Encrypted data synchronization methods, apparatuses, devices, media, and program products

Abstract

This application provides an encrypted data synchronization method, apparatus, device, medium, and program product, which can be applied to the field of big data technology. The method is applied to a synchronization gateway, which is communicatively connected to a first cluster and a second cluster, each possessing independent key management services. The method includes: in response to detecting an encrypted data synchronization task, synchronizing encrypted ciphertext in the first cluster to the second cluster based on a data transmission thread; using a key conversion thread, decrypting a first digital envelope using the first cluster to obtain a data encryption key, encrypting the data encryption key using the second cluster to generate a second digital envelope, wherein the first and second digital envelopes are equipped with different intermediate keys, which are used to decrypt either the first or second digital envelope; and synchronizing the second digital envelope to the second cluster to complete the encrypted data synchronization.

Description

Technical Field

[0001] This application relates to the field of big data technology, and more specifically to an encrypted data synchronization method, apparatus, device, medium, and program product. Background Technology

[0002] With the rapid development of information technology, secure data synchronization has become paramount. Master-slave database disaster recovery is a common data protection and disaster recovery mechanism. It records all modification operations on the master database and synchronizes these operations to the slave database, achieving data backup and real-time data mirroring. Related technologies often employ decryption before transmission and re-encryption for encrypted data. This can lead to performance bottlenecks, high synchronization latency, and the risk of plaintext data exposure. Directly copying ciphertext, however, results in the slave cluster being unable to parse the master cluster's ciphertext due to the independent key management components deployed in the master and slave clusters, ultimately leading to data inaccessibility after synchronization. Therefore, a secure encrypted data synchronization method that overcomes these problems is urgently needed. Summary of the Invention

[0003] In view of the above problems, embodiments of this application provide an encrypted data synchronization method, apparatus, device, medium, and program product.

[0004] According to a first aspect of this application, an encrypted data synchronization method is provided, applied to a synchronization gateway, the synchronization gateway being communicatively connected to a first cluster and a second cluster, each having independent key management services. The method includes: in response to detecting an encrypted data synchronization task, synchronizing encrypted ciphertext in the first cluster to the second cluster based on a data transmission thread; decrypting a first digital envelope using the first cluster to obtain a data encryption key using a key conversion thread, encrypting the data encryption key using the second cluster to generate a second digital envelope, wherein the first digital envelope and the second digital envelope are equipped with different intermediate keys, the intermediate keys being used to decrypt either the first digital envelope or the second digital envelope; and synchronizing the second digital envelope to the second cluster to complete the encrypted data synchronization.

[0005] According to an embodiment of this application, the synchronization gateway is deployed in a trusted operating environment. Based on the data transmission thread, synchronizing encrypted ciphertext in the first cluster to the second cluster includes: reading encrypted ciphertext from the storage node of the first cluster based on a preset virtual path in the data transmission thread, wherein the preset virtual path indicates an access path for reading encrypted ciphertext by bypassing the data decryption logic of the first cluster; and writing the encrypted ciphertext to the storage node of the second cluster.

[0006] According to an embodiment of this application, based on a key conversion thread, using a first cluster to decrypt a first digital envelope to obtain a data encryption key, and using a second cluster to encrypt the data encryption key to generate a second digital envelope includes: sending a decryption request to the first cluster; calling the first cluster to decrypt the first digital envelope based on a first intermediate key to obtain a data encryption key; receiving the data encryption key returned by the first cluster; sending an encryption request to the second cluster based on the data encryption key; and calling the second cluster to encrypt the data encryption key using a second intermediate key to generate a second digital envelope, wherein the second intermediate key is different from the first intermediate key.

[0007] According to an embodiment of this application, before using a first cluster to decrypt a first digital envelope to obtain a data encryption key based on a key conversion thread, and using a second cluster to encrypt the data encryption key to generate a second digital envelope, the process includes: sending a proof report generated based on a trusted execution environment to the first cluster and the second cluster; calling the first cluster and the second cluster to perform legality verification on the proof report respectively; and after the legality verification is passed, receiving a single access token issued by the first cluster and the second cluster respectively, wherein the single access token indicates the access rights of the synchronization gateway to the first cluster or the second cluster.

[0008] According to an embodiment of this application, the decryption failure rate and encryption failure rate of the key conversion thread within a preset time are obtained; if the decryption failure rate and / or encryption failure rate exceed a preset threshold, the sending of new decryption requests and / or encryption requests is suspended and an alarm is triggered; the first cluster and the second cluster are invoked to perform downgrade processing or delayed scheduling of the decryption requests and / or encryption requests that have entered the queue until the decryption failure rate and encryption failure rate fall back to a safe range and then normal operation is restored.

[0009] According to an embodiment of this application, a data block is selected from the data blocks that have completed encrypted data synchronization; a first cluster is used to decrypt the data block and a first hash value is calculated using a hash function; a second cluster is used to decrypt the data block and a second hash value is calculated using a hash function; the first hash value and the second hash value are compared to verify data integrity.

[0010] According to an embodiment of this application, synchronizing the second digital envelope to the second cluster includes: coordinating the synchronization of encrypted ciphertext and the generation of the second digital envelope based on a synchronization coordinator; and synchronizing the second digital envelope to the file metadata corresponding to the encrypted ciphertext in the second cluster when both the synchronization of encrypted ciphertext and the generation of the second digital envelope have been completed.

[0011] According to an embodiment of this application, the process of listening to an encrypted data synchronization task includes: obtaining change events of file operation logs in the first cluster based on a long connection established with the first cluster; parsing the change events to obtain the corresponding file paths; matching the file paths with preset encrypted area information; and determining that an encrypted data synchronization task has been listened to if the match is successful.

[0012] According to a second aspect of this application, an encrypted data synchronization device is provided, applied to a synchronization gateway, the synchronization gateway being communicatively connected to a first cluster and a second cluster having mutually independent key management services, comprising: an encrypted ciphertext synchronization module, configured to, in response to detecting an encrypted data synchronization task, synchronize encrypted ciphertext in the first cluster to the second cluster based on a data transmission thread; a key conversion module, configured to, based on a key conversion thread, decrypt a first digital envelope using the first cluster to obtain a data encryption key, and encrypt the data encryption key using the second cluster to generate a second digital envelope, wherein the first digital envelope and the second digital envelope are equipped with different intermediate keys, the intermediate keys being used to decrypt either the first digital envelope or the second digital envelope; and a digital envelope synchronization module, configured to synchronize the second digital envelope to the second cluster to complete the encrypted data synchronization.

[0013] According to a third aspect of this application, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0014] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program or instructions are stored, wherein the computer program or instructions, when executed by a processor, implement the steps of the above-described method.

[0015] According to a fifth aspect of this application, a computer program product is also provided, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 The illustrations depict application scenarios of encrypted data synchronization methods, apparatuses, devices, media, and program products according to embodiments of this application.

