first data block is processed according to the data it contains, using the corresponding processing method.

[0067] For the first data block, where all data includes the target value, the first data block is directly written into the storage space of storage device 202. This storage space may be the storage space of a thin volume pre-created on storage device 202.

[0068] For a first data block containing data that is not the target value, perform a first encryption process on the first data block to obtain a first ciphertext block. Store the first ciphertext block in the storage space.

[0069] Correspondingly, during the data reading process, computing device 201 retrieves the second data block from the storage space.

[0070] The second data block is processed according to the numerical values ​​of the data it contains.

[0071] If the data in the second data block consists entirely of the target values, then there is no need to process the second data block; simply send the second data block directly.

[0072] If the second data block contains data that is not the target value, that is, data that is not the target value, the second data block is decrypted to obtain the first plaintext block, and the first plaintext block is sent.

[0073] Based on the numerical values ​​of the data blocks they contain, different processing methods are employed. For data blocks containing all target values, no encryption is performed during storage; they are stored directly. During retrieval, they are sent directly without decryption, ensuring the transparent transmission of data blocks containing all target values ​​and preventing the creation of non-target value data blocks after processing. For data blocks containing non-target values, encryption is performed during storage, ensuring that the encrypted ciphertext block does not contain only the target value. Decryption is performed during retrieval, ensuring the data security of non-target value data blocks through encryption and decryption. During encryption and decryption, the conversion of non-target value data blocks into full target value data blocks is avoided to prevent data contamination. In this way, before and after storage and retrieval, data blocks containing all target values ​​and non-target values ​​can be distinguished, enabling the use of thin volumes to store encrypted data, ensuring data security, and improving the efficiency of storage space utilization.

[0074] Next, various non-limiting specific implementations of the data processing method will be described in detail.

[0075] See Figure 3 As shown in the figure, this figure is a schematic flowchart of a data processing method provided in an embodiment of this application, including steps S301-S303.

[0076] S301: Obtain the first data block included in the target data.

[0077] This application does not limit the implementation method of triggering the acquisition of target data. As an example, a storage instruction for the target data may be generated automatically or manually by the user. The storage instruction indicates the target data that needs to be stored in the storage space. In one possible implementation, the storage instruction includes the target data. The target data is retrieved from the storage instruction. In another possible implementation, the storage instruction indicates the method of retrieving the target data. For example, the storage instruction includes the storage location of the target data in the computing device. The target data is retrieved from the storage location included in the storage instruction.

[0078] The target data is data that needs to be stored and has data security requirements. Target data may be, for example, business data. The target data includes at least one data block. Processing is performed on the data blocks included in the target data to achieve data block-level data processing. The first data block included in the target data is obtained. The first data block is the data block to be stored in the storage space from the at least one data block included in the target data. As an example, the first data block can be every single data block included in the target data.

[0079] The target value is the numerical value of the data stored in the unused storage space of a pre-defined thin volume. In other words, all data blocks in the unused storage space contain the target value. A data block containing only the target value is called a full target value data block. The target value can be 0 or 1. The specific value of the target value can be pre-configured.

[0080] See Figure 4 As shown, this figure is a flowchart illustrating a method for processing a first data block according to an embodiment of this application. In one possible implementation, the first data block can be processed using an encryption module included in the computing device. The encryption module is, for example, the Linux kernel dm-crypto library, a cryptographic library used for encrypting and decrypting data. Alternatively, the encryption module can be, for example, a cryptographic application component used for encrypting and decrypting data.

[0081] Based on the numerical values ​​of the data included in the first data block, the first data block can be divided into the following two types:

[0082] The first type: The first data block contains only the target values. In other words, the first data block is a data block containing only the target values.

[0083] The second type: The first data block includes data that is not the target value. In other words, the first data block is a data block that is not entirely composed of the target value.

[0084] For the two different first data blocks, corresponding processing methods are used respectively.

[0085] For the first case, proceed to step S302. For the second case, proceed to step S303.

