Data processing method and apparatus

Abstract

Provided in the embodiments of the present disclosure are a data processing method and apparatus. The method comprises: acquiring a data processing request queue of a cloud storage node, wherein the data processing request queue comprises a specified data processing request and a non-specified data processing request, and the specified data processing request is a data processing request which requires encryption or decryption processing to be performed on carried data; performing cyclic processing on the data processing requests in the data processing request queue, which comprises: performing encryption or decryption processing on data carried in the specified data processing request, giving a response by using data obtained after the encryption or decryption processing, and giving a response by using data carried in the non-specified data processing request; and when it is detected that the accumulated data volume involved in the encryption or decryption processing during the current cyclic processing is greater than a preset data volume, stopping processing the specified data processing request during the current cyclic processing.

Description

[0001] The application relates to a data processing method and device, and belongs to the technical field of storage, in particular to a data processing method and device. In some storage systems, such as a block storage system, a transparent encryption service can be provided for a cloud storage node (such as a cloud disk), a user can provide or use a public cloud key management service to maintain corresponding keys in the storage system, the storage system is encrypted at the bottom, and when the user writes and reads data, the data is in plaintext form, and the data needs to be encrypted and stored and decrypted and returned. However, the encryption and decryption process needs to consume a lot of time, and when the amount of data that needs to be encrypted and decrypted is large, a large delay is caused, and the writing and reading process of data that does not need to be encrypted and decrypted is affected. In view of the above problems, the application provides a data processing method and device to overcome the above problems or at least partially solve the above problems, which comprises: a data processing method, the method comprises: obtaining a data processing request queue of a cloud storage node; wherein the data processing request queue comprises a specified data processing request and a non-specified data processing request, the specified data processing request is a data processing request that needs to encrypt or decrypt the carried data; the data processing request in the data processing request queue is cyclically processed, including: encrypting or decrypting the data carried by the specified data processing request and responding with the encrypted or decrypted data, and responding with the data carried by the non-specified data processing request; when it is detected that the cumulative amount of encrypted or decrypted data in the current cyclic processing process is greater than a preset data amount, the processing of the specified data processing request in the current cyclic processing process is stopped. Optionally, the data processing request queue is a data write request queue for a cloud storage node, the specified data processing request is a specified data write request, the non-specified data processing request is a non-specified data write request, and the specified data write request is a data write request that needs to encrypt the carried data; the cyclic processing of the data processing request in the data processing request queue comprises: encrypting the data carried by the specified data write request and sending the encrypted data to the cloud storage node for storage, and sending the data carried by the non-specified data write request to the cloud storage node for storage.Optionally, the data processing request queue is a data reply request queue for a cloud storage node to feed back data read requests, the specified data processing request is a specified data reply request, the non-specified data processing request is a non-specified data reply request, and the specified data reply request is a data reply request that needs to be decrypted. The method comprises the following steps of: decrypting encrypted data carried by the specified data reply request and replying with the decrypted data, and replying with data carried by the non-specified data reply request. Optionally, the replying with data carried by the non-specified data processing request comprises the following steps of: moving the non-specified data processing request to a first queue, and replying with data carried by the non-specified data processing request when the first queue is processed. Optionally, the encrypting or decrypting data carried by the specified data processing request and replying with the encrypted or decrypted data comprises the following steps of: moving the specified data processing request to a second queue; encrypting or decrypting data carried by the specified data processing request in the second queue; moving the specified data processing request carrying the encrypted or decrypted data to the first queue, and replying with the encrypted or decrypted data when the first queue is processed. Optionally, the processing of the first queue comprises the following steps of: processing non-specified data processing requests and specified data processing requests in the first queue according to the request time sequence of the non-specified data processing requests and the specified data processing requests in the first queue when the first queue is processed. Optionally, the encrypting or decrypting data carried by the specified data processing request and replying with the encrypted or decrypted data further comprises the following steps of: determining an accumulated encrypted or decrypted data amount during current cycle processing, and determining a remaining data amount according to the accumulated encrypted or decrypted data amount and a preset data amount; when the data amount of data carried by the specified data processing request is greater than the remaining data amount, encrypting or decrypting part of the data carried by the specified data processing request according to the remaining data amount, and replying with the encrypted or decrypted data.Optionally, after stopping processing the specified data processing request in the current cycle processing process, further comprising: in a case where part of data carried by the specified data processing request is not encrypted or decrypted, recording the part of data in the specified data processing request that has been encrypted or decrypted and the part of data that has not been encrypted or decrypted; in a next cycle processing process, encrypting or decrypting the part of data that has not been encrypted or decrypted, and responding with all the encrypted or decrypted data. Optionally, further comprising: obtaining a set preset data amount through an external interface. A data processing system, configured to implement the method described above. A data processing apparatus, configured to implement the method described above. An electronic device, characterized by comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method described above. A computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program, when executed by a processor, implements the method described above. A computer program product, comprising a computer program, wherein the computer program, when executed by a processor, implements the method described above. The embodiments of the present disclosure have the following advantages: in the embodiments of the present disclosure, by obtaining a data processing request queue of a cloud storage node, the data processing request queue comprises a specified data processing request and a non-specified data processing request, the specified data processing request is a data processing request that needs to encrypt or decrypt data carried thereby, the data processing request in the data processing request queue is processed in a cycle, including: encrypting or decrypting the data carried by the specified data processing request and responding with the encrypted or decrypted data, and responding with the data carried by the non-specified data processing request, when it is detected that the amount of data encrypted or decrypted in the current cycle processing process is greater than a preset data amount, stopping processing the specified data processing request in the current cycle processing process, which limits the amount of data that needs to be encrypted or decrypted in a single cycle processing process, avoids the amount of data encrypted or decrypted being too large in a single cycle processing process, reduces the delay caused by data encryption or decryption, thereby being able to improve the processing speed of requests that do not need to be encrypted or decrypted, and reducing the impact on data processing processes that do not need to be encrypted or decrypted.BRIEF DESCRIPTION OF DRAWINGS In order to more clearly illustrate the technical solutions of the present disclosure, the drawings needed to be used in the description of the present disclosure will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can also be obtained by those skilled in the art without any creative labor. FIG. 1 is a step flow chart of a data processing method according to an embodiment of the present disclosure; FIG. 2 is a step flow chart of another data processing method according to an embodiment of the present disclosure; FIG. 3 is a step flow chart of still another data processing method according to an embodiment of the present disclosure. DETAILED DESCRIPTION In order to make the above-mentioned objects, features and advantages of the present disclosure more apparent and understandable, the present disclosure will be further described in detail below with reference to the drawings and specific embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without any creative labor are within the scope of protection of the present disclosure. In some storage systems, such as block storage systems, transparent encryption services can be provided for cloud storage nodes (such as cloud disks). Users can provide or use the key management services of public clouds to maintain corresponding keys in the storage systems. The data is encrypted at the bottom layer of the storage systems, but in the form of plaintext when the users write and read data. Therefore, the data needs to be stored after encryption and recovered after decryption. In actual applications, storage clients can be deployed on computing nodes, such as by installing block storage terminal software on the computing nodes to deploy the storage clients. The storage clients provide read and write functions of data to the computing nodes, and the storage clients are the interfaces of the storage systems for users. The input and output data of the storage clients are in plaintext. Specifically, the storage clients can implement the function of a forwarding module to forward the read and write requests issued by the upper virtual machines or virtualization platforms to the back-end service modules of the storage systems according to the corresponding address rules, and then implement the reading and writing of the cloud storage nodes. The computing nodes can be physical servers, and virtualization software can be allowed on the computing nodes to create virtual machines or virtualization platforms for users to use. When the upper virtual machines or virtualization platforms need to use the cloud storage nodes, the storage clients deployed in the computing nodes can be used for processing. In the storage clients, processing threads are used to cyclically issue requests to the back-end and collect requests to the upper layer. For the process of issuing requests to the back-end service modules, the following steps are included: a. obtaining a list of requests to be processed (i.e., a data write request queue for the cloud storage nodes) from the request queues of the virtual machines or virtualization platforms for each cloud disk (i.e., cloud storage node).b、 For each request in the request list, the processing flow is as follows:

