Data processing method and device and related equipment

Abstract

The invention provides a data processing method and device and related equipment. A password service module is built in a service processor of a business system; configuring the service system in a trusted execution environment; when a user calls a server service of a system, a password processing module built in the system is used for carrying out password operation on service flow data generated by calling of the user, and a key of the password operation is generated and managed in a key management system of a trusted execution environment. And sending the data after the password processing operation to the called service business side, so as to return the data after the password operation to the user side through the service business side. According to the method and the device, the cryptographic operation is performed on the business data in the server with the trusted execution environment, so that the security of the data processing and circulation process is better improved through dual protection of the trusted execution environment and the cryptographic operation service, and the probability that the service is attacked or tampered is reduced. And better privacy is provided for service businesses.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data processing method, device and related equipment. Background Art

[0002] As computing platforms become increasingly complex, in order to protect the security of various software functions, strong isolation protection is required between the software components of the computing platform. Trusted Execution Environment (TEE) technology has been increasingly widely promoted and applied. Trusted Execution Environment is a secure computing environment that can run on most common operating systems to provide a secure operating environment for the system, ensure the security of data processing and circulation, and prevent malicious software from obtaining or tampering with data or code in the trusted execution environment, so as to ensure the security and privacy of sensitive data and code. However, although the trusted execution environment technology provides a highly secure execution environment, its design and technical implementation inevitably have a certain degree of technical loopholes, which are at risk of being exploited by hackers for technical attacks. Therefore, how to further reduce the risk of data being attacked during processing and circulation, thereby further improving the security and privacy of computer systems, has become a technical problem that needs to be solved urgently in the industry. Summary of the invention

[0003] In view of this, embodiments of the present application provide a data processing method, device, storage medium, and electronic device to at least or partially solve the above-mentioned problems.

[0004] In a first aspect, an embodiment of the present application provides a method for data processing, including:

[0005] Built-in cryptographic service module for the service processor of the business system;

[0006] Configuring the business system in a trusted execution environment;

[0007] When a service of the business system is called, a cryptographic operation is performed on the service flow data generated by the user call based on the built-in cryptographic processing module, wherein the key of the cryptographic operation is generated and stored in the key management system of the trusted execution environment;

[0008] The service flow data after the cryptographic operation is sent to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

[0009] Optionally, in one embodiment of the present application, the cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions of key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

[0010] Optionally, in one embodiment of the present application, the built-in cryptographic service module for the service processor of the business system includes: configuring a standard protocol service interface for the service processor, so as to implement the built-in cryptographic service module for the system processor by encapsulating an encryption machine or an encryption card through the standard protocol service interface, or configuring a soft encryption algorithm through the encryption service interface.

[0011] Optionally, in an embodiment of the present application, the method further comprises: monitoring a key used in a cryptographic operation to determine whether the key has been changed;

[0012] Correspondingly, when the key changes, the corresponding key in the key management system is updated.

[0013] In a second aspect, based on the data processing method described in the first aspect of the present application, an embodiment of the present application further provides a data processing device, including:

[0014] The first configuration unit is a built-in cryptographic service module for the service processor of the business system;

[0015] A second configuration unit, configuring the business system in a trusted execution environment;

[0016] A processing unit, configured to perform cryptographic operations on service flow data generated by user calls based on the built-in cryptographic processing module when a service business of the business system is called, wherein a key for the cryptographic operations is generated and stored in a key management system of the trusted execution environment;

[0017] The feedback unit is used to send the service flow data after the cryptographic operation to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

[0018] Optionally, in one embodiment of the present application, the cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions of key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

[0019] Optionally, in one embodiment of the present application, the first configuration unit is also used to: configure a standard protocol service interface for the service processor, so as to implement a built-in cryptographic service module for the system processor by encapsulating an encryption machine or encryption card through the standard protocol service interface, or by configuring a soft encryption algorithm through the encryption service interface.

[0020] Optionally, in one embodiment of the present application, the device also includes an update unit, which is used to monitor the key used for cryptographic operations to determine whether the key has changed; when the key has changed, the corresponding key in the key management system is updated.

[0021] In a third aspect, an embodiment of the present application further provides a computer storage medium, on which computer executable instructions are stored, and when the computer executable instructions are executed, any one of the data processing methods described in the first aspect of the embodiment of the present application is performed.

[0022] In a fourth aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus;

[0023] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute any one of the data processing methods described in the first aspect of the embodiment of the present application.

