Data processing method and cluster, computing device, computer readable storage medium, and computer program product

Abstract

Embodiments of the present disclosure provide a data processing method and cluster, a computing device, a computer readable storage medium, and a computer program product. The data processing method is applied to an application program interface service unit of the data processing cluster. The method comprises: receiving a data processing request sent by a client for a target storage unit, wherein the data processing request carries data to be processed and a unit path of the target storage unit; analyzing the data to be processed, and when it is determined on the basis of an analysis result that the data attribute of the data to be processed is a target data attribute, encrypting the data to be processed to obtain ciphertext data and an encryption key; and sending the ciphertext data and the encryption key to the target storage unit on the basis of the unit path, thereby minimizing an attack surface of a malicious user to a node level, and reducing the risk of sensitive data leakage.

Description

[0001] The present disclosure claims priority to Chinese Patent Application No. 202410684724.6, filed on May 29, 2024, with the Chinese Patent Office, entitled “Data Processing Method and Cluster, Computing Device, Computer-Readable Storage Medium, Computer Program Product,” the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] Kubernetes is an open source container cluster management platform, which provides a Secret resource (a security mechanism for storing and managing sensitive information) for application developers to save sensitive data required by application Pods at runtime, such as database passwords, application certificates, authentication tokens, and the like. Once the sensitive data is leaked, it will cause extremely adverse consequences. The sensitive data stored by the user through the Secret resource will be synchronized to a multi-tenant shared resource cluster, and any user (for example, an operator of the resource cluster or a malicious user who has stolen the certificate) who has the Secret reading permission can read the sensitive data by accessing the API Server (application program interface server) in the cluster, which brings great risk to data security. Therefore, embodiments of the present disclosure provide a data processing method. One or more embodiments of the present disclosure also relate to another data processing method, two data processing clusters, a computing device, a computer readable storage medium, and a computer program product, to solve the technical defects of the prior art that sensitive data is at risk of being leaked. According to a first aspect of an embodiment of the present disclosure, a data processing method is provided, which is applied to an application program interface service unit of a data processing cluster, and the method comprises: receiving a data processing request sent by a client and directed to a target storage unit, wherein the data processing request carries to-be-processed data and a unit path of the target storage unit; parsing the to-be-processed data, and in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute, encrypting the to-be-processed data to obtain ciphertext data and an encryption key; and sending the ciphertext data and the encryption key to the target storage unit according to the unit path. According to a second aspect of an embodiment of the present disclosure, a data processing method is provided, which is applied to an application program interface service unit of a data processing cluster, and the method comprises: receiving a data processing request sent by a target work node and directed to a target storage unit, wherein the data processing request carries a data identifier of to-be-acquired data and a unit path of the target storage unit; acquiring ciphertext data corresponding to the to-be-acquired data and an encryption key from the target storage unit according to the data identifier and the unit path, and returning the ciphertext data and the encryption key to the target work node; receiving a decryption request sent by the target work node, wherein the decryption request carries the ciphertext data, the encryption key, and node information; and obtaining the to-be-acquired data according to the ciphertext data, the encryption key, and the node information.According to a third aspect of the embodiments of the present disclosure, a data processing cluster is provided, comprising an application program interface service unit, a data encryption service, and a key management service, wherein the application program interface service unit receives a data processing request sent by a client and directed to a target storage unit, wherein the data processing request carries to-be-processed data and a unit path of the target storage unit, parses the to-be-processed data, in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute, triggers the data encryption service to generate a data key, the data encryption service encrypts the to-be-processed data by using the data key, obtains ciphertext data, and sends a key encryption request to the key management service, wherein the key encryption request carries the data key, the key management service encrypts the data key in response to the key encryption request, obtains an encrypted key, and returns the encrypted key to the data encryption service, the data encryption service sends the ciphertext data and the encrypted key to the application program interface service unit, the application program interface service unit sends the ciphertext data and the encrypted key to the target storage unit according to the unit path, and sends a request success response to the client.According to a fourth aspect of the embodiments of the present disclosure, a data processing cluster is provided, comprising a target worker node, an application program interface service unit, a data decryption service, and a key management service. The target worker node sends a data processing request for a target storage unit to the application program interface service unit, wherein the data processing request carries a data identifier of to-be-acquired data and a unit path of the target storage unit. The application program interface service unit receives the data processing request, acquires, according to the data identifier and the unit path, ciphertext data corresponding to the to-be-acquired data and an encryption key from the target storage unit, and returns the ciphertext data and the encryption key to the target worker node. The target worker node sends a decryption request to the data decryption service through the application program interface service unit, wherein the decryption request carries the ciphertext data, the encryption key, and node information. The data decryption service receives the decryption request, verifies the node information, obtains a verification result of the target worker node, and sends a key decryption request to the key management service in a case where the verification result is a target verification result, wherein the key decryption request carries the encryption key. The key management service decrypts the encryption key to obtain a data key in response to the key decryption request, and sends the data key to the data decryption service. The data decryption service decrypts the ciphertext data according to the data key to obtain the to-be-acquired data, and sends the to-be-acquired data to the target worker node through the application program interface service unit. According to a fifth aspect of the embodiments of the present disclosure, a data processing apparatus is provided, which is applied to an application program interface service unit of a data processing cluster. The apparatus comprises a receiving module configured to receive a data processing request for a target storage unit sent by a client, wherein the data processing request carries to-be-processed data and a unit path of the target storage unit; a parsing module configured to parse the to-be-processed data, and encrypt the to-be-processed data to obtain ciphertext data and an encryption key in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute; and a sending module configured to send the ciphertext data and the encryption key to the target storage unit according to the unit path.According to a sixth aspect of an embodiment of the present disclosure, another data processing apparatus is provided, which is applied to an application program interface service unit of a data processing cluster, and the apparatus comprises: a first receiving module configured to receive a data processing request sent by a target work node and directed to a target storage unit, wherein the data processing request carries a data identifier of to-be-acquired data and a unit path of the target storage unit; an obtaining module configured to obtain, according to the data identifier and the unit path, ciphertext data corresponding to the to-be-acquired data and an encryption key from the target storage unit, and return the ciphertext data and the encryption key to the target work node; a second receiving module configured to receive a decryption request sent by the target work node, wherein the decryption request carries the ciphertext data, the encryption key and node information; and an obtaining module configured to obtain the to-be-acquired data according to the ciphertext data, the encryption key and the node information. According to a seventh aspect of an embodiment of the present disclosure, a computing device is provided, which comprises a memory and a processor, wherein the memory is configured to store computer programs / instructions, and the processor is configured to execute the computer programs / instructions, and the computer programs / instructions, when executed by the processor, implement the steps of the above data processing method. According to an eighth aspect of an embodiment of the present disclosure, a computer readable storage medium is provided, which stores computer programs / instructions, and the computer programs / instructions, when executed by the processor, implement the steps of the above data processing method. According to a ninth aspect of an embodiment of the present disclosure, a computer program product is provided, which comprises computer programs / instructions, and the computer programs / instructions, when executed by the processor, implement the steps of the above data processing method. The data processing method provided by an embodiment of the present disclosure comprises the following steps: an application program interface service unit of a data processing cluster analyzes to-be-processed data in a received data processing request, and in a case where a data attribute of the to-be-processed data is a target data attribute (at this time, the to-be-processed data is sensitive data), the to-be-processed data is encrypted to obtain ciphertext data and an encryption key, the encryption of the to-be-processed data is implemented at the application program interface service unit, and the ciphertext data and the encryption key are stored in a target storage unit of a data unit path, the encryption of sensitive data at the application program interface service unit is implemented, malicious users cannot read plaintext sensitive data from the application program interface service unit, the attack surface of the malicious users is minimized to the node dimension, and the risk of sensitive data leakage is reduced.BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a scenario diagram of a data processing method according to an embodiment of the present disclosure; FIG. 2 is a flowchart of a data processing method according to an embodiment of the present disclosure; FIG. 3 is a flowchart of a processing procedure of a data processing method according to an embodiment of the present disclosure; FIG. 4 is a flowchart of another data processing method according to an embodiment of the present disclosure; FIG. 5 is a flowchart of a processing procedure of another data processing method according to an embodiment of the present disclosure; FIG. 6 is a whole framework diagram of a data processing method according to an embodiment of the present disclosure; FIG. 7 is a structural diagram of a data processing cluster according to an embodiment of the present disclosure; FIG. 8 is a structural diagram of another data processing cluster according to an embodiment of the present disclosure; FIG. 9 is a structural diagram of a data processing apparatus according to an embodiment of the present disclosure; FIG. 10 is a structural diagram of another data processing apparatus according to an embodiment of the present disclosure; FIG. 11 is a structural block diagram of a computing device according to an embodiment of the present disclosure. DETAILED DESCRIPTION In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, the present disclosure can be practiced without the specific details. In other instances, well-known methods, procedures, components, and circuits have not been described in detail so as not to obscure the present disclosure. The following description is not intended to limit the present disclosure, but to provide an appreciation of possible embodiments of the present disclosure. The scope of the present disclosure is described by the appended claims. In one or more embodiments of the present disclosure, the terms used are for the purpose of describing particular embodiments only and are not intended to limit one or more embodiments of the present disclosure. As used in one or more embodiments of the present disclosure and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in one or more embodiments of the present disclosure, specify the presence of stated features, integers, steps, operations,In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in one or more embodiments of the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal. First, the terms involved in one or more embodiments of the present disclosure are explained.