[0002] 1、 Other basic processing of the request, such as unpacking, filling the header, etc. according to the requirements of the network protocol.

[0003] 2、 If the cloud disk to be written is an encrypted cloud disk (i.e. the data carried needs to be encrypted for storage), then encrypt the data part of the request to ensure that the data sent down is ciphertext. c、 Deliver the processed request to the corresponding backend service module. For the process of collecting request replies to the upper virtual machine or virtualization platform:

[0004] 1、 Check if the data message has errors (such as using crc32 algorithm for detection).

[0005] 2、 If the cloud disk from which the data is acquired is an encrypted cloud disk (that is, the reply request carries encrypted data), the data part of the request is decrypted to ensure that the data replied to the upper virtual machine or virtualization platform is in plaintext. c. The processed request is delivered to the corresponding upper virtual machine or virtualization platform. As described above, the storage client needs to perform the above three steps of a, b, and c for the message processing of each process of the request issued to the backend service module and the process of collecting the request reply to the upper virtual machine or virtualization platform, and then processes the next request in the queue. Among them, the two steps of a and c take little time (such as a few microseconds) and have little impact on the delay of other requests in the queue, while for step b, when encryption or decryption is required, the calculation time required by the encryption and decryption process is positively correlated with the data volume, and when the data volume is large, the time is large, and the impact on the delay of other messages in the queue is large. For example, assuming that a regular storage message that does not require encryption (that is, a data write request), the three steps of a, b, and c take 5 microseconds in total, and if there are 100 requests in the queue at the same time, the last request at the tail of the queue needs to wait for 500 microseconds to complete processing, that is, the delay caused by queuing the request in the queue is 500 microseconds. For an encrypted storage message, such as a 64KB message, the encryption process of step b requires 100 microseconds, and the three steps of a, b, and c require 105 microseconds in total. If there are 100 encrypted messages in the queue, the last request at the tail of the queue will be affected by a delay of 100*105 = 10,500 microseconds, which is 20 times the impact of a regular storage message that does not require encryption under the same conditions. It can be seen that if the number of requests that need to be encrypted or decrypted in the client is large, the delay of other messages in the queue will have a huge impact. Based on this, in the embodiments of the present disclosure, the requests that need to be encrypted or decrypted are first delivered to a specific queue, and in each processing cycle of the thread, the amount of encrypted or decrypted data in the queue is limited, and only the preset amount of data is encrypted or decrypted. In addition, the time is used to process other requests that do not require encryption or decryption, thereby improving the processing speed of requests that do not require encryption or decryption and reducing the impact on requests that do not require encryption or decryption.For example, assuming that 100 requests requiring encryption processing enter the queue at a time (assuming that the data amount of each request is 100 KB), if the previous improved scheme is used, the 101st request (assuming that the 101st request is a request not requiring encryption processing) can be processed only after the 100 requests are all encrypted and forwarded, and the queuing delay of the request will be 100*100 KB=10 MB, the data encryption time consumption is very large. According to the scheme of the embodiment of the present disclosure, the 100 requests requiring encryption processing are all delivered to a specific queue, the specific queue encrypts and processes a certain amount of data at a time, assuming that the value is 200 KB, after 200 KB of data is encrypted, other requests not requiring encryption processing, i.e., the 101st request, are processed, and the queuing time consumption of the 101st request is about the encryption time consumption of 200 KB of data, which is greatly optimized compared with the 10 MB encryption time consumption. The present disclosure is further described below with reference to the accompanying drawings: Referring to FIG. 1, a step flowchart of a data processing method provided by an embodiment of the present disclosure is shown, the method can be applied to a storage client, the storage client can be deployed on a computing node, for example, the storage client is a storage client of a block storage system, the storage client is deployed by installing a block storage terminal software on the computing node, the storage client provides read and write functions of data to the computing node, the storage client is an interface of a storage system to a user, and the input and output data of the storage client are all plaintexts. Specifically, the storage client can implement the function of a forwarding module, forwards a read and write request issued by an upper layer virtual machine or virtualization platform to a back-end service module of a storage system according to a corresponding address rule, and then implements reading and writing of a cloud storage node. The computing node can be a physical server, and a virtualization software can be allowed on the computing node to create a virtual machine or virtualization platform for a user to use, when the upper layer virtual machine or virtualization platform needs to use the cloud storage node, the storage client deployed in the computing node can be used for processing. Specifically, the method can include the following steps: In step 101, a data processing request queue of a cloud storage node is obtained; the data processing request queue includes a specified data processing request and a non-specified data processing request, the specified data processing request is a data processing request requiring encryption or decryption processing of carried data. In some embodiments of the present disclosure, the data processing request queue is a data write request queue of the cloud storage node, the specified data processing request is a specified data write request, and the non-specified data processing request is a non-specified data write request; the specified data write request is a data write request requiring encryption processing of carried data.In a data writing scenario, when a virtual machine or a virtualization platform at an upper level needs to write data to a cloud storage node (such as a cloud disk), a data writing request can be sent to a storage client deployed in a computing node where the virtual machine or the virtualization platform at the upper level is located, and then a data writing request queue including a plurality of data writing requests can be formed. In actual application, some cloud storage nodes provide transparent encryption services, that is, data in the cloud storage nodes is encrypted, and some data writing requests in the data writing request queue are designated data writing requests that need to encrypt the data carried. Of course, there are also some cloud storage nodes that do not provide transparent encryption services, that is, data in the cloud storage nodes is not encrypted, and some data writing requests in the data writing request queue are non-designated data writing requests that do not need to encrypt the data. In some examples, whether a data writing request is a designated data writing request can be determined by an identifier carried in the data writing request, such as an identifier of the cloud storage node, that is, whether the cloud storage node