Key updating method and apparatus, and device and storage medium

Abstract

The embodiments of the present application relate to the technical field of computers. Provided are a key updating method and apparatus, and a device and a storage medium. The method comprises: in response to a state switching operation triggered for an application, a service device sending a state switching request to a management platform; and on the basis of the state switching request, the management platform replacing an original key with an updated key, switching a normal state policy to a transition state policy, and issuing the transition state policy to an encryption device in real time, wherein the transition state policy can ensure the coexistence of new and old keys, so that the encryption device can use the updated key to encrypt plaintext data of the application, and send obtained ciphertext data to a database. Moreover, the service device can be synchronized with a bypass to execute a batch data processing task, and existing data in the database can be refreshed, such that key updating and existing data processing in an encrypted database are realized without affecting the normal service provision of the application, thereby guaranteeing the service availability of the application and the database.

Description

Key updating method, device, equipment and storage medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of the People's Republic of China on August 9, 2023, with application number 202311000748.7 and invention name "A key update method, device, equipment and storage medium", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The embodiments of the present application relate to the field of computer technology, and in particular to a key updating method, apparatus, device, and storage medium. Background Art

[0004] With data as a new factor of production, security is paramount, and a global trend is underway. Sensitive data is encrypted before being transmitted to a database, where it exists as ciphertext. Even privileged database accounts and operations personnel cannot access the plaintext data at the database level, effectively safeguarding the security of user sensitive data.

[0005] However, when encrypting sensitive data before transferring it to a database for storage to ensure its security, there's also a need to update the encryption key. Related technologies involve refreshing the existing data in the database after stopping the service. This involves decrypting the existing data using the old key and then encrypting it with the new key. After refreshing the existing data, the service is restarted.

[0006] However, during the refresh of existing data, the application cannot provide external services. Moreover, when the amount of existing data is large, the service outage will last longer, which will affect the service availability of the application and database.

[0007] Summary of the Invention

[0008] The embodiments of the present application provide a key update method, apparatus, device, and storage medium for updating keys and processing existing data in a database without affecting the normal provision of services by applications, thereby ensuring the service availability of applications and databases.

[0009] In one aspect, an embodiment of the present application provides a key update method, applied to a service device, comprising:

[0010] In response to a state switching operation triggered for an application, a state switching request is sent to a management platform, the state switching request being used to instruct the management platform to replace the original key with the updated key; switch the normal state policy to a transition state policy, and send the transition state policy to the encryption device, the transition state policy including at least: the original key and the updated key;

[0011] Sending the plaintext data to the encryption device, so that the encryption device encrypts the plaintext data using the updated key, obtains ciphertext data, and sends the ciphertext data to the database;

[0012] The bypass performs a key refresh operation on the existing data in the database based on the original key and the updated key to obtain updated data.

[0013] On the one hand, an embodiment of the present application provides a key update method, applied to a management platform, comprising:

[0014] receiving a state switching request sent by a service device, where the state switching request is sent by the service device in response to a state switching operation triggered for an application;

[0015] Based on the state switching request, the original key is replaced with the updated key; the normal state policy is switched to the transition state policy, and the transition state policy is sent to the encryption device, and the transition state policy at least includes: the original key and the updated key; so that when the encryption device receives the plaintext data sent by the service device, it uses the updated key to encrypt the plaintext data, obtains the ciphertext data and sends the ciphertext data to the database; the existing data in the database is bypassed by the service device to perform a key refresh operation based on the original key and the updated key.

[0016] In one aspect, an embodiment of the present application provides a key update method, applied to an encryption device, comprising:

[0017] Receiving a transition state policy issued by a management platform, the transition state policy including at least an original key and an updated key, the transition state policy being obtained by the management platform replacing the original key with the updated key and switching from a normal state policy after receiving a state switching request sent by a service device;

[0018] Receiving plaintext data sent by the service device;

[0019] The updated key is used to encrypt the plaintext data to obtain ciphertext data and send the ciphertext data to the database. The existing data in the database is refreshed by the service device based on the original key and the updated key, bypassing the key refresh operation.