[0003] Kubernetes cluster: Kubernetes is an open source container cluster management platform that can realize automatic deployment, automatic scaling, automatic operation and maintenance of container applications, and the cluster managed by Kubernetes is collectively referred to as Kubernetes cluster.

[0004] Kubernetes multi-tenant cluster: a Kubernetes cluster serving multiple external tenants at the same time, ensuring isolation between tenants through namespace isolation, secure containers and other technical means.

[0005] Secret resource: a Kubernetes resource used to store sensitive data such as passwords, tokens, and keys. Although such data can also be stored in pods or images, it is placed in Secret to make it easier to control how the data is used and reduce the risk of exposure. Sensitive data: non-public data that may cause serious harm to individuals or enterprises if leaked. For example, database passwords, application certificates, authentication tokens, etc. In a Kubernetes cluster, sensitive data is usually stored in a Secret resource.

[0006] DEK: Data Encryption Key, a key used to encrypt data.

[0007] KMS: Key Management Service, a secure and trusted key management and data encryption service.

[0008] Kubelet: an essential component of the Kubernetes cluster, which implements fine-grained control and management of containers by Kubernetes on each node, ensuring efficient and stable operation of the entire cluster.

[0009] Pod: A pod is the smallest schedulable unit in Kubernetes, and usually represents one instance of a user's application.

