METHOD AND APPARATUS FOR PROCESSING DATA, COMPUTER DEVICE AND STORAGE MEDIUM

• US 20190325147A1
• Filed: 03/13/2019
• Published: 10/24/2019
• Est. Priority Date: 04/18/2018
• Status: Active Grant

• Current Assignee: Beijing Baidu Netcom Science and Technology Company Limited (Baidu Incorporated)
• Original Assignee: Beijing Baidu Netcom Science and Technology Company Limited (Baidu Incorporated)
• Inventors: Lu, Wei, Zhou, Fei, Lian, Linjiang, Wang, Meng, Niu, Xianhui
• Granted Patent: US 11,397,820 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

Some embodiments disclose a method and apparatus for processing data, a computer device and a storage medium. A method can include: acquiring, by a cloud storage system, a series of slices obtained by dividing a to-be-stored file; encrypting, by the cloud storage system, each slice by using a different data key; and storing, by the cloud storage system, an encrypted data ciphertext.

Claims

1. A method for processing data, the method comprising:

acquiring, by a cloud storage system, a series of slices obtained by dividing a to-be-stored file;

encrypting, by the cloud storage system, each slice by using a different data key; and

storing, by the cloud storage system, an encrypted data ciphertext,

wherein the method is performed by at least one hardware processor.

2. The method according to claim 1, wherein,

the encrypting, by the cloud storage system, each slice by using a different data key comprises:

encrypting, by the cloud storage system, each slice according to a data key acquired from a key management system; and

the method further comprises;

in response to determining that any data ciphertext needs to be decrypted, decrypting, by the cloud storage system, the data ciphertext according to a data key corresponding to the data ciphertext and acquired from the key management system.

3. The method according to claim 2, wherein,

the method further comprises:

buffering, by the cloud storage system, the data key acquired from the key management system, wherein the buffered data key comprises;

an unused data key and a used data key;

in response to determining that any slice needs to be encrypted, encrypting, by the cloud storage system, using the buffered unused data key on the slice; and

in response to determining that any data ciphertext needs to be decrypted, and in response to determining that the data key corresponding to the data ciphertext is buffered, decrypting, by the cloud storage system, using the buffered data key on the data ciphertext.

4. The method according to claim 3, wherein,

the method further comprises:

dynamically adjusting, by the cloud storage system, the buffered data key.

5. The method according to claim 2, wherein,

the method further comprises:

in response to performing data writing, encrypting, by the cloud storage system, existing data in a buffer, while writing data into the buffer, and writing encrypted data ciphertext into a back-end; and

in response to performing data reading, decrypting, by the cloud storage system, existing data in a buffer, while writing data into the buffer, and returning decrypted data plaintext to a user.

6. The method according to claim 2, wherein,

each data key in the key management system is encrypted using a master key and stored in a form of ciphertext;

each master key is encrypted using a root master key and stored in a form of ciphertext; and

each root master key is encrypted and stored using a hardware encryptor.

7. The method according to claim 6, wherein,

in response to determining that any slice needs to be encrypted, acquiring, by the cloud storage system, a data key in a form of plaintext and a data key in a form of ciphertext corresponding to the slice from the key management system, encrypting the slice using the data key in the form of plaintext, and storing encrypted data ciphertext and the data key in the form of ciphertext;

and in response to determining that any data ciphertext needs to be decrypted, sending, by the cloud storage system, the data key in the form of ciphertext stored together with the data ciphertext to the key management system, acquiring the data key in the form of plaintext returned by the key management system, and decrypting the data ciphertext according to the data key in the form of plaintext.

8. An apparatus for processing data, applied to a cloud storage system, comprising:

at least one processor; and

a memory storing instructions, wherein the instructions when executed by the at least one processor, cause the at least one processor to perform operations, the operations comprising;

acquiring a series of slices obtained by dividing a to-be-stored file;

encrypting each slice by using a different data key; and

storing an encrypted data ciphertext.

