CN103699855A - Data processing method and data processing device - Google Patents

Abstract

The invention provides a data processing method and a data processing device. The method comprises the steps of confirming at least one target logic storage unit from a plurality of logic storage units in a storage array; reading metadata stored in the target logic storage unit; encrypting the metadata; storing the encrypted metadata into the target logic storage unit. Before the storage array is moved, the metadata in the logic storage units in the storage array can be encrypted by the data processing method, so that the data leakage in the moving process of the storage array can be reduced, and the safety of the data can be improved.

Description

A data processing method and device

technical field

The present invention relates to the technical field of data processing, and more specifically relates to a data processing method and device.

Background technique

A storage array is also called a disk array. It combines multiple disks together and uses them as a single disk. It stores data in different disks in a segmented manner. When accessing data, the disk array Related disks will act together, thus greatly reducing data access time.

In practical applications, it is often necessary to move the location of the storage array. For example, due to the aging or expansion of the computer room, the physical equipment with the storage array in the computer room is moved to other places. However, during the process of moving the storage array, if unauthorized If the user maliciously copies the data in the disk, the data in the disk will be leaked, affecting the security of the data.

Contents of the invention

In view of this, the present invention provides a data processing method and device, so as to reduce the data leakage in the disk during the moving process of the storage array and improve the security of the data.

To achieve the above object, a first aspect of the present invention provides a data processing method, including:

determining at least one target logical storage unit from a plurality of logical storage units of the storage array;

reading metadata stored in the target logical storage unit;

Encrypting the metadata to obtain encrypted metadata;

updating the metadata stored in the target logical storage unit to the encrypted metadata.

With reference to the first aspect, in a first possible implementation manner, the determining at least one target logical storage unit from the multiple logical storage units of the storage array includes:

The information of the logical storage unit to be encrypted sent by the designated node is received, and the logical storage unit to be encrypted is determined as the target logical storage unit.

Alternatively, all logical storage units of the storage array are determined as the target logical storage units.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second possible implementation manner, after determining at least one target logical storage unit from the plurality of logical storage units in the storage array, further include:

Querying whether data other than the metadata is stored in the target logical storage unit;

The reading the metadata stored in the target logical storage unit includes:

When data other than the metadata is stored in the target logical storage unit, the metadata stored in the target logical storage unit is read.

With reference to the first aspect, in a third possible implementation manner, the determining at least one target logical storage unit from the plurality of logical storage units of the storage array includes:

From the plurality of logical storage units of the storage array, a target logical storage unit storing data other than metadata is determined.

With reference to the first aspect, in a fourth possible implementation manner, after updating the metadata stored in the target logical storage unit to the encrypted metadata, the method further includes:

Generating identification information for the target logical storage unit, where the identification information is used to indicate that the metadata in the target logical unit is encrypted.

A second aspect of the present invention also provides a data processing device, including:

a target determining unit, configured to determine at least one target logical storage unit from a plurality of logical storage units in the storage array;

a data reading unit, configured to read the metadata stored in the target logical storage unit determined by the target determining unit;

An encryption unit, configured to encrypt the metadata read by the data reading unit to obtain encrypted metadata;

A data update unit, configured to update the metadata stored in the target logical storage unit with the encrypted metadata obtained by the encryption unit.

With reference to the second aspect, in a first possible implementation manner, the target determination unit includes:

The first target determining unit is configured to receive the information of the logical storage unit to be encrypted sent by the designated node, and determine the logical storage unit to be encrypted as the target logical storage unit.

Alternatively, the second target determining unit is configured to determine all logical storage units of the storage array as the target logical storage units.

With reference to the second aspect or the first possible implementation manner of the second aspect, in a second possible implementation manner, the device further includes:

a query unit, configured to query whether data other than the metadata is stored in the target logical storage unit determined by the target determination unit;

The data reading unit includes:

A first data reading unit, configured to read the metadata stored in the target logical storage unit when the query unit determines that data other than the metadata is stored in the target logical storage unit .