provides transparent encryption services is used to determine whether the data writing request is a designated data writing request. In some embodiments of the present disclosure, the data processing request queue is a data reply request queue fed back by the cloud storage node for a data reading request, the designated data processing request is a designated data reply request, the non-designated data processing request can be a non-designated data reply request, and the designated data reply request can be a data reply request that needs to decrypt the data carried. In a data reading scenario, a virtual machine or a virtualization platform at an upper level can send a data reading request to a cloud storage node (such as a cloud disk), the cloud storage node can feed back a data reply request to a storage client deployed in a computing node where the virtual machine or the virtualization platform at the upper level is located, and then a data reply request queue including a plurality of data reply requests can be formed. In actual application, some cloud storage nodes provide transparent encryption services, that is, data in the cloud storage nodes is encrypted, and some data reply requests in the data reply request queue carry encrypted data, that is, designated data reply requests. Of course, there are also some cloud storage nodes that do not provide transparent encryption services, that is, data in the cloud storage nodes is not encrypted, and some data reply requests in the data reply request queue carry non-encrypted data, that is, non-designated data reply requests. In some examples, whether a data reply request is a designated data reply request can be determined by an identifier carried in the data reply request, such as an identifier of the cloud storage node, that is, whether the cloud storage node provides transparent encryption services is used to determine whether the data reply request is a designated data reply request.Step 102: cyclically processing the data processing requests in the data processing request queue includes: encrypting or decrypting the data carried by the designated data processing request and responding with the encrypted or decrypted data, and responding with the data carried by the non-designated data processing request. In a data write scenario, cyclically processing the data processing requests in the data processing request queue includes: encrypting the data carried by the designated data write request and sending the encrypted data to a cloud storage node for storage, and sending the data carried by the non-designated data write request to a cloud storage node for storage. In actual applications, a processing thread can be used to cyclically process the data write requests in the data write request queue, i.e., the processing process can be divided into multiple cyclic processing stages. In some examples, a polling mode can be used to continuously execute the loop, where each loop checks all queues for requests to be processed. If there are still requests to be processed, they are processed; if there are no more requests to be processed, the loop ends. Of course, other loop execution methods can also be used, such as using an interrupt-triggered loop execution mode, whereby a thread is awakened for processing when a request is received. Alternatively, loops can be divided according to duration, such as each loop processing duration being 1 second. The process of processing data write requests can include processing designated data write requests. Since designated data write requests require writing data to a cloud storage node that uses transparent encryption services, which requires encrypted storage, and the data obtained from the upper-layer virtual machine or virtualization platform is unencrypted, the data can be encrypted first and then sent to the cloud storage node for storage. The process of processing data write requests can also include processing undesignated data write requests. Since the cloud storage node to which undesignated data write requests are written does not use transparent encryption services, which requires encrypted storage, the unencrypted data obtained from the upper-layer virtual machine or virtualization platform can be directly sent to the cloud storage node for storage without encryption. In a data reading scenario, the cyclic processing of data processing requests in the data processing request queue includes: decrypting the encrypted data carried in the designated data reply request and replying using the decrypted data, and replying using the data carried in the non-designated data reply request. In actual applications, a processing thread can be used to cyclically process the data reply requests in the data reply request queue, i.e., the processing process can be divided into multiple cyclic processing stages.In some examples, a loop can be executed in a polling mode, each loop checks whether there is a request to be processed in all queues, if there is a request to be processed, the request is processed, if there is no request to be processed, the loop ends. Of course, other ways can also be used to execute the loop, such as executing the loop in an interrupt triggered mode, that is, waking up the thread to process when there is a request, or dividing the loop according to the time length, such as the processing time length of each loop is 1 second. In the process of processing the data reply request, the processing of the specified data reply request can be included, since the specified data reply request carries encrypted data, and the upper virtual machine or virtualization platform needs to be replied to the non-encrypted data, the data can be decrypted first, and then the decrypted data is replied to the upper virtual machine or virtualization platform. In the process of processing the data reply request, the processing of the non-specified data reply request can also be included, since the non-specified data reply request carries non-encrypted data, the non-encrypted data can be directly replied to the upper virtual machine or virtualization platform, and decryption processing is not required. In some embodiments of the present disclosure, the data carried by the non-specified data processing request is used for response, including: moving the non-specified data processing request into the first queue, and when the first queue is processed, the data carried by the non-specified data processing request is used for response. In the data writing scenario, the first queue can be established, the first queue can be a regular queue, that is, a queue that does not need to be encrypted, the non-specified data writing request can be moved into the first queue, and then when the data writing request in the first queue is processed, the data carried by the non-specified data writing request is directly sent to the cloud storage node for storage. In some examples, the first queue can also reuse the data writing request queue, that is, the first queue and the data writing request queue are the same queue, of course, they can also be different queues. In the data reading scenario, the first queue can be established, the first queue can be a regular queue, that is, a queue that does not need to be decrypted, the non-specified data reply request can be moved into the first queue, and then when the data reply request in the first queue is processed, the data carried by the non-specified data reply request is directly replied to the upper virtual machine or virtualization platform. In some examples, the first queue can also reuse the data reply request queue, that is, the first queue and the data reply request queue are the same queue, of course, they can also be different queues.In some embodiments of the present disclosure, the data carried by the specified data processing request is encrypted or decrypted, and the data after the encryption or decryption is used for response, including: moving the specified data processing request to a second queue; encrypting or decrypting