[0010] Mutating webhook mechanism: a mechanism in Kubernetes that allows modification of resource objects before the API server actually creates or updates them. In this disclosure, two data processing methods are provided, and the disclosure also relates to two data processing systems, a computing device, a computer-readable storage medium, and a computer program product, which are described in detail in the following embodiments. Referring to FIG. 1, FIG. 1 shows a scene schematic diagram of a data processing method according to an embodiment of the disclosure. Specifically, the data processing method is implemented by an end-side device 102 and a server 104. The end-side device 102 is configured to send a data processing request to the server 104. For example, the data processing request can be triggered by a user modifying the database password in the secret resource. The server 104 includes a data processing cluster. An application programming interface service unit of the data processing cluster receives a data processing request sent by the end-side device 102 for a target storage unit. The data processing request carries to-be-processed data and a unit path of the target storage unit. The to-be-processed data is parsed. If it is determined according to the parsing result that the data attribute of the to-be-processed data is a target data attribute, the to-be-processed data is encrypted to obtain ciphertext data and an encryption key. The ciphertext data and the encryption key are sent to the target storage unit according to the unit path. Thus, the server 104 sends an instruction of a request success response to the end-side device 102. The end-side device 102 can include a browser, an APP (Application), or a web application such as an H5 (Hyper Text Markup Languages, version 5) application, or a light application (also known as a small program, a lightweight application), or a cloud application, etc. The end-side device can be developed based on a software development kit (SDK) of a corresponding service provided by a server, such as an RTC (Real Time Communication) SDK, etc. The end-side device can be deployed in an electronic device and needs to rely on the device or some APP in the device to run, etc. The electronic device can have a display screen and support information browsing, etc. For example, it can be a personal mobile terminal such as a mobile phone, a tablet computer, a personal computer, etc.Various other types of applications can also be configured in the electronic device, such as human-computer interaction type applications, model training type applications, text processing type applications, web browser applications, shopping type applications, search type applications, instant communication tools, email clients, social platform software, etc. The server 104 can be understood as a server providing various services, including a physical server, a cloud server, such as a server providing communication services for multiple clients, such as a server for background training supporting models used on the client, such as a server processing data sent by the client, etc. It should be noted that the server 104 can be implemented as a distributed server cluster composed of multiple servers, or as a single server. The server 104 can also be a server of a distributed system, or a server combined with a blockchain. The server 104 can also be a cloud server of basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN, Content Delivery Network), and big data and artificial intelligence platforms, or an intelligent cloud computing server or intelligent cloud host with artificial intelligence technology. It should be noted that the data processing method provided in the embodiments of the present disclosure can be executed by the server 104, and in other embodiments of the present disclosure, the data processing cluster can be deployed in the end-side device 102, so that the end-side device 102 can also have similar functions as the server 104, thereby executing the data processing method provided in the embodiments of the present disclosure; in other embodiments, the data processing method provided in the embodiments of the present disclosure can also be executed by the end-side device 102 and the server 104 together. The data processing method provided in an embodiment of the present disclosure, through the application program interface service unit of the data processing cluster, analyzes the to-be-processed data in the received data processing request, and in the case that the data attribute of the to-be-processed data is a target data attribute (at this time the to-be-processed data is sensitive data), the to-be-processed data is encrypted to obtain ciphertext data and an encryption key, realizing the encryption of the to-be-processed data in the application program interface service unit, and storing the ciphertext data and the encryption key in the target storage unit of the data unit path, realizing the encryption of the sensitive data in the application program interface service unit, so that malicious users cannot read the plaintext sensitive data from the application program interface service unit, reducing the attack surface of malicious users to the node dimension, and reducing the risk of sensitive data leakage. Referring to FIG. 2, FIG. 2 shows a flowchart of a data processing method provided in an embodiment of the present disclosure, which specifically includes the following steps.The data processing method is applied to an application program interface service unit of a data processing cluster. The data processing cluster can be understood as a system for managing and organizing the life cycle of a container, such as Docker, containerd, rkt, or Kubernetes (K8s), and can automatically deploy, run, expand, and manage the container. The application program interface service unit can be understood as an API Server (Application Programming Interface Server), which is the main part of the Kubernetes control plane, is responsible for receiving and responding to user operation requests, manages the state of the cluster, and can synchronize changes to each component. Step 202: Receive a data processing request sent by a client and directed to a target storage unit, wherein the data processing request carries to-be-processed data and a unit path of the target storage unit. The client can be understood as a client that initiates a data processing request (the client can be a client that initiates a data processing request), for example, the client can be an application program, a user device, or another service, which is not limited herein. The data processing request can be understood as a specific instruction issued by the client, which includes operation content indicating server execution, such as reading data operation, writing data operation, modifying data operation, deleting data operation, etc. The data processing request can include related information on how to process the data, such as information on modifying the data, information on creating the data, etc. The to-be-processed data can be understood as specific data content that needs to perform a specific operation, which can be any form of data, such as text, image, audio, video, or structured data, etc. The target storage unit can be understood as a specific storage location or area, for example, the target storage unit can be a file, a database record, an object storage bucket, or a block of a block storage device, etc. The unit path can be understood as a file system path, which is used to locate the position of the target storage unit, and the unit path can be a file path, a database table primary key, an object storage URL, etc., so that the specified target storage unit can be accessed by path addressing. In the embodiment of the present disclosure, the target storage unit can be a sensitive data storage unit (Secret resource) for storing and managing sensitive information. In actual application, Kubernetes stores Secret data securely in the cluster and provides different ways to inject Secret data into a Pod.Specifically, a data processing request carrying to-be-processed data and a path of a target storage unit is received from a client, and then the target storage unit is located according to information in the data processing request, and a corresponding processing operation is performed on data in the target storage unit. Step 204: The to-be-processed data is parsed, and in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute, the to-be-processed data is encrypted to obtain ciphertext data and an encryption key. The data attribute can be understood as a feature or property of the to-be-processed data, for example, the data attribute can be a data type, a format, a sensitive level, etc.; the target data attribute can be understood as a data attribute that needs to be encrypted, for example, whether the data contains sensitive information is judged, and if so, encryption protection is needed; the sensitive information includes but is not limited to database passwords, application certificates, authentication tokens, etc. The parsing result can be understood as a result obtained by comparing various attributes and structural information of the to-be-processed data with the target data attribute, wherein the various attributes and structural information of the to-be-processed data are obtained by parsing the to-be-processed data; if the parsing result shows that the data attribute of the to-be-processed data meets the encryption condition (i.e., is the target data attribute), a subsequent encryption operation is triggered. In one or more embodiments of the present disclosure, the to-be-processed data can be encrypted by using a data encryption service and a key management service, so as to realize double encryption of the to-be-processed data and obtain ciphertext data and an encryption key. The specific implementation is as follows: the parsing of the to-be-processed data, in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute, the to-be-processed data is encrypted to obtain ciphertext data and an encryption key, includes: parsing the to-be-processed data, in a case where it is determined according to a parsing result that a data attribute of the to-be-processed data is a target data attribute, triggering a data encryption service and a key management service to encrypt the to-be-processed data to obtain ciphertext data and an encryption key. The data encryption service can be understood as a component or service for converting data encryption, and the purpose is to protect data security and prevent unauthorized access and leakage; the key management service can be understood as a service responsible for managing keys in the encryption process to ensure the effectiveness and security of the encryption process. The ciphertext data can be understood as encrypted data that cannot be directly read, and the ciphertext data can be obtained by processing the data encryption service; after the to-be-processed data is processed by the data encryption service, the original to-be-processed data is converted into data that cannot be directly read, and the data that cannot be directly read is the ciphertext data, which can be restored to the original information by using the corresponding decryption key.The encryption key can be understood as a key for encrypting and decrypting the data key, which can exist in the form of information, symbols or parameters, which can be a key obtained by encrypting the data key used in the data encryption process, and the data key can be encrypted and decrypted by the encryption key. Under the cooperation of the data encryption service and the key management service, the to-be-processed data is encrypted, and the obtained encryption key is properly stored for subsequent decryption. Specifically, the to-be-processed data is parsed to determine whether it has a target data attribute that needs to be encrypted, and if the to-be-processed data meets the encryption condition, the data encryption service and the key management service are triggered to work together, the data encryption service is encrypted based on the key to-be-processed data, and the key management service generates and manages the encryption key in the encryption process, so that the ciphertext data and the corresponding encryption key are obtained after the encryption is completed. In one or more embodiments of the present disclosure, the data identifier of the to-be-processed data is parsed, and the to-be-processed data is processed according to the data identifier, which improves the data recognition efficiency, and only the data of the target data attribute is encrypted, which improves the resource utilization efficiency. The specific implementation manner is as follows: the to-be-processed data is parsed, and in a case where it is determined according to the parsing result that the data attribute of the to-be-processed data is a target data attribute, a data encryption service and a key management service are triggered to encrypt the to-be-processed data, and ciphertext data and an encryption key are obtained. The to-be-processed data is parsed to determine the data identifier of the to-be-processed data; in a case where it is determined according to the data identifier that the data attribute of the to-be-processed data is a target data attribute, a data encryption