With reference to the second aspect, in a third possible implementation manner, the target determining unit includes:

The third target determining unit is configured to determine a target logical storage unit storing data other than metadata from among the plurality of logical storage units of the storage array.

With reference to the second aspect, in a fourth possible implementation manner, the device further includes:

an identification unit, configured to generate identification information for the target logical storage unit after the data update unit updates the metadata in the target logical storage unit to encrypted metadata, and the identification information is used to indicate The metadata in the target logical unit is encrypted.

It can be known from the above-mentioned technical solution that the metadata in the target logic unit in the storage array of the present invention is encrypted metadata, so that during the moving process of the storage array, unauthorized users cannot access the metadata due to After decryption, the metadata information in the target logical storage unit cannot be obtained, so that the data stored in the disk cannot be accessed according to the metadata, thereby preventing unauthorized users from maliciously stealing the data in the storage array and improving data security.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings on the premise of not paying creative efforts.

Fig. 1 shows a schematic flow chart of an embodiment of a data processing method of the present invention;

Fig. 2 shows a schematic flow chart of another embodiment of a data processing method of the present invention

FIG. 3 shows a schematic structural diagram of another embodiment of a data processing method of the present invention;

FIG. 4 shows a schematic structural diagram of an embodiment of a data processing method of the present invention;

Fig. 5 shows a schematic structural diagram of another embodiment of a data processing method of the present invention;

FIG. 6 shows a schematic structural diagram of a storage array of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The invention provides a data processing method, which can effectively reduce the data leakage during the moving process of the storage array and improve the security of the data.

Referring to FIG. 1 , it shows a schematic flow chart of an embodiment of a data processing method of the present invention. The method of this embodiment can be applied to a storage network with a storage array, such as a storage area network (SAN, Storage Area Network), direct connection storage network (DAS, Direct-Attached Storage), etc., the method of this embodiment may include:

S101. Determine at least one target logical storage unit from multiple logical storage units in a storage array.

The storage space of a storage array is the sum of the storage space of each disk in the storage array. In practical applications, the total storage space of all disks in the storage array is generally regarded as a virtual logical disk space, and multiple logical storage units can be obtained by dividing the logical disk space. The storage space of each logical storage unit generally spans multiple disks

The logical storage unit is a basic unit for data storage in the storage array, and each logical storage unit corresponds to a logical unit number (LUN, Logical Unit Number).

Wherein, the target logical storage unit is a logical storage unit requiring data protection, that is, a logical storage unit to be encrypted.

S102. Read metadata stored in the target logical storage unit.

Among them, metadata refers to data about data, which defines and describes data, and is a special kind of data.

The data stored in the logical storage unit includes: metadata and data not belonging to the metadata, wherein the data stored in the logical storage unit not belonging to the metadata is commonly known as user data. Generally, after the user data is stored in the logical storage unit, metadata for describing the user data will be correspondingly generated in the logical storage unit. Wherein, the metadata describing the user data may be the name, storage time, etc. of the user data. Compared with the user data stored in the logical storage unit, the amount of metadata is small.

When a user accesses a logical storage unit in the storage array through other devices, the metadata of the logical storage unit must be searched, and then the corresponding user data can be queried based on the metadata. If the metadata is inaccurate, it will affect the Read of user data in the logical storage unit. For example, making the read user data incorrect.

In this embodiment, for any target logical storage unit, the controller of the storage array will read the metadata of the target logical storage unit.

S103. Encrypt the metadata to obtain encrypted metadata.

After the controller of the storage array reads the metadata from the target logic unit, it encrypts the read metadata, so as to obtain the encrypted metadata.

When the user accesses the target logical unit of the storage array through other devices, the metadata in the target logical storage unit must be obtained first, and then the user data in the target logical storage unit can be accessed according to the metadata. Therefore, in When the metadata of the target logical storage unit is encrypted, others cannot correctly read the user data stored in the target logical storage unit through other devices.