the data carried by the specified data processing request in the second queue; moving the specified data processing request carrying the data after the encryption or decryption to the first queue, and using the data after the encryption or decryption for response when processing the first queue. In the data writing scenario, for a specified data writing request, a second queue, i.e., an encryption queue, i.e., a queue that needs to be encrypted, can be established, the specified data writing request can be moved to the second queue, and then when the data writing request in the second queue is processed, the data carried by the specified data writing request is encrypted. After the encryption, the specified data writing request carrying the data after the encryption can be moved to the first queue, and when the data writing request in the first queue is processed, the data after the encryption is sent to the cloud storage node for storage, i.e., the second queue is only used for encrypting data, and the first queue is used for sending data to the cloud storage node. In the data reading scenario, for a specified data reply request, a second queue, i.e., a decryption queue, i.e., a queue that needs to be decrypted, can be established, the specified data reply request can be moved to the second queue, and then when the data reply request in the second queue is processed, the data carried by the specified data reply request is decrypted. After the decryption, the specified data reply request carrying the data after the decryption can be moved to the first queue, and when the data reply request in the first queue is processed, the data after the decryption is sent to the upper virtual machine or virtualization platform, i.e., the second queue is only used for decrypting data, and the first queue is used for replying data to the upper virtual machine or virtualization platform. In some embodiments of the present disclosure, the processing of the first queue includes: during the processing of the first queue, the non-specified data processing request and the specified data processing request in the first queue are processed in the order of the request time of the non-specified data processing request and the specified data processing request. When the data processing request in the first queue is processed, the non-specified data processing request and the specified data processing request in the first queue can be sorted in the order of the request time of the non-specified data processing request and the specified data processing request, and then the data processing request is processed in the order of the request time. In step 103, when it is detected that the amount of data after the encryption or decryption accumulated in the current loop processing process is greater than a preset amount of data, the processing of the specified data processing request in the current loop processing process is stopped.In the data writing scenario, in the current cycle processing process, the cumulative encryption processing data amount can be calculated, and it can be judged that the encryption processing data amount is greater than a first preset data amount, such as 16KB, 32KB, 200KB. When the cumulative encryption processing data amount is less than or equal to the first preset data amount, it is allowed to continue to process the specified data write request in the current cycle processing process, that is, to perform encryption processing, and when the cumulative encryption processing data amount is greater than the first preset data amount, the processing of the specified data write request is stopped in the current cycle processing process, that is, no encryption processing is performed, and only the processing of the non-specified data write request is executed, until the next cycle processing process, the processing of the specified data write request is restarted. In the data reading scenario, in the current cycle processing process, the cumulative decryption processing data amount can be calculated, and it can be judged that the decryption processing data amount is greater than a second preset data amount, such as 16KB, 32KB, 200KB. When the cumulative decryption processing data amount is less than or equal to the second preset data amount, it is allowed to continue to process the specified data reply request in the current cycle processing process, that is, to perform decryption processing, and when the cumulative decryption processing data amount is greater than the second preset data amount, the processing of the specified data reply request is stopped in the current cycle processing process, that is, no decryption processing is performed, and only the processing of the non-specified data reply request is executed, until the next cycle processing process, the processing of the specified data reply request is restarted. In some embodiments of the present disclosure, the preset data amount is obtained through an external interface. In actual application, the preset data amount can be pre-set or set by the user through the external interface. In some embodiments of the present disclosure, the encryption or decryption processing of the data carried by the specified data processing request and the response using the encrypted or decrypted data further include: in the current cycle processing process, determining the cumulative encryption or decryption processing data amount, and determining the remaining data amount according to the cumulative encryption or decryption processing data amount and the preset data amount; in the case that the data amount of the data carried by the specified data processing request is greater than the remaining data amount, performing encryption or decryption processing on part of the data of the data carried by the specified data processing request according to the remaining data amount, and responding using the encrypted or decrypted data. In the data writing scenario, in the current cycle processing process, the current cumulative encryption processing data amount can be determined, and then the preset data amount as the data amount limit value is subtracted by the current cumulative encryption processing data amount to obtain the remaining data amount.In the data reading scenario, in the current cycle processing process, the data quantity that has been accumulated and decrypted can be determined, and then the preset data quantity as the data quantity limit is subtracted from the data quantity that has been accumulated and decrypted to obtain the residual data quantity. After determining the residual data quantity, it can be judged whether the data quantity of the data carried by the next specified data reading request to be processed is greater than the residual data quantity. In the case where the data quantity of the data carried by the next specified data reading request to be processed is less than or equal to the residual data quantity, the processing can be directly performed. In the case where the data quantity of the data carried by the next specified data reading request to be processed is greater than the residual data quantity, only the partial data of the residual data quantity size can be decrypted, and the partial data that has not been decrypted is left for processing in the next cycle. In some embodiments of the present disclosure, after the processing of the specified data processing request is stopped in the current cycle processing process, if there is part of the data carried by the specified data processing request that has not been encrypted or decrypted, the part of the data that has been encrypted or decrypted and the part of the data that has not been encrypted or decrypted in the specified data processing request are recorded. In the next cycle processing process, the part of the data that has not been encrypted or decrypted is encrypted or decrypted, and all the encrypted or decrypted data is used for response. In the data writing scenario, in the current cycle processing process, when the