service and a key management service are triggered to encrypt the to-be-processed data, and ciphertext data and an encryption key are obtained. In actual application, in a case where a user creates or modifies sensitive data in a Secret resource, a client adds a corresponding data identifier to the sensitive data in a data processing request; so that when the application programming interface service unit parses the to-be-processed data in the data processing request to obtain the data identifier of the to-be-processed data, it is determined according to the data identifier whether the data attribute of the to-be-processed data is sensitive data, and in a case where it is determined according to the data attribute that the to-be-processed data is sensitive data, a data encryption service and a key management service are triggered to encrypt the to-be-processed data, and ciphertext data and an encryption key are obtained. The data processing method provided by the present disclosure can protect sensitive information in a targeted manner by parsing the data identifier and determining whether to encrypt according to a specific data attribute, avoid illegal theft and use of data during transmission and storage, and enhance the security of the data.In one or more embodiments of the present disclosure, not only is the to-be-processed data itself encrypted, but also the data key used to encrypt the data is encrypted, greatly improving the overall security of the system. The specific implementation is as follows: triggering the data encryption service and the key management service to encrypt the to-be-processed data to obtain ciphertext data and an encrypted key, including: triggering the data encryption service to generate a data key for the to-be-processed data, encrypting the to-be-processed data according to the data key to obtain the ciphertext data, and the key management service encrypting the data key to obtain the encrypted key, wherein the key management service encrypts the data key in response to a key encryption request sent by the data encryption service and carrying the data key, obtains and returns the encrypted key. The data key can be understood as a key generated for encrypting to-be-processed data, used to encrypt the original data to generate unreadable ciphertext data; the ciphertext data can be understood as encrypted form data that cannot directly read the original content, which is obtained by encrypting the to-be-processed data using the data key by the data encryption service. The key management service can be understood as a service responsible for the whole life cycle management of the key, including but not limited to key generation, storage, distribution, revocation, and destruction, etc. The key management service is a service component independent of the data encryption service; the encrypted key can be understood as a key obtained by further encrypting the data key by the key management service. Specifically, the data encryption service generates a data key for the to-be-processed data, performs encryption operation on the to-be-processed data using the data key, and generates ciphertext data; the data encryption service initiates a request to the key management service, which contains the data key to be encrypted, the key management service encrypts the data key using its own key encryption technology after receiving the request, and the key management service returns the encrypted data key (i.e. the encrypted key) to the data encryption service for saving, for subsequent decryption. In actual application, the data encryption service will first generate a random DEK suitable for encrypting specific data (such as database records, files, etc.), the DEK is a key used to directly encrypt data, has a short life cycle, and can be quickly generated and replaced; the DEK is used to encrypt sensitive information, which is converted into ciphertext data form that cannot be read by unauthorized persons.If the DEK is stored or transmitted in plaintext, there is a risk of leakage; therefore, the data encryption service sends the DEK to the KMS (i.e., the key management service described above) to request the KMS to encrypt it using a higher-level key (e.g., a Master Key or a Customer Master Key, CMK) to obtain an encrypted encryption key. The data processing method provided by the embodiments of the present disclosure can encrypt the data key using a higher-level key in the key management service. In this way, an attacker cannot directly decrypt the original data key, achieving the effects of strengthening key protection, improving data security, and simplifying key management. Step 206: sending the ciphertext data and the encryption key to the target storage unit according to the unit path. Specifically, the ciphertext data and the encryption key are stored on the target storage unit according to the unit path (such as a specific directory structure, a database table name, or a key-value pair). In actual applications, it is necessary to ensure that only services or users with corresponding permissions can access the ciphertext data and the encryption key stored on the target storage unit, ensuring the security of the entire link from the generation, encryption, transmission to storage of the encrypted data. In one or more embodiments of the present disclosure, by persisting the ciphertext data and the encryption key in the target storage unit to the target storage medium, it is ensured that even after system restart or failure, access to the encrypted data can be restored, and the key itself is also protected and will not be lost due to transient state, causing the data to be unable to be decrypted. The specific implementation is as follows: after the ciphertext data and the encryption key are sent to the target storage unit according to the unit path, the method further includes persisting the ciphertext data and the encryption key of the target storage unit to a target storage medium. Persistence is a mechanism for converting program data between persistent and transient states. In simple terms, it is to persist transient data (such as data in memory, which cannot be permanently saved) as persistent data (such as persisting to a database, which can be saved for a long time). The target storage medium can be understood as a carrier for storing data, such as a mobile hard disk, an optical disk, a flash memory, etc. In actual applications, kubectl or API calls can be used to apply Secret data to the cluster, send Secret information to the Kubernetes API Server, and store it in the etcd (a highly available distributed key-value storage database) database of the cluster by the API Server.In one or more embodiments of the present disclosure, the data processing method applied to the application program interface service unit of the data processing cluster further includes: receiving a data processing request sent by a target work node and directed to a target storage unit, wherein the data processing request carries a data identifier of to-be-acquired data and a unit path of the target storage unit; acquiring, according to the data identifier and the unit path, the ciphertext data corresponding to the to-be-acquired data and an encryption key from the target storage unit, and returning the ciphertext data and the encryption key to the target work node; receiving a decryption request sent by the target work node, wherein the decryption request carries the ciphertext data, the encryption key, and node information; triggering a data decryption service and a key management service, and obtaining the to-be-acquired data according to the ciphertext data, the encryption key, and the node information. The data processing request can be understood as a data acquisition request initiated by the target work node to the application program interface service unit, and is used to acquire data stored in the target storage unit. The target work node can be a server, a container, or a microservice, which is not limited herein. The node information can be understood as identity information of the target work node, and is used to verify the legality of the request initiator according to the node information, so as to ensure that the target work node for request decryption is an authorized work node. Specifically, in the case of sensitive data to be applied, the encrypted sensitive data needs to be decrypted to obtain decrypted sensitive data, so that the target work node can apply the decrypted sensitive data for data processing. In actual application, the target work node (such as a server, a container, or a microservice) initiates a data acquisition request directed to the target storage unit to the application program interface service unit, and the request contains a data identifier and a unit path. The two parameters together locate the specific data to be processed in the target storage unit. The data identifier is usually a unique identifier used to identify a data record. The unit path indicates the position of the data in the storage structure. The specific to-be-acquired data is acquired through the data identifier and the unit path, but the to-be-acquired data at this time is ciphertext data in an encrypted form, so the ciphertext data corresponding to the to-be-acquired data and the encryption key are acquired.To obtain the original plaintext to-be-acquired data, the target worker node, in the case of obtaining the ciphertext data and the encryption key, further sends a decryption request for decryption of the ciphertext data and the encryption key. The decryption request contains the ciphertext data and the encryption key, and also contains the identity information of the node itself. Through the cooperative work of the data decryption service and the key management service, decryption is performed based on the data carried in the decryption request, thereby restoring the original to-be-acquired data. The target worker node can then use the to-be-acquired data to perform a data processing task. The data processing method provided in the embodiments of the present disclosure enables the target worker node to obtain the encrypted ciphertext data and the encryption key, so that the application programming interface service unit can obtain the decrypted to-be-acquired data by using the data decryption service and the key management service after receiving the decryption request of the target worker node for the ciphertext data and the encryption key, thereby reducing the risk of sensitive data leakage. The data processing method provided in the embodiments of the present disclosure encrypts the Secret when the user creates or updates the Secret, which ensures that malicious users cannot directly read the Secret plaintext from the API Server. Moreover, the data processing method provided in the embodiments of the present disclosure can be applied to a scenario in which sensitive data must be saved in the Kubernetes cluster, without relying on the migration of sensitive data to outside the Kubernetes cluster. Referring to FIG. 3, FIG. 3 shows a processing process flowchart of a data processing method according to an embodiment of the present disclosure, which specifically includes the following steps. Step 1: Synchronize the Secret. oIn the case of user creation or update for sensitive data, the user carries the sensitive data (not limited to Secret data, but also user-defined data, which is set in advance to add a specific identifier when creating or updating) with a specific identifier in the data processing request sent by the client to the API Server (i.e., the application interface service unit in the above embodiment) of the server. Step 2: Mutating Webhook In the case that the API Server receives the data processing request, the data in the data processing request is obtained, and in the case that the data in the data processing request contains a specific identifier, a Mutating Webhook request (a mechanism for modifying the admission process of cluster resource objects (such as Pod, Deployment, etc.). It allows developers to intervene in the request response cycle of the Kuber netes API Server by writing custom Webhook services. Specifically, when a new or updated resource object is submitted to the API Server, the Mutating Webhook receives a request containing the resource object before the resource object is persisted. The Webhook service can choose whether and how to modify this resource object according to its own logic, such as adding default tags, injecting container image pull keys, etc.), which is used to make the encryption service (i.e., the data encryption service in the above embodiment) generate a DEK (i.e., the data key in the above embodiment), and encrypt the above obtained data using the DEK. Step 3: Generate DEK and encrypt data using generated DEK. The encryption service generates a DEK upon receiving the Mutating Webhook request, and encrypts the data carried in the request using the DEK to obtain ciphertext data. Step 4: Request to encrypt DEK. After encrypting the obtained data, the data key of the encrypted data also needs to be encrypted to double-protect the security of the data; the encryption service sends an encryption request to the KMS (i.e., the key management service in the above embodiment), so that the KMS encrypts the DEK carried in the request based on the encryption request. Step 5: Ciphertext DEK.

