WO2024051252A1 - 数据处理方法及装置 - Google Patents

数据处理方法及装置 Download PDF

Info

Publication number
WO2024051252A1
WO2024051252A1 PCT/CN2023/100314 CN2023100314W WO2024051252A1 WO 2024051252 A1 WO2024051252 A1 WO 2024051252A1 CN 2023100314 W CN2023100314 W CN 2023100314W WO 2024051252 A1 WO2024051252 A1 WO 2024051252A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
storage pool
storage
attribute
encryption
Prior art date
Application number
PCT/CN2023/100314
Other languages
English (en)
French (fr)
Inventor
邹明
牛浩鑫
张箭
陈滔
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2024051252A1 publication Critical patent/WO2024051252A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/06—Digital input from, or digital output to, record carriers, e.g. RAID, emulated record carriers or networked record carriers

Definitions

  • the present application relates to the field of computers, and in particular, to a data processing method and device.
  • the storage resources of one or more storage devices can be integrated to build a storage pool to achieve large-scale data storage.
  • the encryption attribute of the storage pool when the data in the storage pool needs to be encrypted, the encryption attribute of the storage pool will be configured to be encrypted in advance when the storage pool is created, so that the data to be written can be encrypted and written according to the encryption attribute of the storage pool.
  • Storage pool when the data in the storage pool does not need to be encrypted, the encryption attribute of the storage pool is configured as non-encrypted in advance when creating the storage pool, so that the data to be written can be subsequently written based on the encryption attribute of the storage pool. No encryption is done and written to the storage pool.
  • This application provides a data processing method and device to solve the problem that encryption attributes of a storage pool can only be configured when it is created, resulting in inflexible use of the storage pool.
  • a data processing method includes: receiving configuration information. Update the first encryption attribute of the storage pool to the second encryption attribute according to the configuration information.
  • the encryption attributes of the storage pool can be updated according to actual needs through configuration information. This improves the storage performance of the storage pool.
  • the method further includes: recording a timestamp of updating the first encryption attribute of the storage pool to the second encryption attribute.
  • the storage pool that can switch the encryption attribute may include two kinds of data: one is encrypted data, and the other is unencrypted data. Therefore, by recording the timestamp of the encryption attribute switching, you can use the timestamp and the time when each data is written to the storage pool to distinguish which data is encrypted and which data is not encrypted.
  • the method before updating the first encryption attribute of the storage pool to the second encryption attribute according to the configuration information, the method further includes: writing the first data to the storage pool according to the current first encryption attribute of the storage pool. .
  • the method further includes: rewriting the first data into the storage pool according to the second encryption attribute of the storage pool.
  • the data of the first encrypted attribute in the storage pool can be converted into the data of the second encrypted data, so that the encryption attribute corresponding to each data in the storage pool is consistent with the current encryption attribute of the storage pool.
  • writing the first data to the storage pool according to the current first encryption attribute of the storage pool includes: writing the first data and the first data to the storage pool according to the current first encryption attribute of the storage pool.
  • An identifier is written into the storage pool; the first identifier is used to indicate that the first data corresponds to the first encryption attribute.
  • an identifier for indicating whether the data has been encrypted can be configured (i.e., the above a first identifier corresponding to a piece of data), and write the identifier together with the data into the storage pool. In this way, when reading data, the encryption attribute corresponding to the data can be quickly determined based on the identification.
  • the first identification is stored in the data integrity domain DIF corresponding to the first data in the storage pool.
  • the identification is stored in the DIF corresponding to the data. In this way, when the data is read, by reading the identification in the same sector as the data, it can be determined whether the data is encrypted for subsequent processing. deal with.
  • the first identification is specifically stored in the logical block application identification Meta Tag of the data integrity domain DIF corresponding to the first data in the storage pool.
  • the identifier can be stored in the Meta Tag field used to carry user-defined information in the DIF corresponding to the data, so that the identifier corresponding to the data can be stored without changing the relevant existing protocols.
  • the first identifier is stored in a metadata file in the storage pool; the metadata file is used to record metadata of data stored in the storage pool.
  • the method further includes: receiving a read request.
  • the read request is used to request to read data to be processed.
  • the data to be processed is read according to the encryption attribute corresponding to the data to be processed.
  • the encryption attribute includes either encryption or non-encryption.
  • the data corresponding to the encryption attributes can be read according to different encryption attributes, thereby improving the storage performance of the storage pool.
  • reading the data to be processed according to the encryption attribute corresponding to the data to be processed includes: obtaining an attribute identifier used to indicate the encryption attribute corresponding to the data to be processed; according to the attribute identifier The indicated encryption attribute reads the data to be processed.
  • the encryption attribute corresponding to the data when reading data in the storage pool, can be determined based on the identifier corresponding to the data, and then the data can be read based on the encryption attribute, thereby improving the storage performance of the storage pool.
  • a data processing device including: a communication unit configured to receive configuration information; and an attribute updating unit configured to update a first encryption attribute of a storage pool to a second encryption attribute according to the configuration information.
  • the attribute updating unit is further configured to record a timestamp of updating the first encrypted attribute of the storage pool to the second encrypted attribute.
  • the data processing device further includes a reading and writing unit; the reading and writing unit is configured to write the first data into the storage pool according to the current first encryption attribute of the storage pool.
  • the read-write unit is further configured to rewrite the first data into the storage pool according to the updated second encryption attribute of the storage pool.
  • a read-write unit is configured to write the first data to the storage pool according to the current first encryption attribute of the storage pool, including: the read-write unit, specifically configured to write the first data according to the current first encryption attribute of the storage pool.
  • the read-write unit specifically configured to write the first data according to the current first encryption attribute of the storage pool.
  • the first identification is stored in the data integrity domain DIF corresponding to the first data in the storage pool.
  • the first identification is specifically stored in the logical block application identification Meta Tag of the data integrity domain DIF corresponding to the first data in the storage pool.
  • the first identifier is stored in a metadata file in the storage pool; the metadata file is used to record metadata of data stored in the storage pool.
  • the communication unit is also used to receive a read request; the read request is used to request to read the data to be processed; the read-write unit is used to read all the data according to the encryption attribute corresponding to the data to be processed.
  • the data to be processed; the encryption attribute includes either encryption or non-encryption.
  • a reading and writing unit is used to read the data to be processed according to the encryption attribute corresponding to the data to be processed, including: the reading and writing unit is used to obtain an indication of the data to be processed.
  • the reading and writing unit is configured to read the data to be processed according to the encrypted attribute indicated by the attribute identifier.
  • a data processing device including a memory and a processor.
  • the memory is used to store computer instructions.
  • the processor is used to call and run the computer instructions from the memory to implement the first step as described above. The method described in any implementation manner of the aspect or the first aspect.
  • a storage system including a controller and at least one storage node, the storage node is used to store data, and the controller is used to perform the above-mentioned first aspect or any implementation of the first aspect.
  • a fifth aspect provides a storage system, including a plurality of storage servers, the plurality of storage servers are used to store data, and one or more servers among the plurality of storage servers are used to perform the above-mentioned first aspect or the third aspect.
  • a sixth aspect provides a chip, including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to implement the above first aspect or The method described in any implementation manner of the first aspect.
  • a computer-readable storage medium is provided.
  • a computer program is stored in the storage medium.
  • the computer program is executed by a processor, the above-mentioned first aspect or any one of the implementation methods of the first aspect is implemented. method described.
  • a computer program product includes instructions. When the instructions are run on a processor, the method described in the above first aspect or any implementation manner of the first aspect is implemented.
  • Figure 1 is a schematic structural diagram of a storage system provided by an embodiment of the present application.
  • Figure 2 is one of the schematic flow diagrams of a data processing method provided by an embodiment of the present application.
  • Figure 3 is a second schematic flowchart of a data processing method provided by an embodiment of the present application.
  • Figure 4 is the third flow diagram of a data processing method provided by the embodiment of the present application.
  • Figure 5 is the fourth schematic flowchart of a data processing method provided by an embodiment of the present application.
  • Figure 6 is a schematic flowchart 5 of a data processing method provided by an embodiment of the present application.
  • Figure 7 is one of the structural schematic diagrams of a data processing device provided by an embodiment of the present application.
  • FIG. 8 is a second structural schematic diagram of a data processing device provided by an embodiment of the present application.
  • words such as “first” and “second” are used to distinguish identical or similar items with basically the same functions and effects.
  • words such as “first” and “second” do not limit the number and execution order, and words such as “first” and “second” do not limit the number and execution order.
  • words such as “exemplary” or “for example” are used to represent examples, illustrations or explanations. Any embodiment or design described in this embodiment as “exemplary” or “such as” is not intended to be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as “exemplary” or “such as” is intended to present related concepts in a concrete manner that is easier to understand.
  • FIG. 1 is a schematic structural diagram of a storage system provided in this embodiment.
  • user data in the storage system 120 can be stored by running an application program.
  • the computer running the application program may be called an "application server", where the application server 100 may be a physical machine or a virtual machine.
  • the application server 100 includes but is not limited to desktop computers, servers, laptop computers, mobile devices, etc.
  • the application server 100 accesses the storage system 120 through the switch 110 to access user data.
  • the switch 110 is only an optional device, and the application server 100 can also directly communicate with the storage system 120 through the network.
  • the switch 110 can also be replaced with an Ethernet switch, an InfiniBand switch, a RoCE (RDMA over Converged Ethernet) switch, etc.
  • Storage system 120 is a device or device cluster for storing user data. Specifically, in actual application, the storage system 120 may be a centralized storage system. A centralized storage system is characterized by a unified entrance through which all data from external devices such as application servers must pass.
  • the entrance to the centralized storage system may be the engine 121 of the centralized storage system.
  • the engine 121 may include one or more controllers.
  • one controller 122 is taken as an example for illustration.
  • the multiple controllers can back up each other through mirror channels.
  • one of the controllers fails, other controllers can take over the services of the failed controller, thus Prevent hardware failure from causing the entire storage system to become unavailable.
  • the engine 121 may also include a front-end interface 125 and a back-end interface 126, where the front-end interface 125 is used to communicate with the application server 100 to provide storage services for the application server 100.
  • the backend interface 126 is used to communicate with the hard disk 127 to expand the capacity of the storage system. Through the backend interface 126, the engine 121 can connect more hard disks 127, thereby forming a very large storage resource pool.
  • the controller 122 may include a processor 123 and a memory 124.
  • the processor 112 may be a central processing unit (CPU), which is used to process data access requests from outside the storage system (such as application servers or other storage systems), and is also used to process requests that occur within the storage system.
  • CPU central processing unit
  • the CPU 123 receives write data requests sent by the application server 100 through the front-end interface 125, the user data in these write data requests will be temporarily stored in the memory 124.
  • the CPU 123 sends the user data stored in the memory 124 to the hard disk 127 for persistent storage through the back-end interface.
  • the memory 124 is an internal memory used to directly exchange data with the processor. It can read and write data at any time and has a fast reading and writing speed. It can be used as a temporary data storage for the operating system or other running programs.
  • the memory 124 can include a variety of memories.
  • the memory can be either a random access memory or a read-only memory (Read Only Memory, ROM).
  • random access memory is dynamic random access memory (Dynamic Random Access Memory, DRAM) or storage class memory (Storage Class Memory, SCM).
