A method and system for ciphertext key rotation and version control

Abstract

The present invention relates to a method and system for ciphertext key rotation and version control, belonging to the field of big data. The method comprises the following steps: S1: establishing a key management center for encrypting all plaintext data and controlling key versions; S2: establishing a distributed storage cache system for responding to client read and write requests; S3: all read and write requests of the client are passed through the storage cache system, and during the rotation of the ciphertext key, pre-caching is performed. After the rotation of the ciphertext key is completed, the pre-cached is recycled or the cache is forcibly refreshed so that the client obtains the latest encrypted data or plaintext data; S4: setting a file storage format and naming it as a fibo file type; S5: obtaining the read and write requests of the storage client, and querying the distributed cache according to the read and write requests; the present invention not only improves the security of file storage, but also speeds up file access.

Description

Technical Field

[0001] The present invention belongs to the field of big data and relates to a method and system for ciphertext key rotation and version control. Background Art

[0002] Encryption technology is a safe and effective means to achieve data security. By encrypting data and combining it with effective key protection methods and certain control strategies, strong access control over data can be achieved while maintaining an open environment, making data sharing safer and more effective.

[0003] In the field of big data, the amount of data is generally in the TB or PB range. The large amount of data requires a long time to change the encryption key. Therefore, how to ensure that data processing services are not affected during the key rotation cycle is a technical problem that needs to be solved. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method and system for ciphertext key rotation and version control, which can complete the rotation of data encryption keys while ensuring that data processing is not interrupted.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A method for ciphertext key rotation and version control, the method comprising the following steps:

[0007] S1: Establish a key management center for encrypting all plaintext data and controlling key versions;

[0008] S2: Establish a distributed storage cache system for responding to client read and write requests;

[0009] S3: All read and write requests from the client go through the storage cache system. During the ciphertext key rotation, pre-caching is performed. After the ciphertext key rotation is completed, the pre-cached is recycled or forced to refresh the cache so that the client can obtain the latest encrypted data or plaintext data.

[0010] S4: Set a file storage format and name it as fibo file type;

[0011] S5: Obtain the read and write requests from the storage client, and query the distributed cache based on the read and write requests. If the cache hits, the plaintext data or ciphertext data is directly returned; if the hit fails, the distributed cache forwards the request to the storage system, and the storage system returns the corresponding data information based on the read and write requests.

[0012] Optionally, in S5, obtaining the read and write request of the storage client is specifically:

[0013] Get the read and write request permission field and path field;

[0014] Check whether it is within the scope of the permissions according to the permission field.

[0015] Optionally, the fibo file type includes three parts:

[0016] The first part, the file header field, includes the Magic Number, the current encrypted version, the key field encrypted using the private key of the key management center, the timestamp field, the fibo file length information, and the ciphertext length information;

[0017] Among them, Magic Number is the identifier of the file type, which is set to "fibo", indicating the file type encrypted using this invention, and all subsequent files are of this file type;

[0018] The current encrypted version, which is the file header field that identifies the encrypted version information of the current file. When decrypting a file, the storage system queries the key management center through this file header field information to obtain the key information for decrypting the file.

[0019] The key field is encrypted using the private key of the key management center. For this purpose, the file header field is a field encrypted using the private key of the key management center. The field content is the symmetric key used to encrypt and decrypt the file body content.

[0020] The timestamp field is used to identify the starting time when this version of the key is applied to the file;

[0021] Fibo file length information, which identifies the total length of the fibo file;

[0022] Ciphertext length information, which is used to identify the ciphertext length of the fibo file body;

[0023] The original file format of the file header field identifies the plain text file format before encryption and compression;

[0024] The compression method of the file header field is to identify the compression format before encryption;

[0025] The second part, the file body field, includes the ciphertext field encrypted using the key in the key field;

[0026] The ciphertext field is encrypted by obtaining the symmetric key from the file header key field;

[0027] The third part, the end of the file, includes the historical encryption key;

[0028] The historical encryption key includes the historical encrypted version information and the corresponding key information.