[0011] The KMS receives the encryption request sent by the encryption service, encrypts the DEK, and returns the encrypted ciphertext DEK (i.e., the encryption key in the above embodiment) to the encryption service after the encryption is completed. Step 6: Return a response, and update Secret to the encryption service. The response is returned, the plaintext data of Secret in the API Server is replaced with the encrypted ciphertext data, and the ciphertext DEK is saved to Secret. Step 7: Save the Secret after the encryption processing.

[0012] The API Server persists the encrypted Secret. Step 8: Return Response. After persisting the encrypted Secret, a response is returned to the user's client. The data processing method provided in this embodiment parses the data to be processed in the received data processing request through the application programming interface (API) service unit of the data processing cluster. When the data attribute of the data to be processed is the target data attribute (sensitive data), the data to be processed is encrypted to obtain ciphertext data and encryption key. This realizes the encryption of the data to be processed at the API service unit and saves the ciphertext data and encryption key to the target storage unit of the data unit path. Subsequently, the ciphertext data and encryption key can be persistently stored through the target storage unit to ensure that the plaintext of the data to be processed only appears on the necessary nodes, minimizing the attack surface of malicious users to the node dimension and reducing the risk of sensitive data leakage. See Figure 4. Figure 4 shows a flowchart of another data processing method provided in an embodiment of this disclosure, which specifically includes the following steps. This data processing method is applied to the API service unit of the data processing cluster. Step 402: Receive a data processing request sent by the target worker node for the target storage unit. The data processing request carries a data identifier for the data to be acquired and the unit path of the target storage unit. In a distributed system or cloud computing environment, the target worker node can be understood as a node responsible for executing specific tasks, such as a server or virtual machine. The target worker node can send a data processing request to the central server or control system to request the central server or control system to process the data in the target storage unit. In this embodiment, the target worker node is a Worker Node. A Worker Node can be understood as a node in a Kubernetes cluster responsible for running container applications. In the Kubernetes architecture, a Worker Node is a concept relative to the Master Node. Worker Nodes and Master Nodes constitute the computing resource foundation of the cluster and bear the actual data load. The data identifier for the data to be acquired can be understood as a series of information used to uniquely identify or locate the data to be acquired. This series of information can be a filename, database record ID, object storage key, etc.When the target worker node includes Kubelet (a Kubernetes agent responsible for running containers on the node and communicating with the master node to report node health and container status), a data processing request is sent to the API Server using Kubelet. Upon receiving the request, the API Server locates the target storage unit and performs the corresponding data processing operation based on the provided data identifier and unit path. Step 404: Based on the data identifier and unit path, the encrypted data and encryption key corresponding to the data to be acquired are obtained from the target storage unit, and the encrypted data and encryption key are returned to the target worker node. Specifically, based on the data identifier and unit path in the data processing request sent by the target worker node, the encrypted data and encryption key corresponding to the data to be acquired are located and retrieved from the target storage unit. The encrypted data and encryption key are then retrieved from the storage system, ready to be returned to the target worker node, and the encrypted data and encryption key are transmitted back to the target worker node securely. In practical applications, after encrypting the data to be processed using the above data processing method, the encrypted ciphertext data and encryption key are obtained through the API Server. In one or more embodiments of this disclosure, data location is based on unit path and data identifier, making data access more targeted and accurate, enabling fine-grained access control and data isolation, allowing only users or services with appropriate permissions to obtain the corresponding ciphertext data and encryption key. The specific implementation is as follows: Obtaining the ciphertext data and encryption key corresponding to the data to be obtained from the target storage unit according to the data identifier and the unit path includes: determining the target storage unit corresponding to the unit path according to the unit path; determining the data to be obtained corresponding to the data identifier from the target storage unit according to the data identifier, and obtaining the ciphertext data and encryption key corresponding to the data to be obtained. Specifically, based on the received unit path, the target storage unit corresponding to the unit path is located in the storage system. Within the target storage unit, using the provided data identifier, the data to be acquired that matches the data identifier is found, thereby determining the data to be acquired, the encrypted ciphertext data, and the encryption key. In practical applications, the ciphertext data and encryption key can be stored separately or associated together in some secure way; this is not limited here. The acquired ciphertext data and encryption key are returned to the target worker node that requested the data. The target worker node can then use a decryption request to decrypt the encryption key and ciphertext data, thereby recovering the original data and obtaining the data to be acquired.The data processing method provided in this disclosure not only ensures secure data storage but also offers flexibility in data decryption. Step 406: Receive a decryption request sent by the target worker node, wherein the decryption request carries the ciphertext data, the encryption key, and node information. The decryption request can be understood as a request to decrypt the ciphertext data and the encryption key. This decryption request is a request sent by the target worker node to the application programming interface service unit. The decryption request includes the ciphertext data to be decrypted, the encryption key used to encrypt the data, and relevant information of the requesting worker node (such as node ID, role, location, etc.). Specifically, the decryption service or system listens for requests from the target worker node. When it receives a decryption request carrying ciphertext data, the encryption key, and node information, the decryption service begins processing the decryption request. The decryption service verifies the legitimacy of the decryption request, such as confirming the request source (node ​​information) and the validity of the encryption key; and if the verification is successful and decryption is determined to be possible, the ciphertext data and encryption key carried in the decryption request are decrypted. Step 408: Obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information. In one or more embodiments of this disclosure, the ciphertext data and encryption key can be decrypted based on a data decryption service and a key management service to obtain the decrypted plaintext data to be acquired. The specific implementation is as follows: After receiving the decryption request sent by the target working node, the method further includes: triggering the data decryption service and the key management service to obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information. The data decryption service can be understood as a service for decrypting encrypted data. The data decryption service accepts the encrypted ciphertext data and the corresponding encryption key, and uses a decryption algorithm to restore the ciphertext data to the original, readable plaintext data. The node information can be understood as the identity, permissions, location, and other information of the target working node. The data decryption service verifies the node based on the node information to ensure that the decryption request comes from an authorized and trusted node.Specifically, the target worker node sends a decryption request to the data decryption service through the application programming interface (API) service unit. The decryption request includes the ciphertext data to be decrypted, the encryption key used to encrypt the data, and the node information of the requesting worker node. The data decryption service first verifies the node information to confirm that the node is authorized to request decryption. After verifying the validity of the node information, the data decryption service sends a key decryption request to the key management service, which includes the encryption key. Upon receiving the key decryption request, the key management service decrypts the encryption key to obtain the original decryption key (data key). After obtaining the data key, the data decryption service decrypts the ciphertext data based on the data key to restore the original data to be acquired. After decryption, the data decryption service returns the plaintext data of the data to be acquired to the target worker node through the API service unit, enabling it to continue subsequent processing or data operations based on the data. In one or more embodiments of this disclosure, by verifying the target worker node, its corresponding verification result is obtained, and the data to be acquired is obtained based on the verification result. The specific implementation method is as follows: The triggering data decryption service and key management service obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information, including: triggering the data decryption service, using the data decryption service to verify the node information, and obtaining the verification result of the target working node; obtaining the data to be acquired based on the verification result, the ciphertext data, and the encryption key. The node information can be understood as the identifier, certificate, authorization credentials, and other related information carried by the working node that made the data decryption request, used to prove that the node has legitimacy and sufficient authority to access and decrypt specific data; the verification result can be either pass (indicating that the node is legitimate and has the authority to perform decryption operations) or fail (meaning that the node has no authority to decrypt or its identity is illegitimate). This verification result is obtained by the data decryption service after receiving the node information and verifying the node information. Specifically, when a target worker node attempts to decrypt data, it triggers the data decryption service to perform strict verification and authentication of the node information. The data decryption service analyzes the information provided by the node to ensure that the node has the legality and authority to perform the decryption operation. If the node information is verified, the data decryption service will further process the decryption request; otherwise, if the verification fails, it will refuse to decrypt and may record the abnormal event.In practical applications, the data decryption service verifies node information by verifying that the data decryption request was initiated by a Kubelet instance through the certificate information in the data decryption request, and that a Pod with the currently decrypted secret is mounted on the node where the instance resides; thus verifying the node information. The data processing method provided in this disclosure, through node information verification during the decryption process, restricts the users capable of decrypting the data to be obtained. That is, the data decryption service will only further process the decryption request after the node information verification is successful, further ensuring that the plaintext data to be obtained only appears on necessary nodes, thereby minimizing the attack surface for malicious users. In one or more embodiments of this disclosure, it is ensured that only the target working node that has been verified and whose verification result matches the target verification result can decrypt the encrypted data, thereby enhancing data security and privacy protection. The specific implementation method is as follows: Obtaining the data to be acquired based on the verification result, the ciphertext data, and the encryption key includes: if the verification result is determined to be the target verification result, triggering the data decryption service to call the key management service to decrypt the encryption key, so that the data decryption service uses the decrypted data key to decrypt the ciphertext data, obtain and send the data to be acquired to the application interface service unit; and receiving the data to be acquired sent by the data decryption service. Wherein, the target verification result is the result of successful verification. For example, the verification result can be represented using numerical values, symbols, or labels; when using numerical values ​​to represent the verification result, a value of 0 indicates that the verification failed, and a value of 1 indicates that the verification passed. Specifically, after successful node verification, the data decryption service sends a key decryption request, containing the encryption key, to the key management service. Upon receiving the request, the key management service decrypts the encryption key to obtain the actual decryption key (data key). Using this data key, the data decryption service decrypts the ciphertext data. Through this decryption process, the previously unreadable ciphertext data is restored to the original, meaningful data to be retrieved. In one or more embodiments of this disclosure, while ensuring data security, efficient linkage between the resource management unit and the data is achieved, enhancing system security and operational convenience, and improving the overall reliability and service quality of the project.The specific implementation is as follows: Receiving a data processing request for a target storage unit sent by the target worker node includes: receiving a data processing request for a target storage unit sent by the target worker node based on the unit configuration information of the target resource management unit, provided that a target resource management unit to be run exists; After obtaining the data to be acquired based on the ciphertext data, the encryption key, and the node information, the triggering of the data decryption service and key management service further includes: sending the data to be acquired to the target worker node so that the target worker node establishes an association between the data to be acquired and the target resource management unit. Here, the target resource management unit can be understood as a resource management unit to be run on the target worker node, which can be understood as a Pod; the unit configuration information can be understood as the configuration information of the containers and storage resources required to run the application contained in the resource management unit. Specifically, when the target worker node detects a Pod to be run, it sends a data processing request to the API Server based on the Pod's configuration information. The API Server then retrieves the encrypted and ciphertext data of the data to be acquired (the data required to configure the Pod). The target worker node then sends a data decryption request to the API Server, triggering the data decryption and key management services to obtain the decrypted data. Finally, the target worker node sends the plaintext data back to the target worker node. Upon receiving the decrypted data, the target worker node associates this data with the Pod to be run. This might involve loading the decrypted data into the Pod's container (e.g., mounting the secret data as a file system volume within the container), or further processing and using the data according to the Pod's needs. In one or more embodiments of this disclosure, the data processing method further includes: receiving a data processing request sent by a client for a target storage unit, wherein the data processing request carries data to be processed and a unit path of the target storage unit; parsing the data to be processed, and if the data attribute of the data to be processed is determined to be a target data attribute based on the parsing result, triggering a data encryption service and a key management service to encrypt the data to be processed to obtain ciphertext data and an encryption key; and sending the ciphertext data and the encryption key to the target storage unit according to the unit path. For specific details, please refer to the above embodiments, which are not limited here.The data processing method provided in this disclosure embodiment verifies the target worker node before decrypting the encrypted data. Only when the verification result matches the target verification result will the decryption key be requested from the key management service. This strengthens the control over the decryption behavior, reduces the attack surface for malicious users, and reduces the risk of sensitive data leakage. Referring to Figure 5, Figure 5 shows a flowchart of another data processing method provided in an embodiment of this disclosure, specifically including the following steps: Step 1: Request to read the Secret that the Pod depends on. o

[0013] Kubelet requests the API Server to read the Secrets that the application Pod depends on. The Pod definition includes the Secrets it needs to reference. Therefore, when Kubelet sends a request to the API Server, it can include Pod information in the request, allowing the API Server to determine and read the Secret corresponding to the Pod. In practice, when a new Pod is created, Kubelet starts a container for the Pod on the node. Before starting the container, Kubelet needs to ensure that the Pod can access all the resources it needs, including Secrets. For example, if the Secret contains the database username and password, before the container starts, Kubelet will request the API Server based on the Pod definition to read the corresponding Secret data and then provide this sensitive information to the container, enabling the container to connect to the database service using the database username and password. Step 2: Secret containing encrypted data and encrypted DEK. After receiving the request from Kubelet, the API Server determines and returns the encrypted data and encrypted DEK corresponding to the Secret based on the Secret name carried in the request. Step 3: Request decryption of encrypted data.

[0014] After receiving the Secret containing the encrypted data and the encrypted DEK, Kubernetes sends a decryption request to the API Server based on the encrypted data and the encrypted DEK. The decryption request carries the encrypted data, the encrypted DEK, and certificate information (the certificate information includes node information, which can be used to determine the source of the decryption request, i.e., which node sent the decryption request, and thus query which pods are on this node); Step 4: Forward the request.