  • DRAM is a semiconductor memory that, like most Random Access Memory (RAM), is a volatile memory device.
  • SCM is a composite storage technology that combines the characteristics of traditional storage devices and memory.
  • DRAM and SCM can provide faster reading and writing speeds than hard disks, but the access speed is slower than DRAM and the cost is cheaper than DRAM.
  • DRAM and SCM indicate exemplary descriptions in this embodiment, and the memory may also include other random access memories, such as static random access memory (Static Random Access Memory, SRAM), etc.
  • static random access memory Static Random Access Memory, SRAM
  • read-only memory for example, it can be programmable read-only memory (Programmable Read Only Memory, PROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, EPROM), etc.
  • the memory 124 can also be a dual in-line memory module or a dual in-line memory module (Dual In-line Memory Module, DIMM for short), that is, a module composed of DRAM, or a solid state drive (Solid State Disk, SSD). .
  • the controller 122 may be configured with multiple memories 124 and different types of memories 124 . This embodiment does not limit the number and type of memories 124 .
  • the memory 124 can be configured to have a power-saving function. The power-guaranteing function means that the data stored in the memory 124 will not be lost when the system is powered off and then on again. Memory with a power-saving function is called non-volatile memory.
  • the storage system may include two or more engines 121, and redundancy or load balancing is performed between the multiple engines 121.
  • the engine 121 can also include a hard disk slot.
  • the hard disk 127 can be directly deployed in the engine 121.
  • the back-end interface 126 is an optional configuration. When the system storage space is insufficient, it can be Connect more hard disks or hard disk enclosures through the backend interface 126.
  • FIG. 1 only provides an exemplary structural schematic diagram of a centralized storage system.
  • the storage system 120 may be composed of multiple independent storage servers, and the storage servers may communicate with each other.
  • Each storage server may include hardware components such as a processor, memory, network card, and hard disk.
  • the processor and memory are used to provide computing resources; the processor is used to process data access requests from outside the storage server; the memory is used to directly exchange data with the processor's internal memory. It can read and write data at any time, and it is very fast. Can be used as temporary data storage for the operating system or other running programs.
  • a hard disk is used to provide storage resources, such as storing data.
  • the storage server may also include a network card for communicating with the application server. It is easy to understand that this embodiment does not limit the framework structure of the storage system applying the technical solution provided by this application.
  • the storage resources included in the storage system 120 can be (Multiple hard disks 127 in the figure) are constructed into a storage pool.
  • the application server 100 needs storage space, some/all of the storage space can be divided from the storage pool and provided for the application server 100 to use.
  • each hard disk can be divided into several physical chunks (chunks). These physical chunks are mapped into logical chunks to form a storage pool (pool).
  • the storage pool is used to provide upward storage space. The storage The space actually comes from the hard disk included in the storage system. Of course, not all hard drives provide space for the above storage pools.
  • the storage system may contain one or more storage pools, and one storage pool may include some or all hard disks.
  • multiple logical chunks from different storage nodes (different storage nodes can be understood as different hard disks in Figure 1) form a logical chunk group (chunk group), and the logical chunk group is the minimum allocation unit of the storage pool.
  • the storage pool 120 may provide one or more logical block groups to the storage service layer.
  • the storage service layer further virtualizes the storage space provided by the logical block group into a logical unit (logical unit, LU) for use by the application server 100 .
  • Each logical unit has a unique logical unit number (LUN). Since the application server 100 can directly perceive the logical unit number, those skilled in the art usually directly use LUN to refer to the logical unit.
  • Each LUN has a LUN ID, which identifies the LUN.
  • the specific location of data within a LUN can be determined by the starting address and the length of the data. For the starting address, those skilled in the art usually call it a logical block address (logical block address, LBA). It can be understood that the three factors of LUN ID, LBA and length identify a certain address segment.
  • the data access request generated by the application server usually carries the LUN ID, LBA and length in the request.
  • the encryption attributes of the storage pool are pre-configured when the storage pool is created. Then, when the storage system receives a write request to write data into the storage pool, it will be configured as previously configured. Encryption attribute, the data is encrypted (or not encrypted) and written to the storage pool. For example, on the one hand, when the data in the storage pool needs to be encrypted, the encryption attribute of the storage pool is configured to be encrypted in advance when the storage pool is created, so that the data to be written can be encrypted and written according to the encryption attribute of the storage pool.
  • Storage pool when the data in the storage pool does not need to be encrypted, the encryption attribute of the storage pool is configured as non-encrypted in advance when creating the storage pool, so that the data to be written can be subsequently written based on the encryption attribute of the storage pool. No encryption is done and written to the storage pool.
  • this embodiment considers that if the function of switching the encryption attribute of the storage pool can be implemented during the use of the storage pool, the overhead of creating a storage pool and migrating data can be omitted, and the efficiency of the storage pool can be improved. Storage performance.
  • this embodiment provides a data processing method, as shown in Figure 2.
  • the data processing device can update the encryption attributes of the storage pool according to the configuration information to add the first encrypted data to the storage pool.
  • the encryption attribute is updated to the second encryption attribute (S202).
  • the encryption attributes of the storage pool can be updated at any time according to actual needs during the use of the storage pool. This improves the storage performance of the storage pool.
  • the data processing method provided in this embodiment can be divided into two implementation processes:
  • the first implementation process is the implementation process of the data processing method provided by this embodiment in the case where the encryption attribute of the storage pool is updated from “non-encrypted” to "encrypted”.
  • the second implementation process is the implementation process of the data processing method provided by this embodiment in the case where the encryption attribute of the storage pool is updated from “encrypted” to "non-encrypted”.
  • the following mainly takes the first implementation process (that is, the situation in which the encryption attribute of the storage pool is updated from “non-encrypted” to “encrypted”) as an example to describe the implementation process of the data processing method provided in this embodiment.
  • the first implementation process that is, the situation in which the encryption attribute of the storage pool is updated from "non-encrypted” to "encrypted”
  • the second implementation process that is, updating the encryption attribute of the storage pool from "encrypted” to "non-encrypted”
  • the detailed description of the second implementation process will not be described again in this embodiment.
  • the method includes:
  • the storage system 120 obtains the write request.
  • the write request (for ease of distinction, the write request is referred to as the "first write request” below) carries data to be stored (hereinafter referred to as the "first data").
  • the first write request may be that the storage system 120 receives an IO request sent by an external device.
  • the first write request may be a write request received from the application server 100 by the controller 122 in the storage system 120 through the front-end interface 125 .
  • the first write request may also be an IO request generated when the storage system performs services.
  • the service may be a garbage collection (GC) process performed by the storage system 120.
  • the first write request may be to write valid data from a recycled logical block group to a new logical block group during the GC process. Write a request.
  • GC garbage collection
  • the processor 123 can store the first write request in the memory 124 of the controller 122 for subsequent processing.
  • the storage system 120 writes the first data into the storage pool according to the current first encryption attribute of the storage pool.
  • the processor 123 can call the first write request in the memory 124 to determine the first data carried in the first write request. Then, after determining not to encrypt the first data according to the current first encryption attribute of the storage pool (specifically, the current encryption attribute is non-encryption), the first data is directly written into the storage pool through the backend interface 126 .
  • the method provided in this embodiment considers that: a method for indicating whether the first data has been encrypted can be configured. Encrypt the first identifier (that is, used to indicate the encryption attribute corresponding to the first data), and write the first identifier together with the first data into the storage pool. In this way, when reading the first data, the encryption attribute corresponding to the first data can be quickly determined based on the first identifier.
  • the first identification may be stored in the same sector as the first data.
  • both the first data and the first identifier are stored in sector 1281.
  • the first data when the first data is read, by reading the first identifier located in the same sector 1281 as the first data, it can be determined whether the first data is encrypted for subsequent processing.
  • the first identifier can be stored in the data integrity field (data integrity field, DIF) corresponding to the first data.
  • the first identifier may be stored in the logical block application identifier (Logical Block Application Tag, Meta Tag) field in the DIF corresponding to the first data.
  • logical block application identifier Logical Block Application Tag, Meta Tag
  • the DIF can include a logical block check (Logical Block Guard, Guard) field, a logical block application identifier (Logical Block Application Tag, Meta Tag) field and a logical block reference identifier (Logical Block Reference Tag, Ref Tag) fields.
  • a logical block check Logical Block Guard, Guard
  • a logical block application identifier Logical Block Application Tag, Meta Tag
  • a logical block reference identifier Logical Block Reference Tag, Ref Tag
  • Guard is usually 2 bytes and can be used to carry the Cyclic Redundancy Check (CRC) checksum of the data in the sector.
  • CRC Cyclic Redundancy Check
  • the Meta Tag field is usually 2 bytes and can be used to carry user-defined and application-related information. For example, it can be used to carry LUN identification information or block status identification.
  • the Ref Tag field is usually 4 bytes and is mainly used to carry the lower 4 bits of the logical block address (logical block address, LBA) of the data in the sector.
  • the first identifier can be stored in the Meta Tag field used to carry user-defined information in the DIF corresponding to the first data, so that the first identifier can be stored without changing the relevant existing protocols.
  • the first identification may be stored in a metadata file within the storage pool.
  • a metadata file 1283 is built in the storage pool 128 , and the metadata file 1283 is used to record the metadata of the data in the storage pool 128 .
  • the metadata file 1283 includes the first identifier.
  • the first identifier may be recorded in the metadata corresponding to the first data.
  • the metadata of the first data when the metadata of the first data is read in the metadata file 1283, it can be determined according to the first identifier in the metadata whether the first data is encrypted for subsequent processing.
  • the storage system 120 updates the first encryption attribute of the storage pool to the second encryption attribute according to the configuration information.
  • the configuration information may be input by technicians into storage system 120.
  • storage system 120 updates the first encryption attribute of the storage pool to the second encryption attribute.
  • the storage system 120 may be configured with a trigger condition for updating encryption attributes in advance, and the storage system 120 generates configuration information after detecting the trigger condition. In this way, after the storage system 120 receives the configuration information, the storage pool will be The first encryption attribute of is updated to the second encryption attribute.
  • the first encryption attribute is non-encrypted, and the first encryption attribute is encryption. Therefore, S303 can be understood as updating the encryption attribute of the storage pool from non-encrypted to encrypted.
  • the current encryption attributes of the storage pool are stored in the memory 124 of the storage system 120.
  • the processor 123 checks the current encryption attributes stored in the memory 124 to perform And determine whether to encrypt the data in the write request.
  • the storage system 120 may modify the encryption attribute in the memory 124 to update the first encryption attribute of the storage pool to the second encryption attribute.
  • the method further includes:
  • the storage system 120 obtains the second write request.
  • the second write request carries second data.
  • the second write request may be an IO request sent by an external device received by the storage system 120, or may be an IO request generated when the storage system performs services.
  • the processor 123 can save the second write request in the memory 124 of the controller 122 for subsequent processing.
  • the storage system 120 writes the second data into the storage pool according to the current second encryption attribute of the storage pool.
  • the processor 123 can call the second write request in the memory 124 to determine the second data carried in the second write request. Then, after the second data is encrypted according to the current second encryption attribute of the storage pool (specifically, the current encryption attribute is encryption), the encrypted first data is directly written into the storage pool through the backend interface 126 .
  • the method provided in this embodiment can be configured to indicate whether the second data has been encrypted. (that is, used to indicate the encryption attribute corresponding to the second data), and write the second identifier into the storage pool together with the second data. In this way, when reading the second data, the encryption attribute corresponding to the second data can be quickly determined based on the second identifier.