[0018] Figure 2 A flowchart illustrating an encrypted data synchronization method according to an embodiment of this application is shown schematically.

[0019] Figure 3A flowchart illustrating a method for verifying data integrity according to an embodiment of this application is shown schematically.

[0020] Figure 4 This illustration schematically shows another flowchart of an encrypted data synchronization method according to an embodiment of this application;

[0021] Figure 5 This schematic diagram illustrates a structural block diagram of an encrypted data synchronization device according to an embodiment of the present application;

[0022] Figure 6 This schematically illustrates another structural block diagram of an encrypted data synchronization device according to an embodiment of the present application;

[0023] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing an encrypted data synchronization method according to an embodiment of this application. Detailed Implementation

[0024] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0027] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0028] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0029] It should be noted that the information collected in the embodiments of this application (including but not limited to user device information, user personal information, collected data, used data, generated data, processed data, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, collected information, used information, generated information, processed information, etc.) are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse. If the user chooses to refuse, the process will proceed to the expert decision-making process.

[0030] The inventors discovered that financial industry big data platforms commonly employ distributed file system transparent encryption technology to protect underlying data, effectively reducing the difficulty of modifying upper-layer applications for storage encryption. Under the commonly built two-site, three-center disaster recovery architecture in the financial industry, how to achieve efficient and secure synchronization of encrypted data with storage capacity reaching petabyte (PB) level has become a pressing problem for current financial big data platforms. Mainstream big data disaster recovery solutions in the financial sector primarily rely on tools to perform periodic full or incremental synchronization operations. However, for encrypted data with distributed file system transparent encryption enabled, a "decrypt, transmit, then encrypt" processing strategy is commonly adopted. However, this approach has many drawbacks, such as: firstly, a severe performance bottleneck. The main cluster performing decryption operations on all data consumes a large amount of central processing unit (CPU) resources, resulting in recovery point objectives (RPO) reaching the hour level, which is insufficient to meet the minute-level or even second-level disaster recovery time requirements of the financial sector. Secondly, there are security and compliance risks. Data may exist in plaintext form briefly during transmission or in device memory, which does not comply with high-level data security management standards such as "data must not be stored on the ground" and "plaintext must not leave the domain." Thirdly, the key systems are not interoperable. If the encrypted data is copied directly, the backup cluster cannot parse the encrypted metadata of the primary cluster because the primary and backup clusters typically deploy independent Key Management Services (KMS) and Hardware Security Modules (HSMs). Ultimately, this results in the synchronized data being unreadable and unusable.

[0031] Figure 1 The illustrations depict application scenarios of the encrypted data synchronization method, apparatus, device, medium, and program products according to embodiments of this application. Figure 1 As shown, application scenario 100 according to an embodiment of this application may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables. For example, a user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send information, etc.

[0032] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be electronic devices such as smartphones, wearable devices, personal computers, intelligent voice interaction devices, smart home appliances, intelligent vehicles, in-vehicle terminals, aircraft, unmanned vending terminals, and extended reality devices. Extended reality devices can include virtual reality devices, augmented reality devices, and mixed reality devices. A client application for the target application can be installed and run on the terminal devices. This target application can include, but is not limited to, financial transaction applications, payment applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, and social media platform software (these are just examples). Furthermore, this application embodiment does not limit the form of the target application, and it can include, but is not limited to, applications, mini-programs, etc., installed on the terminal devices, and can also be in the form of web pages.

[0033] Server 105 can be a server providing various services, such as a backend management server supporting websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services such as cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and basic cloud computing services such as big data. The server can be the backend server of the aforementioned target application, used to provide backend services to the clients of the target application.

[0034] It should be noted that the encrypted data synchronization method provided in this application embodiment can generally be executed by server 105 and / or terminal devices 101-103. Accordingly, the encrypted data synchronization device provided in this application embodiment can generally be set in server 105 and / or terminal devices 101-103.

[0035] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0036] Figure 2 A flowchart illustrating an encrypted data synchronization method according to an embodiment of this application is shown. Figure 2 As shown, the encrypted data synchronization method 200 according to the embodiments of this application may include steps S210 to S230.

[0037] In step S210, in response to the detection of the encrypted data synchronization task, the encrypted ciphertext in the first cluster is synchronized to the second cluster based on the data transmission thread.

[0038] It should be noted that a synchronization gateway can refer to a cross-cluster component deployed in a trusted environment, acting as the sole interaction hub between the first and second clusters, responsible for coordinating encrypted data transmission, key-envelope conversion, task scheduling, and other tasks. The first cluster can refer to the main cluster deployed on the production end, carrying core business operations; also called the source cluster, it is the data source for encrypted data. The second cluster can refer to the backup cluster deployed on the disaster recovery end, used for data backup; also called the target cluster, it stores the synchronized encrypted data. These two clusters can be separated in terms of geographical location, network environment, and management permissions to meet high-level disaster recovery requirements. They are each configured with physically isolated, non-shared key management services. The key management service can refer to a service component responsible for key generation, storage, rotation, and destruction, while providing encryption / decryption call interfaces and managing the entire key lifecycle. Encrypted ciphertext can refer to file data blocks of text data stored in the storage nodes of the first cluster after being encrypted with a data encryption key. The data transmission thread can refer to an independent running thread specifically responsible for performing encrypted ciphertext reading, network transmission, and writing operations, working in parallel with the key processing flow.

[0039] In the embodiments of this application, when an operation such as adding or modifying a file is detected in the preset encrypted area, the encrypted data synchronization task is determined to be triggered, and an independent data transmission thread is then started. Without changing the encrypted ciphertext content in the first cluster or decrypting business data, the data transmission thread uses a direct ciphertext transmission method to completely synchronize the encrypted ciphertext from the first cluster to the second cluster. The entire process only moves the ciphertext data and does not involve any processing of plaintext business data, ensuring security and consistency during data transmission.

[0040] In another embodiment of this application, the method for monitoring encrypted data synchronization tasks includes, but is not limited to, establishing a persistent long connection between the synchronization gateway and the first cluster, subscribing to file operation log change events in real time or at regular intervals through the cluster's log push channel; or the synchronization gateway capturing the writing or modification behavior of encrypted files by parsing the underlying data change logs of the first cluster; or the synchronization gateway periodically polling the first cluster and identifying changes by comparing the file's metadata (such as modification timestamps, file size, hash values, etc.).

[0041] In another embodiment of this application, the transmission thread continuously monitors the data block transmission status throughout the process. It can ensure that the ciphertext data is synchronized from the first cluster to the second cluster completely and orderly by means such as verifying the data block length and transmission offset, thereby realizing direct cross-cluster transmission of encrypted ciphertext without decryption.