[0020] In one aspect, an embodiment of the present application provides a key updating apparatus, applied to a service device, comprising:

[0021] A first sending module is configured to send a state switching request to a management platform in response to a state switching operation triggered by an application, wherein the state switching request is configured to instruct the management platform to replace an original key with an updated key; switch a normal state policy to a transition state policy, and send the transition state policy to an encryption device, wherein the transition state policy includes at least the original key and the updated key;

[0022] The first sending module is further configured to send the plaintext data to the encryption device, so that the encryption device encrypts the plaintext data using the updated key, obtains ciphertext data, and sends the ciphertext data to the database;

[0023] The refresh module is used to bypass the key refresh operation on the existing data in the database based on the original key and the updated key to obtain updated data.

[0024] Optionally, the refresh module is specifically configured to:

[0025] Bypass uses the original key to decrypt the stored data to obtain the stored plaintext data;

[0026] The updated key is used to encrypt the existing plaintext data to obtain the updated data.

[0027] Optionally, the refresh module is further configured to:

[0028] Before the bypass performs a key refresh operation on the stock data in the database based on the original key and the updated key, it receives a stock data batch processing task issued by the management platform.

[0029] Optionally, it further includes a first receiving module;

[0030] The first sending module is further configured to:

[0031] Sending a data read request carrying an original query condition to the encryption device, wherein the original query condition includes a plaintext query field, so that the encryption device encrypts the plaintext query field using the original key to obtain a first encrypted field, and encrypts the plaintext query field using the updated key to obtain a second encrypted field, and concatenates the query condition including the first encrypted field with the query condition including the second encrypted field to obtain a target query condition; and obtaining a ciphertext query result set from the database based on the target query condition, wherein the ciphertext query result set includes: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field;

[0032] The first receiving module is specifically configured to:

[0033] Receive a plaintext query result set returned by the encryption device, wherein the plaintext query result set includes: first plaintext data obtained by decrypting the first ciphertext data using the original key, and second plaintext data obtained by decrypting the second ciphertext data using the updated key.

[0034] Optionally, the first sending module is further configured to:

[0035] The bypass uses the updated key to encrypt the existing plaintext data. After obtaining the updated data, in response to the state recovery operation triggered by the application, a state recovery request is sent to the management platform. The state switching request is used to instruct the management platform to switch the transition state policy to the normal state policy, and send the normal state policy to the encryption device. The normal state policy includes: the updated key.

[0036] On the one hand, an embodiment of the present application provides a key update device, applied to a management platform, comprising:

[0037] A second receiving module is configured to receive a state switching request sent by a service device, where the state switching request is sent by the service device in response to a state switching operation triggered for an application;

[0038] A processing module, configured to replace the original key with the updated key based on the state switching request; and switch the normal state policy to the transition state policy;

[0039] The second sending module is used to send the transition state strategy to the encryption device, and the transition state strategy includes at least: the original key and the updated key; so that when the encryption device receives the plaintext data sent by the service device, it uses the updated key to encrypt the plaintext data, obtains the ciphertext data and sends the ciphertext data to the database; the existing data in the database is bypassed by the service device to perform a key refresh operation based on the original key and the updated key.

[0040] In one aspect, an embodiment of the present application provides a key updating apparatus, applied to an encryption device, comprising:

[0041] a third receiving module, configured to receive a transition state policy issued by the management platform, the transition state policy including at least an original key and an updated key, the transition state policy being obtained by the management platform replacing the original key with the updated key and switching from a normal state policy after receiving a state switching request sent by the service device;

[0042] The third receiving module is configured to receive the plaintext data sent by the service device;

[0043] An encryption module is used to encrypt the plaintext data using the updated key to obtain ciphertext data and send the ciphertext data to a database, and the existing data in the database is refreshed by the service device based on the original key and the updated key without using the original key.