Encrypting metadata can be based on a set key and combined with a preset encryption algorithm. The encryption process can be the same as the existing data encryption process. For example, it can be based on the Advanced Encryption Standard (AES, Advanced Encryption Standard ), and can also be encrypted based on other encryption algorithms, which are not limited here.

S104. Update the metadata stored in the target logical storage unit to the encrypted metadata.

After encrypting the read metadata, the controller of the storage array stores the encrypted metadata in the target logical storage unit, so as to update the metadata stored in the target logical storage unit to the encrypted metadata.

In this embodiment, the metadata in the target logical unit in the storage array is encrypted metadata. If the user cannot decrypt the encrypted metadata, the metadata in the target logical storage unit cannot be obtained. Data information, so that the data stored in the target logical storage unit cannot be accessed according to the metadata. In this way, before the storage array is relocated, if the metadata in the target logical storage unit of the storage array is encrypted by the method of the present invention, then in the process of relocating the storage array, unauthorized users cannot After decryption, the data in the target logical storage unit cannot be accessed according to the metadata, thereby ensuring that the data stored in the disk is not maliciously stolen by other users and improving data security.

In addition, since the amount of metadata in the target logical storage unit is much smaller than that of user data, compared with encrypting all data in the target logical storage unit, only reading the metadata in the target logical unit and encrypting Metadata encryption can not only improve data security, but also reduce the amount of data processing, reduce the time-consuming data processing, and reduce resource consumption.

In the embodiment of the present invention, the condition for triggering the storage array to determine the target logical storage unit may be the detection of an encryption instruction, or the arrival of a preset encryption time. Wherein, the storage array detects an encryption instruction may be that the storage array receives an encryption instruction sent by a specified node. Wherein, the specified node may be a computer or other control device that is connected to the storage array through a physical line or a network and controls the storage array.

There may be multiple ways of determining the target logical storage unit by the storage array.

Optionally, a manner of determining a target logical storage unit may be: the storage array uses all logical storage units in the storage array as target logical storage units to be encrypted.

Another manner of determining the target logical storage unit may be that the storage array receives the information of the logical storage unit to be encrypted sent by the user through the designated node, and determines the logical storage unit corresponding to the information as the target logical storage unit. For example, before encryption, the user can access the storage array through a designated node, and then select the logical storage unit that the user thinks needs to be encrypted, and send the logical unit number of the selected logical storage unit to the storage array through the designated node, The storage array determines the logical storage unit corresponding to the logical unit number as the target logical storage unit.

It can be understood that, when there is no user data stored in the logical storage unit of the storage array, the logical storage unit will also have metadata. After the user data is stored in the logical storage unit, the logical Metadata related to the user data is also generated in the storage unit. Therefore, if no user data is stored in the logical storage unit, it is meaningless to encrypt the metadata in the logical storage unit, and it will waste data processing time and consume resources.

In order to reduce resource consumption, refer to FIG. 2 , which shows a schematic flow chart of another embodiment of a data processing method of the present invention. The method of this embodiment may include:

S201. Determine at least one target logical storage unit from multiple logical storage units in a storage array.

Wherein, the manner of determining the target logical storage unit is not limited in this embodiment.

Optionally, the manner of determining the target logical storage unit may be the two situations described above.

S202. Query whether data other than metadata is stored in the target logical storage unit.

Among the data stored in the logical storage unit, data other than metadata is determined whether there is user data in the logical storage unit.

Any existing query method may be used to query whether data other than metadata is stored in the target logical storage unit, and no limitation is imposed here.

S203. When data other than the metadata is stored in the target logical storage unit, read the metadata stored in the target logical storage unit.

S204. Update the metadata stored in the target logical storage unit to encrypted metadata.

When there is only metadata in the target logical storage unit and no user data is stored, there is no risk of user data being leaked or stolen, and there is no need to read the metadata in the target logical storage unit and perform an encryption operation.