9. The apparatus according to claim 8, wherein,

the encrypting, by the cloud storage system, each slice by using a different data key comprises:

encrypting each slice according to a data key acquired from a key management system; and

the operations further comprise;

in response to determining that any data ciphertext needs to be decrypted, decrypting the data ciphertext according to a data key corresponding to the data ciphertext and acquired from the key management system.

10. The apparatus according to claim 9, wherein,

the operations further comprise:

buffering the data key acquired from the key management system, wherein the buffered data key comprises;

an unused data key and a used data key;

in response to determining that any slice needs to be encrypted, encrypting the slice using the buffered unused data key; and

in response to determining that any data ciphertext needs to be decrypted, and in response to determining that the data key corresponding to the data ciphertext is buffered, decrypting the data ciphertext using the buffered data key.

11. The apparatus according to claim 10, wherein,

the operations further comprise:

dynamically adjusting the buffered data key.

12. The apparatus according to claim 9, wherein,

the operations further comprise:

in response to performing data writing, encrypting existing data in a buffer, while writing data into the buffer, and writing encrypted data ciphertext into a back-end; and

in response to performing data reading, decrypting existing data in a buffer, while writing data into the buffer, and returning decrypted data plaintext to a user.

13. The apparatus according to claim 9, wherein,

each data key in the key management system is encrypted using a master key and stored in a form of ciphertext;

each master key is encrypted using a root master key and stored in a form of ciphertext; and

each root master key is encrypted and stored using a hardware encryptor.

14. The apparatus according to claim 13, wherein,

in response to determining that any slice needs to be encrypted, acquiring a data key in a form of plaintext and a data key in a form of ciphertext corresponding to the slice from the key management system, encrypting the slice using the data key in the form of plaintext, and storing encrypted data ciphertext and the data key in the form of ciphertext;

and

in response to determining that any data ciphertext needs to be decrypted, sending the data key in the form of ciphertext stored together with the data ciphertext to the key management system, acquiring the data key in the form of plaintext returned by the key management system, and decrypting the data ciphertext according to the data key in the form of plaintext.

15. A non-transitory computer readable storage medium, storing a computer program thereon, wherein the computer program, when executed by a processor, causes the processor to perform operations, the operations comprising:

acquiring a series of slices obtained by dividing a to-be-stored file;

encrypting each slice by using a different data key; and

storing an encrypted data ciphertext.

16. The non-transitory computer readable storage medium according to claim 15, wherein,

the encrypting, by the cloud storage system, each slice by using a different data key comprises:

encrypting each slice according to a data key acquired from a key management system; and

the operations further comprise;

in response to determining that any data ciphertext needs to be decrypted, decrypting the data ciphertext according to a data key corresponding to the data ciphertext and acquired from the key management system.

17. The non-transitory computer readable storage medium according to claim 16, wherein,

the operations further comprise:

buffering the data key acquired from the key management system, wherein the buffered data key comprises;

an unused data key and a used data key;

in response to determining that any slice needs to be encrypted, encrypting the slice using the buffered unused data key; and

in response to determining that any data ciphertext needs to be decrypted, and in response to determining that the data key corresponding to the data ciphertext is buffered, decrypting the data ciphertext using the buffered data key.

18. The non-transitory computer readable storage medium according to claim 17, wherein,

the operations further comprise:

dynamically adjusting the buffered data key.

19. The non-transitory computer readable storage medium according to claim 16, wherein,

the operations further comprise:

in response to performing data writing, encrypting existing data in a buffer, while writing data into the buffer, and writing encrypted data ciphertext into a back-end; and

in response to performing data reading, decrypting existing data in a buffer, while writing data into the buffer, and returning decrypted data plaintext to a user.

20. The non-transitory computer readable storage medium according to claim 16, wherein,

each data key in the key management system is encrypted using a master key and stored in a form of ciphertext;

each master key is encrypted using a root master key and stored in a form of ciphertext; and

each root master key is encrypted and stored using a hardware encryptor.