[0044] Optionally, the third receiving module is further configured to receive a data reading request carrying an original query condition sent by a service device, wherein the original query condition includes a plaintext query field;

[0045] The encryption module is further used to encrypt the plaintext query field using the original key to obtain a first encrypted field, and to encrypt the plaintext query field using the updated key to obtain a second encrypted field, and to concatenate the query condition containing the first encrypted field with the query condition containing the second encrypted field to obtain a target query condition; obtain a ciphertext query result set from the database query based on the target query condition, and the ciphertext query result set includes: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field; decrypt the first ciphertext data using the original key to obtain first plaintext data, and decrypt the second ciphertext data using the updated key to obtain second plaintext data; and send the plaintext query result set containing the first plaintext data and the second plaintext data to the service device.

[0046] On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned key update method when executing the program.

[0047] On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of the above-mentioned key update method.

[0048] On the one hand, an embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer performs the steps of the key update method as described above.

[0049] In an embodiment of the present application, the service device responds to a state switching operation triggered for an application by sending a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with the updated key, switches the normal state policy to the transition state policy, and sends the transition state policy to the encryption device in real time. The transition state policy ensures the coexistence of the old and new keys, allowing the encryption device to use the updated key to encrypt the application's plaintext data and send the obtained ciphertext data to the database. At the same time, the service device can synchronously bypass the execution of batch data processing tasks and refresh the existing data in the database. Without affecting the normal provision of services by the application, the service device can update the key and process the existing data in the encrypted database, thereby ensuring the service availability of the application and database. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] FIG1 is a schematic diagram of a system architecture provided in an embodiment of the present application;

[0052] FIG2 is a schematic diagram of a flow chart of a key updating method provided in an embodiment of the present application;

[0053] FIG3 is a flow chart of a state recovery method provided in an embodiment of the present application;

[0054] FIG4 is a schematic diagram of a process flow of a key updating device provided in an embodiment of the present application;

[0055] FIG5 is a schematic diagram of a process flow of a key updating device provided in an embodiment of the present application;

[0056] FIG6 is a schematic diagram of a process flow of a key updating device provided in an embodiment of the present application;

[0057] FIG7 is a schematic structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and beneficial effects of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0059] Refer to Figure 1, which is a system architecture diagram applicable to an embodiment of the present application. The system architecture includes at least a service device 101, a management platform 102, an encryption device 103 and a database 104. Among them, the management platform 102 and the encryption device 103 can be two independent devices or integrated into one device. This application does not make any specific limitations on this.

[0060] The management platform 102 includes a key management module and a policy management module. The key management module is used for key management, and the policy management module is used for managing encryption and decryption policies.

[0061] The service device 101 and the management platform 102 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers. They can also be cloud servers that provide basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The service device 101 and the management platform 102 can be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions on this.

[0062] The encryption device 103 is placed in front of the database 104. The plaintext data of the service device 101 needs to be encrypted by the encryption device 103 before being stored in the database 104. That is, the database 104 stores ciphertext data. Therefore, the database 104 can also be called a secret database.

[0063] Based on the system architecture diagram shown in FIG1 , an embodiment of the present application provides a process of a key update method, as shown in FIG2 . The process of the method is interactively executed by a service device, a management platform, an encryption device, and a database, and includes the following steps:

[0064] Step S201: In response to a state switching operation triggered on an application, the service device sends a state switching request to a management platform.

[0065] Specifically, the application on the service device logs in to the management platform. When the application switches from the normal state to the transition state, the service device sends a state switching request to the management platform.

[0066] In step S202 , the management platform replaces the original key with the updated key based on the state switching request, and switches the normal state policy to the transition state policy.