[0029] Optionally, the S1 is specifically:

[0030] S11: Obtaining attribute information of users in the target group;

[0031] S12: classifying the users of the target group into roles according to the attribute information and preset attribute information features;

[0032] S13: Mapping the roles obtained by role classification one by one through the permission management page;

[0033] S14: granting the operation permission of the corresponding target file path to the corresponding role;

[0034] S15: At the same time, the encryption key of the corresponding target file path is mapped and stored in the key management database;

[0035] S16: When responding to the read and write requests of the storage client, the distributed storage cache performs encryption and decryption through the key management center to meet the read and write requests.

[0036] Optionally, S2 is specifically:

[0037] S21: responding to the read and write requests of the storage client;

[0038] S22: Interact with the key management center to obtain storage permission control and complete encryption and decryption calls;

[0039] S23: Complete the rotation of the ciphertext key; after the storage client sends a read or write request, the distributed cache loads the file header information, reads the timestamp, and determines whether the encryption key needs to be replaced.

[0040] A ciphertext key rotation and version control system, the control system comprising:

[0041] The authority and key center establishment module is used to pre-establish the corresponding access permission information for each target file, and the key data used to encrypt confidential data, summarize them and store them in the database;

[0042] The authority and key center establishment modules specifically include:

[0043] A first acquisition unit, used to acquire global attribute information of a target user;

[0044] A role classification unit, used for classifying the target user into roles according to the attribute information and preset attribute information;

[0045] A mapping unit, used to map roles obtained by role classification through the authority management platform one by one;

[0046] A role authorization unit is used to grant target file access permissions to corresponding roles;

[0047] The cache system is used to respond to the read and write requests of the storage client, complete the encryption and decryption of the data, and rotate the encryption keys of the files.

[0048] Optionally, the control system further includes:

[0049] A second acquisition unit, acquiring key information for file encryption and decryption;

[0050] Obtain the permission information of specific files and the corresponding encryption and decryption key information through interactive authentication with the permission key center system;

[0051] The decryption module decrypts the encrypted file loaded from the storage system according to the obtained key information and returns it to the storage client;

[0052] The encryption module performs encryption operations when the storage client completes file modification or cache timeout and replacement, and then writes back to the storage system module;

[0053] The key rotation module first checks the key generation timestamp in the file header if a read or write request occurs. If it exceeds a certain time, the key rotation operation is performed. Specifically, the file content is first loaded into the cache, the timestamp and key version information are checked and decrypted, and then the cache write-back flag position is set as the key rotation. Finally, when the storage system needs to be written back, the data is encrypted with the new key and written back to the storage system, and the current key is appended to the historical key list at the end of the file.

[0054] Storage system, used to store files in fibo file format, based on existing file storage systems, including HDFS, Ceph, and NFS file systems.

[0055] Optionally, the cache system includes:

[0056] Fibo file header parsing and generation module, ciphertext file encryption and decryption module.

[0057] A computer device comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the method described is implemented when the processor executes the computer program.

[0058] A computer-readable storage medium stores a computer program, which implements the method when executed by a processor.

[0059] The beneficial effects of the present invention are: the present invention pre-establishes a unified permission control and operation control plane for different storage systems; pre-establishes a confidential file encryption key management and rotation update mechanism; the distributed cache intercepts all read and write requests for files, and transparently accesses and caches confidential files through the key management system, which not only improves the security of file storage, but also speeds up file access.

[0060] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0062] Figure 1 A schematic diagram of a control system for storing confidential data and reading and writing cache provided by a specific embodiment of the present invention;

[0063] Figure 2 A flow chart of a method for storing and reading confidential data provided by a specific embodiment of the present invention;

[0064] Figure 3 A flow chart of a method for storing and writing confidential data provided by a specific embodiment of the present invention;

[0065] Figure 4 A flow chart for rotating confidential data keys provided by a specific embodiment of the present invention;

[0066] Figure 5 This is an example diagram of the FIBO file format type on which the present invention is based. DETAILED DESCRIPTION

[0067] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0068] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0069] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0070] Please refer to Figure 1 to Figure 5 , a method and system for ciphertext key rotation and version control, comprising:

[0071] S11: A distributed cache system, through which storage clients can perform unified read and write operations on the encrypted data storage system, including management of read and write permissions and caching of data.