accumulated encrypted data quantity is greater than the first preset data quantity, the processing of the specified data writing request needs to be stopped, that is, the encryption processing is stopped. If there is part of the data carried by the specified data writing request that has not been encrypted, that is, part of the data in a request has been encrypted, and part of the data has not been encrypted, the part of the data that has been encrypted and the part of the data that has not been encrypted in the specified data writing request can be recorded. In the next cycle processing process, the part of the data that has not been encrypted is encrypted, and then all the encrypted data in the request is sent to the cloud storage node for storage.In the data reading scenario, when the amount of data accumulated in the current cycle of decryption processing is greater than the second preset data amount, the processing of the specified data reply request needs to be stopped, that is, the decryption processing is stopped, and there may be a case that the data carried in the specified data reply request is not decrypted, that is, part of the data in a request is decrypted, and part of the data is not decrypted. In this case, the part of the data that is decrypted and the part of the data that is not decrypted in the specified data reply request can be recorded, and in the next cycle of processing, the part of the data that is not decrypted is decrypted, and then all the data decrypted in the request is replied to the upper virtual machine or virtualization platform. In the embodiment of the present disclosure, by obtaining the data processing request queue of the cloud storage node, the data processing request queue includes a specified data processing request and a non-specified data processing request, the specified data processing request is a data processing request that needs to be encrypted or decrypted, the data processing request in the data processing request queue is processed in a cycle, including: encrypting or decrypting the data carried in the specified data processing request and responding with the encrypted or decrypted data, and responding with the data carried in the non-specified data processing request. When it is detected that the amount of data accumulated in the current cycle of encryption or decryption processing is greater than the preset data amount, the processing of the specified data processing request is stopped in the current cycle of processing, which limits the amount of data that needs to be encrypted or decrypted in a single cycle of processing, avoids that the amount of encrypted or decrypted data in a single cycle of processing is too large, reduces the delay caused by data encryption or decryption, and thus the processing speed of the request that does not need to be encrypted or decrypted is improved, and the influence on the data processing process that does not need to be encrypted or decrypted is reduced. Referring to FIG. 2, a step flowchart of another data processing method provided by an embodiment of the present disclosure is shown, which can specifically include the following steps: step 201, obtaining a data write request queue for a cloud storage node, the data write request queue includes a specified data write request, and the specified data write request is a data write request that needs to be encrypted and stored. In the data writing scenario, when the upper virtual machine or virtualization platform needs to write data to the cloud storage node (such as a cloud disk), a data write request can be sent to the storage client deployed in the computing node where the upper virtual machine or virtualization platform is located, and then a data write request queue containing multiple data write requests can be formed. In practical applications, some cloud storage nodes provide transparent encryption services, that is, the data in the cloud storage node is encrypted, and part of the data write request in the data write request queue needs to be encrypted and stored, that is, the specified data write request.Of course, there are also some cloud storage nodes that do not provide transparent encryption services, that is, the data in the cloud storage node is not encrypted, and some data write requests in the data write request queue do not need to be encrypted, that is, non-designated data write requests. In some examples, whether a data write request is a designated data write request can be determined by an identifier carried in the data write request, such as an identifier of the cloud storage node, that is, whether the cloud storage node provides transparent encryption services to determine whether it is a designated data write request. Step 202, the data write request in the data write request queue is processed in a loop, including: encrypting the data carried by the designated data write request and sending the encrypted data to the cloud storage node for storage, and sending the data carried by the non-designated data write request to the cloud storage node for storage. In practical applications, a processing thread can be used to process the data write request in the data write request queue in a loop, that is, the processing process can be divided into multiple loop processing stages. In some examples, a polling mode can be used to continuously execute a loop, and each loop checks whether there are requests to be processed in all queues. If there are still requests to be processed, they are processed, and if there are no requests to be processed, the loop ends. Of course, other ways of executing a loop can also be used, such as using an interrupt trigger mode to execute a loop, that is, when there is a request, the thread is awakened to process it. The loop can also be divided according to the time, such as 1 second for each loop. During the processing of the data write request, the processing of the designated data write request can be included. Since the designated data write request is to write data to a cloud storage node that uses transparent encryption services, that is, the data needs to be encrypted and stored, and the data obtained from the upper virtual machine or virtualization platform is not encrypted, the data can be encrypted first, and then the encrypted data is sent to the cloud storage node for storage. During the processing of the data write request, the processing of the non-designated data write request can also be included. Since the cloud storage node to which the non-designated data write request is written does not use transparent encryption services, that is, the data does not need to be encrypted and stored, the non-encrypted data obtained from the upper virtual machine or virtualization platform can be directly sent to the cloud storage node for storage, without the need for encryption processing. Step 203, when it is detected that the amount of data encrypted and processed in the current loop processing process is greater than a preset data amount, stop processing the designated data write request in the current loop processing process. In the current loop processing process, the amount of data encrypted and processed can be calculated, and it can be determined whether the amount of data encrypted and processed is greater than a first preset data amount, such as 16KB, 32KB, or 200KB.When the cumulative encrypted data volume is less than or equal to a first preset data volume, processing of designated data write requests in the current processing cycle is allowed to continue, i.e., encryption processing is performed. When the cumulative encrypted data volume exceeds the first preset data volume, processing of designated data write requests in the current processing cycle is stopped, i.e., encryption processing is not performed, and only non-designated data write requests are processed. Processing of designated data write requests is not resumed until the next processing cycle. The following example illustrates the data writing process in the present disclosure.