It can be seen that since no user data is stored in the target logical storage unit, there is no risk of data leakage. Therefore, only when user data is stored in the target logical storage unit is queried, the data in the target logical storage unit is read. Metadata, and encrypting metadata can avoid reading useless metadata, reduce the amount of data reading and processing, and thus reduce the time-consuming data processing.

It can be understood that, on the premise of ensuring data security, in order to reduce the amount of data processing, when the storage array determines the target logical storage unit, it may be a logical storage unit that stores data other than metadata in the storage array Determined as the target logical storage unit. For example, when determining the target logical storage unit, the controller of the storage array may sequentially query whether user data is stored in each logical storage unit in addition to metadata, and determine the logical storage unit storing user data as the storage unit. For example, there are 10 logical storage units in the storage array, but only 6 of them store data in the logical storage units. After the storage array finds that the 6 logical storage units store data, the 6 logical storage units are stored The unit is determined as a target logical storage unit to be encrypted.

The target logical storage units determined in this way all store user data, and there is no need to read meaningless metadata when performing query operations, that is to say, there is no waste of data reading and processing Condition.

Of course, in practical applications, after a user accesses the storage array through a designated node, the user can see which logical storage units store data, so the user can select from the logical storage units that store user data to be encrypted In this way, after the storage array determines the logical unit selected by the user as the target logical storage unit, there is no need to query whether data other than metadata is stored in the target logical storage unit.

Referring to Fig. 3, it shows a schematic flow chart of another embodiment of a data processing method of the present invention, the method of this embodiment may include:

S301. Determine at least one target logical storage unit from multiple logical storage units in a storage array.

S302, read metadata stored in the target logical storage unit

S303. Encrypt the metadata to obtain encrypted metadata.

S304. Update the metadata stored in the target logical storage unit to encrypted metadata.

Wherein, for the above steps 301 to 304, reference may be made to relevant descriptions in any of the foregoing embodiments, and details are not repeated here.

Optionally, before step 302 in this embodiment, it may also include querying whether data other than metadata is stored in the target logical storage unit, and when it is determined that the target logical storage unit stores data other than metadata , execute step 302.

S305. Generate identification information for the target logical storage unit, where the identification information is used to indicate that the metadata in the target logical unit is encrypted.

Since there are multiple logical storage units in the storage array, in order to quickly and accurately determine the target logical storage unit storing encrypted metadata during subsequent decryption, the metadata in the target logical storage unit is updated to encrypted After the metadata of the target logical storage unit, identification information needs to be generated for the target logical storage unit. In this way, when the storage array needs to be decrypted, the target logical storage unit with identification information can be determined as the logical storage unit that needs to be decrypted.

Wherein, the identification information can be stored in a specified location of the target logical storage unit, and when the metadata is encrypted, the data in the specified location can still be read.

Wherein, the order of the step 204 and the step 205 is not limited to that shown in FIG. 2 , and the order of the step 204 and the step 205 can be interchanged, that is, the step 205 is executed first and then the step 204 is executed, or the step is executed simultaneously 204 and step 205.

After the target logical storage unit is encrypted by any of the above methods, the storage array can be moved to a designated location. After the storage array is moved to the specified location, the controller of the storage array can decrypt the metadata in the target logical storage unit. For example, the storage array may decrypt the metadata in the target logical storage unit after detecting the decryption instruction. When decrypting the metadata in the target logical storage unit, it can be decrypted according to a preset key and in combination with a specific decryption algorithm.

Wherein, when metadata decryption needs to be performed, the controller of the storage array can sequentially determine whether each logical storage unit is encrypted, and then determine the target logical storage unit storing the encrypted metadata, and the target logical storage unit The metadata in is decrypted.

In particular, after the metadata is encrypted, if the storage array generates identification information for the target logical storage unit, when decryption is required, the target logical storage unit whose metadata is encrypted can be determined according to the identification information, and then the The metadata in the target logical storage unit is decrypted.