[0024] The present application provides a method, apparatus and related equipment for data processing, by building a cryptographic service module into the service processor of the business system; configuring the business system in a trusted execution environment; when a user calls the server service of the system, cryptographic operations are performed on the service flow data generated by the user call based on the cryptographic processing module built into the system, wherein the key for the cryptographic operation is generated in the key management system of the trusted execution environment, and the data after the cryptographic operation is sent to the called service business party, so that the data after the cryptographic operation is returned to the user end through the service business party. The present application performs cryptographic operations on business data in a server with a trusted execution environment, so as to better improve the security of the data processing and circulation process through the dual protection of the trusted execution environment and the cryptographic operation service, and reduce the probability of the service being attacked or tampered with. Provide better privacy for service business. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0026] Figure 1 A schematic diagram of a workflow of a data processing method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of the structure of a data processing device provided in an embodiment of the present application.

[0028] Figure 3 A schematic structural diagram of an electronic device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0030] It should be understood that the various steps described in the method implementation of the present application can be performed in different orders and / or performed in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0031] Embodiment 1

[0032] The present application embodiment provides a method for data processing, such as Figure 1 As shown, Figure 1 A schematic diagram of a workflow of a data processing method provided in an embodiment of the present application includes:

[0033] Step S101, a cryptographic service module is built into the service processor of the business system. In the implementation of the embodiment of the present application, by building a cryptographic service module into the service processor of the business system, a tightly coupled cryptographic operation service can be provided for the business system, and technical isolation from malicious third parties outside the system is achieved during the encryption and decryption stage of the circulating service data, so as to ensure the security of the circulation of business data in the business system.

[0034] Preferably, in an optional implementation method of the embodiment of the present application, a cryptographic service module is built into the service processor of the business system, including: using a domestic CPU with a built-in cryptographic hardware processing module to implement a built-in cryptographic service module for the service processor of the business system, so as to improve the security and controllability of the service business processing process through the domestic CPU.

[0035] Specifically, in an optional implementation of an embodiment of the present application, the method further includes: configuring the business system or the service processor on a domestic server. The domestic server has the technical advantages of localized support and safe and controllable. Specifically, domestic server companies have the advantage of localization in after-sales service and technical support, and can more conveniently obtain professional technical support and maintenance services, while also being able to obtain faster response speeds and solutions. And domestic servers are safe and reliable based on domestic technology research and development and manufacturing. Due to a deeper understanding of security, domestic servers have been optimized in accordance with localized needs for domestic network environments and security requirements, and can provide more complete security performance and protection measures for business systems.

[0036] Step S102: Configure the business system in a trusted execution environment. A trusted execution environment (TEE) is a secure computing environment that can run on top of a normal operating system, providing a secure operating environment that isolates and protects each software component in the service system, making it difficult for malware to easily obtain or tamper with data and code in the TEE, thereby ensuring the security and privacy of sensitive data and code.

[0037] Step S103: When the service business of the business system is called, the service flow data generated by the user call is cryptographically operated based on the built-in cryptographic processing module, wherein the key for the cryptographic operation is generated and stored in the key management system of the trusted execution environment. At this stage of the embodiment of the present application, since the business system is placed in a trusted execution environment, the cryptographic processing module is also placed in the trusted execution environment, thereby realizing cryptographic operations such as encryption and decryption of the data generated or circulated by the business system in the trusted execution environment, thereby further improving the security of the operating environment, greatly reducing the possibility of malicious acquisition or tampering of data, and better ensuring the security and privacy of sensitive data and code.

[0038] Step S104: Send the service flow data after the cryptographic operation to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

[0039] Optionally, in one embodiment of the present application, the cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions of key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

[0040] In combination with the above-mentioned method, exemplary, the embodiment of the present application here exemplifies the cryptographic operation of the service flow data generated by the service call based on the built-in cryptographic processing module: through the SM2 asymmetric algorithm, an asymmetric root key pair is generated, and the private key in the asymmetric root key is saved in the key management system using the symmetric key generated by the SM4 symmetric algorithm, and the public key is sent to the service call end that initiates the service call. When it is necessary to perform a cryptographic operation on the service flow data generated by the service call, the corresponding encrypted private key data is obtained from the key management system, and the encrypted private key data is decrypted using the symmetric key to obtain the private key data, and the private key data is used to encrypt or decrypt the service flow data, and the decrypted data is further processed, and the encrypted data is sent to the called service business party, so that the cryptographic operation data is returned to the call end that initiates the service call through the service business party. After receiving the flow data fed back by the business system, the call end uses the public key in the asymmetric root key pair generated above to decrypt the received encrypted data to obtain the plaintext data of the feedback data. In this way, the embodiments of the present application can ensure the security and privacy of the data flow process throughout the entire process, making it difficult for malicious acquisition or tampering.