[0006] 1. The data write request queue receives a list of pending requests (i.e., the data write request queue) from the upper-layer virtual machine or virtualization platform's request queues for each cloud disk. It then performs other basic processing on the requests, such as unpacking and header filling according to network protocol requirements. If the request requires encryption (i.e., a specific data write request), it is placed in the encryption queue (i.e., the second queue). If the request does not require encryption, it is placed in the regular queue (i.e., the first queue).

[0007] 2. Process the encryption queue to obtain a first preset data size. Assume that the first preset data size limited to processing during a processing loop is totalSize, and the cumulative encrypted data processed during the current processing loop is snowSize (initial value 0). Determine whether snowSize is less than totalSize. If snowSize is greater than totalSize, no further processing is performed on the encryption queue. If snowSize is less than totalSize, the request is removed from the encryption queue and the message is encrypted. During encryption, if snowSize + message size to be processed is less than totalSize, the entire message is encrypted. If snowSize + message size to be processed is greater than totalSize, only data equal to totalSize minus nowSize is encrypted, and the remaining data is reserved for processing in the next processing loop.

[0008] 3. Processing the Regular Queue: During the current cyclic processing, each request in the regular queue is directly delivered to the corresponding backend module and then sent to the cloud storage node for storage. In the disclosed embodiment, a data write request queue for the cloud storage node is obtained. The data write request queue includes specified data write requests, which are data write requests that require encrypted storage of the data they carry. The data write requests in the data write request queue are cyclically processed, including: encrypting the data carried by the specified data write request and sending the encrypted data to the cloud storage node for storage. If it is detected that the cumulative encrypted data volume during the current cyclic processing exceeds a first preset data volume, processing of the specified data write request in the current cyclic processing is stopped. This limits the amount of data that requires encryption during a single cyclic processing cycle, avoids excessively large amounts of encrypted data during a single cyclic processing cycle, reduces latency caused by data encryption, and improves the processing speed of requests that do not require encryption, thereby reducing the impact on the data write process that does not require encryption. Referring to FIG3 , a flowchart of another data processing method provided by an embodiment of the present disclosure is shown. Specifically, the method may include the following steps: Step 301: Obtain a data reply request queue for data read requests from a cloud storage node. The data reply request queue includes designated data reply requests, which are data reply requests requiring decryption of the data carried. In a data read scenario, an upper-layer virtual machine or virtualization platform may send a data read request to a cloud storage node (e.g., a cloud disk). The cloud storage node may respond to the data read request with a data reply request to a storage client deployed in the compute node where the upper-layer virtual machine or virtualization platform resides, thereby forming a data reply request queue containing multiple data reply requests. In actual applications, some cloud storage nodes provide transparent encryption services, meaning that data in the cloud storage nodes is encrypted. Some data reply requests in the data reply request queue carry encrypted data, i.e., designated data reply requests. Of course, some cloud storage nodes do not provide transparent encryption services. That is, the data in the cloud storage nodes is not encrypted, and some data reply requests in the data reply request queue carry unencrypted data, that is, non-designated data reply requests. In some examples, whether a data reply request is a designated data reply request can be determined based on an identifier carried in the data reply request. For example, if the identifier is a cloud storage node, then whether the cloud storage node provides transparent encryption services can be used to determine whether the request is a designated data reply request.Step 302, loop processing the data reply request in the data reply request queue, including: decrypting the encrypted data carried by the specified data reply request and replying with the decrypted data, and replying with the data carried by the non-specified data reply request. In actual application, the data reply request in the data reply request queue can be loop processed by a processing thread, that is, the processing process can be divided into multiple loop processing stages. In some examples, a loop can be constantly executed in a polling mode, each loop checks whether there is a request to be processed in all queues, and if there is a request to be processed, the request is processed, and if there is no request to be processed, the loop is ended. Of course, other ways can also be used to execute the loop, such as interrupt triggering mode, that is, the thread is awakened to process when there is a request, or the loop can be divided according to the time length, such as 1 second for each loop. In the process of processing the data reply request, the processing of the specified data reply request can be included, since the specified data reply request carries encrypted data, and the upper virtual machine or virtualization platform needs to be replied with non-encrypted data, the data can be decrypted first, and then the decrypted data is replied to the upper virtual machine or virtualization platform. In the process of processing the data reply request, the processing of the non-specified data reply request can also be included, since the non-specified data reply request carries non-encrypted data, the non-encrypted data can be directly replied to the upper virtual machine or virtualization platform, and no decryption processing is needed. Step 303, when it is detected that the amount of data decrypted and processed in the current loop processing process is greater than a second preset data amount, stopping processing the specified data reply request in the current loop processing process. In the current loop processing process, the amount of data decrypted and processed can be calculated, and it can be judged whether the amount of data decrypted and processed is greater than the second preset data amount, such as 16KB, 32KB, 200KB. When the amount of data decrypted and processed is less than or equal to the second preset data amount, the processing of the specified data reply request in the current loop processing process is allowed to continue, that is, decryption processing is performed, and when the amount of data decrypted and processed is greater than the second preset data amount, the processing of the specified data reply request in the current loop processing process is stopped, that is, no decryption processing is performed, and only the processing of the non-specified data reply request is performed, until the next loop processing process, the processing of the specified data reply request is restarted. The data reading process in the present disclosure is exemplarily illustrated by an example as follows.