  • the specific form of the second logo can also include two design methods:
  • the second identification may be stored in the same sector as the second data.
  • both the second data and the second identifier are stored in sector 1282.
  • the second identifier can be stored in the DIF corresponding to the second data.
  • the second identifier can be stored in the Meta Tag field in the DIF corresponding to the second data.
  • the second identification may be stored in a metadata file within the storage pool.
  • a metadata file 1283 is built in the storage pool 128 , and the metadata file 1283 is used to record the metadata of the data in the storage pool 128 .
  • the metadata file 1283 includes the second identifier.
  • the second identifier may be recorded in the metadata corresponding to the second data.
  • the first data when the first data is written to the storage pool, the first data can be first updated according to the current first encryption attribute of the storage pool. Write into the storage pool. Later, the first encryption attribute of the storage pool can be updated to the second encryption attribute, and when the second data is written to the storage pool, the second data is written to the storage pool according to the current second encryption attribute of the storage pool.
  • the method may also include:
  • the storage system 120 receives the first read request.
  • the first read request carries the identifier of the first data.
  • the first read request may be that the storage system 120 receives an IO request sent by an external device.
  • the first read request may be a read request from the application server 100 received by the controller 122 in the storage system 120 through the front-end interface 125 .
  • the first read request may also be an IO request generated when the storage system performs services.
  • the processor 123 can store the first read request in the memory 124 of the controller 122 for subsequent processing.
  • the storage system 120 reads the first data according to the first encryption attribute corresponding to the first data.
  • the first encryption attribute is non-encryption.
  • S402 can include:
  • the storage system 120 obtains an attribute identifier indicating the encryption attribute corresponding to the first data.
  • the first identifier is used to indicate the encryption attribute corresponding to the first data.
  • the processor 123 in the storage system 120 can read the first identifier recorded in the storage pool through the backend node 126 .
  • the processor 123 may obtain the first identifier from the sector corresponding to the first data in the storage pool. logo.
  • the processor 123 may obtain the first identifier from the metadata of the first data in the metadata file in the storage pool.
  • the storage system 120 reads the first data according to the encryption attribute indicated by the first identifier.
  • the encryption attribute indicated by the first identifier is non-encrypted. It can be seen that the first data stored in the storage pool is non-encrypted data. Therefore, the first data may be read directly without decryption.
  • the storage system 120 may feed back the first data to the application server through the front-end interface 125 .
  • the method may also include :
  • the storage system 120 receives the second read request.
  • the second read request carries the identifier of the second data.
  • the second read request may be that the storage system 120 receives an IO request sent by an external device.
  • the second read request may be a read request from the application server 100 received by the controller 122 in the storage system 120 through the front-end interface 125 .
  • the second read request may also be an IO request generated when the storage system performs services.
  • the processor 123 can store the second read request in the memory 124 of the controller 122 for subsequent processing.
  • the storage system 120 reads the second data according to the second encryption attribute corresponding to the second data.
  • the second encryption attribute is encryption.
  • S502 can include:
  • the storage system 120 obtains the attribute identifier of the encryption attribute corresponding to the second data.
  • the second identifier is used to indicate the encryption attribute corresponding to the second data.
  • the processor 123 in the storage system 120 can read the second identification recorded in the storage pool through the backend node 126 .
  • the processor 123 may obtain the second identifier from the sector corresponding to the second data in the storage pool. logo.
  • the processor 123 may obtain the second identifier from the metadata of the second data in the metadata file in the storage pool.
  • the storage system 120 reads the second data according to the encryption attribute indicated by the second identifier.
  • the encryption attribute indicated by the second identifier is encryption. It can be seen that the second data stored in the storage pool is encrypted data. Therefore, as shown in (b) of FIG. 5 , after reading the encrypted data of the first data from the storage pool, the processor 123 can decrypt the encrypted data of the second data, and then use the decrypted second data to Feedback to the application server through the front-end interface 125.
  • the method may also include:
  • the storage system 120 records the timestamp of updating the first encryption attribute of the storage pool to the second encryption attribute.
  • the storage pool that can update the encryption attribute may include two types of data: one is encrypted data, and the other is unencrypted data. Therefore, by recording the timestamp of the encryption attribute update, you can use the timestamp and the time when each data is written to the storage pool to distinguish which data is encrypted and which data is not encrypted.
  • the timestamp when the encryption attribute is updated can be recorded in the memory 124 for use in subsequent processes. This timestamp distinguishes which data is encrypted and which data is not.
  • the method in order to make the encryption attributes corresponding to each data in the storage pool consistent with the current encryption attributes of the storage pool, as shown in Figure 6, the method also includes:
  • the storage system 120 uses the timestamp to determine from the storage pool the data written to the storage pool according to the first encryption attribute.
  • the writing time of each data recorded in the metadata file of the storage pool and the above-mentioned timestamp can be used to filter out the data written to the storage pool before the above-mentioned timestamp.
  • These data can be: Data written to the storage pool based on the first encryption attribute.
  • the data written to the storage pool according to the first encryption attribute includes the first data.
  • the second encryption attribute is encryption
  • S308 may specifically include: encrypting the first data and rewriting it into the storage pool.
  • the processing The processor 123 first encrypts the first data, and then rewrites the encrypted first data into the storage pool.
  • the data of the first encrypted attribute in the storage pool can be converted into the data of the second encrypted data, so that the encryption attribute corresponding to each data in the storage pool is consistent with the current encryption attribute of the storage pool.
  • this embodiment also provides a data processing device, which can be used to execute some or all of the steps in the above-mentioned data processing method in this embodiment.
  • the data processing device includes corresponding hardware structures and/or software modules that perform each function.
  • the technical solution provided in this embodiment can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software driving the hardware depends on the specific application scenarios and design constraints of the technical solution.
  • the data processing apparatus may run in a hardware device used to manage stored data in the storage system.
  • the data processing apparatus may run in a controller or part of the hardware in a controller in a centralized storage system.
  • the data processing apparatus may run in a storage server or part of the hardware within the storage server that has the function of managing data reading and writing in the distributed storage system.
  • FIG. 7 is a schematic structural diagram of a data processing device provided in this embodiment.
  • the data processing device 60 includes one or more of a communication unit 601, an attribute updating unit 602, and a reading and writing unit 603.
  • the data processing device can be used to implement the functions of some or all steps in the method described in Figures 2 to 6.
  • the communication unit 601 is used to perform one or more of S201 in Figure 2, S301 and S304 in Figures 3-4, and S401 and S501 in Figure 5.
  • the attribute update unit 602 is used to execute one or more of S202 in Figure 2, S303 in Figures 3-4, and S306 in Figure 6.
  • the reading and writing unit 603 is used to execute one or more of S201 and S203 in Figure 2, S302 and S305 in Figures 3-4, S402 and S503 in Figure 5, and S308 in Figure 6.
  • the communication unit 601 is used to receive configuration information.
  • the attribute updating unit 602 is configured to update the first encryption attribute of the storage pool to the second encryption attribute according to the configuration information.
  • the attribute updating unit 602 is also configured to record the timestamp of updating the first encryption attribute of the storage pool to the second encryption attribute.
  • the reading and writing unit 603 is configured to write the first data into the storage pool according to the current first encryption attribute of the storage pool.
  • the reading and writing unit 603 is also configured to rewrite the first data into the storage pool according to the updated second encryption attribute of the storage pool.
  • the reading and writing unit 603 is configured to write the first data to the storage pool according to the current first encryption attribute of the storage pool, including:
  • the reading and writing unit 603 is specifically configured to write the first data and the first identification into the storage pool according to the current first encryption attribute of the storage pool; the first identification is used to indicate that the The first data corresponds to the first encryption attribute.
  • the first identification is stored in the data integrity domain DIF corresponding to the first data in the storage pool.
  • the first identification is specifically stored in the logical block application identification Meta Tag of the data integrity domain DIF corresponding to the first data in the storage pool.
  • the first identifier is stored in a metadata file in the storage pool; the metadata file is used to record metadata of data stored in the storage pool.
  • the communication unit 601 is also used to receive read requests.
  • the read request is used to request to read data to be processed.
  • the reading and writing unit 603 is configured to read the data to be processed according to the encryption attribute corresponding to the data to be processed.
  • the encryption attribute includes either encryption or non-encryption.
  • the reading and writing unit 603 is used to read the data to be processed according to the encryption attribute corresponding to the data to be processed, including: the reading and writing unit 603 is used to obtain an indication of the data to be processed.
  • the reading and writing unit 603 is configured to read the data to be processed according to the encryption attribute indicated by the attribute identifier.
  • FIG 8 is a schematic structural diagram of a chip provided by this application.
  • the chip 70 is used to implement the data processing method provided by this application. Specifically, the chip can be used to implement some or all of the steps in the above data processing method. Among them, the chip 70 includes:
  • the processor 701 is used to execute the data processing method provided by this application.
  • the processor 701 can include a general central processing unit (CPU) and memory.
  • the processor 701 can also be a microprocessor, a field programmable gate array (Field Programmable Gate Array, FPGA) or a specific application integrated Circuit (application-specific integrated circuit, ASIC), etc.
  • the processor 701 includes a CPU and a memory, the CPU executes computer instructions stored in the memory to execute the data processing method provided by this application.
  • the chip 70 may also include: a memory 702 .
  • Computer instructions are stored in the memory 702, and the processor 701 executes the computer instructions stored in the memory to execute the data processing method provided by this application.
  • the memory 702 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage , optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store program codes in the form of instructions or data structures and can be used by Any other media accessible by a computer, but not limited to this.
  • EEPROM electrically erasable programmable read-only memory
  • CD-ROM compact disc read-only memory
  • optical disc storage including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the chip 70 may also include: an interface 703.
  • Interface 703 can be used to receive and send data.
  • the interface 702 may be a communication interface or a transceiver, or the like.
  • chip 70 may also include communication lines 704.
  • communication line 704 may be a data bus used to transmit information between the components described above.
  • the method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM, flash memory, ROM, PROM, EPROM, EEPROM, registers, hard disks, mobile hard disks, CD-ROM or any other form of storage media well known in the art.
  • An exemplary storage medium is coupled to the processor such that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and storage media may be located in an ASIC. Additionally, the ASIC can be located in network equipment or terminal equipment.
  • the processor and the storage medium can also exist as discrete components in network equipment or terminal equipment.
  • the computer program product includes one or more computer programs or instructions.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, a network device, a user equipment, or other programmable device.
  • the computer program or instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another.
  • the computer program or instructions may be transmitted from a website, computer, A server or data center transmits via wired or wireless means to another website site, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media.
  • the available media may be magnetic media, such as floppy disks, hard disks, and magnetic tapes; they may also be optical media, such as digital video discs (DVDs); they may also be semiconductor media, such as SSDs.
  • At least one of (at least one of) means one or any combination of subsequent associated objects, for example, "at least one of A, B, and C” includes A, B, C, AB, AC, BC, or ABC.
  • the character “/” generally indicates that the related objects are an “or” relationship; in the formula of this application, the character “/” indicates that the before and after The associated object is a "division" relationship.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种数据处理方法及装置（60），涉及存储领域。方法包括：接收配置信息（S201）；根据配置信息将存储池的第一加密属性更新为第二加密属性（S202）。方法用于提高存储池的存储性能。