[0086] S302: If all the data in the first data block are target values, store the first data block in the storage space.

[0087] If all the data in the first data block are target values, then the first data block is stored directly.

[0088] See Figure 5 As shown in the figure, this is a schematic flowchart of processing a first data block according to an embodiment of this application. Taking the above-described processing of the first data block using an encryption module as an example, the first data block is a data block containing all target values. The encryption module transmits the first data block and stores it in the storage space.

[0089] S303: If the first data block contains data that is not the target value, perform a first encryption process on the first data block to obtain a first ciphertext block, and store the first ciphertext block in the storage space.

[0090] For a first data block that is not a full target value data block, a first encryption process is performed on the first data block to obtain a first ciphertext block. This application embodiment does not limit the first encryption algorithm or the first encryption key used in the first encryption process. As an example, the first encryption algorithm is a symmetric encryption algorithm, such as Advanced Encryption Standard (AES) or SM4. The first encryption algorithm has the property of a single-valued function, and the data included in the first ciphertext block will necessarily be different from the data included in the first data block.

[0091] The first ciphertext block generated by the first encryption process is stored in the storage space.

[0092] In one possible implementation, the corresponding storage method is used for the numerical value of the data included in the first ciphertext block.

[0093] See Figure 4 As shown, based on the numerical values ​​of the data included in the first ciphertext block, the first ciphertext block can be divided into the following two types:

[0094] The first type: The first ciphertext block contains data that is not the target value. In other words, the first ciphertext block is a data block that is not entirely the target value.

[0095] The second type: The first ciphertext block contains only the target values. In other words, the first ciphertext block is a block of data containing only the target values.

[0096] In the first case, where the first ciphertext block is a non-full target value data block, the first ciphertext includes data that is not the target value, and is not confused with the first data block containing full target value data directly stored in the storage space. The first ciphertext is then stored in the storage space. In the second case, where the first ciphertext block is a full target value data block, the first ciphertext block is processed to obtain a second ciphertext block, which is then stored in the storage space. The second ciphertext block includes data that is not the target value. By processing the first ciphertext block, it is transformed into a second ciphertext block containing data that is not the target value. This ensures data security while guaranteeing that the non-full target value data block to be stored remains a non-full target value data block after being stored in the storage space, avoiding confusion with other full target value data blocks in the storage space, ensuring data storage and retrieval consistency, and guaranteeing the characteristics of a thin volume.

[0097] This application does not limit the processing method for the first ciphertext block. As an example, this application provides two possible implementations for processing the first ciphertext block to generate the second ciphertext block.

[0098] The first method involves performing a second encryption process on the first ciphertext block to obtain the second ciphertext block.

[0099] The data included in the second ciphertext block must be different from the data included in the first ciphertext block; the resulting second ciphertext block is a non-full target value data block. This avoids confusion between the encrypted first ciphertext block and the full target value data block directly stored in the storage space. This application does not limit the second encryption algorithm or the second encryption key used in the second encryption process. As an example, the second encryption algorithm is a symmetric encryption algorithm. The first and second encryption algorithms can be the same or different. If the first and second encryption algorithms are the same, the first and second encryption keys can be the same or different.

[0100] In one possible implementation, the first encryption algorithm and the second encryption algorithm are the same, and the first encryption key and the second encryption key are also the same. This allows for direct re-encryption of the first ciphertext block using the same encryption algorithm and key, while the second ciphertext block is generated more simply, reducing the complexity of the two encryption operations.

[0101] For example, suppose the target value is 0. Both the first and second encryption algorithms are XTS (XEX-based Tweaked CodeBook mode with ciphertext stealing) algorithms, represented as: f = XTS(a, DEK). DEK is the encryption key for the first and second encryption algorithms. a is the independent variable. f is the dependent variable.