[0067] Specifically, the management platform includes a key management module and a policy management module. When the management platform receives a state switch request, the key management module replaces the original key with the updated key, triggering the policy management module to switch from the normal state policy to the transition state policy. The normal state policy includes the updated key, while the transition state policy includes the original key and the updated key, for example, key: keyID1 | keyID2. In addition to the key, the normal state policy and the transition state policy each include other policy information, such as the database, table, and field information required for encryption by the application.

[0068] In step S203, the management platform sends the transition state policy to the encryption device.

[0069] Specifically, after receiving the transition state policy, the encryption device also switches from the normal state policy to the transition state policy.

[0070] Step S204: The encryption device receives the plaintext data sent by the service device.

[0071] In step S205 , the encryption device encrypts the plaintext data using the updated key to obtain ciphertext data.

[0072] Specifically, the plaintext data is the data that the application needs to write into the database; the encryption device uses the new key to encrypt the plaintext data to obtain the ciphertext data.

[0073] In step S206, the encryption device sends the encrypted data to the database.

[0074] In step S207, the service device bypasses the original key and the updated key, performs a key refresh operation on the existing data in the database, and obtains updated data.

[0075] In an embodiment of the present application, the service device responds to a state switching operation triggered for an application by sending a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with the updated key, switches the normal state policy to the transition state policy, and sends the transition state policy to the encryption device in real time. The transition state policy ensures the coexistence of the old and new keys, allowing the encryption device to use the updated key to encrypt the application's plaintext data and send the obtained ciphertext data to the database. At the same time, the service device can synchronously bypass the execution of batch data processing tasks and refresh the existing data in the database. Without affecting the normal provision of services by the application, the service device can update the key and process the existing data in the encrypted database, thereby ensuring the service availability of the application and database.

[0076] In some embodiments, the service device sends a data read request carrying an original query condition to the encryption device, where the original query condition includes a plaintext query field. The encryption device encrypts the plaintext query field using the original key to obtain a first encrypted field, encrypts the plaintext query field using the updated key to obtain a second encrypted field, and concatenates the query condition including the first encrypted field with the query condition including the second encrypted field to obtain a target query condition.

[0077] A ciphertext query result set is obtained from a database query based on a target query condition, wherein the ciphertext query result set includes: first ciphertext data obtained by querying a first encrypted field, and second ciphertext data obtained by querying a second encrypted field; the first ciphertext data is decrypted using an original key to obtain first plaintext data, and the second ciphertext data is decrypted using an updated key to obtain second plaintext data; and the plaintext query result set containing the first plaintext data and the second plaintext data is sent to a service device.

[0078] Specifically, in the transition state, the database contains not only new data encrypted with the updated key, but also existing data encrypted with the original key. In order to ensure the integrity of the data query results, a parser is used to rewrite the original query conditions (i.e., the original query statement), that is, the plaintext query field is encrypted with the original key to obtain the first encrypted field, and the plaintext query field is encrypted with the updated key to obtain the second encrypted field. The query conditions containing the first encrypted field are concatenated with the query conditions containing the second encrypted field to obtain the target query conditions (i.e., the target query statement). When the target query conditions are used to query data, all ciphertext data before and after the key change can be queried. All ciphertext data is decrypted to obtain all plaintext data, and then all plaintext data is sent to the service device.

[0079] For example, let's assume the original key is Key 1, the updated key is Key 2, and the original query is: "select * from table_A where name = Zhang San." This means the original query includes the plaintext field "Zhang San." The SQL parser in the encryption device uses Key 1 to encrypt the plaintext field "Zhang San," obtaining Ciphertext 1. It then uses Key 2 to encrypt the plaintext field "Zhang San," obtaining Ciphertext 2. The SQL parser uses a union statement to concatenate the query containing Ciphertext 1 with the query containing Ciphertext 2, obtaining the target query: "select * from table_A where name = Ciphertext 1, union(select * from table_A where name = Ciphertext 2)."