[0041] Optionally, in an embodiment of the present application, the service processor of the business system has a built-in cryptographic service module, including: configuring a standard protocol service interface for the service processor, so as to realize the built-in cryptographic service module for the system processor by means of a packaged encryption machine or encryption card through the standard protocol service interface, or by configuring a soft encryption algorithm through the encryption service interface. This improves the flexibility and compatibility of configuring the service processor for the business system, so as to meet the adaptation requirements of different business system deployments.

[0042] Optionally, in one embodiment of the present application, the method further includes: monitoring the key used for cryptographic operations to determine whether the key has changed; correspondingly, when the key has changed, updating the corresponding key in the key management system. In this way, the operation and maintenance party can adjust or replace the encryption key in use in a timely manner to further reduce the probability of data being maliciously obtained or tampered with.

[0043] The present application provides a method for data processing, by building a cryptographic service module into the service processor of the business system; configuring the business system in a trusted execution environment; when a user calls the server service of the system, performing cryptographic operations on the service flow data generated by the user call based on the cryptographic processing module built into the system, wherein the key for the cryptographic operation is generated in the key management system of the trusted execution environment, and the data after the cryptographic operation is sent to the called service business party, so that the data after the cryptographic operation is returned to the user end through the service business party. The present application performs cryptographic operations on business data in a server with a trusted execution environment, so as to better improve the security of the data processing and circulation process through the dual protection of the trusted execution environment and the cryptographic operation service, and reduce the probability of the service being attacked or tampered with. Provide better privacy for service business.

[0044] Embodiment 2

[0045] Based on the data processing method provided in the first embodiment of the present application, the present application also provides a data processing device, such as Figure 2 As shown, Figure 2 A schematic diagram of the structure of a data processing device 20 provided in an embodiment of the present application, wherein the data processing device 20 includes:

[0046] The first configuration unit is a built-in cryptographic service module for the service processor of the business system;

[0047] A second configuration unit, configuring the business system in a trusted execution environment;

[0048] A processing unit, configured to perform cryptographic operations on service flow data generated by user calls based on the built-in cryptographic processing module when a service business of the business system is called, wherein a key for the cryptographic operations is generated and stored in a key management system of the trusted execution environment;

[0049] The feedback unit is used to send the service flow data after the cryptographic operation to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

[0050] Optionally, in one embodiment of the present application, the cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions of key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

[0051] Exemplarily, the embodiment of the present application here uses a processing unit to perform cryptographic operations on the service flow data generated by the service call based on the built-in cryptographic processing module when the service business of the business system is called: an asymmetric root key is generated by the SM2 asymmetric algorithm, and the private key in the asymmetric root key is saved in the key management system using the symmetric key generated by the SM4 symmetric algorithm, and the public key is sent to the service call end that initiates the service call. When it is necessary to perform cryptographic operations on the service flow data generated by the service call, the corresponding encrypted private key data is obtained from the key management system, and the encrypted private key data is decrypted using the symmetric key to obtain the private key data, and the private key data is used to encrypt or decrypt the service flow data, and the decrypted data is further processed, and the encrypted data is sent to the called service business party, so that the cryptographically operated data is returned to the calling end that initiates the service call through the service business party. In this way, the security and privacy of the data flow process are guaranteed throughout the entire process, and it is not easy to be obtained or tampered with by a malicious third party.

[0052] Optionally, in one embodiment of the present application, the first configuration unit is also used to: configure a standard protocol service interface for the service processor, so as to implement a built-in cryptographic service module for the system processor by encapsulating an encryption machine or encryption card through the standard protocol service interface, or by configuring a soft encryption algorithm through the encryption service interface.

[0053] Optionally, in one embodiment of the present application, the device also includes an update unit, which is used to monitor the key used for cryptographic operations to determine whether the key has changed; when the key has changed, the corresponding key in the key management system is updated.