[0102] For example, see Figure 6As shown, this figure is a schematic diagram of the correspondence of encrypted data provided in an embodiment of this application. The first data block includes data represented as X. The data in the first data block undergoes a first encryption process, represented as: Y = XTS(X, DEK), resulting in a first ciphertext block Y. The data in the first ciphertext block is all 0. The first ciphertext block undergoes a second encryption process, represented as: Z = XTS(Y, DEK), resulting in a second ciphertext block Z. Based on... Figure 6 The diagram shows the correspondence between encrypted data. Performing a second encryption process on the first ciphertext block converts 0 to n+1, resulting in a second ciphertext block where not all data is 0; it is a non-full target value data block.

[0103] The second method involves setting the data at the target location included in the first ciphertext block to a non-target value to obtain the second ciphertext block.

[0104] The target location can be set according to the needs of converting from the first ciphertext block to the second ciphertext block. The target location may include the location of one or more data. The target location may be represented by the number of bits in the data.

[0105] After converting the data at the target location from the target value to a non-target value, a second ciphertext block is obtained. The data in the second ciphertext block is not all target values, thus achieving the distinction between blocks containing only target values.

[0106] As an example, the target value is 0, the non-target value is 1, and the target position is the 5th bit. Setting the 5th bit of the data in the first ciphertext block to 1 yields the second ciphertext block. This ensures that the second ciphertext block includes data with non-target values, making it easier to distinguish between different types of data blocks.

[0107] Based on the above S301-S303, it can be seen that when storing the first data block, different processing methods are adopted for full target value data blocks and non-full target value data blocks. On the basis of ensuring data security, it avoids the conversion of full target value data blocks into non-full target value data blocks after storage, and avoids confusion between full target value data blocks and non-full target value data blocks before and after storage. It retains the characteristics of thin volume, realizes on-demand use of storage space, and supports the storage of large-scale encrypted data.

[0108] The above is an introduction to the data storage process. The following section introduces the process of reading data from storage space.

[0109] See Figure 7 As shown in the figure, this figure is a schematic flowchart of another data processing method provided in the embodiment of this application, which includes steps S701-S703 in addition to the steps described above.

[0110] S701: Retrieve the second data block from the storage space.

[0111] The second data block is the data block where the target data has already been stored in the storage space. The second data block is the data block that needs to be read from the storage space.

[0112] This application does not limit the triggering method for retrieving the second data block from the storage space. As an example, in response to a read command, the second data block is retrieved from the storage space. The read command can be triggered automatically or by the user. The read command indicates the second data block to be read from the storage space. In one possible implementation, the read command includes the storage location of the second data block in the storage space. The second data block is retrieved from the storage location included in the read command.

[0113] See Figure 8 As shown, this figure is a flowchart illustrating a method for processing a second data block according to an embodiment of this application. In one possible implementation, the second data block can be processed using a decryption module included in a computing device. The decryption module is, for example, a Linux kernel, which is an encryption / decryption cryptographic library. Alternatively, the decryption module may be, for example, an encryption / decryption cryptographic application component.

[0114] The type of the second data block is determined based on the numerical values ​​of the data it contains. Specifically, there are two possibilities:

[0115] The first type: The second data block contains only the target values. In other words, the second data block is a data block containing only the target values.

[0116] The second type: The second data block includes data that is not the target value. In other words, the second data block is a data block that does not contain all target values.

[0117] The processing method for the second data block varies depending on the type of second data block.

[0118] For the first case, proceed to step S702. For the second case, proceed to step S703.

[0119] S702: If all the data in the second data block are target values, then send the second data block;

[0120] See Figure 9 As shown in the figure, this figure is a schematic flowchart of a process for processing a second data block provided in an embodiment of this application.

[0121] If the second data block contains only the target values, it means that the second data block is stored directly without encryption. Therefore, there is no need to decrypt the second data block; it can be sent to the device that requested it.

[0122] S703: If the second data block contains data that is not the target value, perform a first decryption process on the second data block to obtain a first plaintext block, and send the first plaintext block.

[0123] If the second data block contains data that is not the target value, it means that the second data block is stored encrypted and needs to be decrypted. Perform the first decryption process on the second data block to obtain the first plaintext block.