[0042] In step S220, based on the key conversion thread, the first digital envelope is decrypted using the first cluster to obtain the data encryption key, and the data encryption key is encrypted using the second cluster to generate the second digital envelope. The first digital envelope and the second digital envelope are equipped with different intermediate keys, which are used to decrypt either the first digital envelope or the second digital envelope.

[0043] It should be noted that the key conversion thread can refer to a dedicated thread, independent of the data transmission thread, responsible for key conversion operations such as digital envelope decryption and data encryption key reencryption. The first digital envelope can refer to the encrypted metadata generated by the key management service and hardware security module of the first cluster encrypting the data encryption key using the intermediate key of the first cluster. This metadata is stored in the extended attributes of the main cluster file and used by the main cluster to decrypt and read the data encryption key. The second digital envelope can refer to the encrypted metadata generated by the key management service and hardware security module of the second cluster encrypting the data encryption key using the intermediate key of the second cluster. This metadata is also stored in the extended attributes of the main cluster file and used by the main cluster to decrypt and read the data encryption key. The digital envelope can also be called the Encrypted Data Encryption Key (EDEK). The intermediate key can refer to the Encryption Zone Key (EZK) located between the master key and the data encryption key in the three-layer key architecture. It is used for encryption and decryption of the digital envelopes. The intermediate keys used by the first and second clusters are independent and not interchangeable. A data encryption key (DEK) refers to the underlying key used to encrypt the original data of a file, i.e., plaintext data. It is also the key content encapsulated inside a digital envelope.

[0044] In the embodiments of this application, when the encrypted data synchronization task is triggered, the synchronization gateway starts an independent key conversion thread. This thread first sends a decryption request to the first cluster. The key management service of the first cluster calls the corresponding hardware security module, uses its dedicated first intermediate key to decrypt the first digital envelope, extracts the data encryption key, and securely sends the data encryption key back to the synchronization gateway. Subsequently, the key conversion thread sends an encryption request to the second cluster. The key management service of the second cluster calls the corresponding hardware security module, uses a second intermediate key that is completely independent of the first intermediate key, and re-encrypts the received data encryption key to generate a second digital envelope adapted to the second cluster. The first and second intermediate keys are managed by two physically isolated key systems, realizing secure conversion of digital envelopes across clusters and ensuring the normal reading of subsequent encrypted data.

[0045] In another embodiment of this application, each encryption / decryption request and key transmission operation generates an immutable audit log. The log may include information such as the request time, access source address, specific operation type, execution result, and session identifier. These logs are synchronized in real-time to an independent audit module, facilitating post-event traceability and compliance review. An abnormal behavior detection mechanism is also configured. When situations occur such as repeated requests to decrypt the same set of digital envelopes within a preset time period, access source addresses outside the trusted cluster range, or consecutive encryption / decryption failures during a single session, the relevant requests are automatically blocked, external responses cease, and a risk warning is proactively issued to ensure the security and reliability of the entire digital envelope conversion process.

[0046] In step S230, the second digital envelope is synchronized to the second cluster to complete the encrypted data synchronization.

[0047] In the embodiments of this application, after the second digital envelope is generated, the synchronization gateway directly pushes the complete second digital envelope data to the second cluster through a pre-established dedicated communication channel. The second cluster binds and stores the second digital envelope with the corresponding encrypted ciphertext, completing the distribution and archiving of the digital envelope.

[0048] In another embodiment of this application, the synchronization gateway adds all the second digital envelopes to be sent to a transmission queue and pushes the data to the second cluster sequentially according to a preset task order. The second cluster receives the digital envelope data in the queue sequentially and completes the storage association. This method can process multiple sets of synchronization tasks in an orderly manner, avoid data transmission chaos, and stably achieve batch synchronization of the second digital envelopes to the second cluster. The preset task order includes, but is not limited to, file generation time order, encryption zone priority order, sorting order by file size, business level priority order, read / write popularity priority order, etc., which can be set according to the actual situation and are not specifically limited here.

[0049] It should be noted that the master key, intermediate key, and data encryption key involved in the embodiments of this application can all be keys generated by symmetric encryption algorithms. For example, symmetric encryption algorithms include, but are not limited to, commonly used encryption algorithms such as the Data Encryption Standard (DES), Triple Encryption Standard (TES), and Advanced Encryption Standard (AES). The master key, intermediate key, and data encryption key can be generated by the same symmetric encryption algorithm or by different symmetric encryption algorithms. The above encryption algorithms are only illustrative examples, and the embodiments of this application do not impose specific limitations; they can be selected according to actual circumstances.

[0050] According to embodiments of this application, by directly transmitting encrypted data in ciphertext form, the decryption and re-encryption of massive amounts of data in existing technologies are avoided. This reduces the computational resource consumption of the primary and backup clusters, shortens data synchronization latency, improves overall data synchronization throughput and cluster resource utilization, and meets the high-timeliness disaster recovery requirements. Through parallel operation of the data transmission thread and the key conversion thread, the data remains in ciphertext state throughout the entire synchronization link. Different intermediate keys are used to deseal, reseal, and transmit the digital envelope containing the encryption key of the encrypted data. This effectively solves the security challenges of data synchronization across independent key systems, meeting high-level security compliance requirements such as no plaintext data being stored or transmitted across domains, and effectively avoiding the risk of plaintext data exposure. This improves the security, timeliness, and environmental adaptability of cross-cluster encrypted data synchronization.

[0051] In the embodiments of this application, the synchronization gateway is deployed in a trusted operating environment. Based on the data transmission thread, synchronizing encrypted ciphertext in the first cluster to the second cluster includes: reading encrypted ciphertext from the storage node of the first cluster based on a preset virtual path in the data transmission thread, wherein the preset virtual path indicates an access path to read encrypted ciphertext by bypassing the data decryption logic of the first cluster; and writing encrypted ciphertext to the storage node of the second cluster.

[0052] It should be noted that a trusted operating environment can refer to an independent operating environment isolated from a general-purpose operating system, possessing hardware-level security protection capabilities. This ensures that program code and sensitive data run in protected memory, preventing data tampering, theft, and unauthorized access. A preset virtual path can refer to an access path used to bypass the cluster's built-in automatic decryption mechanism and directly access the original encrypted data blocks on storage nodes. Like a native dedicated access entry point, it directly reads the original encrypted ciphertext stored on the disk, skipping the distributed file system's transparent encryption and automatic decryption process, and does not parse the encrypted ciphertext into plaintext. A storage node can refer to the node device in the cluster responsible for persistently storing file data blocks; it is the actual storage carrier of the encrypted ciphertext.