[0054] The present application provides a data processing device, wherein a first configuration unit is set to be a built-in cryptographic service module of a service processor of a business system; a second configuration unit is set to configure the business system in a trusted execution environment; a processing unit is set to perform cryptographic operations on service flow data generated by user calls based on the built-in cryptographic processing module of the system when a user calls a server service of the system, wherein the key for the cryptographic operation is generated in a key management system of the trusted execution environment; a feedback unit is set to send the data after the cryptographic operation to the called service business party, so that the data after the cryptographic operation is returned to the user end through the service business party. The present application performs cryptographic operations on business data in a server with a trusted execution environment, so as to better improve the security of the data processing and circulation process through the dual protection of the trusted execution environment and the cryptographic operation service, and reduce the probability of the service being attacked or tampered with. Provide better privacy for service business.

[0055] Embodiment 3

[0056] An embodiment of the present application also provides a storage medium on which a computer program is stored. When the program is executed by a processor, any one of the data processing methods described in the first embodiment of the present application is implemented.

[0057] Embodiment 4:

[0058] The present application also provides an electronic device, such as Figure 3 As shown, Figure 3 A schematic diagram of the structure of an electronic device 30 is provided for an embodiment of the present application. The electronic device 30 includes:

[0059] One or more processors 301, communication interface 302, memory 303 and communication bus 304, the processor 301, memory 303 and communication interface 302 communicate with each other via the communication bus 304;

[0060] Memory 303, used to store one or more programs;

[0061] When the one or more programs are executed by the one or more processors 301, the one or more processors 301 implement any one of the data processing methods described in Embodiment 1 of the present application.

[0062] So far, the application has described specific embodiments of the subject matter. In some cases, the actions recorded in the claims can be performed in different orders and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing can be advantageous.

[0063] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system layer on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0064] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0065] The system layers, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0066] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0067] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0068] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, system layers or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0069] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific transactions or implement specific abstract data types. The present application may also be practiced in distributed computing environments where transactions are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0070] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system layer embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0071] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for data processing, characterized in that: include: Built-in cryptographic service module for the service processor of the business system; Configuring the business system in a trusted execution environment; When a service of the business system is called, a cryptographic operation is performed on the service flow data generated by the user call based on the built-in cryptographic processing module, wherein the key of the cryptographic operation is generated and stored in the key management system of the trusted execution environment; The service flow data after the cryptographic operation is sent to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

2. The data processing method according to claim 1, characterized in that: The cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions including key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

3. The data processing method according to claim 1, characterized in that: The built-in cryptographic service module for the service processor of the business system includes: configuring a standard protocol service interface for the service processor, so as to implement the built-in cryptographic service module for the system processor by encapsulating an encryption machine or an encryption card through the standard protocol service interface, or by configuring a soft encryption algorithm through the encryption service interface.

4. The data processing method according to claim 3, characterized in that: The method further comprises: monitoring a key used in a cryptographic operation to determine whether the key has been changed; Correspondingly, when the key changes, the corresponding key in the key management system is updated.

5. A data processing device, characterized in that: include: The first configuration unit is a built-in cryptographic service module for the service processor of the business system; A second configuration unit, configuring the business system in a trusted execution environment; A processing unit, configured to perform cryptographic operations on service flow data generated by user calls based on the built-in cryptographic processing module when a service business of the business system is called, wherein a key for the cryptographic operations is generated and stored in a key management system of the trusted execution environment; The feedback unit is used to send the service flow data after the cryptographic operation to the called service business party, so that the service flow data after the cryptographic operation is returned to the calling end that initiates the service business call through the service business party.

6. The data processing device according to claim 5, characterized in that: The cryptographic service module supports the national secret SM2 asymmetric algorithm, SM3 hash algorithm and SM4 symmetric algorithm, and is used to provide one or more cryptographic service functions including key management, symmetric encryption and decryption, asymmetric encryption and decryption, data signature, and data signature verification for the server business.

7. The data processing device according to claim 5, characterized in that: The first configuration unit is also used to configure a standard protocol service interface for the service processor, so as to implement a built-in cryptographic service module for the system processor by encapsulating an encryption machine or encryption card through the standard protocol service interface, or by configuring a soft encryption algorithm through the encryption service interface.

8. The data processing device according to claim 7, characterized in that: The device also includes an updating unit, which is used to monitor the key used for cryptographic operations to determine whether the key has changed; when the key has changed, the corresponding key in the key management system is updated.

9. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and when the computer executable instructions are executed, the data processing method according to any one of claims 1 to 4 is performed.

10. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the data processing method as described in any one of claims 1-4.

Images