[0124] The first decryption process is the decryption process corresponding to the first encryption process. The first decryption algorithm is the decryption algorithm corresponding to the first encryption algorithm. The first decryption key is determined based on the first encryption key used by the first encryption algorithm.

[0125] In some possible implementations, the second data block may undergo other processing besides encryption during storage to ensure that it is not a data block containing all target values. This application provides a possible implementation of a first decryption process on the second data block, including the following steps:

[0126] A1: Process the second data block to obtain the third data block.

[0127] Based on the above description of the data block storage process, the second data block may be obtained by encrypting and other processing of the original data block. When decrypting the second data block, it is first processed to obtain the third data block. Based on the values ​​of the data included in the third data block, the processing method used when storing the second data block can be determined, such as simple encryption, or encryption combined with other processing. Therefore, the corresponding decryption process is performed on the second data block to restore the data.

[0128] The method of processing the second data block corresponds to the method of processing the first ciphertext block to obtain the second ciphertext block in the above storage process. It is the reverse processing method of processing the first ciphertext block to obtain the second ciphertext block in the above storage process.

[0129] Taking the above two possible methods of processing the first ciphertext block to obtain the second ciphertext block as examples, this application provides two possible implementation methods for processing the second data block.

[0130] The first method involves performing a second decryption process on the second data block to obtain the third data block.

[0131] The second decryption algorithm used in the second decryption process is the decryption algorithm corresponding to the second encryption algorithm used in the second encryption process. The second decryption key used by the second decryption algorithm is determined based on the second encryption key.

[0132] In one possible implementation, the first encryption algorithm and the second encryption algorithm are the same, and the first encryption key and the second encryption key are also the same. Correspondingly, the first decryption algorithm and the second decryption algorithm are the same, and the first decryption key and the second decryption key are also the same. Thus, the second data block can be decrypted twice using the same decryption algorithm and decryption key to obtain the first plaintext block. This method of obtaining the first plaintext block is relatively simple and has a low cost.

[0133] The second method involves setting the data at the target location included in the second data block to the target value, thus obtaining the third data block.

[0134] Taking the above example where the target value is 0, the non-target value is 1, and the target position is the 5th bit, the data in the 5th bit of the second data block is set to 0 to obtain the third data block.

[0135] The type of the third data block is determined based on the numerical values ​​of the data it contains. Specifically, there are two possibilities:

[0136] The first type: The third data block contains only the target values. In other words, the third data block is a data block containing only the target values.

[0137] The second type: The third data block includes data that is not the target value. In other words, the third data block is a data block that does not contain all target values.

[0138] In the case where the third data block is a full target value data block, it indicates that the second data block was obtained after encryption and other processing during data storage. The third data block undergoes a first decryption process to obtain the first plaintext block.

[0139] In the case where the second type of third data block is not a full target value data block, it means that during the data storage process, the second data block is only obtained through encryption. The second data block undergoes a first decryption process to obtain the first plaintext block.

[0140] Based on the above S701-S703, it can be seen that when reading data, reading methods corresponding to the storage method are adopted for full target value data blocks and non-full target value data blocks respectively. This can distinguish between full target value data blocks and non-full target value data blocks, realize the differentiation of full target value data blocks in unused storage space, achieve accurate data restoration, and improve data security while retaining the characteristics of thin volume and distinguishing between used and unused storage space.

[0141] This application also provides a data processing apparatus applied to a computing device, the computing device being configured with a simplified volume.

[0142] like Figure 10As shown, the data processing device includes:

[0143] The first acquisition module 1001 is used to acquire a first data block included in the target data, wherein the first data block is to be stored in the storage space of the simplified volume, the target data includes at least one data block, and the at least one data block includes the first data block;

[0144] The first storage module 1002 is used to store the first data block into the storage space when all the data included in the first data block are target values, wherein the target value is the value of the data stored in the pre-set unused storage space;

[0145] The second storage module 1003 is used to perform a first encryption process on the first data block when the first data block includes data that is not the target value, to obtain a first ciphertext block, and to store the first ciphertext block in the storage space.