[0015] After receiving the decryption request, the API Server forwards it to the decryption service; Step 5: Verify the request source. The decryption service, based on the certificate information in the decryption request, determines that the decryption request originated from a Kubelet instance, and that a Pod with the currently decrypted Secret exists on the node where the Kubelet instance resides. Then, it performs decryption according to the request; Step 6: Request DEK decryption. First, the ciphertext DEK is decrypted. The decryption service sends a decryption request to KMS, carrying the ciphertext DEK; Step 7: Plaintext DEK.

[0016] KMS receives the decryption request sent by the decryption service, decrypts the ciphertext DEK carried in the decryption request, and obtains and returns the decrypted plaintext DEKo. Step 8: Decrypt the ciphertext data using DEK. Decrypt to obtain the decrypted plaintext data.

[0017] The API server returns the plaintext data to the Pod that sent the request; Step 1: Mount the plaintext data to the Pod...

[0018] After receiving plaintext data, Kubernetes mounts it to the corresponding Pod. This process is typically accomplished through the tmpfs file system, a memory-based file system that provides a fast and secure way to access data. By mounting the Secret data to the Pod, the application in the Pod can obtain the database username and password contained in the plaintext Secret data, thus enabling it to connect to the database service. The data processing method provided in this disclosure encrypts the Secret when a user creates or updates it, ensuring that malicious users cannot directly read the plaintext Secret from the API Server. Simultaneously, the verification mechanism of the decryption service restricts users capable of decrypting Secrets, further ensuring that the plaintext Secret only appears on necessary nodes, thereby minimizing the attack surface of malicious users to the node level. Through the collaboration of the encryption service, decryption service, and Kubernetes components, a unified encryption protection method is provided for Secret resources in the Kubernetes cluster, requiring no application modification and greatly reducing the cost and complexity of application modification. Referring to Figure 6, Figure 6 illustrates the overall framework diagram of a data processing method provided in one embodiment of this disclosure. In practical applications, customers manage application Pods through a virtual lightweight Kubernetes cluster (i.e., VC, Virtual ICI Controller cluster). The VC cluster itself does not have resource scheduling capabilities. Pods, Secrets, and other resources created by users in the VC cluster are synchronized to a Kubernetes multi-tenant cluster (which can be understood as a resource cluster). The resource cluster schedules Pods to actual nodes and starts the Pods using secure containers. That is, sensitive data created by customers in the VC is synchronized to the multi-tenant shared resource cluster. Any user with Secret read permissions (such as resource cluster maintenance personnel or malicious users who have stolen certificates) can access the API Server in the cluster to read sensitive data, posing a significant risk to data security. Therefore, the data processing method provided in this embodiment encrypts the Secret submitted by the user to the cluster and ensures that the plaintext of the Secret is visible on the necessary nodes, thereby minimizing the attack surface of malicious users to the node dimension.The data processing method provided in this disclosure is applied to a data processing cluster. The architecture of this data processing cluster mainly includes two parts: a control plane and worker nodes. The control plane is responsible for managing and coordinating the system's configuration, status information, and logical control of data flow. Taking Kubernetes as an example, the control plane includes components such as API servers, schedulers, and controllers. Worker nodes are the hosts in the cluster that actually run application containers. They are physical or virtual machines, which can be cloud instances or local servers. Each worker node runs several key components, such as Kubernetes API (the main agent of the node, responsible for the lifecycle management of Pods, such as creating, starting and stopping containers, and communicating with the Kubernetes API Server to report the status of nodes and Pods). In one embodiment of this disclosure, the control plane of the data processing cluster includes a Kubernetes API Server (hereinafter referred to as API Server, i.e., the application programming interface service unit in the above embodiment), an encryption service (i.e., the data encryption service in the above embodiment, including the mutating webhook mechanism), a decryption service (i.e., the data decryption service in the above embodiment), and a KMS (i.e., the key management service in the above embodiment); the worker nodes of the data processing cluster (i.e., the target worker nodes in the above embodiment) include: Kubernetes and application Pods. Data encryption: When a user creates or updates a Secret through the API Server, the mutating webhook mechanism is triggered to access the encryption service and complete the encryption of the Secret data. After encryption, the Secret read by the user through the API Server contains only ciphertext data; therefore, attackers cannot use the API Server as an entry point to directly read sensitive data in the Secret. Data Decryption: When an application Pod is scheduled to a worker node in the cluster, the Kubelet on that worker node requests a decryption service to decrypt the Secret it depends on, ensuring the Pod can function correctly. The decryption service is an extended API Server that verifies the request originates from a legitimate Kubelet instance based on the certificate information in the request (the request must have been initiated by a Kubelet instance, and the node hosting that instance must have a Pod mounting the current Secret).This further reduces the attack surface for malicious users: the plaintext of a Secret is only visible on the nodes that need to use it, and malicious users must compromise specific nodes to steal it. The data processing method provided in this disclosure encrypts the Secret when a user creates or updates it, ensuring that malicious users cannot directly read the plaintext Secret from the API Server. Simultaneously, the verification mechanism of the decryption service restricts users capable of decrypting Secrets, further ensuring that the plaintext Secret only appears on necessary nodes, thereby minimizing the attack surface for malicious users to the node dimension and reducing the risk of sensitive data leakage. Through the collaboration of the encryption service, decryption service, and Kubernetes components, a unified encryption protection method is provided for Secret resources in the Kubernetes cluster, requiring no application modification and greatly reducing the cost and complexity of application modification. Corresponding to the above method embodiments, this disclosure also provides a data processing cluster embodiment. Figure 7 shows a schematic diagram of the structure of a data processing cluster provided in one embodiment of this disclosure. As shown in Figure 7, the cluster includes an application programming interface (API) service unit 702, a data encryption service 704, and a key management service 706. The API service unit 702 receives a data processing request from a client for a target storage unit. The data processing request carries the data to be processed and the unit path of the target storage unit. It parses the data to be processed, and if the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, it triggers the data encryption service 704 to generate a data key. The data encryption service 704 uses the data key to encrypt the data to be processed, obtaining ciphertext data, and sends a key encryption request to the key management service 706, wherein the key encryption request carries the data key. The key management service 706 responds to the key encryption request, encrypts the data key, obtains an encryption key, and returns the encryption key to the data encryption service 704. The data encryption service 704 sends the ciphertext data and the encryption key to the API service unit 702. The application programming interface (API) service unit 702 sends the encrypted data and the encryption key to the target storage unit according to the unit path, and sends a success response to the client. Optionally, the API service unit 702 is further configured to: persist the encrypted data and the encryption key from the target storage unit to the target storage medium.The above is an illustrative scheme of a data processing system according to this embodiment. It should be noted that the technical solution of this data processing system and the technical solution of the data processing method described above belong to the same concept. Details not described in detail in the technical solution of the data processing system can be found in the description of the technical solution of the data processing method described above. Corresponding to the above method embodiment, this disclosure also provides another data processing cluster embodiment. Figure 8 shows a schematic diagram of the structure of a data processing cluster provided in an embodiment of this disclosure. As shown in Figure 8, the cluster includes a target worker node 802, an application programming interface (API) service unit 804, a data decryption service 806, and a key management service 808. The target worker node 802 sends a data processing request for a target storage unit to the API service unit 804. The data processing request carries a data identifier of the data to be acquired and the unit path of the target storage unit. The API service unit 804 receives the data processing request, retrieves the ciphertext data and encryption key corresponding to the data to be acquired from the target storage unit based on the data identifier and the unit path, and returns the ciphertext data and encryption key to the target worker node 802. The target worker node 802 sends a decryption request to the data decryption service 806 through the API service unit 804. The decryption request carries the ciphertext data, the encryption key, and node information. The data decryption service 806 receives the decryption request, verifies the node information, and obtains the verification result of the target worker node 802. If the verification result is determined to be the target verification result, a key decryption request is sent to the key management service 808, wherein the key decryption request carries the encryption key; the key management service 808, in response to the key decryption request, decrypts the encryption key to obtain a data key, and sends the data key to the data decryption service 806; the data decryption service 806, based on the data key, decrypts the encrypted data to obtain the data to be acquired, and sends the data to be acquired to the target worker node 802 through the application programming interface service unit 804. Optionally, the target worker node 802 is further configured to: if it is determined that there is a target resource management unit to be run, send a data processing request for the target storage unit to the application programming interface service unit based on the unit configuration information of the target resource management unit.Optionally, the target working node 802 is further configured to: establish an association between the data to be acquired and the target resource management unit. The above is an illustrative scheme of a data processing cluster according to this embodiment. It should be noted that the technical solution of this data processing cluster belongs to the same concept as the technical solution of the above-described data processing method. Details not described in detail in the technical solution of the data processing cluster can be found in the description of the technical solution of the above-described data processing method. Corresponding to the above method embodiment, this disclosure also provides a data processing device embodiment. Figure 9 shows a schematic diagram of the structure of a data processing device provided in an embodiment of this disclosure. As shown in Figure 9, the device includes a receiving module 902, a parsing module 904, and a sending module 906. The receiving module 902 is configured to receive a data processing request sent by a client for a target storage unit, wherein the data processing request carries data to be processed and the unit path of the target storage unit. The parsing module 904 is configured to parse the data to be processed, and if the data attribute of the data to be processed is determined to be a target data attribute based on the parsing result, encrypt the data to be processed to obtain ciphertext data and an encryption key. The sending module 906 is configured to