Description

数据处理方法及装置
本申请要求于2022年9月6日提交中国专利局、申请号为202211082775.9、申请名称为“数据处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机领域，尤其涉及一种数据处理方法及装置。
背景技术
随着信息技术的发展，各业务所需要存储的数据量越来越大。现有技术中可以将一台或多台存储设备的存储资源进行整合构建成一个存储池，以实现大规模数据的存储。
目前，一方面，当需要对存储池中的数据进行加密时，会预先在创建存储池时配置存储池的加密属性为加密，以便后续根据存储池的加密属性对待写入数据进行加密并写入存储池；另一方面，当不需要对存储池中的数据进行加密时，则预先在创建存储池时配置存储池的加密属性为非加密，以便后续根据存储池的加密属性，对待写入数据不进行加密并写入存储池。
发明内容
本申请提供一种数据处理方法及装置，用于解决存储池只能在创建时配置加密属性，进而导致存储池的使用不够灵活的问题。
第一方面，提供一种数据处理方法，该方法包括：接收配置信息。根据配置信息将存储池的第一加密属性更新为第二加密属性。
该方法中，通过为存储池增加切换加密属性的这一功能，从而在存储池的使用过程中，可以根据实际需要，通过配置信息对存储池的加密属性进行更新。从而提高了存储池的存储性能。
在一种实现方式中，该方法还包括：记录将所述存储池的第一加密属性更新为所述第二加密属性的时间戳。
本实现方式中，考虑到在能够切换加密属性的存储池中，可能包括两种数据：一种是加密过的数据，另一种是未经过加密的数据。因此，通过记录加密属性切换的时间戳，从而可以利用该时间戳以及各数据写入存储池的时间，区分出哪些数据进行了加密，哪些数据未加密。
在一种实现方式中，在根据配置信息将存储池的第一加密属性更新为第二加密属性之前，该方法还包括：根据存储池当前的第一加密属性，将第一数据写入存储池。
在一种实现方式中，该方法还包括：根据所述存储池的所述第二加密属性，将所述第一数据重新写入所述存储池。
通过上述方式，可以将存储池中第一加密属性的数据转换为第二加密数据的数据，从而使得存储池中各数据所对应的加密属性与存储池的当前加密属性保持一致。
在一种实现方式中，根据存储池当前的第一加密属性，将第一数据写入所述存储池，包括：根据所述存储池当前的第一加密属性，将所述第一数据和第一标识写入所述存储池；所述第一标识用于指示所述第一数据对应所述第一加密属性。
上述实现方式中，为了在之后读取数据时方便确定数据是否进行过加密，本实施例所提供方法中考虑到：可以通过配置一种用于指示数据是否进行了加密的标识(即上文中第一数据对应的第一标识)，并将该标识与数据一并写入存储池中。这样一来，在读取数据时便可以根据标识快速确定该数据所对应的加密属性。
在一种实现方式中，该第一标识存储在存储池中第一数据所对应的数据完整性域DIF中。
上述实现方式中，通过将标识存储在数据所对应的DIF中，这样一来当读取数据时，通过读取与该数据处于同一扇区的标识，即可确定该数据是否加密，以便进行后续处理。
在一种实现方式中，第一标识具体存储在所述存储池中所述第一数据所对应的数据完整性域DIF的逻辑块应用标识Meta Tag中。
上述实现方式中，通过将标识可以存储在数据所对应的DIF中用于承载用户定义的信息的Meta Tag字段，从而可以在不改变相关现有协议的前提下存储数据对应的标识。
在一种实现方式中，第一标识存储在所述存储池中的元数据文件中；所述元数据文件用于记录存储在所述存储池中的数据的元数据。
上述实现方式中，通过将上述标识存储在元数据文件中，这样一来，当在元数据文件中读取到数据的元数据时，便可以根据元数据中的标识确定该数据是否加密，以便进行后续处理。
在一种实现方式中，该方法还包括：接收读请求。所述读请求用于请求读取待处理数据。根据所述待处理数据对应的加密属性，读取所述待处理数据。所述加密属性包括加密或非加密中任一项。
上述实现方式中，在读取存储池中的不同数据时，可以根据不同的加密属性，读取加密属性对应的数据，从而提高了存储池的存储性能。
在一种实现方式中，根据所述待处理数据对应的加密属性，读取所述待处理数据，包括：获取用于指示所述待处理数据所对应加密属性的属性标识；根据所述属性标识所指示的加密属性，读取所述待处理数据。
上述实现方式中，在读取存储池中的数据时，可以根据该数据对应的标识，确定该数据对应的加密属性，进而根据给加密属性读取该数据，从而提高了存储池的存储性能。
第二方面，提供一种数据处理装置，包括：通信单元，用于接收配置信息；属性更新单元，用于根据所述配置信息将存储池的第一加密属性更新为第二加密属性。
在一种实现方式中，所述属性更新单元，还用于记录将所述存储池的所述第一加密属性更新为所述第二加密属性的时间戳。
在一种实现方式中，所述数据处理装置还包括读写单元；所述读写单元，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池。
在一种实现方式中，所述读写单元，还用于根据所述存储池更新后的所述第二加密属性，将所述第一数据重新写入所述存储池。
在一种实现方式中，读写单元，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池，包括：所述读写单元，具体用于根据所述存储池当前的所述第一加密属性，将所述第一数据和第一标识写入所述存储池；所述第一标识用于指示所述第一数据对应所述第一加密属性。
在一种实现方式中，所述第一标识存储在所述存储池中所述第一数据所对应的数据完整性域DIF中。
在一种实现方式中，所述第一标识具体存储在所述存储池中所述第一数据所对应的数据完整性域DIF的逻辑块应用标识Meta Tag中。
在一种实现方式中，第一标识存储在所述存储池中的元数据文件中；所述元数据文件用于记录存储在所述存储池中的数据的元数据。
在一种实现方式中，通信单元，还用于接收读请求；所述读请求用于请求读取待处理数据；读写单元，用于根据所述待处理数据对应的加密属性，读取所述待处理数据；所述加密属性包括加密或非加密中任一项。
在一种实现方式中，读写单元，用于根据所述待处理数据对应的加密属性，读取所述待处理数据，包括：所述读写单元，用于获取用于指示所述待处理数据所对应加密属性的属性标识。所述读写单元，用于根据所述属性标识所指示的加密属性，读取所述待处理数据。
第三方面，提供一种数据处理装置，包括存储器和处理器，所述存储器用于存储计算机指令，所述处理器用于从所述存储器中调用并运行所述计算机指令，以实现如上述第一方面或第一方面中任一实现方式所述的方法。
第四方面，提供一种存储系统，包括控制器和至少一个存储节点，所述存储节点用于存储数据，所述控制器用于执行如上述第一方面或第一方面中任一实现方式所述的方法。
第五方面，提供一种存储系统，包括多个存储服务器，所述多个存储服务器用于存储数据，所述多个存储服务器中的一个或多个服务器用于执行如上述第一方面或第一方面中任一实现方式所述的方法。
第六方面，提供一种芯片，包括存储器和处理器，所述存储器用于存储计算机指令，所述处理器用于从所述存储器中调用并运行所述计算机指令，以实现如上述第一方面或第一方面中任一实现方式所述的方法。
第七方面，提供一种计算机可读存储介质，所述存储介质中存储有计算机程序，当所述计算机程序被处理器执行时，实现如上述第一方面或第一方面中任一实现方式所述的方法。
第八方面，提供一种计算机程序产品，所述计算机程序产品包括指令，当所述指令在处理器上运行时，实现如上述第一方面或第一方面中任一实现方式所述的方法。
附图说明
图1为本申请实施例提供的一种存储系统的结构示意图；
图2为本申请实施例提供的一种数据处理方法的流程示意图之一；
图3为本申请实施例提供的一种数据处理方法的流程示意图之二；
图4为本申请实施例提供的一种数据处理方法的流程示意图之三；
图5为本申请实施例提供的一种数据处理方法的流程示意图之四；
图6为本申请实施例提供的一种数据处理方法的流程示意图之五；
图7为本申请实施例提供的一种数据处理装置的结构示意图之一；
图8为本申请实施例提供的一种数据处理装置的结构示意图之二。
具体实施方式
下面将结合本实施例中的附图，对本实施例中的技术方案进行描述。其中，为了便于清楚描述本实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。同时，在本实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念，便于理解。
为了便于理解本实施例，首先对本实施例所提供技术方案的应用场景进行介绍：
示例性的，图1位本实施例提供的一种存储系统的结构示意图。在图1所示存储系统中，可以通过运行应用程序来存储存储系统120中的用户数据。其中，运行应用程序的计算机可以称为“应用服务器”，其中应用服务器100可以是物理机也可以是虚拟机。应用服务器100包括但不限于桌面电脑、服务器、笔记本电脑以及移动设备等。应用服务器100通过交换机110访问存储系统120以存取用户数据。然而，交换机110只是一个可选设备，应用服务器100也可以直接通过网络与存储系统120通信。或者，交换机110也可以替换成以太网交换机、InfiniBand交换机、RoCE(RDMA over Converged Ethernet)交换机等。
存储系统120为用于存储用户数据的设备或设备集群。具体的，在实际应用过程中，存储系统120可以为集中式存储系统。集中式存储系统的特点是由一个统一的入口，所有从外部设备如应用服务器来的数据都要经过这个入口。