[0146] In one possible implementation, the second storage module 1003 is used to store the first ciphertext block into the storage space, including:

[0147] The second storage module 1003 is used to process the first ciphertext block to obtain a second ciphertext block when all the data included in the first ciphertext block are the target values, and to store the second ciphertext block in the storage space; and to store the first ciphertext block in the storage space when the first ciphertext block includes data that is not the target values.

[0148] In one possible implementation, the second storage module 1003 is used to process the first ciphertext block to obtain a second ciphertext block, including:

[0149] The second storage module 1003 is used to perform a second encryption process on the first ciphertext block to obtain a second ciphertext block.

[0150] In one possible implementation, the second storage module 1003 is used to process the first ciphertext block to obtain a second ciphertext block, including:

[0151] The second storage module 1003 is used to set the data at the target location included in the first ciphertext block to a non-target value to obtain a second ciphertext block.

[0152] In one possible implementation, the device further includes:

[0153] The second acquisition module 1004 is used to acquire the second data block from the storage space, wherein the at least one data block includes the second data block;

[0154] The first reading module 1005 is used to send the second data block when all the data included in the second data block are target values;

[0155] The second reading module 1006 is used to perform a first decryption process on the second data block when the second data block includes data that is not the target value, to obtain a first plaintext block, and to send the first plaintext block.

[0156] In one possible implementation, the second reading module 1006 is used to perform a first decryption process on the second data block, including:

[0157] The second reading module 1006 is used to process the second data block to obtain a third data block; when all the data included in the third data block are the target values, the third data block is subjected to a first decryption process; when the third data block includes data that is not the target value, the second data block is subjected to a first decryption process.

[0158] In one possible implementation, the second reading module 1006 is used to process the second data block to obtain a third data block, including:

[0159] The second reading module 1006 is used to perform a second decryption process on the second data block to obtain a third data block.

[0160] In one possible implementation, the second reading module 1006 is used to process the second data block to obtain a third data block, including:

[0161] The second reading module 1006 is used to set the data of the target position included in the second data block as the target value to obtain the third data block.

[0162] The first acquisition module 1001, the first storage module 1002, the second storage module 1003, the second acquisition module 1004, the first reading module 1005, and the second reading module 1006 can all be implemented in software or in hardware. For example, the implementation of the first acquisition module 1001 will be described below. Similarly, the implementation of the first storage module 1002, the second storage module 1003, the second acquisition module 1004, the first reading module 1005, and the second reading module 1006 can refer to the implementation of the first acquisition module 1001.

[0163] As an example of a software functional unit, the first acquisition module 1001 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the aforementioned computing instance may be one or more. For example, the first acquisition module 1001 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0164] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0165] As an example of a hardware functional unit, the first acquisition module 1001 may include at least one computing device, such as a server. Alternatively, the first acquisition module 1001 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0166] The multiple computing devices included in the first acquisition module 1001 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the first acquisition module 1001 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the first acquisition module 1001 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0167] It should be noted that, in other embodiments, the first acquisition module 1001 can be used to execute any step in the data processing method, the first storage module 1002 can be used to execute any step in the data processing method, the second storage module 1003 can be used to execute any step in the data processing method, the second acquisition module 1004 can be used to execute any step in the data processing method, the first reading module 1005 can be used to execute any step in the data processing method, and the second reading module 1006 can be used to execute any step in the data processing method. The steps implemented by the first acquisition module 1001, the first storage module 1002, the second storage module 1003, the second acquisition module 1004, the first reading module 1005, and the second reading module 1006 can be specified as needed. All functions can be achieved by implementing different steps in the data processing method by the first acquisition module 1001, the first storage module 1002, the second storage module 1003, the second acquisition module 1004, the first reading module 1005, and the second reading module 1006 respectively.