[0080] In some embodiments, after the management platform switches the normal state policy to the transition state policy, it creates a batch processing task for existing data and then sends the batch processing task to the service device. The service device bypasses the original key to decrypt the existing data to obtain the existing plaintext data; bypasses the updated key to encrypt the existing plaintext data to obtain the updated data.

[0081] In actual applications, the service device batch-reads the existing data in the database, decrypts it using the original key, then encrypts the existing plaintext data using the updated key and rewrites the updated data into the database. During the key refresh process, the database pressure is kept within an appropriate range by controlling parameters (such as the number of concurrent connections and the amount of data processed in batches) so as not to affect the normal provision of services by the application. After the existing data refresh is completed, the batch processing task of the existing data is terminated, and the database is filled with ciphertext data encrypted with the updated key.

[0082] In some embodiments, after the existing data is refreshed, the application is restored to a normal state, and the encryption and decryption strategy is updated accordingly. Referring to FIG3 , the following steps are included:

[0083] Step S301: In response to a state recovery operation triggered on an application, the service device sends a state recovery request to a management platform.

[0084] Step S302: The management platform switches the transition state policy to the normal state policy based on the state recovery request.

[0085] Step S303: The management platform sends the normal state policy to the encryption device.

[0086] Common state strategies include: Update key.

[0087] Step S304: The encryption device receives the plaintext data sent by the service device.

[0088] In step S305 , the encryption device encrypts the plaintext data using the updated key to obtain ciphertext data.

[0089] Step S306: The encryption device sends the ciphertext data to the database.

[0090] Specifically, after the existing data processing is completed, the application returns to the normal operating state, the encryption and decryption strategy of the management platform is switched back to the normal state strategy (the key in the normal state strategy only contains the update key), and the management platform sends the encryption and decryption strategy to the encryption device in real time.

[0091] In an embodiment of the present application, the service device synchronously bypasses and executes batch data processing tasks, refreshes the existing data in the database, and restores to the normal state after the refresh is completed, thereby achieving the update of the key and the processing of the existing data in the confidential database without affecting the normal provision of services by the application, thereby ensuring the service availability of the application and the database.

[0092] Based on the same technical concept, an embodiment of the present application provides a structural diagram of a key updating device, which is applied to a service device. As shown in FIG4 , the device 400 includes:

[0093] A first sending module 401 is configured to send a state switching request to a management platform in response to a state switching operation triggered by an application, wherein the state switching request is configured to instruct the management platform to replace the original key with the updated key; switch the normal state policy to a transition state policy, and send the transition state policy to the encryption device, wherein the transition state policy includes at least the original key and the updated key;

[0094] The first sending module 401 is further configured to send the plaintext data to the encryption device, so that the encryption device encrypts the plaintext data using the updated key, obtains ciphertext data, and sends the ciphertext data to the database;

[0095] The refresh module 402 is configured to bypass the key refresh operation performed on the existing data in the database based on the original key and the updated key to obtain updated data.

[0096] Optionally, the refreshing module 402 is specifically configured to:

[0097] Bypass uses the original key to decrypt the stored data to obtain the stored plaintext data;

[0098] The updated key is used to encrypt the existing plaintext data to obtain the updated data.

[0099] Optionally, the refreshing module 402 is further configured to:

[0100] Before the bypass performs a key refresh operation on the stock data in the database based on the original key and the updated key, it receives a stock data batch processing task issued by the management platform.

[0101] Optionally, it further includes a first receiving module 403;

[0102] The first sending module 401 is further configured to:

[0103] Sending a data read request carrying an original query condition to the encryption device, wherein the original query condition includes a plaintext query field, so that the encryption device encrypts the plaintext query field using the original key to obtain a first encrypted field, and encrypts the plaintext query field using the updated key to obtain a second encrypted field, and concatenates the query condition including the first encrypted field with the query condition including the second encrypted field to obtain a target query condition; and obtaining a ciphertext query result set from the database based on the target query condition, wherein the ciphertext query result set includes: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field;

[0104] The first receiving module 403 is specifically configured to:

[0105] Receive a plaintext query result set returned by the encryption device, wherein the plaintext query result set includes: first plaintext data obtained by decrypting the first ciphertext data using the original key, and second plaintext data obtained by decrypting the second ciphertext data using the updated key.