如图1所示，集中式存储系统的入口具体可以是集中式存储系统的引擎121。其中，引擎121中可以包括一个或多个控制器，图1中以一个控制器122为例进行说明。另外，当引擎121中有多个控制器时，可以通过镜像通道的方式使多个控制器互为备份，当其中一个控制器发生故障时，其他控制器可以接管该故障控制器的业务，从而避免硬件故障导致整个存储系统的不可用。
另外，引擎121中还可以包含前端接口125和后端接口126，其中前端接口125用于与应用服务器100通信，从而为应用服务器100提供存储服务。后端接口126用于与硬盘127通信，以扩充存储系统的容量。通过后端接口126，引擎121可以连接更多的硬盘127，从而形成一个非常大的存储资源池。
另外，在控制器122内，可以包括处理器123、内存124。处理器112可以为一个中央处理器(central processing unit，CPU)，用于处理来自存储系统外部(如应用服务器或其他存储系统)的数据访问请求，也用于处理存储系统内部发生的请求。示例 性的，CPU 123通过前端接口125接收应用服务器100发送的写数据请求时，会将这些写数据请求中的用户数据暂时保存在内存124中。当内存124中的用户数据总量达到一定阈值时，CPU 123通过后端接口将内存124中存储的用户数据发送至硬盘127进行持久化存储。
内存124是用于与处理器直接交换数据的内部存储器，它可以随时读写数据，而且读写速度快，可以作为操作系统或其他正在运行中的程序的临时数据存储器。其中内存124可以包括多种存储器，例如内存既可以是随机存取存储器，也可以是只读存储器(Read Only Memory,ROM)。举例来说，随机存取存储器是动态随机存取存储器(Dynamic Random Access Memory,DRAM)或者存储级存储器(Storage Class Memory,SCM)。DRAM是一种半导体存储器，与大部分随机存取存储器(Random Access Memory，RAM)一样，属于一种易失性存储器(volatile memory)设备。SCM是一种同时结合传统存储装置和存储器特性的复合型存储技术，SCM能够提供比硬盘更快的读写速度，但存取速度上比DRAM慢，在成本上也比DRAM更便宜。然而，DRAM和SCM在本实施例中指示示例性的说明，内存还可以包括其他随机存取存储器，例如静态随机存取存储器(Static Random Access Memory，SRAM)等。而对于只读存储器，举例来说，可以是可编程只读存储器(Programmable Read Only Memory,PROM)、可抹除可编程只读存储器(Erasable Programmable Read Only Memory,EPROM)等。另外，内存124还可以是双列直插式存储器模块或双线存储器模块(Dual In-line Memory Module，简称DIMM)，即由DRAM组成的模块，还可以是固态硬盘(Solid State Disk,SSD)。实际应用中，控制器122中可配置多个内存124，以及不同类型的内存124。本实施例不对内存124的数量和类型进行限定。此外，可对内存124进行配置使其具有保电功能。保电功能是指系统发生掉电又重新上电时，内存124中存储的数据也不会丢失。具有保电功能的内存被称为非易失性存储器。
需要说明的是，图1中只示出了一个引擎121，然而在实际应用中，存储系统中可包含两个或两个以上引擎121，多个引擎121之间做冗余或者负载均衡。另外，在一种实现方式中，引擎121还可以包括硬盘槽位，这种情况下硬盘127可以直接部署在引擎121中，后端接口126属于可选配置，当系统的存储空间不足时，可以通过后端接口126连接更多的硬盘或硬盘框。
另外需要说明的是，图1仅示例性的提供了一种集中式存储系统的结构示意图。在另一些应用场景中，存储系统120可以由多个独立的存储服务器构成，其中存储服务器之间可以相互通信。其中，各存储服务器可以分别包括处理器、内存、网卡和硬盘等硬件部件。其中，处理器与内存用于提供计算资源；处理器用于处理来自存储服务器外的数据访问请求；内存用于与处理器直接交换数据的内部存储器，它可以随时读写数据，而且速度很快，可以作为操作系统或其他正在运行中的程序的临时数据存储器。硬盘用于提供存储资源，例如存储数据，它可以是磁盘或其他类型的存储介质，例如固态硬盘或叠瓦式磁记录硬盘等。另外，存储服务器中还可以包括用于与应用服务器通信的网卡。容易理解的，本实施例对于应用本申请所提供技术方案的存储系统的框架结构可以不做限制。
进一步，从存储系统的逻辑层结构来讲，可以将存储系统120所包括的存储资源 (如图中的多个硬盘127)构建成存储池(pool)。当应用服务器100需要存储空间时，可以从存储池划分出部分/全部存储空间提供为应用服务器100使用。
具体的，如图1中，每个硬盘可以被划分为若干个物理块(chunk)，这些物理chunk映射成逻辑chunk从而构成一个存储池(pool)，存储池用于向上提供存储空间，该存储空间实际来源于存储系统所包含的硬盘。当然，并非所有硬盘都提供空间给上述存储池。在实际应用中，存储系统中可包含一个或多个存储池，一个存储池可以包括部分或全部硬盘。其中，来自不同存储节点(在图1中不同存储节点可以理解为不同硬盘)的多个逻辑chunk组成一个逻辑块组(chunk group)，所述逻辑块组是所述存储池的最小分配单位。
当存储服务层向所述存储池120申请存储空间时，所述存储池120可以提供一个或多个逻辑块组给存储服务层。存储服务层进一步将逻辑块组提供的存储空间虚拟化为逻辑单元(logical unit，LU)提供给应用服务器100使用。每个逻辑单元具有唯一的逻辑单元号(logical unit number，LUN)。由于应用服务器100能直接感知到逻辑单元号，本领域技术人员通常直接用LUN代指逻辑单元。每个LUN具有LUN ID，用于标识所述LUN。数据位于一个LUN内的具体位置可以由起始地址和该数据的长度(length)确定。对于起始地址，本领域技术人员通常称作逻辑块地址(logical block address，LBA)。可以理解的是，LUN ID、LBA和length这三个因素标识了一个确定的地址段。应用服务器生成的数据访问请求，通常在该请求中携带LUN ID、LBA和length。
在相关技术中，会在创建存储池时预先配置存储池的加密属性(包括加密或非加密)，然后当存储系统接收到将数据写入存储池中的写请求时，则会按照之前配置好的加密属性，对数据进行加密(或不对数据加密)并写入存储池中。例如，一方面，当需要对存储池中的数据进行加密时，会预先在创建存储池时配置存储池的加密属性为加密，以便后续根据存储池的加密属性对待写入数据进行加密并写入存储池；另一方面，当不需要对存储池中的数据进行加密时，则预先在创建存储池时配置存储池的加密属性为非加密，以便后续根据存储池的加密属性，对待写入数据不进行加密并写入存储池。
进一步的，如果在存储池使用的过程中，想要改变存储池的加密属性(例如，从加密的存储池变为非加密的存储池，或者从非加密的存储池变为加密的存储池)，通常采用重新创建一个新的存储池，并通过将原存储池中的数据整体迁移至新的存储池中的这种方式，以实现存储池加密属性的转换。这样一来，就需要占用额外的开销来进行创建存储池并对数据进行迁移。其中，若存储池所对应的上层业务数量较多，在数据迁移过程中还可能影响业务的运行。
针对上述问题，本实施例中考虑到：若能够在存储池使用的过程中，实现切换该存储池加密属性的功能，则可以省去创建存储池以及迁移数据所产生的开销，提高存储池的存储性能。
进而，本实施例提供一种数据处理方法，如图2所示，该方法中数据处理装置在接收到配置信息(S201)后，可以根据配置信息更新存储池的加密属性，以将第一加 密属性更新为第二加密属性(S202)。
该方法中，通过为存储池增加切换加密属性的这一功能，从而在存储池的使用过程中，可以根据实际需要，随时对存储池的加密属性进行更新。从而提高了存储池的存储性能。
下面以图1所示存储系统120为例，对本实施例所提供的数据处理方法进行介绍。
具体的，根据存储池的加密属性在更新前后的不同，本实施例所提供的数据处理方法可以分为两种实现过程：
第一种实现过程，是将存储池的加密属性由“非加密”更新为“加密”的这种情况下，本实施例所提供的数据处理方法的实现过程。
第二种实现过程，是将存储池的加密属性由“加密”更新为“非加密”的这种情况下，本实施例所提供的数据处理方法的实现过程。
具体的，下文中主要是以第一种实现过程(即将存储池的加密属性由“非加密”更新为“加密”的这种情况)为例，对本实施例所提供的数据处理方法的实现过程进行详细介绍。可以理解的是，第二种实现过程(即将存储池的加密属性由“加密”更新为“非加密”的这种情况)的具体实现过程与第一种实现过程，可以是完全对应的，对于第二种实现过程的详细描述，本实施例中将不再赘述。
如图3所示，该方法包括：
S301、存储系统120获取写请求。
其中，该写请求(为便于区分，下文将该写请求称为“第一写请求”)中携带有待存储数据(下文称为“第一数据”)。
在一种实现方式中，第一写请求可以是存储系统120接收外部设备发送的IO请求。例如图3所示，第一写请求可以是存储系统120中控制器122通过前端接口125接收到的来自应用服务器100的写请求。
在另一种实现方式中，该第一写请求也可以是存储系统执行业务时所生成的IO请求。例如，该业务可以是存储系统120执行的垃圾回收(garbage collection，GC)过程，第一写请求可以是在GC过程中，将有效数据从被回收的逻辑块组写入新的逻辑块组的写请求。
具体的，如图3中，存储系统120在获取到第一写请求后，可以由处理器123将该第一写请求保存在控制器122的内存124中，以便后续处理。