[0168] This application also provides a computing device 1100. For example... Figure 11 As shown, the computing device 1100 includes a bus 1102, a processor 1104, a memory 1106, and a communication interface 1108. The processor 1104, the memory 1106, and the communication interface 1108 communicate with each other via the bus 1102. The computing device 1100 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1100.

[0169] Bus 1102 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 11The bus 1102 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 1102 may include a path for transmitting information between various components of the computing device 1100 (e.g., memory 1106, processor 1104, communication interface 1108).

[0170] The processor 1104 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0171] The memory 1106 may include volatile memory, such as random access memory (RAM). The processor 1104 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0172] The memory 1106 stores executable program code, and the processor 1104 executes this executable program code to implement the functions of the aforementioned first acquisition module 1001, first storage module 1002, second storage module 1003, second acquisition module 1004, first read module 1005, and second read module 1006, thereby realizing the data processing method. That is, the memory 1106 stores instructions for executing the data processing method.

[0173] The communication interface 1108 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1100 and other devices or communication networks.

[0174] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0175] like Figure 12As shown, the computing device cluster includes at least one computing device 1100. The memory 1106 of one or more computing devices 1100 in the computing device cluster may store the same instructions for executing data processing methods.

[0176] In some possible implementations, the memory 1106 of one or more computing devices 1100 in the computing device cluster may also store partial instructions for executing data processing methods. In other words, a combination of one or more computing devices 1100 can jointly execute instructions for executing data processing methods.

[0177] It should be noted that the memory 1106 in different computing devices 1100 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the data processing device. That is, the instructions stored in the memory 106 of different computing devices 100 can implement the functions of one or more modules among the first acquisition module 1001, the first storage module 1002, the second storage module 1003, the second acquisition module 1004, the first read module 1005, and the second read module 1006.

[0178] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 13 One possible implementation is shown. For example... Figure 13 As shown, the two computing devices 1100A and 1100B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this possible implementation, the memory 1106 in computing device 1100A stores instructions for executing the functions of the first acquisition module 1001, the first storage module 1002, and the second storage module 1003. Simultaneously, the memory 1106 in computing device 1100B stores instructions for executing the functions of the second acquisition module 1004, the first read module 1005, and the second read module 1006.

[0179] Figure 13 The connection method between the computing device clusters shown can take into account the need for large-scale data storage and large-scale data retrieval in the data processing method provided in this application. Therefore, it is considered that the functions implemented by the second acquisition module 1004, the first reading module 1005 and the second reading module 1006 are performed by the computing device 1100B.

[0180] It should be understood that Figure 13 The functions of computing device 1100A shown can also be performed by multiple computing devices 1100. Similarly, the functions of computing device 1100B can also be performed by multiple computing devices 1100.

[0181] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any available medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform a data processing method.

[0182] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform a data processing method.

[0183] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data processing method, characterized in that, The method is applied to a computing device configured with a thin volume, and the method includes: The target data includes a first data block, wherein the first data block is to be stored in the storage space of the thin volume, and the target data includes at least one data block, wherein the at least one data block includes the first data block; If all the data in the first data block are target values, the first data block is stored in the storage space, where the target value is the value of the data stored in the pre-set unused storage space. If the first data block contains data that is not the target value, the first data block is subjected to a first encryption process to obtain a first ciphertext block, and the first ciphertext block is stored in the storage space.

2. The method according to claim 1, characterized in that, The step of storing the first ciphertext block to the storage space includes: If all the data in the first ciphertext block are the target values, the first ciphertext block is processed to obtain the second ciphertext block, and the second ciphertext block is stored in the storage space. If the first ciphertext block includes data that is not the target value, the first ciphertext block is stored in the storage space.

3. The method according to claim 2, characterized in that, The process of processing the first ciphertext block to obtain the second ciphertext block includes: The first ciphertext block is subjected to a second encryption process to obtain a second ciphertext block.