[0106] Optionally, the first sending module 401 is further configured to:

[0107] The bypass uses the updated key to encrypt the existing plaintext data. After obtaining the updated data, in response to the state recovery operation triggered by the application, a state recovery request is sent to the management platform. The state switching request is used to instruct the management platform to switch the transition state policy to the normal state policy, and send the normal state policy to the encryption device. The normal state policy includes: the updated key.

[0108] Based on the same technical concept, an embodiment of the present application provides a structural diagram of a key update device, which is applied to a management platform. As shown in FIG5 , the device 500 includes:

[0109] A second receiving module 501 is configured to receive a state switching request sent by a service device, where the state switching request is sent by the service device in response to a state switching operation triggered for an application;

[0110] The processing module 502 is configured to replace the original key with the updated key based on the state switching request; and switch the normal state policy to the transition state policy;

[0111] The second sending module 503 is used to send the transition state strategy to the encryption device, and the transition state strategy includes at least: the original key and the updated key; so that when the encryption device receives the plaintext data sent by the service device, it uses the updated key to encrypt the plaintext data, obtains the ciphertext data and sends the ciphertext data to the database; the existing data in the database is bypassed by the service device to perform a key refresh operation based on the original key and the updated key.

[0112] Based on the same technical concept, an embodiment of the present application provides a schematic structural diagram of a key updating device, which is applied to an encryption device. As shown in FIG6 , the device 600 includes:

[0113] The third receiving module 601 is configured to receive a transition state policy issued by the management platform, the transition state policy including at least an original key and an updated key. The transition state policy is obtained by the management platform replacing the original key with the updated key and switching from the normal state policy after receiving a state switching request from the service device.

[0114] The third receiving module 601 is configured to receive plaintext data sent by the service device;

[0115] The encryption module 602 is used to encrypt the plaintext data using the updated key, obtain ciphertext data and send the ciphertext data to the database. The existing data in the database is refreshed by the service device based on the original key and the updated key.

[0116] Optionally, the third receiving module 601 is further configured to receive a data reading request carrying an original query condition sent by a service device, wherein the original query condition includes a plaintext query field;

[0117] The encryption module 602 is further used to encrypt the plaintext query field using the original key to obtain a first encrypted field, and to encrypt the plaintext query field using the updated key to obtain a second encrypted field, and to concatenate the query condition containing the first encrypted field with the query condition containing the second encrypted field to obtain a target query condition; obtain a ciphertext query result set from the database query based on the target query condition, and the ciphertext query result set includes: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field; decrypt the first ciphertext data using the original key to obtain first plaintext data, and decrypt the second ciphertext data using the updated key to obtain second plaintext data; and send the plaintext query result set containing the first plaintext data and the second plaintext data to the service device.

[0118] In an embodiment of the present application, the service device responds to a state switching operation triggered for an application by sending a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with the updated key, switches the normal state policy to the transition state policy, and sends the transition state policy to the encryption device in real time. The transition state policy ensures the coexistence of the old and new keys, allowing the encryption device to use the updated key to encrypt the application's plaintext data and send the obtained ciphertext data to the database. At the same time, the service device can synchronously bypass the execution of batch data processing tasks and refresh the existing data in the database. Without affecting the normal provision of services by the application, the service device can update the key and process the existing data in the encrypted database, thereby ensuring the service availability of the application and database.

[0119] Based on the same technical concept, an embodiment of the present application provides a computer device, which can be at least one of the service device, management platform, and encryption device shown in Figure 7. As shown in Figure 7, the computer device includes at least one processor 701 and a memory 702 connected to the at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of the present application. In Figure 7, the processor 701 and the memory 702 are connected via a bus as an example. Buses can be divided into address buses, data buses, control buses, etc.