[0072] In the implementation of the present invention, for the management of read and write permissions, it is necessary to pre-establish a permission management center for aggregating and persisting the corresponding control permission information of each underlying storage backend, including: pre-authorizing the backend storage system, underlying file system, directory, and file at different levels; establishing a permission management plane for configuring permissions at different levels in response to preset authorized user operations, and displaying, configuring, and persisting permission management through the permission management plane.

[0073] In the implementation of the present invention, access to storage client read and write requests requires the pre-establishment of a distributed cache, and the data copies in the distributed cache system are independent of the copies that may already exist in the underlying storage system. The distributed cache system relies on the underlying files to store most of the data and does not need to save unused data copies. At the same time, the distributed cache system uses key management to encrypt and decrypt ciphertext data and convert ciphertext encrypted versions. When the ciphertext data key is rotated and upgraded, the time-sharing cache system actively caches the ciphertext data of the key to be rotated and upgraded, and after the cache is completed, it notifies the ciphertext storage system to rotate and upgrade the ciphertext encryption key.

[0074] S12: Key management system;

[0075] In the implementation of the present invention, a key management system needs to be established in advance, and the encryption keys used by all data files that need to be encrypted come from the key management system. The key management system persists the one-to-one mapping between files and their corresponding encryption keys, and saves the historical versions of the encryption keys used.

[0076] S13: ciphertext storage system;

[0077] The ciphertext storage system is one of the core systems of the present invention, which relies on the underlying general storage solution. At the same time, it provides a file format for saving FIBO files. The ciphertext storage system implements the encryption, transmission, and ciphertext key conversion and upgrade functions of ciphertext data based on this file format.

[0078] In summary, the method and system for confidential data storage and access control provided by the embodiments of the present invention realizes decentralized control at different levels based on the underlying storage system, directory, and file; and it provides the setting of the permission management plane to realize the function of different storage clients to access corresponding files based on different permissions, reducing the operation and maintenance management cost of ciphertext permissions; it realizes the cache access function of data, and introduces a distributed cache to manage local storage, including memory. This brings significantly improved I / O performance to the fast data layer between the storage client and various underlying storages; it realizes the transparent processing of encrypted data key rotation upgrade, and uses the distributed cache to upgrade the key of a certain file or directory. First, the distributed cache is driven to cache, and then the confidential data is encrypted using the new encryption key. Finally, after the key upgrade is completed, the distributed cache is actively refreshed to replace the new encrypted ciphertext.

[0079] It should be appreciated that embodiments of the present invention may be implemented or enforced by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable memory. The method may be implemented in a computer program using standard programming techniques - including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner - according to the methods and drawings described in the specific embodiments. Each program may be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if desired, the program may be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language. In addition, the program may be run on a programmed ASIC for this purpose.

[0080] Furthermore, the operations of the processes described herein may be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described herein (or variations and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions, and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) that is executed collectively on one or more processors, by hardware, or a combination thereof. The computer program includes a plurality of instructions that may be executed by one or more processors.

[0081] Further, the method can be implemented in any type of computing platform that is operably connected to a suitable computer, including but not limited to a personal computer, a minicomputer, a mainframe, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or in communication with a charged particle tool or other imaging device, etc. Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, an optical read and / or write storage medium, a RAM, a ROM, etc., so that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the process described herein. In addition, the machine-readable code, or a portion thereof, can be transmitted via a wired or wireless network. When such media includes instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor, the invention described herein includes these and other different types of non-transitory computer-readable storage media. When programmed according to the methods and techniques for ciphertext key rotation and version control described in the present invention, the present invention also includes the computer itself.