S302、存储系统120根据存储池当前的第一加密属性，将第一数据写入存储池。
具体的，如图3所示，在存储系统120中，处理器123可以调用内存124中的第一写请求，以确定第一写请求中携带的第一数据。然后，在根据存储池当前的第一加密属性(具体的，当前加密属性为非加密)确定不对第一数据进行加密之后，通过后端接口126，将第一数据直接写入存储池。
在一种实现方式中，为了在之后读取第一数据时方便确定第一数据是否进行过加密，本实施例所提供方法中考虑到：可以通过配置一种用于指示第一数据是否进行了加密(即用于指示第一数据所对应加密属性)的第一标识，并将该第一标识与第一数据一并写入存储池中。这样一来，在读取第一数据时便可以根据第一标识快速确定第一数据所对应的加密属性。
下面，分两种设计方式，对于第一标识的具体形式进行介绍：
第一种设计方式中：
第一标识可以存储在与第一数据同一个扇区内。例如图3中，第一数据与第一标识都存储在扇区1281中。
这样一来，当读取第一数据时，通过读取与第一数据处于同一扇区1281的第一标识，即可确定第一数据是否加密，以便进行后续处理。
进一步，可选的，如图3中，第一标识可以存储在第一数据所对应的数据完整性域(data integrity field，DIF)中。
进一步，可选的，第一标识可以存储在第一数据所对应的DIF中的逻辑块应用标识(Logical Block Application Tag，Meta Tag)字段中。
具体的，如图3所示，在DIF中可以包括，逻辑块校验(Logical Block Guard，Guard)字段、逻辑块应用标识(Logical Block Application Tag，Meta Tag)字段以及逻辑块参考标识(Logical Block Reference Tag，Ref Tag)字段。
其中，Guard通常为2个字节，可以用于承载扇区中数据的循环冗余校验(Cyclic Redundancy Check，CRC)校验和。
Meta Tag字段通常为2个字节，可以用于承载用户定义的和应用相关的信息。例如，可以用来承载LUN的标识信息或块状态标识等。
Ref Tag字段通常为4个字节，主要用于承载扇区中数据的低4位的逻辑块地址(logical block address，LBA)。
上述设计中，通过将第一标识可以存储在第一数据所对应的DIF中用于承载用户定义的信息的Meta Tag字段，从而可以在不改变相关现有协议的前提下存储第一标识。
第二种设计方式：
第一标识可以存储在存储池内的元数据文件中。例如，图4所示，在存储池128中构建有元数据文件1283，该元数据文件1283用于记录存储池128中的数据的元数据。
其中，元数据文件1283中包括第一标识。例如，在元数据文件1283中，第一标识可以记录在第一数据所对应的元数据中。
这样一来，当在元数据文件1283中读取到第一数据的元数据时，便可以根据元数据中的第一标识确定第一数据是否加密，以便进行后续处理。
S303、存储系统120根据配置信息将存储池的第一加密属性更新为第二加密属性。
其中，配置信息具体可以为技术人员输入存储系统120的，这样一来，在存储系统120接收到技术人员输入的配置信息后，存储系统120将存储池的第一加密属性更新为第二加密属性。再例如，也可以预先在存储系统120配置了更新加密属性的触发条件，存储系统120在检测到该触发条件后生成配置信息，这样一来，在存储系统120接收到该配置信息后将存储池的第一加密属性更新为第二加密属性。
本实现过程中，第一加密属性为非加密，第一加密属性为加密，因此S303可以理解为将存储池的加密属性从非加密更新为加密。
示例性的，在存储系统120中内存124中存储有存储池的当前加密属性，当存储系统120获取到写请求时，处理器123通过查看内存124中存储的当前加密属性，进 而确定是否对写请求中的数据进行加密。
例如，如图3所示，存储系统120在接收到更新存储池加密属性的指令后，可以通过修改内存124中的加密属性，从而实现将存储池的第一加密属性更新为第二加密属性。
在将存储池的第一加密属性更新为第二加密属性之后，当再次写入数据时，该方法还包括：
S304、存储系统120获取第二写请求。
其中，第二写请求中携带有第二数据。
与上文第一写请求类似的，第二写请求可以是存储系统120接收外部设备发送的IO请求，也可以是存储系统执行业务时所生成的IO请求。
具体的，如图3中，存储系统120在获取到第二写请求后，可以由处理器123将该第二写请求保存在控制器122的内存124中，以便后续处理。
S305、存储系统120根据存储池当前的第二加密属性，将第二数据写入存储池。
具体的，如图3所示，在存储系统120中，处理器123可以调用内存124中的第二写请求，以确定第二写请求中携带的第二数据。然后，在根据存储池当前的第二加密属性(具体的，当前加密属性为加密)对第二数据进行加密之后，通过后端接口126，将加密后的第一数据直接写入存储池。
与上述第一数据对应的第一标识类似，为了便于在读取第二数据时确定第二数据是否进行过加密，本实施例所提供方法中，可以配置用于指示第二数据是否进行了加密(即用于指示第二数据所对应加密属性)的第二标识，并将该第二标识与第二数据一并写入存储池中。这样一来，在读取第二数据时便可以根据第二标识快速确定第二数据所对应的加密属性。
另外，对于第二标识的具体形式，也可以包括两种设计方式：
第一种设计方式中：
第二标识可以存储在与第二数据同一个扇区内。例如图3中，第二数据与第二标识都存储在扇区1282中。
进一步，可选的，如图3中，第二标识可以存储在第二数据所对应的DIF中。
进一步，可选的，第二标识可以存储在第二数据所对应的DIF中的Meta Tag字段中。
第二种设计方式：
第二标识可以存储在存储池内的元数据文件中。例如，图4所示，在存储池128中构建有元数据文件1283，该元数据文件1283用于记录存储池128中的数据的元数据。
其中，元数据文件1283中包括第二标识。例如，在元数据文件1283中，第二标识可以记录在第二数据所对应的元数据中。
上述对于第二标识的两种设计方式的相关描述，可参照上文中对第一标识的对应描述内容，重复之处在此不做赘述。
本实施例所提供上述方法中，通过为存储池增加更新加密属性的功能，一方面，当有第一数据写入存储池时，可以先根据存储池当前的第一加密属性，将第一数据写 入存储池。之后可以将存储池的第一加密属性更新为第二加密属性，并在之后第二数据写入存储池时，根据存储池当前的第二加密属性，将第二数据写入存储池。
下面结合上述图3或图4所示第一数据的写入过程，对应用本实施例所提供方法读取存储池中的数据的过程进行介绍。如图5的(a)所示，该方法还可以包括：
S401、存储系统120接收第一读请求。
其中，第一读请求中携带有第一数据的标识。
例如，第一读请求可以是存储系统120接收外部设备发送的IO请求。例如图5的(a)所示，第一读请求可以是存储系统120中控制器122通过前端接口125接收到的来自应用服务器100的读请求。
再例如，该第一读请求也可以是存储系统执行业务时所生成的IO请求。
具体的，如图5的(a)中，存储系统120在获取到第一读请求后，可以由处理器123将该第一读请求保存在控制器122的内存124中，以便后续处理。
S402、存储系统120根据第一数据对应的第一加密属性，读取第一数据。
其中，第一加密属性即为非加密。
具体的，S402可以包括：
S4021、存储系统120获取用于指示第一数据所对应的加密属性的属性标识。
其中，如上文所述，第一标识用于指示第一数据所对应的加密属性。具体的，存储系统120中处理器123可以通过后端节点126，读取到存储池中记录的第一标识。
例如，在图3所示第一标识记录在第一数据所对应的DIF中的Meta Tag字段中的情况下，处理器123可以从存储池中第一数据所对应的扇区中获取到第一标识。
再例如，在图4所示第一标识记录在元数据文件中的情况下，处理器123可以从存储池中元数据文件中第一数据的元数据中获取到第一标识。
S4022、存储系统120根据第一标识所指示的加密属性，读取第一数据。
具体的，由第一标识所指示的加密属性即非加密，可知存储池中存储的第一数据为非加密数据。因此对于第一数据可以不需要解密，直接进行读取。
在读取到第一数据后，如图5的(a)所示，存储系统120可以通过前端接口125将第一数据反馈给应用服务器。
在另一种实现方式中，结合上述图3或图4所示第二数据的写入过程，在读取第二数据的情况下，如图5的(b)所示，该方法还可以包括：
S501、存储系统120接收第二读请求。
其中，第二读请求中携带有第二数据的标识。
例如，第二读请求可以是存储系统120接收外部设备发送的IO请求。例如图5的(b)所示，第二读请求可以是存储系统120中控制器122通过前端接口125接收到的来自应用服务器100的读请求。
再例如，该第二读请求也可以是存储系统执行业务时所生成的IO请求。
具体的，如图5的(b)中，存储系统120在获取到第二读请求后，可以由处理器123将该第二读请求保存在控制器122的内存124中，以便后续处理。
S502、存储系统120根据第二数据对应的第二加密属性，读取第二数据。
其中，第二加密属性即为加密。
具体的，S502可以包括：
S5021、存储系统120获取第二数据所对应的加密属性的属性标识。
其中，如上文所述，第二标识用于指示第二数据所对应的加密属性。具体的，存储系统120中处理器123可以通过后端节点126，读取到存储池中记录的第二标识。
例如，在图3所示第二标识记录在第二数据所对应的DIF中的Meta Tag字段中的情况下，处理器123可以从存储池中第二数据所对应的扇区中获取到第二标识。