[0053] In the embodiments of this application, the synchronization gateway is deployed within a trusted operating environment, providing secure isolation for the entire process of ciphertext reading, transmission, and key processing. The synchronization gateway automatically generates a corresponding preset virtual path based on the actual path of the file to be synchronized within the first cluster, replacing the original path prefix to form a standard path format that allows direct access to the ciphertext. The synchronization gateway initiates a preset virtual path access request to the name node of the first cluster. The name node verifies the access permissions of the synchronization gateway, allowing only those gateways with direct ciphertext read permissions to access data through this path, preventing unauthorized ciphertext reading. Upon receiving the preset virtual path access request, the name node forcibly closes the distributed file system's transparent encryption and automatic decryption process, without triggering key acquisition or data decryption operations, and directly locates the storage node and data block address corresponding to the file. Based on the preset virtual path, the data transmission thread of the synchronization gateway directly establishes a data connection with the storage node of the first cluster, reading the original encrypted ciphertext data blocks persistently stored on the disk without performing any decryption operations; the ciphertext remains unchanged. This path can directly connect to the storage node to read the underlying data blocks. After the reading is complete, the data transmission thread writes the original encrypted ciphertext directly to the storage node of the second cluster. The second cluster also keeps the ciphertext unchanged and does not decode it, thus completing the lossless synchronization of ciphertext across clusters.

[0054] According to the embodiments of this application, by using a preset virtual path to access data, the transparent encryption automatic decryption process can be bypassed, enabling the transmission of encrypted ciphertext without decryption. This avoids the large resource consumption of the source cluster CPU and other components due to data decryption, which is beneficial to improving the overall performance of data synchronization and transmission throughput. It also ensures that the data always flows in ciphertext form, avoiding the risk of plaintext leakage and meeting the high-level security and compliance requirements in financial scenarios. At the same time, this path can simplify the data access link, further shorten the synchronization time, and ensure the security and timeliness of cross-cluster encrypted data synchronization.

[0055] In the embodiments of this application, based on a key conversion thread, using a first cluster to decrypt a first digital envelope to obtain a data encryption key, and using a second cluster to encrypt the data encryption key to generate a second digital envelope includes: sending a decryption request to the first cluster; calling the first cluster to decrypt the first digital envelope based on a first intermediate key to obtain a data encryption key; receiving the data encryption key returned by the first cluster; sending an encryption request to the second cluster based on the data encryption key; and calling the second cluster to encrypt the data encryption key using a second intermediate key to generate a second digital envelope, wherein the second intermediate key is different from the first intermediate key.

[0056] It should be noted that a decryption request can refer to the instruction and content initiated by the synchronization gateway to the first cluster, requesting the decryption of the first digital envelope. An encryption request can refer to the instruction and content initiated by the synchronization gateway to the second cluster, requesting the generation of a new digital envelope based on the data encryption key. The first intermediate key can refer to the key exclusive to the first cluster, used to decrypt the first digital envelope to obtain the data encryption key. The second intermediate key can refer to the key exclusive to the second cluster, used to encrypt the data encryption key to generate the second digital envelope. The second intermediate key is independent of the first intermediate key and cannot be used interchangeably.

[0057] In the embodiments of this application, the synchronization gateway sends a decryption request to the first cluster through a key conversion thread. Upon receiving the decryption request, the first cluster invokes its own key management service, uses its first intermediate key to decrypt the first digital envelope corresponding to the file, extracts the plaintext data encryption key, and sends this data encryption key back to the synchronization gateway. After receiving this data encryption key through the key conversion thread, the synchronization gateway sends an encryption request to the second cluster based on it. Upon receiving the encryption request, the second cluster invokes its local key management service, uses its independently configured second intermediate key, completely different from the first intermediate key, to encrypt the data encryption key, generating a second digital envelope adapted to the second cluster's key system. In this embodiment, the first and second intermediate keys belong to two physically isolated key systems. Only the decryption and re-encryption of the digital envelope are performed; there is no need to decrypt the encrypted ciphertext data. While meeting the security requirement of mutual isolation between the primary and backup cluster keys, the cross-cluster digital envelope conversion is successfully completed, ensuring that encrypted data can be read and used normally in the second cluster.

[0058] In another embodiment of this application, the synchronization gateway relies on a thread queue priority scheduling mechanism to manage massive concurrent decryption and encryption requests in a queued manner. Task priorities are assigned based on business importance, disaster recovery timeliness requirements, and the encrypted partition to which the file belongs. High-priority requests are processed first, preventing core disaster recovery processes from being blocked by high-traffic tasks and improving the overall processing orderliness and response speed in multi-tasking scenarios. Upon receiving various requests, the first and second clusters first verify the legitimacy of the synchronization gateway's identity credentials, such as by comparing with a trusted device whitelist to identify the request source and intercepting erroneous requests, thus building a secure access barrier from the source. In the key transmission stage, the synchronization gateway and the clusters dynamically negotiate a single-use temporary session key. The first cluster can use the temporary session key to encapsulate the encryption key of the decrypted data before transmission, effectively preventing the key from being eavesdropped on or intercepted in the link, achieving end-to-end encryption protection. The synchronization gateway also has a local key cache pool to store the mapping relationship between data encryption keys, the first intermediate key, and the second intermediate key. When the same key is used for conversion again, the cached content can be reused directly, reducing cross-cluster interactions and repeated encryption / decryption operations, reducing cluster computing power consumption and improving processing efficiency. After the second cluster generates the second digital envelope, it will attach a digital signature using its local private key. After receiving the signature, the synchronization gateway will verify it using its public key to check the integrity and authenticity of the digital envelope. If the verification fails, a re-encryption process will be automatically triggered, effectively avoiding synchronization failures caused by data tampering.

[0059] According to the embodiments of this application, by using the independent intermediate keys of the first cluster and the second cluster to complete the decryption and re-encryption of the digital envelope, it is beneficial to realize the secure bridging of the data encryption key between two independent key management systems. The digital envelope cross-cluster adaptation is completed without decrypting the encrypted ciphertext data of the business. This not only meets the financial security compliance requirements of the mutual independence of the primary and backup cluster keys, but also simplifies the cross-cluster key interaction logic and ensures the stable and efficient operation of the encrypted data synchronization process.

[0060] In the embodiments of this application, before using the first cluster to decrypt the first digital envelope to obtain the data encryption key based on the key conversion thread, and using the second cluster to encrypt the data encryption key to generate the second digital envelope, the process includes: sending a proof report generated based on the trusted execution environment to the first cluster and the second cluster; calling the first cluster and the second cluster to perform legality verification on the proof report respectively; and after the legality verification is passed, receiving a single access token issued by the first cluster and the second cluster respectively, wherein the single access token indicates the access rights of the synchronization gateway to the first cluster or the second cluster.

[0061] It should be noted that a Trusted Execution Environment (TEE) refers to a runtime environment isolated from the operating system, possessing independent secure memory and computing space. This ensures the secure execution of program code and sensitive data within the isolated area, resisting external malicious attacks and illegal theft. A verification report refers to an authentication file generated by the synchronization gateway within the TEE, used to prove the trustworthiness of its runtime environment, the legitimacy of its identity, and the normality of its operation. Legality verification refers to the security detection process where the first and second clusters verify the content, format, source of generation, and validity of the received verification report. A single access token refers to a temporary permission credential issued by the cluster to the synchronization gateway after successful verification, allowing the synchronization gateway to complete only one specified access operation, thus limiting the access scope and operation permissions of the corresponding cluster.