[0120] In the embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. The at least one processor 701 can perform the steps of the above-mentioned key update method by executing the instructions stored in the memory 702.

[0121] The processor 701 is the control center of the computer device. It can connect various components of the computer device using various interfaces and lines. It can implement key updates by running or executing instructions stored in the memory 702 and accessing data stored in the memory 702. Optionally, the processor 701 may include one or more processing units. The processor 701 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0122] The processor 701 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0123] The memory 702 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 702 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer device, but is not limited thereto. The memory 702 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0124] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the steps of the above-mentioned key update method.

[0125] Based on the same inventive concept, an embodiment of the present invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer performs the steps of the key update method as described above.

[0126] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer device or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0128] These computer program instructions may also be stored in a computer-readable memory that can direct a computer device or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0129] These computer program instructions can also be loaded onto a computer device or other programmable data processing device, so that a series of operating steps are executed on the computer device or other programmable device to produce a process implemented by the computer device, so that the instructions executed on the computer device or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0130] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0131] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A key updating method, applied to a service device, characterized in that: include: In response to a state switching operation triggered for the application, sending a state switching request to the management platform, wherein the state switching request is used to instruct the management platform to replace the original key with the updated key; Switching the normal state policy to a transition state policy, and sending the transition state policy to the encryption device, wherein the transition state policy includes at least: the original key and the updated key; Sending the plaintext data to the encryption device so that the encryption device encrypts the plaintext data using the updated key, obtains ciphertext data and sends the ciphertext data to the database; The bypass performs a key refresh operation on the stock data in the database based on the original key and the updated key to obtain updated data.

2. The method according to claim 1, characterized in that The bypass performs a key refresh operation on the stock data in the database based on the original key and the updated key, including: Bypass uses the original key to decrypt the stock data to obtain the stock plaintext data; The updated key is used in a bypass to encrypt the existing plaintext data to obtain the updated data.

3. The method according to claim 1, characterized in that Before the bypass performs a key refresh operation on the stock data in the database based on the original key and the updated key, the bypass further includes: Receive the batch processing task of stock data issued by the management platform.

4. The method according to claim 1, characterized in that Also includes: Sending a data read request carrying an original query condition to the encryption device, wherein the original query condition includes a plaintext query field, so that the encryption device encrypts the plaintext query field using the original key to obtain a first encrypted field, and encrypts the plaintext query field using the updated key to obtain a second encrypted field, and concatenates the query condition including the first encrypted field with the query condition including the second encrypted field to obtain a target query condition; and obtaining a ciphertext query result set from the database based on the target query condition, wherein the ciphertext query result set includes: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field; A plaintext query result set returned by the encryption device is received, wherein the plaintext query result set includes: first plaintext data obtained by decrypting the first ciphertext data using the original key, and second plaintext data obtained by decrypting the second ciphertext data using the updated key.

5. The method according to claim 1, characterized in that The bypass uses the update key to encrypt the existing plaintext data, and after obtaining the update data, it also includes: In response to the state recovery operation triggered for the application, a state recovery request is sent to the management platform, and the state switching request is used to instruct the management platform to switch the transition state policy to the normal state policy, and send the normal state policy to the encryption device. The normal state policy includes: the updated key.

6. A key update method, applied to a management platform, characterized in that: include: receiving a state switching request sent by a service device, wherein the state switching request is sent by the service device in response to a state switching operation triggered for an application; Based on the state switching request, replacing the original key with the updated key; The normal state strategy is switched to a transition state strategy, and the transition state strategy is sent to the encryption device, wherein the transition state strategy at least includes: the original key and the updated key; so that when the encryption device receives the plaintext data sent by the service device, The updated key encrypts the plaintext data to obtain ciphertext data and sends the ciphertext data to the database; the existing data in the database is refreshed by the service device based on the original key and the updated key, bypassing the key refresh operation.