再例如，在图4所示第二标识记录在元数据文件中的情况下，处理器123可以从存储池中元数据文件中第二数据的元数据中获取到第二标识。
S5022、存储系统120根据第二标识所指示的加密属性，读取第二数据。
具体的，由第二标识所指示的加密属性为加密，可知存储池中存储的第二数据为加密数据。因此如图5的(b)所示，在从存储池中读取到第一数据的加密数据后，可以由处理器123对第二数据的加密数据进行解密，然后将解密后的第二数据通过前端接口125反馈给应用服务器。
在一种实现方式中，如图6所示，本实施例上述数据处理方法中，在将存储池的加密属性进行更新(即S303)后，该方法还可以包括：
S306、存储系统120记录将存储池的第一加密属性更新为第二加密属性的时间戳。
本实现方式中，考虑到在能够更新加密属性的存储池中，可能包括两种数据：一种是加密过的数据，另一种是未经过加密的数据。因此，通过记录加密属性更新的时间戳，从而可以利用该时间戳以及各数据写入存储池的时间，区分出哪些数据进行了加密，哪些数据未加密。
示例性的，如图6中，存储系统120中在将存储池的第一加密属性更新为第二加密属性后，可以将更新加密属性时的时间戳记录在内存124中，以便后续过程中使用该时间戳区分出哪些数据进行了加密，哪些数据未加密。
需要说明的是，为了提高附图的可读性，在图6中仅示出了在将存储池的加密属性进行更新(即S303)后，与时间戳直接相关的步骤。对于图6中存储系统120的其他处理步骤(例如写入数据或读取数据的步骤)可参照上文中图3至图5的相应描述，在此不做赘述。
在一种可能的设计中，为了使得存储池中各数据所对应的加密属性与存储池的当前加密属性保持一致，如图6所示，该方法还包括：
S307、存储系统120利用时间戳，从存储池中确定根据第一加密属性写入存储池的数据。
例如，在存储系统120中，可以利用存储池的元数据文件中记录的各数据的写入时间，以及上述时间戳，筛选出在上述时间戳之前写入存储池的数据，这些数据即可以为根据第一加密属性写入存储池的数据。
具体的，根据第一加密属性写入存储池的数据中包括第一数据。
S308、根据第二加密属性，将第一数据重新写入存储池。
具体的，第二加密属性为加密，因此S308具体可以包括：对第一数据进行加密，并重新写入存储池。
例如图6中，在通过后端接口126读取到存储池128中未加密的第一数据后，处 理器123先将第一数据进行加密，然后再将加密后的第一数据重新写入存储池中。
通过上述方式，可以将存储池中第一加密属性的数据转换为第二加密数据的数据，从而使得存储池中各数据所对应的加密属性与存储池的当前加密属性保持一致。
另外，本实施例还提供一种数据处理装置，该数据处理装置能够用于执行本实施例上述数据处理方法中的部分或全部步骤。
可以理解的是，为了实现上述数据处理方法中功能，数据处理装置包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本实施例中描述的各示例的单元及方法步骤，本实施例所提供技术方案能够以硬件或硬件和计算机软件相结合的形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用场景和设计约束条件。
在本实施例中，该数据处理装置可以运行在存储系统中用于管理存储数据的硬件设备中。例如，数据处理装置可以运行在集中式存储系统中的控制器或控制器中的部分硬件中。再例如，数据处理装置可以运行在分布式存储系统中具有管理数据读写功能的存储服务器或存储服务器内的部分硬件中。
图7为本实施例提供的一种数据处理装置的结构示意图。该数据处理装置60包括通信单元601、属性更新单元602以及读写单元603中一项或多项。该数据处理装置可以用于实现上述图2-图6所述的方法中部分或全部步骤的功能。
例如，通信单元601用于执行图2中的S201、图3-图4中S301和S304图5中S401和S501中的一项或多项。
属性更新单元602用于执行图2中S202、图3-图4中S303以及图6中S306中的一项或多项。
读写单元603用于执行图2中S201和S203、图3-图4中S302和S305、图5中S402和S503以及图6中S308中的一项或多项。
具体的，通信单元601，用于接收配置信息。属性更新单元602，用于根据所述配置信息将存储池的第一加密属性更新为第二加密属性。
可选的，属性更新单元602，还用于记录将所述存储池的所述第一加密属性更新为所述第二加密属性的时间戳。
可选的，所述读写单元603，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池。
可选的，读写单元603，还用于根据所述存储池更新后的所述第二加密属性，将所述第一数据重新写入所述存储池。
可选的，读写单元603，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池，包括：
所述读写单元603，具体用于根据所述存储池当前的所述第一加密属性，将所述第一数据和第一标识写入所述存储池；所述第一标识用于指示所述第一数据对应所述第一加密属性。
可选的，第一标识存储在所述存储池中所述第一数据所对应的数据完整性域DIF中。
可选的，第一标识具体存储在所述存储池中所述第一数据所对应的数据完整性域DIF的逻辑块应用标识Meta Tag中。
可选的，第一标识存储在所述存储池中的元数据文件中；所述元数据文件用于记录存储在所述存储池中的数据的元数据。
可选的，通信单元601，还用于接收读请求。所述读请求用于请求读取待处理数据。
读写单元603，用于根据所述待处理数据对应的加密属性，读取所述待处理数据。所述加密属性包括加密或非加密中任一项。
可选的，读写单元603，用于根据所述待处理数据对应的加密属性，读取所述待处理数据，包括：所述读写单元603，用于获取用于指示所述待处理数据所对应加密属性的属性标识。所述读写单元603，用于根据所述属性标识所指示的加密属性，读取所述待处理数据。
有关上述通信单元601、属性更新单元602以及读写单元603更详细的描述，可以直接参考图2-图6所示的方法中相关描述，这里不再赘述。
图8为本申请提供的一种芯片的结构示意图。该芯片70用于实现本申请所提供的数据处理方法。具体的，该芯片可以用于实现上述数据处理方法中的部分或全部步骤。其中，该芯片70包括：
处理器701用于执行本申请所提供的数据处理方法。
具体的，处理器701可以包含通用中央处理器(central processing unit，CPU)和存储器，处理器701还可以为微处理器、现场可编程逻辑门阵列(Field Programmable Gate Array，FPGA)或者特定应用集成电路(application-specific integrated circuit，ASIC)等。在处理器701包含CPU和存储器的场景中，CPU执行存储器中存储的计算机指令，用于执行本申请所提供的数据处理方法。
另外，该芯片70还可以包括：存储器702。存储器702中存储有计算机指令，处理器701执行存储器中存储的计算机指令，用于执行本申请所提供的数据处理方法。
具体的，存储器702可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的程序代码并能够由计算机存取的任何其他介质，但不限于此。
另外，该芯片70还可以包括：接口703。接口703可以用于接收和发送数据。接口702可以为通信接口或收发器等。
另外，芯片70还可以包括通信线路704。例如，通信线路704可以为数据总线，用于在上述组件之间传输信息。
关于上述芯片70更详细的描述可以直接参考上述数据处理方法中相关描述，这里不再赘述。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM、闪存、ROM、PROM、EPROM、EEPROM、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于网络设备或终端设备中。当然，处理器和存储介质也可以作为分立组件存在于网络设备或终端设备中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行所述计算机程序或指令时，全部或部分地执行本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其它可编程装置。所述计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘(digital video disc，DVD)；还可以是半导体介质，例如，SSD。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上，其它量词与之类似。“和/或”描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。此外，对于单数形式“a”，“an”和“the”出现的元素(element)，除非上下文另有明确规定，否则其不意味着“一个或仅一个”，而是意味着“一个或多于一个”。例如，“a device”意味着对一个或多个这样的device。再者，至少一个(at least one of).......”意味着后续关联对象中的一个或任意组合，例如“A、B和C中的至少一个”包括A，B，C，AB，AC，BC，或ABC。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系；在本申请的公式中，字符“/”，表示前后关联对象是一种“相除”的关系。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。