4. The method according to claim 2, characterized in that, The process of processing the first ciphertext block to obtain the second ciphertext block includes: The data at the target location included in the first ciphertext block is set to a non-target value to obtain the second ciphertext block.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: A second data block is obtained from the storage space, wherein the at least one data block includes the second data block; If all the data in the second data block are target values, then send the second data block. If the second data block contains data that is not the target value, the second data block is subjected to a first decryption process to obtain a first plaintext block, and the first plaintext block is sent.

6. The method according to claim 5, characterized in that, The first decryption process for the second data block includes: The second data block is processed to obtain the third data block; If all the data included in the third data block are the target values, the third data block is subjected to a first decryption process; If the third data block includes data that is not the target value, the second data block is subjected to a first decryption process.

7. The method according to claim 6, characterized in that, The process of processing the second data block to obtain the third data block includes: The second data block is decrypted to obtain the third data block.

8. The method according to claim 6, characterized in that, The process of processing the second data block to obtain the third data block includes: The data at the target location included in the second data block is set as the target value to obtain the third data block.

9. A data processing apparatus, characterized in that, The apparatus is applied to a computing device configured with a thin volume, and the apparatus includes: The first acquisition module is used to acquire a first data block including the target data, wherein the first data block is to be stored in the storage space of the simplified volume, the target data includes at least one data block, and the at least one data block includes the first data block; The first storage module is configured to store the first data block into the storage space when all the data included in the first data block are target values, wherein the target value is a value of the data stored in the pre-set unused storage space; The second storage module is configured to perform a first encryption process on the first data block when the first data block includes data that is not the target value, to obtain a first ciphertext block, and to store the first ciphertext block in the storage space.

10. The apparatus according to claim 9, characterized in that, The second storage module is used to store the first ciphertext block into the storage space, including: The second storage module is configured to process the first ciphertext block to obtain a second ciphertext block and store the second ciphertext block in the storage space when all the data included in the first ciphertext block are the target values; and to store the first ciphertext block in the storage space when the first ciphertext block includes data that are not the target values.

11. The apparatus according to claim 10, characterized in that, The second storage module is used to process the first ciphertext block to obtain a second ciphertext block, including: The second storage module is used to perform a second encryption process on the first ciphertext block to obtain a second ciphertext block.

12. The apparatus according to claim 10, characterized in that, The second storage module is used to process the first ciphertext block to obtain a second ciphertext block, including: The second storage module is used to set the data at the target location included in the first ciphertext block to a non-target value to obtain a second ciphertext block.

13. The apparatus according to any one of claims 9-12, characterized in that, The device further includes: The second acquisition module is used to acquire the second data block from the storage space, wherein the at least one data block includes the second data block; The first reading module is used to send the second data block when all the data included in the second data block are target values; The second reading module is used to perform a first decryption process on the second data block to obtain a first plaintext block when the second data block includes data that is not the target value, and then send the first plaintext block.

14. The apparatus according to claim 13, characterized in that, The second reading module is used to perform a first decryption process on the second data block, including: The second reading module is used to process the second data block to obtain a third data block; when all the data included in the third data block are the target values, the third data block is subjected to a first decryption process; when the third data block includes data that is not the target value, the second data block is subjected to a first decryption process.

15. The apparatus according to claim 14, characterized in that, The second reading module is used to process the second data block to obtain a third data block, including: The second reading module is used to perform a second decryption process on the second data block to obtain a third data block.

16. The apparatus according to claim 14, characterized in that, The second reading module is used to process the second data block to obtain a third data block, including: The second reading module is used to set the data at the target location included in the second data block as the target value to obtain the third data block.

17. A computing device cluster, characterized in that, It includes at least one computing device, each computing device including a processor and memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the operational steps of the method as described in any one of claims 1 to 8.

18. A computer program product containing instructions, characterized in that, When the instruction is executed by the computing device cluster, the computing device cluster causes the computing device cluster to perform the operation steps of the method as described in any one of claims 1 to 8.

19. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a cluster of computing devices, perform the operational steps of the method as described in any one of claims 1 to 8.

Images