Corresponding to a data processing method of the present invention, the present invention also provides a data processing device, which can be applied to a storage array, see FIG. 4, which shows an embodiment of a data processing device of the present invention As a schematic structural diagram, the device of this embodiment may include: a target determining unit 401 , a data reading unit 402 , an encrypting unit 403 and a data updating unit 404 .

Wherein, the target determining unit 401 is configured to determine at least one target logical storage unit from a plurality of logical storage units in the storage array.

The data reading unit 402 is configured to read the metadata stored in the target logical storage unit determined by the target determining unit.

The encryption unit 403 is configured to encrypt the metadata read by the data reading unit to obtain encrypted metadata.

A data update unit 404, configured to update the metadata stored in the target logical storage unit with the encrypted metadata obtained by the encryption unit.

In this embodiment, after the encryption unit encrypts the metadata in the target logic unit in the storage array, the data updating unit updates the metadata in the target storage array to the encrypted metadata. In this way, during the moving process of the storage array, since unauthorized users cannot decrypt the metadata, they cannot obtain the metadata information in the target logical storage unit, and thus cannot access the storage in the disk according to the metadata. data, thereby preventing unauthorized users from maliciously stealing data in the storage array and improving data security.

Optionally, the target determination unit includes:

The first target determining unit is configured to receive the information of the logical storage unit to be encrypted sent by the designated node, and determine the logical storage unit to be encrypted as the target logical storage unit.

Alternatively, the second target determining unit is configured to determine all logical storage units of the storage array as the target logical storage units.

Referring to Fig. 5, another embodiment of a data processing device of the present invention is shown. The device of this embodiment is different from the embodiment of the previous device in that:

In this embodiment, it further includes: a query unit 405, configured to query whether data other than the metadata is stored in the target logical storage unit determined by the target determination unit 401;

Correspondingly, the data reading unit 402 includes:

The first data reading unit 4021 is configured to read the metadata stored in the target logical storage unit when the query unit determines that data other than the metadata is stored in the target logical storage unit. data.

After the target determining unit determines the target logical storage unit, the query unit inquires whether data other than metadata is stored in the target logical storage unit, and only when it is determined that metadata is stored in the target logical storage unit, the first Only the data reading unit reads the metadata, thereby avoiding reading meaningless metadata when no user data is stored in the target logical storage unit, thereby reducing the amount of data read.

Optionally, on the other hand, the target determination unit may also include:

The third target determining unit is configured to determine a target logical storage unit storing data other than metadata from among the plurality of logical storage units of the storage array.

The target logical storage units determined by the third target determining unit all store user data, so there is no need to inquire whether data other than metadata is stored in the target logical storage unit.

Further, in any one of the above embodiments, the data processing device may further include:

an identification unit, configured to generate identification information for the target logical storage unit after the data update unit updates the metadata in the target logical storage unit to encrypted metadata, and the identification information is used to indicate The metadata in the target logical unit is encrypted.

By using the identification unit to identify the target logical storage unit storing the encrypted metadata, when decryption is required, the target logical storage unit whose metadata is encrypted can be quickly determined.

In addition, the present invention also provides a storage array, referring to FIG. 6 , which shows a schematic structural diagram of a storage array of the present invention, the storage array 600 includes a controller 601 and multiple disks 602, and the multiple disks pass through The disk enclosures are fastened together.

Wherein, the controller is connected to the plurality of disks. Wherein, the storage space of the multiple disks is virtualized into multiple logical storage units.

The controller 601 is configured to store at least one target logical storage unit determined from a plurality of logical storage units of the storage array; read metadata stored in the target logical storage unit; encrypt the metadata, Obtain encrypted metadata; update the metadata stored in the target logical storage unit with the encrypted metadata obtained by the encryption unit.

Information about programs executed by the controller is stored in the disk array 602 .

The storage array is also provided with a disk frame, the disk frame is not shown in Figure 6, a communication bus is provided on the disk frame, the controller is connected to the communication bus on the disk frame, and each disk is connected to the disk frame The communication bus is connected to realize the connection between the controller and the disk.