Claims (25)

  1. 一种数据处理方法，其特征在于，包括：
    接收配置信息；
    根据所述配置信息将存储池的第一加密属性更新为第二加密属性。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    记录将所述存储池的所述第一加密属性更新为所述第二加密属性的时间戳。
  3. 根据权利要求1或2所述的方法，其特征在于，在根据所述配置信息将存储池的第一加密属性更新为第二加密属性之前，还包括：
    根据存储池当前的所述第一加密属性，将第一数据写入所述存储池。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    根据所述存储池的所述第二加密属性，将所述第一数据重新写入所述存储池。
  5. 根据权利要求3或4所述的方法，其特征在于，所述根据存储池当前的所述第一加密属性，将第一数据写入所述存储池，包括：
    根据所述存储池当前的所述第一加密属性，将所述第一数据和第一标识写入所述存储池；所述第一标识用于指示所述第一数据对应所述第一加密属性。
  6. 根据权利要求5所述的方法，其特征在于，所述第一标识存储在所述存储池中所述第一数据所对应的数据完整性域DIF中。
  7. 根据权利要求6所述的方法，其特征在于，所述第一标识具体存储在所述存储池中所述第一数据所对应的数据完整性域DIF的逻辑块应用标识Meta Tag中。
  8. 根据权利要求5所述的方法，其特征在于，所述第一标识存储在所述存储池中的元数据文件中；所述元数据文件用于记录存储在所述存储池中的数据的元数据。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述方法还包括：
    接收读请求；所述读请求用于请求读取待处理数据；
    根据所述待处理数据对应的加密属性，读取所述待处理数据；所述加密属性包括加密或非加密中任一项。
  10. 根据权利要求9所述的方法，其特征在于，所述根据所述待处理数据对应的加密属性，读取所述待处理数据，包括：
    获取用于指示所述待处理数据所对应加密属性的属性标识；
    根据所述属性标识所指示的加密属性，读取所述待处理数据。
  11. 一种数据处理装置，其特征在于，包括：
    通信单元，用于接收配置信息；
    属性更新单元，用于根据所述配置信息将存储池的第一加密属性更新为第二加密属性。
  12. 根据权利要求11所述的数据处理装置，其特征在于，所述属性更新单元，还用于记录将所述存储池的所述第一加密属性更新为所述第二加密属性的时间戳。
  13. 根据权利要求11或12所述的数据处理装置，其特征在于，所述数据处理装置还包括读写单元；
    所述读写单元，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池。
  14. 根据权利要求13所述的数据处理装置，其特征在于，所述读写单元，还用于根据所述存储池更新后的所述第二加密属性，将所述第一数据重新写入所述存储池。
  15. 根据权利要求13或14所述的数据处理装置，其特征在于，所述读写单元，用于根据存储池当前的所述第一加密属性，将第一数据写入所述存储池，包括：
    所述读写单元，具体用于根据所述存储池当前的所述第一加密属性，将所述第一数据和第一标识写入所述存储池；所述第一标识用于指示所述第一数据对应所述第一加密属性。
  16. 根据权利要求15所述的数据处理装置，其特征在于，所述第一标识存储在所述存储池中所述第一数据所对应的数据完整性域DIF中。
  17. 根据权利要求16所述的数据处理装置，其特征在于，所述第一标识具体存储在所述存储池中所述第一数据所对应的数据完整性域DIF的逻辑块应用标识Meta Tag中。
  18. 根据权利要求15所述的数据处理装置，其特征在于，所述第一标识存储在所述存储池中的元数据文件中；所述元数据文件用于记录存储在所述存储池中的数据的元数据。
  19. 根据权利要求11-18任一项所述的数据处理装置，其特征在于，所述通信单元，还用于接收读请求；所述读请求用于请求读取待处理数据；
    读写单元，用于根据所述待处理数据对应的加密属性，读取所述待处理数据；所述加密属性包括加密或非加密中任一项。
  20. 根据权利要求19所述的数据处理装置，其特征在于，所述读写单元，用于根据所述待处理数据对应的加密属性，读取所述待处理数据，包括：
    所述读写单元，用于获取用于指示所述待处理数据所对应加密属性的属性标识；
    所述读写单元，用于根据所述属性标识所指示的加密属性，读取所述待处理数据。
  21. 一种数据处理装置，其特征在于，包括存储器和处理器，所述存储器用于存储计算机指令，所述处理器用于从所述存储器中调用并运行所述计算机指令，以实现如权利要求1-10中任一项所述的方法。
  22. 一种存储系统，其特征在于，包括控制器和至少一个存储节点，所述存储节点用于存储数据，所述控制器用于执行如权利要求1-10中任一项所述的方法。
  23. 一种存储系统，其特征在于，包括多个存储服务器，所述多个存储服务器用于存储数据，所述多个存储服务器中的一个或多个服务器用于执行如权利要求1-10中任一项所述的方法。
  24. 一种芯片，其特征在于，包括存储器和处理器，所述存储器用于存储计算机指令，所述处理器用于从所述存储器中调用并运行所述计算机指令，以实现如权利要求1-10中任一项所述的方法。
  25. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有计算机程序，当所述计算机程序被处理器执行时，实现如权利要求1-10中任一项所述的方法。
PCT/CN2023/100314 2022-09-06 2023-06-15 数据处理方法及装置 WO2024051252A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211082775.9 2022-09-06
CN202211082775.9A CN117707414A (zh) 2022-09-06 2022-09-06 数据处理方法及装置

Publications (1)

Publication Number Publication Date
WO2024051252A1 true WO2024051252A1 (zh) 2024-03-14

Family

ID=90142987

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/100314 WO2024051252A1 (zh) 2022-09-06 2023-06-15 数据处理方法及装置

Country Status (2)

Country Link
CN (1) CN117707414A (zh)
WO (1) WO2024051252A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100306635A1 (en) * 2009-05-28 2010-12-02 Emulex Design & Manufacturing Corporation Method for Verifying Correct Encryption Key Utilization
CN105389526A (zh) * 2015-12-03 2016-03-09 泰华智慧产业集团股份有限公司 加密区和非加密区一体化的移动硬盘及其数据存储方法
US20170317991A1 (en) * 2016-04-29 2017-11-02 Netapp, Inc. Offloading storage encryption operations
CN109033849A (zh) * 2018-06-29 2018-12-18 无锡艾立德智能科技有限公司 对存入磁盘阵列数据进行加密的加密方法及装置
CN109726575A (zh) * 2018-12-29 2019-05-07 杭州宏杉科技股份有限公司 一种数据加密方法及装置
CN111399770A (zh) * 2020-02-26 2020-07-10 平安科技（深圳）有限公司 数据存储方式转换方法、装置及存储介质
CN111737720A (zh) * 2020-07-21 2020-10-02 腾讯科技（深圳）有限公司 数据处理方法、装置及电子设备

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100306635A1 (en) * 2009-05-28 2010-12-02 Emulex Design & Manufacturing Corporation Method for Verifying Correct Encryption Key Utilization
CN105389526A (zh) * 2015-12-03 2016-03-09 泰华智慧产业集团股份有限公司 加密区和非加密区一体化的移动硬盘及其数据存储方法
US20170317991A1 (en) * 2016-04-29 2017-11-02 Netapp, Inc. Offloading storage encryption operations
CN109033849A (zh) * 2018-06-29 2018-12-18 无锡艾立德智能科技有限公司 对存入磁盘阵列数据进行加密的加密方法及装置
CN109726575A (zh) * 2018-12-29 2019-05-07 杭州宏杉科技股份有限公司 一种数据加密方法及装置
CN111399770A (zh) * 2020-02-26 2020-07-10 平安科技（深圳）有限公司 数据存储方式转换方法、装置及存储介质
CN111737720A (zh) * 2020-07-21 2020-10-02 腾讯科技（深圳）有限公司 数据处理方法、装置及电子设备

Also Published As

Publication number Publication date
CN117707414A (zh) 2024-03-15

Similar Documents

Publication Publication Date Title
US10782880B2 (en) Apparatus and method for providing storage for providing cloud services
US20220214967A1 (en) Management of Storage Resources Allocated from Non-volatile Memory Devices to Users
US11789614B2 (en) Performance allocation among users for accessing non-volatile memory devices
US9092426B1 (en) Zero-copy direct memory access (DMA) network-attached storage (NAS) file system block writing
US20190146931A1 (en) Namespace encryption in non-volatile memory devices
KR20170120489A (ko) 통지와 함께 백그라운드 활동을 효율적으로 관리하는 ssd를 위한 메카니즘
US9116851B2 (en) System and method for virtual tape library over S3
WO2011120791A1 (en) Transmission of map-reduce data based on a storage network or a storage network file system
TW201702860A (zh) 自主空間壓縮之儲存裝置以及方法
CN111949210A (zh) 分布式存储系统中元数据存储方法、系统及存储介质
CN113420308A (zh) 用于加密存储器的数据访问控制方法及控制系统
EP4369171A1 (en) Method and apparatus for processing access request, and storage device and storage medium
US20130311659A1 (en) Controlling access to a shared storage system
US20240126847A1 (en) Authentication method and apparatus, and storage system
KR102376152B1 (ko) 클라우드 서비스 제공을 위한 스토리지 제공 장치 및 방법
WO2024051252A1 (zh) 数据处理方法及装置
WO2023207132A1 (zh) 一种数据存储方法、装置、设备及介质
KR101470857B1 (ko) iSCSI 스토리지 시스템을 이용한 네트워크 분산 파일 시스템 및 방법
US10809927B1 (en) Online conversion of storage layout
US20140281300A1 (en) Opportunistic Tier in Hierarchical Storage
US20240211612A1 (en) Data Storage Method and Apparatus, Device, and Readable Medium
EP4350557A1 (en) Data storage method and apparatus, device, and readable storage medium
US20240143790A1 (en) Encryption Key Enhancement Of Storage Array Snapshots
US20230315316A1 (en) Reading a master boot record for a namespace after reformatting the namespace
US11748272B2 (en) Shared keys for no PCBA cartridges

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23861955

Country of ref document: EP

Kind code of ref document: A1