7. A key updating method, applied to an encryption device, characterized in that: include: Receiving a transition state policy issued by a management platform, the transition state policy at least including: an original key and an updated key, the transition state policy being obtained by the management platform replacing the original key with the updated key and switching from a normal state policy after receiving a state switching request sent by a service device; Receiving plaintext data sent by the service device; The updated key is used to encrypt the plaintext data to obtain ciphertext data and send the ciphertext data to a database, and the stock data in the database is refreshed by the service device based on the original key and the updated key, bypassing the key refresh operation.

8. The method according to claim 7, characterized in that Also includes: Receiving a data reading request carrying an original query condition sent by a service device, wherein the original query condition includes a plaintext query field; The plaintext query field is encrypted using the original key to obtain a first encrypted field, and the plaintext query field is encrypted using the updated key to obtain a second encrypted field, and the query condition containing the first encrypted field is concatenated with the query condition containing the second encrypted field to obtain a target query condition; Obtaining a ciphertext query result set from the database query based on the target query condition, the ciphertext query result set including: first ciphertext data obtained by querying the first encrypted field, and second ciphertext data obtained by querying the second encrypted field; Decrypting the first ciphertext data using the original key to obtain first plaintext data, and decrypting the second ciphertext data using the updated key to obtain second plaintext data; Sending a plaintext query result set including the first plaintext data and the second plaintext data to the service device.

9. A key updating device, applied to a service device, characterized in that: include: A first sending module, configured to send a state switching request to a management platform in response to a state switching operation triggered for an application, wherein the state switching request is used to instruct the management platform to replace an original key with an updated key; Switching the normal state policy to a transition state policy, and sending the transition state policy to the encryption device, wherein the transition state policy includes at least: the original key and the updated key; The first sending module is further used to send the plaintext data to the encryption device, so that the encryption device uses the updated key to encrypt the plaintext data, obtain the ciphertext data and send the ciphertext data to the database; A refresh module is used to bypass the key refresh operation performed on the stock data in the database based on the original key and the updated key to obtain updated data.

10. A key updating device, applied to a management platform, characterized in that: include: A second receiving module, configured to receive a state switching request sent by a service device, wherein the state switching request is sent by the service device in response to a state switching operation triggered for an application; A processing module, configured to replace the original key with an updated key based on the state switching request; Switch the normal state strategy to the transition state strategy; The second sending module is used to send the transition state strategy to the encryption device, wherein the transition state strategy at least includes: the original key and the updated key; so that the encryption device receives the plaintext sent by the service device When updating data, the updated key is used to encrypt the plaintext data to obtain the ciphertext data and send the ciphertext data to the database; the existing data in the database is refreshed by the service device based on the original key and the updated key without using the service device.

11. A key updating device, applied to an encryption device, characterized in that: include: A third receiving module is used to receive a transition state policy issued by the management platform, wherein the transition state policy includes at least: an original key and an updated key, and the transition state policy is obtained by replacing the original key with the updated key and switching from the normal state policy after the management platform receives a state switching request sent by the service device; The third receiving module is used to receive the plaintext data sent by the service device; The encryption module is used to encrypt the plaintext data using the updated key, obtain the ciphertext data and send the ciphertext data to the database, and the stock data in the database is refreshed by the service device based on the original key and the updated key without using the original key.

12. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of any one of the methods of claims 1 to 8 are implemented.

13. A computer-readable storage medium, characterized in that: It stores a computer program executable by a computer device. When the program is run on the computer device, the computer device executes the steps of any method described in claims 1 to 8.

14. A computer program product, characterized in that The computer program product comprises a computer program stored on a computer-readable storage medium, wherein the computer program comprises program instructions, and when the program instructions are executed by a computer, the computer is caused to execute the steps of the method according to any one of claims 1 to 8.

Images