send the ciphertext data and the encryption key to the target storage unit according to the unit path. Optionally, the parsing module 904 is further configured to: parse the data to be processed, and if the data attribute of the data to be processed is determined to be a target data attribute based on the parsing result, trigger a data encryption service and a key management service to encrypt the data to be processed to obtain ciphertext data and an encryption key. Optionally, the parsing module 904 is further configured to: trigger the data encryption service to generate a data key for the data to be processed; encrypt the data to be processed according to the data key to obtain the ciphertext data; and encrypt the data key using the key management service to obtain the encryption key, wherein the key management service responds to a key encryption request carrying the data key sent by the data encryption service, encrypts the data key, obtains and returns the encryption key. The apparatus further includes: a storage module configured to persist the ciphertext data and the encryption key from the target storage unit to the target storage medium.Optionally, the parsing module 904 is further configured to: parse the data to be processed, determine the data identifier of the data to be processed; if the data attribute of the data to be processed is determined to be a target data attribute based on the data identifier, trigger a data encryption service and a key management service to encrypt the data to be processed, and obtain ciphertext data and an encryption key. The device further includes: a decryption module, configured to: receive a data processing request sent by a target working node for a target storage unit, wherein the data processing request carries the data identifier of the data to be acquired and the unit path of the target storage unit; obtain the ciphertext data and encryption key corresponding to the data to be acquired from the target storage unit based on the data identifier and the unit path, and return the ciphertext data and the encryption key to the target working node; receive a decryption request sent by the target working node, wherein the decryption request carries the ciphertext data, the encryption key, and node information; trigger a data decryption service and a key management service to obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information. The data processing apparatus provided in this embodiment parses the data to be processed in the received data processing request through the application programming interface (API) service unit of the data processing cluster. When the data attribute of the data to be processed is the target data attribute (in which case the data to be processed is sensitive data), the data to be processed is encrypted to obtain ciphertext data and an encryption key. This achieves encryption of the data to be processed at the API service unit, and saves the ciphertext data and encryption key to the target storage unit in the data unit path. This achieves encryption of sensitive data at the API service unit, preventing malicious users from reading plaintext sensitive data from the API service unit, minimizing the attack surface of malicious users to the node dimension, and reducing the risk of sensitive data leakage. The above is an illustrative scheme of a data processing apparatus according to this embodiment. It should be noted that the technical solution of this data processing apparatus belongs to the same concept as the technical solution of the above-described data processing method. Details not described in detail in the technical solution of the data processing apparatus can be found in the description of the technical solution of the above-described data processing method. Corresponding to the above method embodiment, this disclosure also provides a data processing apparatus embodiment. Figure 10 shows a schematic diagram of the structure of a data processing apparatus provided in an embodiment of this disclosure.As shown in Figure 10, the device includes a first receiving module 1002, an acquisition module 1004, a second receiving module 1006, and an acquisition module 1008. The first receiving module 1002 is configured to receive a data processing request sent by a target working node for a target storage unit, wherein the data processing request carries a data identifier of the data to be acquired and a unit path of the target storage unit. The acquisition module 1004 is configured to acquire the ciphertext data and encryption key corresponding to the data to be acquired from the target storage unit based on the data identifier and the unit path, and return the ciphertext data and the encryption key to the target working node. The second receiving module 1006 is configured to receive a decryption request sent by the target working node, wherein the decryption request carries the ciphertext data, the encryption key, and node information. The acquisition module 1008 is configured to acquire the data to be acquired based on the ciphertext data, the encryption key, and the node information. Optionally, the obtaining module 1008 is further configured to: trigger a data decryption service and a password management service, and obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information. Optionally, the obtaining module 1004 is further configured to: determine the target storage unit corresponding to the unit path based on the unit path; determine the data to be acquired corresponding to the data identifier from the target storage unit based on the data identifier, and obtain the ciphertext data and the encryption key corresponding to the data to be acquired. Optionally, the obtaining module 1008 is further configured to: trigger the data decryption service, verify the node information using the data decryption service, and obtain the verification result of the target working node; obtain the data to be acquired based on the verification result, the ciphertext data, and the encryption key. Optionally, the obtaining module 1008 is further configured to: when the verification result is determined to be the target verification result, trigger the data decryption service to call the key management service to decrypt the encryption key, so that the data decryption service can use the decrypted data key to decrypt the ciphertext data, obtain and send the data to be obtained to the application interface service unit; and receive the data to be obtained sent by the data decryption service. Optionally, the first receiving module 1002 is further configured to: receive a data processing request for the target storage unit sent by the target worker node according to the unit configuration information of the target resource management unit when it is determined that there is a target resource management unit to be run.The apparatus further includes: a sending module configured to send the data to be acquired to the target working node, so that the target working node establishes an association between the data to be acquired and the target resource management unit. The apparatus also includes: an encryption module configured to receive a data processing request sent by a client for a target storage unit, wherein the data processing request carries the data to be processed and the unit path of the target storage unit; parse the data to be processed, and if the data attribute of the data to be processed is determined to be a target data attribute based on the parsing result, trigger a data encryption service and a key management service to encrypt the data to be processed to obtain ciphertext data and an encryption key; and send the ciphertext data and the encryption key to the target storage unit according to the unit path. The data processing apparatus provided in this embodiment verifies the target working node before decrypting the ciphertext data. Only when the verification result is the target verification result will the decryption key be requested from the key management service, thereby strengthening the control over the decryption behavior, reducing the attack surface of malicious users, and reducing the risk of sensitive data leakage. The above is an illustrative scheme of a data processing device according to this embodiment. It should be noted that the technical solution of this data processing device and the technical solution of the data processing method described above belong to the same concept. Details not described in detail in the technical solution of the data processing device can be found in the description of the technical solution of the data processing method described above. Figure 111 shows a structural block diagram of a computing device 1100 according to an embodiment of this disclosure. The components of the computing device 1100 include, but are not limited to, a memory 1110 and a processor 1120. The processor 1120 is connected to the memory 1110 via a bus 1130, and a database 1150 is used to store data. The computing device 1100 also includes an access device 1140, which enables the computing device 1100 to communicate via one or more networks 1160. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet.Access device 1140 may include one or more of any type of wired or wireless network interface (e.g., network interface card (NIC), such as an IEEE 802.11 Wireless Local Area Network (WLAN) interface, a Wi-MAX (World Wide Interface for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, or a Near Field Communication (NFC) interface. In one embodiment of this disclosure, the aforementioned components of computing device 1100, as well as other components not shown in FIG. 11, may also be interconnected, for example, via a bus. It should be understood that the computing device block diagram shown in FIG. 11 is for illustrative purposes only and is not intended to limit the scope of this disclosure. Those skilled in the art can add or replace other components as needed. The computing device 1 100 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 1 100 can also be a mobile or stationary server. The processor 1 120 is used to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the above-described data processing method. The various embodiments in this disclosure are described in a progressive manner; similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the computing device embodiments, since they are basically similar to the data processing method embodiments, the description is relatively simple; relevant parts can be referred to in the description of the data processing method embodiments. An embodiment of this disclosure also provides a computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the above-described data processing method.The various embodiments in this disclosure are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the computer-readable storage medium embodiments are relatively simple in description because they are basically similar to the data processing method embodiments; relevant parts can be referred to the descriptions of the data processing method embodiments. One embodiment of this disclosure also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described data processing method. The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the above-described data processing method belong to the same concept. Details not described in detail in the technical solution of the computer program product can be referred to the description of the technical solution of the above-described data processing method. Specific embodiments of this disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than in the embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some implementations, multitasking and parallel processing are possible or may be advantageous. The computer instructions include computer program code, which may be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium may include any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals. It should also be noted that, for the foregoing method embodiments, for the sake of simplicity, they are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this disclosure are not limited to the described order of actions, because according to the embodiments of this disclosure, some steps may be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments of this disclosure.In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. The preferred embodiments disclosed above are only for the purpose of illustrating this disclosure. Optional embodiments do not describe all details exhaustively, nor do they limit the invention to the specific implementations described. Obviously, many modifications and variations can be made based on the content of the embodiments of this disclosure. This disclosure selects and specifically describes these embodiments to better explain the principles and practical applications of the embodiments of this disclosure, thereby enabling those skilled in the art to better understand and utilize this disclosure. This disclosure is limited only by the claims and their full scope and equivalents.