[0009] 1、 Collect data reply request queue From the reply request queue of each cloud disk for data acquisition request, obtain the list of reply requests to be processed (i.e. data reply request queue), perform other basic processing on the request, such as unpacking, filling packet header, etc. according to the requirements of the network protocol. If the request is a message that needs to be decrypted (i.e. specified data reply request), it is placed in the decryption queue (i.e. the fourth queue). If the request is a message that does not need to be decrypted, it is placed in the regular queue (i.e. the third queue).

[0010] 2、 Process decryption queue Obtain a second preset data size, assuming that the second preset data size limited for processing in a loop processing process is total Size, and the cumulative decrypted data size in the current loop processing process is nowSize (the initial value is 0). Determine whether nowSize is less than total Size. In the case of nowSize greater than total Size, the decryption queue is not processed. In the case of nowSize < total Size, the request is taken out from the decryption queue, and the message is decrypted. In the decryption process, if nowSize + message to be processed size < totalSize, the data of the entire message is decrypted. If nowSize + message to be processed size > totalSize, only the data of total Size - nowSize is decrypted, and the remaining data is left for processing in the next loop processing process.

[0011] 3、 Processing a regular queue In the current cycle processing process, each request in the regular queue is directly delivered to the corresponding backend module, and then replied to the upper virtual machine or virtualization platform. In the embodiment of the present disclosure, a data reply request queue is obtained, which is fed back by a cloud storage node in response to a data read request, and the data reply request queue includes a specified data reply request, the specified data reply request carries encrypted data, and the data reply request in the data reply request queue is processed in a cycle, including: decrypting the encrypted data carried by the specified data reply request and replying with the decrypted data, when it is detected that the amount of data decrypted in the current cycle processing process is greater than a second preset data amount, stopping processing the specified data reply request in the current cycle processing process, thereby limiting the amount of data that needs to be decrypted in a single cycle processing process, avoiding too large amount of decrypted data in a single cycle processing process, reducing the delay caused by data decryption, and thus improving the processing speed of requests that do not need to be decrypted, and reducing the impact on the reply process of data read requests that do not need to be decrypted. It should be noted that for the method embodiment, in order to simply describe, it is expressed as a combination of a series of actions, but those skilled in the art should know that the embodiment of the present disclosure is not limited by the order of the described actions, because according to the embodiment of the present disclosure, certain steps can be performed in other order or at the same time. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily the ones that must be used in the embodiment of the present disclosure. An embodiment of the present disclosure also provides a system for data processing, which is configured to implement the method as described above. An embodiment of the present disclosure also provides a device for data processing, which is configured to implement the method as described above. An embodiment of the present disclosure also provides an electronic device, which can include a processor, a memory, and a computer program stored on the memory and capable of running on the processor, and the computer program is executed by the processor to implement the method as described above. An embodiment of the present disclosure also provides a computer readable storage medium, a computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the method as described above. An embodiment of the present disclosure also provides a computer program product, which includes a computer program, and the computer program is executed by the processor to implement the method as described above. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts are referred to the part of the method embodiment.It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of countries and regions, and provide corresponding operation portal for user to select authorization or refusal. Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same parts of each embodiment can be referred to each other. Those skilled in the art should understand that the embodiments of the disclosure can be provided as a method, device or computer program product. Therefore, the embodiments of the disclosure can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the disclosure can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk memory, compact disc read-only memory, optical memory, etc.) containing computer usable program code. The embodiments of the disclosure are described with reference to the flowcharts and / or block diagrams of the method, terminal device (system) and computer program product according to the embodiments of the disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be realized by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing terminal device to produce a machine, so that the instructions executed by the computer or other programmable data processing terminal device produce a device for realizing the functions specified in one or more flows of the flowcharts and / or one or more blocks of the block diagrams. These computer program instructions can also be stored in a computer readable memory that can guide the computer or other programmable data processing terminal device to work in a specific way, so that the instructions stored in the computer readable memory produce a product including instruction devices, which realize the functions specified in one or more flows of the flowcharts and / or one or more blocks of the block diagrams. These computer program instructions can also be loaded into a computer or other programmable data processing terminal device, so that a series of operation steps are performed on the computer or other programmable terminal device to produce a computer implemented process, so that the instructions executed on the computer or other programmable terminal device provide steps for realizing the functions specified in one or more flows of the flowcharts and / or one or more blocks of the block diagrams.Although preferred embodiments of the present disclosure have been described, those skilled in the art will appreciate that other alterations and modifications are possible. Accordingly, the appended claims are intended to embrace all alterations and modifications of the preferred embodiments within the scope of the present disclosure. Finally, it should be noted that the terms "first", "second", and the like herein do not denote any order, quantity, or importance, but rather are used to distinguish one element from another. Also, the terms "comprises", "comprising", or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element. The above detailed description of the provided method and apparatus for data processing has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the present disclosure to the precise form disclosed. Many modifications and variations are possible in light of the above teachings. It is intended that the specification be illustrative, but not limiting, of the disclosure. Industrial Applicability In the present disclosure, by obtaining a data processing request queue of a cloud storage node, the data processing request queue includes a specified data processing request and a non-specified data processing request, the specified data processing request is a data processing request that needs to perform encryption or decryption processing on the carried data, performing cyclic processing on the data processing requests in the data processing request queue, including: performing encryption or decryption processing on the data carried by the specified data processing request and responding with the encrypted or decrypted data, and responding with the data carried by the non-specified data processing request, when it is detected that the amount of data accumulated in the current cyclic processing process that needs to be encrypted or decrypted is greater than a preset amount, stopping processing the specified data processing request in the current cyclic processing process, limiting the amount of data that needs to be encrypted or decrypted in a single cyclic processing process is achieved, avoiding the amount of data encrypted or decrypted in a single cyclic processing process being too large, reducing the delay caused by data encryption or decryption, thereby being able to improve the processing speed of requests that do not need to be encrypted or decrypted, and reducing the impact on data processing processes that do not need to be encrypted or decrypted.