[0062] In the embodiments of this application, before initiating the key conversion thread to perform digital envelope decryption and re-encryption operations, the synchronization gateway first generates a proof report in a trusted execution environment. Simultaneously, it calculates a hash digest of the proof report and attaches a digital signature to the gateway device. The proof report, carrying both the hash digest and digital signature, is then sent to the first and second clusters. Upon receiving the proof report, the first and second clusters first verify the validity of the digital signature and compare the hash digest. Then, they conduct a comprehensive legality check on the proof report using preset security rules to confirm that the synchronization gateway's operating environment and device identity are authentic and trustworthy. If the legality check fails, all subsequent access requests are directly rejected and an exception log is recorded. If all legality checks pass, the first and second clusters generate and issue a single-access token to the synchronization gateway. This single-access token explicitly defines the type of operation, access interface, and validity period that the synchronization gateway can execute this time, precisely controlling the synchronization gateway's access permissions to the corresponding cluster. Only after obtaining the single-access token can the synchronization gateway continue to perform subsequent key conversion-related operations. It should be noted that the identity key and signature key used in TEE proof reports, etc., can be generated by asymmetric encryption algorithms. Asymmetric encryption algorithms include, but are not limited to, elliptic curve public key cryptography (ShangMi 2, abbreviated as SM2), Rivest-Shamir-Adelman algorithm (RSA, abbreviated as RSA), and digital signature algorithm (DSA, abbreviated as DSA). Using asymmetric encryption algorithms can achieve trusted authentication across cluster devices, anti-eavesdropping transmission, and anti-tampering of data.

[0063] According to the embodiments of this application, by generating and sending a proof report to both clusters before the key conversion operation, and having the clusters complete the legality verification and issue a single-access token, it is beneficial to achieve pre-credible authentication of the identity and operating environment of the synchronization gateway. By leveraging the temporary permission control characteristics of the single-access token, the access scope and operation permissions of the gateway are strictly limited, effectively avoiding security risks such as unauthorized device access and unauthorized access. At the same time, relying on the underlying security capabilities of the trusted execution environment, the authentication process itself is guaranteed not to be tampered with, further strengthening the security level of the cross-cluster key interaction link, which meets the compliance requirements of data and key access in financial scenarios.

[0064] In the embodiments of this application, the decryption failure rate and encryption failure rate of the key conversion thread within a preset time are obtained; if the decryption failure rate and / or encryption failure rate exceed a preset threshold, the sending of new decryption requests and / or encryption requests is suspended and an alarm is triggered; the first cluster and the second cluster are invoked to perform downgrade processing or delayed scheduling of the decryption requests and / or encryption requests that have entered the queue until the decryption failure rate and encryption failure rate fall back to the safe range and then return to normal.

[0065] It should be noted that the preset time can refer to a pre-configured statistical period used to periodically collect abnormal data on the key conversion thread, such as 1 day, 2 days, etc. There is no specific limitation here; it can be set according to actual needs. The decryption failure rate can refer to the ratio of the number of failed decryption requests initiated by the key conversion thread to the total number of decryption requests within the statistical period. The encryption failure rate can refer to the ratio of the number of failed encryption requests initiated by the key conversion thread to the total number of encryption requests within the statistical period. The preset threshold can refer to a pre-set critical failure rate value, used as a criterion for judging whether the key conversion process has an anomaly. There is no specific limitation here; it can be set according to actual needs. Degradation processing can refer to the cluster's management methods for lowering the running priority of requests waiting in the queue, reducing processing resources, or simplifying some non-core verification logic. Delayed scheduling can refer to the cluster's scheduling strategy of temporarily delaying the execution of requests waiting in the queue, avoiding abnormal periods for task processing. The safe range can refer to the numerical range within which the failure rate is below the preset threshold and the key conversion thread can operate stably and normally. There is no specific limitation here; it can be set according to actual needs.

[0066] In the embodiments of this application, during the decryption and encryption operations performed by the key conversion thread, the synchronization gateway polls and collects the decryption failure rate and encryption failure rate generated by the key conversion thread within a preset time period at fixed intervals, and stores the statistical data in the local operation log library for future reference. When the decryption failure rate exceeds a preset threshold, the synchronization gateway immediately suspends sending new decryption requests; when the encryption failure rate exceeds a preset threshold, the synchronization gateway immediately suspends sending new encryption requests; it can also link with the operation and maintenance management module to push hierarchical alarm information, specifying the anomaly type, the node where the anomaly occurred, and the current failure rate value. On this basis, the synchronization gateway calls the first cluster and the second cluster to perform downgrade processing or delayed scheduling on the decryption requests and / or encryption requests that have entered the task queue, and at the same time starts the preliminary root cause investigation program to check the cluster key service status, network connectivity status, and key legality; it continuously monitors the two failure rate indicators in real time until the decryption failure rate and encryption failure rate both fall back to the preset safe range, the synchronization gateway releases the request suspension state, the cluster resumes the normal task scheduling strategy, and the entire key conversion process returns to normal operation.

[0067] According to the embodiments of this application, by periodically calculating the decryption failure rate and encryption failure rate of the key conversion thread and combining them with preset thresholds for anomaly judgment, new requests are promptly suspended and alarms are triggered when the indicators exceed the limits. At the same time, tasks in the queue are downgraded or delayed, which is conducive to realizing real-time anomaly monitoring and proactive rate limiting control of the key conversion process. This can effectively prevent the spread of faults and reduce the probability of batch task anomalies. Normal operation is restored after the indicators return to the safe range, which is conducive to improving the operational stability, fault tolerance and operation and maintenance response efficiency of the cross-cluster key conversion link.

[0068] In the embodiments of this application, a data block is selected from the data blocks that have completed encrypted data synchronization; a first cluster is used to decrypt the data block and a first hash value is calculated using a hash function; a second cluster is used to decrypt the data block and a second hash value is calculated using a hash function; the first hash value and the second hash value are compared to verify data integrity.

[0069] It should be noted that a data block can refer to the smallest unit of data storage formed after a file is split in a distributed storage system; it is the basic carrier for encrypted data synchronization, read and write operations. A hash function can refer to a one-way operation function that can map data of arbitrary length to a fixed-length numerical string, often used for data integrity and consistency verification. The first hash value can refer to the characteristic value obtained by the first cluster after decrypting a specified data block and performing a hash function operation. The second hash value can refer to the characteristic value obtained by the second cluster after decrypting the same data block and performing a hash function operation. Data integrity means that the data in the synchronization backup cluster is consistent with the original data content of the primary cluster, and no state such as loss, tampering, or corruption has occurred.