Claims

Claims 1. A data processing method, applied to an application programming interface (API) service unit of a data processing cluster, the method comprising: The system receives a data processing request from a client for a target storage unit, wherein the data processing request carries data to be processed and the unit path of the target storage unit; it parses the data to be processed, and if the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, it encrypts the data to be processed to obtain ciphertext data and an encryption key; and it sends the ciphertext data and the encryption key to the target storage unit according to the unit path.

2. The data processing method according to claim 1, wherein parsing the data to be processed, and determining, based on the parsing result, that the data attribute of the data to be processed is the target data attribute, encrypting the data to be processed to obtain ciphertext data and an encryption key, includes: The data to be processed is parsed. If the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, the data encryption service and key management service are triggered to encrypt the data to be processed, thereby obtaining ciphertext data and encryption key.

3. The data processing method according to claim 2, wherein triggering the data encryption service and key management service to encrypt the data to be processed to obtain ciphertext data and encryption key includes: The data encryption service is triggered to generate a data key for the data to be processed. The data to be processed is then encrypted using the data key to obtain the ciphertext data. The key management service also encrypts the data key to obtain the encryption key. In this case, the key management service responds to a key encryption request sent by the data encryption service, which carries the data key, by encrypting the data key and obtaining and returning the encryption key.

4. The data processing method according to any one of claims 1-3, further comprising, after sending the ciphertext data and the encryption key to the target storage unit according to the unit path: The encrypted data and the encryption key of the target storage unit are persisted to the target storage medium.

5. The data processing method according to any one of claims 2-4, wherein parsing the data to be processed, and if the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, triggering a data encryption service and a key management service to encrypt the data to be processed to obtain ciphertext data and an encryption key, includes: Parse the data to be processed and determine the data identifier of the data to be processed; If the data attribute of the data to be processed is determined to be the target data attribute based on the data identifier, the data encryption service and key management service are triggered to encrypt the data to be processed and obtain ciphertext data and encryption key.

6. The data processing method according to any one of claims 1-5, further comprising: The system receives a data processing request from a target worker node for a target storage unit, wherein the data processing request carries a data identifier of the data to be acquired and a unit path of the target storage unit; based on the data identifier and the unit path, it retrieves the ciphertext data and encryption key corresponding to the data to be acquired from the target storage unit and returns the ciphertext data and encryption key to the target worker node; it receives a decryption request from the target worker node, wherein the decryption request carries the ciphertext data, the encryption key, and node information; it triggers a data decryption service and a key management service, and obtains the data to be acquired based on the ciphertext data, the encryption key, and the node information.

7. The data processing method according to any one of claims 1-6, wherein the target storage unit is a sensitive data storage unit.

8. A data processing method, applied to an application programming interface (API) service unit of a data processing cluster, the method comprising: The system receives a data processing request sent by a target working node for a target storage unit, wherein the data processing request carries a data identifier of the data to be acquired and a unit path of the target storage unit; based on the data identifier and the unit path, the system obtains the encrypted data and encryption key corresponding to the data to be acquired from the target storage unit, and returns the encrypted data and encryption key to the target working node; Receive a decryption request sent by the target working node, wherein the decryption request carries the ciphertext data, the encryption key, and node information; obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information.

9. The data processing method according to claim 8, further comprising, after receiving the decryption request sent by the target working node: The data decryption service and password management service are triggered to obtain the data to be acquired based on the ciphertext data, the encryption key, and the node information.

10. The data processing method according to claim 8 or 9, wherein obtaining the ciphertext data and encryption key corresponding to the data to be obtained from the target storage unit based on the data identifier and the unit path includes: Based on the unit path, determine the target storage unit corresponding to the unit path; Based on the data identifier, determine the data to be acquired corresponding to the data identifier from the target storage unit, and acquire the ciphertext data and the encryption key corresponding to the data to be acquired.

11. The data processing method according to claim 9 or 10, wherein the triggering of the data decryption service and the password management service, based on the ciphertext data, the encryption key, and the node information, obtains the data to be acquired, including: The data decryption service is triggered, and the node information is verified using the data decryption service to obtain the verification result of the target working node; Based on the verification result, the encrypted data, and the encryption key, the data to be acquired is obtained.

12. The data processing method according to claim 11, wherein obtaining the data to be acquired based on the verification result, the ciphertext data, and the encryption key includes: If the verification result is determined to be the target verification result, the data decryption service is triggered to call the key management service to decrypt the encryption key, so that the data decryption service can use the decrypted data key to decrypt the ciphertext data, obtain and send the data to be obtained to the application interface service unit. Receive the data to be acquired sent by the data decryption service.

13. The data processing method according to any one of claims 9-12, wherein receiving the data processing request for the target storage unit sent by the target working node includes: Receive a data processing request for the target storage unit sent by the target working node based on the unit configuration information of the target resource management unit, when it is determined that there is a target resource management unit to be run; The trigger data decryption service and key management service, after obtaining the data to be acquired based on the ciphertext data, the encryption key, and the node information, further include: sending the data to be acquired to the target working node so that the target working node establishes an association between the data to be acquired and the target resource management unit.

14. The data processing method according to any one of claims 8-13, further comprising: The system receives a data processing request from a client for a target storage unit, wherein the data processing request carries data to be processed and the unit path of the target storage unit; it parses the data to be processed, and if the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, it triggers a data encryption service and a key management service to encrypt the data to be processed, obtaining ciphertext data and an encryption key; and it sends the ciphertext data and the encryption key to the target storage unit according to the unit path.

15. A data processing cluster, comprising an application programming interface (API) service unit, a data encryption service, and a key management service, wherein the API service unit receives a data processing request sent by a client for a target storage unit, wherein... The data processing request carries the data to be processed and the unit path of the target storage unit. The data to be processed is parsed, and if the data attribute of the data to be processed is determined to be the target data attribute based on the parsing result, the data encryption service is triggered to generate a data key. The data encryption service uses the data key to encrypt the data to be processed, obtaining ciphertext data. And send a key encryption request to the key management service, wherein the key encryption request carries the data key; The key management service, in response to the key encryption request, encrypts the data key to obtain an encryption key and returns the encryption key to the data encryption service; the data encryption service sends the ciphertext data and the encryption key to the application interface service unit; the application interface service unit sends the ciphertext data and the encryption key to the target storage unit according to the unit path and sends a success response to the client.

16. The data processing cluster according to claim 15, further comprising, after sending the encrypted data and the encryption key to the target storage unit according to the unit path: The application programming interface service unit persists the encrypted data and the encryption key from the target storage unit to the target storage medium.

17. A data processing cluster, comprising a target worker node, an application programming interface (API) service unit, a data decryption service, and a key management service, wherein, The target working node sends a data processing request for a target storage unit to the application programming interface (API) service unit. The data processing request carries a data identifier for the data to be acquired and the unit path of the target storage unit. The API service unit receives the data processing request, retrieves the encrypted data and encryption key corresponding to the data to be acquired from the target storage unit based on the data identifier and the unit path, and returns the encrypted data and encryption key to the target working node. The target working node sends a decryption request to the data decryption service through the API service unit. The decryption request carries the encrypted data, the encryption key, and node information. The data decryption service receives the decryption request, verifies the node information, obtains the verification result of the target working node, and if the verification result is the target verification result, sends a key decryption request to the key management service. The key decryption request carries the encryption key. In response to the key decryption request, the key management service decrypts the encryption key to obtain a data key and sends the data key to the data decryption service. The data decryption service decrypts the encrypted data according to the data key to obtain the data to be acquired, and sends the data to be acquired to the target working node through the application programming interface service unit.

18. The data processing cluster according to claim 17, wherein sending a data processing request for the target storage unit to the application programming interface service unit includes: When the target working node determines that there is a target resource management unit to be run, it sends a data processing request for the target storage unit to the application interface service unit according to the unit configuration information of the target resource management unit.

19. The data processing cluster according to claim 17 or 18, after sending the data to be acquired to the target worker node through the application programming interface service unit, it further includes: The target working node establishes an association between the data to be acquired and the target resource management unit.

20. A computing device, comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions, which, when executed by the processor, implement the steps of the data processing method according to any one of claims 1 to 14.

21. A computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 14.

22. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 14.

Images