Claims

Claims 1. A data processing method, comprising: Obtain a data processing request queue of a cloud storage node; wherein the data processing request queue includes designated data processing requests and non-designated data processing requests, and the designated data processing request is a data processing request that requires encryption or decryption of the carried data; perform cyclic processing on the data processing requests in the data processing request queue, including: encrypting or decrypting the data carried by the designated data processing request and responding with the encrypted or decrypted data, and responding with the data carried by the non-designated data processing request; when it is detected that the cumulative amount of data encrypted or decrypted during the current cyclic processing process is greater than a preset data amount, stop processing the designated data processing request during the current cyclic processing process.

2. The method according to claim 1, wherein: The data processing request queue is a data write request queue for the cloud storage node, the designated data processing request is a designated data write request, the non-designated data processing request is a non-designated data write request, and the designated data write request is a data write request requiring encryption of the carried data; The cyclic processing of the data processing requests in the data processing request queue includes: encrypting the data carried by the designated data write request and sending the encrypted data to the cloud storage node for storage, and sending the data carried by the non-designated data write request to the cloud storage node for storage.

3. The method according to claim 1, wherein: The data processing request queue is a data reply request queue for data read request feedback from the cloud storage node, the designated data processing request is a designated data reply request, the non-designated data processing request is a non-designated data reply request, and the designated data reply request is a data reply request that requires decryption of the carried data; the data processing requests in the data processing request queue are cyclically processed, including: decrypting the encrypted data carried by the designated data reply request and replying with the decrypted data, and replying with the data carried by the non-designated data reply request.

4. The method according to any one of claims 1 to 3, wherein: The responding using the data carried by the non-designated data processing request includes: moving the non-designated data processing request into a first queue, and responding using the data carried by the non-designated data processing request when processing the first queue.

5. The method according to claim 4, wherein: The encrypting or decrypting the data carried by the designated data processing request and responding with the encrypted or decrypted data includes: moving the designated data processing request into a second queue; encrypting or decrypting the data carried by the designated data processing request in the second queue; moving the designated data processing request carrying the encrypted or decrypted data into the first queue, and responding with the encrypted or decrypted data when processing the first queue.

6. The method according to claim 5, wherein: The processing of the first queue includes: in the process of processing the first queue, processing the non-designated data processing requests and the designated data processing requests in the first queue according to the request time sequence of the non-designated data processing requests and the designated data processing requests in the first queue.

7. The method according to claim 1, wherein: The encrypting or decrypting the data carried in the designated data processing request and responding with the encrypted or decrypted data further includes: determining a cumulative amount of encrypted or decrypted data during a current cyclic processing process, and determining a remaining data amount based on the cumulative amount of encrypted or decrypted data and a preset data amount; and, if the amount of data carried in the designated data processing request is greater than the remaining data amount, encrypting or decrypting a portion of the data carried in the designated data processing request according to the remaining data amount, and responding with the encrypted or decrypted data.

8. The method according to claim 1, wherein: After stopping processing the designated data processing request in the current cyclic processing process, the method further includes: if part of the data carried in the designated data processing request is not encrypted or decrypted, recording the encrypted or decrypted part of the data and the unencrypted or undecrypted part of the data in the designated data processing request; and, in the next cyclic processing process, encrypting or decrypting the unencrypted or undecrypted part of the data and responding using all the encrypted or decrypted data.

9. The method according to claim 1, wherein: Also includes: Obtain the preset data volume through the external interface.

10. A data processing system, wherein the system is configured to implement the method according to any one of claims 1 to 9.

11. A data processing device, wherein the device is configured to implement the method according to any one of claims 1 to 9.

12. An electronic device comprising a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the method according to any one of claims 1 to 9 when executed by the processor.

13. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 9.

14. A computer program product, comprising a computer program, wherein when executed by a processor, the computer program implements the method according to any one of claims 1 to 9.

Images