[0070] Figure 3 A flowchart illustrating a method for verifying data integrity according to an embodiment of this application is shown, such as... Figure 3 As shown, a data block is randomly selected from all encrypted data blocks in the file that have completed synchronization, using a random sampling rule, as the verification object. The synchronization gateway sends verification commands to both the first and second clusters. The first cluster calls its own decryption component to decrypt the data block, then uses a hash function to generate a first hash value and sends it back to the synchronization gateway. The second cluster synchronously performs decryption on the same data block stored locally, calculates the second hash value using the exact same hash function, and sends it back. The hash function can be selected according to the actual situation and is not specifically limited here. After receiving the two sets of hash values, the synchronization gateway synchronously records the timestamp, data block number, and hash result of this verification to the audit log, and then compares the first and second hash values. When the comparison result shows that the two sets of hash values ​​are the same, the integrity verification is considered to have passed; when the comparison result shows that the two sets of hash values ​​are different, it indicates that the data may have been tampered with, lost, or damaged during the synchronization process, immediately triggering a data anomaly alarm and marking the abnormal data block for subsequent troubleshooting.

[0071] According to the embodiments of this application, by decrypting the same data block in the first cluster and the second cluster respectively and generating a hash value based on the hash function and then comparing them, it is beneficial to realize the integrity verification of cross-cluster synchronized encrypted data. It can quickly identify problems such as data tampering, loss, and transmission anomalies. While controlling the verification computing power overhead, it ensures the consistency of data content at both ends in disaster recovery scenarios, effectively improving the reliability and data security of encrypted data synchronization results.

[0072] In the embodiments of this application, synchronizing the second digital envelope to the second cluster includes: coordinating the synchronization of encrypted ciphertext and the generation of the second digital envelope based on the synchronization coordinator; and synchronizing the second digital envelope to the file metadata corresponding to the encrypted ciphertext in the second cluster when both the synchronization of encrypted ciphertext and the generation of the second digital envelope have been completed.

[0073] It should be noted that the synchronization coordinator can refer to a control component deployed within the synchronization gateway, used to uniformly monitor and schedule the progress of encrypted ciphertext synchronization and digital envelope generation, ensuring the coordinated execution of these two types of tasks. File metadata can refer to supplementary data used to describe basic file attributes, storage location, encryption information, permission configuration, etc., and the file metadata can store the corresponding digital envelope.

[0074] In the embodiments of this application, a synchronization coordinator is integrated within the synchronization gateway, and the encrypted ciphertext synchronization task and the second digital envelope generation task are executed in parallel. The synchronization gateway completes the cross-cluster transmission of the encrypted ciphertext through a data transmission thread and generates the second digital envelope through a key conversion thread. The synchronization coordinator periodically or in real-time polls to monitor the synchronization progress of the encrypted ciphertext and the generation progress of the second digital envelope. When the synchronization coordinator detects that the encrypted ciphertext has been completely written to the second cluster and the second digital envelope has been successfully generated, it confirms that both tasks have been completed and then performs the digital envelope synchronization operation, writing the second digital envelope into the file metadata corresponding to the encrypted ciphertext within the second cluster, thus achieving the binding of the ciphertext and the second digital envelope. If either the encrypted ciphertext synchronization or the second digital envelope generation task is not completed, the synchronization coordinator continues to wait and does not execute the second digital envelope distribution operation, effectively avoiding the abnormal state of ciphertext and digital envelope mismatch in the backup cluster, ensuring the atomicity of encrypted data synchronization, and enabling the second cluster to normally complete the parsing and reading of encrypted files.

[0075] According to the embodiments of this application, the synchronization status of encrypted ciphertext and the generation status of the second digital envelope are monitored by a synchronization coordinator. After all the work is completed, the second digital envelope is written into the corresponding file metadata. This facilitates the atomic binding of ciphertext data and the second digital envelope, effectively avoids the data and key mismatch problem caused by the completion of a single task first, effectively ensures that the encrypted files in the second cluster can be parsed and used normally, and helps to improve the integrity, stability and data availability of cross-cluster encrypted data synchronization.

[0076] In the embodiments of this application, the process of listening to an encrypted data synchronization task includes: obtaining change events of file operation logs in the first cluster based on a long connection established with the first cluster; parsing the change events to obtain the corresponding file paths; matching the file paths with preset encrypted area information; and determining that an encrypted data synchronization task has been listened to if the match is successful.

[0077] It should be noted that a persistent connection refers to a communication link established between the synchronization gateway and the first cluster that maintains a continuous connection without repeated establishment and disconnection, enabling real-time transmission of interactive data and event information. A file operation log refers to a log file that the first cluster records various operations such as adding, modifying, moving, and synchronizing files in real time, used to track file dynamics and capture data changes. A change event refers to event notification information actively reported by the first cluster when a file is added, overwritten, or migrated. A file path refers to unique identifiers used to locate the file's storage location within the cluster, precisely pointing to the directory where the file is located. Preset encryption zone information refers to the configuration information such as the identifier and directory range corresponding to a pre-defined encrypted file storage area, used to distinguish encrypted files from ordinary files.

[0078] In the embodiments of this application, the synchronization gateway establishes and maintains a long connection with the first cluster in advance to achieve continuous communication link connectivity. The synchronization gateway uses this long connection to monitor the file operation logs of the first cluster in real time or periodically, capturing various change events generated by the logs. When file additions, modifications, or other operations occur within the first cluster, the corresponding change events are promptly pushed to the synchronization gateway. The synchronization gateway parses and processes the received change events, extracting the file path corresponding to the operation, and then compares this file path with pre-configured preset encryption zone information. If the file path matches the preset encryption zone information, it is determined that the encrypted data synchronization task has been successfully monitored, and the synchronization gateway immediately initiates subsequent processes such as digital envelope conversion and cross-cluster synchronization of encrypted ciphertext; if the two do not match, it is determined to be a normal file operation event.

[0079] According to the embodiments of this application, by relying on long connections to continuously subscribe to the log data stream of the first cluster, the synchronization task is triggered only after the file operation change event is successfully matched with the preset encrypted area information. This abandons the traditional polling detection method, which is conducive to realizing real-time perception and on-demand start of encrypted data synchronization tasks, effectively reducing resource consumption. At the same time, it accurately filters unencrypted file operation events, reduces invalid processing procedures, and further improves task triggering efficiency and overall running performance.

[0080] Figure 4 Another flowchart illustrating an encrypted data synchronization method according to an embodiment of this application is shown. Figure 4As shown, in step S410, the encrypted data synchronization task is monitored. In step S420, it is determined whether the monitored task is information from a preset encrypted area. If not, proceed to step S430 to perform normal synchronization; if yes, proceed to step S440 to extract the first digital envelope. Subsequently, the steps of ciphertext direct transmission (S450) and decrypting the first digital envelope and encrypting it to obtain the second digital envelope (S460) are executed in parallel. When it is confirmed that both tasks have been completed, proceed to step S470 to synchronize the second digital envelope to the second cluster. In step S480, data integrity is sampled and verified. Finally, in step S490, logs are recorded, completing the encrypted data synchronization process.