As for the device embodiment, since it basically corresponds to the method embodiment, for related parts, please refer to the description of the method embodiment. The system embodiments described above are only illustrative, and some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without creative effort.

In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways without exceeding the spirit and scope of the present application. The present embodiment is only an exemplary example and should not be taken as a limitation, and the specific content given should not limit the purpose of the present application. For example, the division of the units or subunits is only a division of logical functions. In actual implementation, there may be other division methods, such as combining multiple units or multiple subunits. Also, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not implemented.

The foregoing is only a specific embodiment of the present invention. It should be pointed out that for those of ordinary skill in the art, some improvements and modifications can also be made without departing from the principle of the present invention. It should be regarded as the protection scope of the present invention.

Claims (10)

1. a data processing method, is characterized in that, comprising:

From a plurality of logic storage units of storage array, determine at least one target logic storage unit;

Read the metadata of storing in described target logic storage unit;

Described metadata is encrypted, obtains the metadata of encrypting;

The metadata that is described encryption by the described metadata updates of storing in described target logic storage unit.

2. method according to claim 1, is characterized in that, described at least one target logic storage unit of determining from a plurality of logic storage units of storage array, comprising:

The information that receives the logic storage unit to be encrypted of specified node transmission, is defined as described target logic storage unit by described logic storage unit to be encrypted;

Or, all logic storage units of described storage array are all defined as to described target logic storage unit.

3. method according to claim 1 and 2, is characterized in that, described from a plurality of logic storage units of storage array, determine at least one target logic storage unit after, also comprise:

Inquire about in described target logic storage unit and whether store the data outside described metadata;

The described metadata of storing in described target logic storage unit that reads, comprising:

While storing the data outside described metadata in described target logic storage unit, read the described metadata of storing in described target logic storage unit.

4. method according to claim 1, is characterized in that, described at least one target logic storage unit of determining from a plurality of logic storage units of storage array, comprising:

From a plurality of logic storage units of described storage array, determine the target logic storage unit of the data that store outside metadata.

5. method according to claim 1, is characterized in that, after the described metadata that is described encryption by the metadata updates of storing in described target logic storage unit, also comprises:

For described target logic storage unit generating identification information, described identification information is for showing that the described metadata of described destination logical unit is encrypted.

6. a data processing equipment, is characterized in that, comprising:

Target determining unit, for determining at least one target logic storage unit from a plurality of logic storage units of storage array;

Data-reading unit, the metadata of storing for reading described target logic storage unit that described target determining unit determines;

Ciphering unit, is encrypted for the described metadata that described data-reading unit is read, and obtains the metadata of encrypting;

Data updating unit is the metadata of the described encryption that obtains of described ciphering unit for the described metadata updates that described target logic storage unit is stored.

7. device according to claim 6, is characterized in that, described target determining unit, comprising:

First object determining unit, for receiving the information of the logic storage unit to be encrypted of specified node transmission, is defined as described target logic storage unit by described logic storage unit to be encrypted;

Or the second target determining unit, for being all defined as described target logic storage unit by all logic storage units of described storage array.

8. according to the device described in claim 6 or 7, it is characterized in that, also comprise:

Whether query unit, store the data outside described metadata for inquiring about the described target logic storage unit that described target determining unit determines;

Described data-reading unit, comprising:

The first data-reading unit, while storing the data outside described metadata for determine described target logic storage unit when described query unit, reads the described metadata of storing in described target logic storage unit.

9. device according to claim 6, is characterized in that, described target determining unit, comprising:

The 3rd target determining unit, for a plurality of logic storage units from described storage array, determines the target logic storage unit of the data that store outside metadata.

10. device according to claim 6, is characterized in that, described device also comprises:

Identify unit, after the described metadata updates of described target logic storage unit being the metadata of encrypting in described data updating unit, for described target logic storage unit generating identification information, described identification information is for showing that the described metadata of described destination logical unit is encrypted.

Images