[0081] Figure 5 A schematic block diagram of an encrypted data synchronization device according to an embodiment of this application is shown. Figure 5 As shown, the primary cluster (first cluster) contains a distributed file system A, a key management service A, and a hardware security module A. This cluster is equipped with a dedicated master key 'a', and its storage space simultaneously stores the encrypted ciphertext and the first digital envelope 'a'. The secondary cluster (second cluster) also contains a distributed file system B, a key management service B, and a hardware security module B. This cluster is equipped with an independent master key 'b', isolated from the key system of the primary cluster domain. Its storage space is used to store the synchronized encrypted ciphertext and the second digital envelope 'b'. The primary and secondary clusters deploy independent key management services and hardware security modules, respectively. The synchronization gateway sends a decryption request to the first cluster via a key conversion thread. Upon receiving the decryption request, the first cluster invokes its own key management service, using its first intermediate key to decrypt the first digital envelope corresponding to the file. After decryption, it extracts the data encryption key in plaintext form, thus decrypting the first digital envelope. This data encryption key is then sent back to the synchronization gateway. The synchronization gateway, upon receiving this data encryption key via its key conversion thread, uses it as the basis to send an encryption request to the second cluster. After receiving the encryption request, the second cluster invokes its local key management service and uses a second intermediate key, independently configured and completely different from the first intermediate key, to encrypt the data encryption key, generating a second digital envelope adapted to the second cluster's key system, thus completing the resealing of the data encryption key. In this embodiment, the first and second intermediate keys belong to two physically isolated key systems. Only the decryption and reencryption of the digital envelope are performed; there is no need to decrypt the encrypted ciphertext data. While meeting the security requirement of mutual isolation between the primary and backup cluster keys, the cross-cluster digital envelope conversion is successfully completed. A direct ciphertext transmission method is also used to completely transfer the encrypted ciphertext from the primary cluster to the backup cluster. The entire data transmission process does not involve decryption of the ciphertext. After the second digital envelope is generated, the synchronization gateway injects it into the backup cluster, ultimately allowing the distributed file system of the backup cluster domain to simultaneously store the ciphertext data and the new digital envelope, i.e., the second digital envelope.

[0082] Based on the above-described encrypted data synchronization method, embodiments of this application also provide an encrypted data synchronization device. The following will be combined with... Figure 6 The device is described in detail.

[0083] Figure 6 This schematically illustrates another structural block diagram of an encrypted data synchronization device according to an embodiment of the present application.

[0084] like Figure 6 As shown, the encrypted data synchronization device 600 of this embodiment is applied to a synchronization gateway, which is communicatively connected to a first cluster and a second cluster that have independent key management services, and includes an encrypted ciphertext synchronization module 610, a key conversion module 620 and a digital envelope synchronization module 630.

[0085] The encrypted ciphertext synchronization module 610 is used to synchronize the encrypted ciphertext in the first cluster to the second cluster in response to the detected encrypted data synchronization task, based on the data transmission thread. In one embodiment, the encrypted ciphertext synchronization module 610 can be used to perform step S210 described above, which will not be repeated here.

[0086] The key conversion module 620 is used, based on the key conversion thread, to decrypt the first digital envelope using a first cluster to obtain a data encryption key, and then uses a second cluster to encrypt the data encryption key to generate a second digital envelope. The first and second digital envelopes are equipped with different intermediate keys, which are used to decrypt either the first or second digital envelope. In one embodiment, the key conversion module 620 can be used to execute step S220 described above, which will not be repeated here.

[0087] The digital envelope synchronization module 630 is used to synchronize the second digital envelope to the second cluster to complete the encrypted data synchronization. In one embodiment, the digital envelope synchronization module 630 can be used to perform step S230 described above, which will not be repeated here.

[0088] According to an embodiment of this application, the encrypted ciphertext synchronization module 610 is further configured to read encrypted ciphertext from the storage node of the first cluster based on a preset virtual path in the data transmission thread, wherein the preset virtual path indicates an access path for reading encrypted ciphertext by bypassing the data decryption logic of the first cluster; and write the encrypted ciphertext to the storage node of the second cluster.

[0089] According to an embodiment of this application, the key conversion module 620 is further configured to, based on the key conversion thread, decrypt the first digital envelope using the first cluster to obtain a data encryption key, and encrypt the data encryption key using the second cluster to generate a second digital envelope, including: sending a decryption request to the first cluster; calling the first cluster to decrypt the first digital envelope based on the first intermediate key to obtain a data encryption key; receiving the data encryption key returned by the first cluster; sending an encryption request to the second cluster based on the data encryption key; and calling the second cluster to encrypt the data encryption key using the second intermediate key to generate a second digital envelope, wherein the second intermediate key is different from the first intermediate key.

[0090] According to an embodiment of this application, the encrypted data synchronization device 600 further includes a verification module, which is used to send a proof report generated based on a trusted execution environment to a first cluster and a second cluster; call the first cluster and the second cluster to perform legality verification on the proof report respectively; and after the legality verification is passed, receive a single access token issued by the first cluster and the second cluster respectively, wherein the single access token indicates the access rights of the synchronization gateway to the first cluster or the second cluster.

[0091] According to an embodiment of this application, the encrypted data synchronization device 600 further includes a failure rate module, which is used to obtain the decryption failure rate and encryption failure rate of the key conversion thread within a preset time; if the decryption failure rate and / or encryption failure rate exceed a preset threshold, the sending of new decryption requests and / or encryption requests is suspended and an alarm is triggered; the first cluster and the second cluster are invoked to perform downgrade processing or delayed scheduling of the decryption requests and / or encryption requests that have entered the queue until the decryption failure rate and encryption failure rate fall back to a safe range and then normal operation is restored.

[0092] According to an embodiment of this application, the encrypted data synchronization device 600 further includes a comparison module, which is used to select a data block from the data blocks that have completed encrypted data synchronization; decrypt a data block using a first cluster and calculate a first hash value using a hash function; decrypt a data block using a second cluster and calculate a second hash value using a hash function; and compare the first hash value and the second hash value to verify data integrity.

[0093] According to an embodiment of this application, the digital envelope synchronization module 630 is further configured to coordinate the synchronization of encrypted ciphertext and the generation of the second digital envelope based on the synchronization coordinator; when both the synchronization of encrypted ciphertext and the generation of the second digital envelope are completed, the second digital envelope is synchronized to the file metadata corresponding to the encrypted ciphertext in the second cluster.

[0094] According to an embodiment of this application, the encrypted ciphertext synchronization module 610 is further configured to obtain change events of file operation logs in the first cluster based on a long connection established with the first cluster; parse the change events to obtain the corresponding file paths; match the file paths with preset encrypted area information; and determine that an encrypted data synchronization task has been detected if the match is successful.

[0095] According to embodiments of this application, any plurality of modules among the encrypted ciphertext synchronization module 610, key conversion module 620, and digital envelope synchronization module 630 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the encrypted ciphertext synchronization module 610, key conversion module 620, and digital envelope synchronization module 630 can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays, programmable logic arrays, systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits, or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the encrypted ciphertext synchronization module 610, key conversion module 620, and digital envelope synchronization module 630 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0096] Figure 7 A block diagram schematically illustrates an electronic device suitable for implementing an encrypted data synchronization method according to an embodiment of this application.

[0097] like Figure 7 As shown, an electronic device 700 according to an embodiment of this application includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory 702 or a program loaded from a storage portion 708 into a random access memory 703. The processor 701 may include, for example, a general-purpose microprocessor, an instruction set processor and / or an associated chipset and / or a dedicated microprocessor. The processor 701 may also include onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for executing different steps of the method flow according to an embodiment of this application.

[0098] Random access memory 703 stores various programs and data required for the operation of electronic device 700. Processor 701, read-only memory 702, and random access memory 703 are interconnected via bus 704. Processor 701 executes various steps of the method flow according to embodiments of this application by executing programs stored in read-only memory 702 and / or random access memory 703. It should be noted that programs may also be stored in one or more memories other than read-only memory 702 and random access memory 703. Processor 701 may also execute various steps of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0099] According to embodiments of this application, the electronic device 700 may further include an input / output interface 705, which is also connected to a bus 704. The electronic device 700 may also include one or more of the following components connected to the input / output interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube, liquid crystal display, etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card, such as a local area network card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0100] Embodiments of this application also provide a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0101] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination thereof. In embodiments of this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include the read-only memory 702, and / or random access memory 703, and / or one or more memories other than read-only memory 702 and random access memory 703 described above.

[0102] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this application.

[0103] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 709, and / or installed from a removable medium 711. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0104] In embodiments of this application, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by processor 701, it performs the functions defined in the system of embodiments of this application. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0105] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0106] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0107] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A method for synchronizing encrypted data, characterized in that, The method is applied to a synchronization gateway, which is communicatively connected to a first cluster and a second cluster, each having independent key management services. In response to the detection of an encrypted data synchronization task, the encrypted ciphertext in the first cluster is synchronized to the second cluster based on the data transmission thread; Based on the key conversion thread, the first cluster is used to decrypt the first digital envelope to obtain the data encryption key, and the second cluster is used to encrypt the data encryption key to generate the second digital envelope. The first digital envelope and the second digital envelope are equipped with different intermediate keys, and the intermediate keys are used to decrypt the first digital envelope or the second digital envelope. The second digital envelope is synchronized to the second cluster to complete the encrypted data synchronization.

2. The method according to claim 1, characterized in that, The synchronization gateway is deployed in a trusted operating environment, and the process of synchronizing encrypted ciphertext in the first cluster to the second cluster based on data transmission threads includes: The encrypted ciphertext is read from the storage node of the first cluster based on a preset virtual path in the data transmission thread, wherein the preset virtual path indicates an access path to read the encrypted ciphertext by bypassing the data decryption logic of the first cluster. The encrypted ciphertext is written to the storage node of the second cluster.

3. The method according to claim 1, characterized in that, The step of using the key conversion thread to decrypt the first digital envelope using the first cluster to obtain the data encryption key, and then using the second cluster to encrypt the data encryption key to generate the second digital envelope includes: Send the decryption request to the first cluster; The first cluster is invoked to decrypt the first digital envelope based on the first intermediate key to obtain the data encryption key; Receive the data encryption key returned by the first cluster; Based on the data encryption key, the encryption request is sent to the second cluster; The second cluster is invoked to encrypt the data encryption key using the second intermediate key to generate the second digital envelope, wherein the second intermediate key is different from the first intermediate key.

4. The method according to claim 1, characterized in that, Before the data encryption key is obtained by decrypting the first digital envelope using the first cluster based on the key conversion thread, and the data encryption key is encrypted using the second cluster to generate the second digital envelope, the process includes: The proof report generated based on the trusted execution environment is sent to the first cluster and the second cluster; The first cluster and the second cluster are invoked respectively to verify the legality of the proof report; After the legitimacy verification is passed, the system receives single access tokens issued by the first cluster and the second cluster respectively, wherein the single access token indicates the access rights of the synchronization gateway to the first cluster or the second cluster.

5. The method according to claim 3, characterized in that, Also includes: Obtain the decryption failure rate and encryption failure rate of the key conversion thread within a preset time period; If the decryption failure rate and / or the encryption failure rate exceed a preset threshold, the sending of new decryption requests and / or encryption requests will be suspended, and an alarm will be triggered. The first and second clusters are invoked to downgrade or delay the decryption and / or encryption requests that have entered the queue until the decryption failure rate and encryption failure rate fall back to a safe range and then return to normal.

6. The method according to claim 1, characterized in that, Also includes: Select one data block from the data blocks that have completed encrypted data synchronization; The first cluster is used to decrypt the data block and a first hash value is calculated using a hash function. The second cluster is used to decrypt the data block and the hash function is used to calculate the second hash value. The first hash value and the second hash value are compared to verify data integrity.

7. The method according to claim 1, characterized in that, The step of synchronizing the second digital envelope to the second cluster includes: The synchronization coordinator coordinates the synchronization of the encrypted ciphertext and the generation of the second digital envelope. Once the encryption ciphertext synchronization and the generation of the second digital envelope are both completed, the second digital envelope is synchronized to the file metadata corresponding to the encryption ciphertext in the second cluster.

8. The method according to claim 1, characterized in that, The task of monitoring and synchronizing encrypted data includes: Based on the long connection established with the first cluster, obtain the change events of the file operation log in the first cluster; The corresponding file path is obtained by parsing the change event; Match the file path with the preset encrypted area information; If a match is successful, it is determined to be the encrypted data synchronization task that was monitored.

9. An encrypted data synchronization device, characterized in that, The device is applied to a synchronization gateway, which is communicatively connected to a first cluster and a second cluster, each having independent key management services. The device includes: The encrypted ciphertext synchronization module is used to respond to the detected encrypted data synchronization task and, based on the data transmission thread, synchronize the encrypted ciphertext in the first cluster to the second cluster. A key conversion module is used, based on a key conversion thread, to decrypt a first digital envelope using the first cluster to obtain a data encryption key, and then to encrypt the data encryption key using the second cluster to generate a second digital envelope. The first digital envelope and the second digital envelope are equipped with different intermediate keys, which are used to decrypt either the first digital envelope or the second digital envelope. The digital envelope synchronization module is used to synchronize the second digital envelope to the second cluster to complete the encrypted data synchronization.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images