[0082] The computer program can be applied to input data to perform the functions described herein, thereby converting the input data to generate output data stored in a non-volatile memory. The output information can also be applied to one or more output devices such as a display. In a preferred embodiment of the present invention, the converted data represents physical and tangible objects, including specific visual depictions of physical and tangible objects produced on the display.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A method for ciphertext key rotation and version control, characterized by: The method comprises the following steps: S1: Establish a key management center for encrypting all plaintext data and controlling key versions; The S1 is specifically: S11: Obtaining attribute information of users in the target group; S12: classifying the users of the target group into roles according to the attribute information and preset attribute information features; S13: Mapping the roles obtained by role classification one by one through the permission management page; S14: granting the operation permission of the corresponding target file path to the corresponding role; S15: At the same time, the encryption key of the corresponding target file path is mapped and stored in the key management database; S16: When responding to the read and write requests of the storage client, the distributed storage cache performs encryption and decryption through the key management center to satisfy the read and write requests; S2: Establish a distributed storage cache system for responding to client read and write requests; The S2 is specifically: S21: responding to the read and write requests of the storage client; S22: Interact with the key management center to obtain storage permission control and complete encryption and decryption calls; S23: Complete the rotation of the ciphertext key; after the storage client sends a read / write request, the distributed cache loads the file header information, reads the timestamp, and determines whether the encryption key needs to be replaced; S3: All read and write requests from the client go through the storage cache system. During the ciphertext key rotation, pre-caching is performed. After the ciphertext key rotation is completed, the pre-cached is recycled or forced to refresh the cache so that the client can obtain the latest encrypted data or plaintext data. S4: Set a file storage format and name it as fibo file type; S5: Obtain the read and write requests from the storage client, and query the distributed cache based on the read and write requests. If the cache hits, the plaintext data or ciphertext data is directly returned; if the hit fails, the distributed cache forwards the request to the storage system, and the storage system returns the corresponding data information based on the read and write requests.

2. A method for ciphertext key rotation and version control according to claim 1, characterized in that: In S5, obtaining the read and write request of the storage client is specifically: Get the read and write request permission field and path field; Check whether it is within the scope of the permissions according to the permission field.

3. A method for ciphertext key rotation and version control according to claim 1, characterized in that: The fibo file type consists of three parts: The first part, the file header field, includes the Magic Number, the current encrypted version, the key field encrypted using the private key of the key management center, the timestamp field, the fibo file length information, and the ciphertext length information; The Magic Number is the identifier of the file type. It is set to "fibo", indicating that the file type is encrypted using the ciphertext key rotation and version control method. All subsequent files are of this file type. The current encrypted version, which is the file header field that identifies the encrypted version information of the current file. When decrypting a file, the storage system queries the key management center through this file header field information to obtain the key information for decrypting the file. The key field is encrypted using the private key of the key management center. For this purpose, the file header field is a field encrypted using the private key of the key management center. The field content is the symmetric key used to encrypt and decrypt the file body content. The timestamp field is used to identify the starting time when this version of the key is applied to the file; Fibo file length information, which identifies the total length of the fibo file; Ciphertext length information, which is used to identify the ciphertext length of the fibo file body; The original file format of the file header field identifies the plain text file format before encryption and compression; The compression method of the file header field is to identify the compression format before encryption; The second part, the file body field, includes the ciphertext field encrypted using the key in the key field; The ciphertext field is encrypted by obtaining the symmetric key from the file header key field; The third part, the end of the file, includes the historical encryption key; The historical encryption key includes the historical encrypted version information and the corresponding key information.

4. A system for ciphertext key rotation and version control, characterized by: The control system includes: The authority and key center establishment module is used to pre-establish the corresponding access permission information for each target file, and the key data used to encrypt confidential data, summarize them and store them in the database; The authority and key center establishment modules specifically include: A first acquisition unit, used to acquire global attribute information of a target user; A role classification unit, used for classifying the target user into roles according to the attribute information and preset attribute information; A mapping unit, used to map roles obtained through role classification on a rights management platform one by one; A role authorization unit is used to grant target file access permissions to corresponding roles; The cache system is used to respond to the read and write requests of the storage client, complete the encryption and decryption of data, and rotate the encryption keys of files; The control system further comprises: A second acquisition unit, acquiring key information for file encryption and decryption; Obtain the permission information of specific files and the corresponding encryption and decryption key information through interactive authentication with the permission key center system; The decryption module decrypts the encrypted file loaded from the storage system according to the obtained key information and returns it to the storage client; The encryption module performs encryption operations when the storage client completes file modification or cache timeout and replacement, and then writes back to the storage system module; The key rotation module first checks the key generation timestamp in the file header if a read or write request occurs. If it exceeds a certain time, the key rotation operation is performed. Specifically, the file content is first loaded into the cache, the timestamp and key version information are checked and decrypted, and then the cache write-back flag position is set as the key rotation. Finally, when the storage system needs to be written back, the data is encrypted with the new key and written back to the storage system, and the current key is appended to the historical key list at the end of the file. Storage system, used to store files in fibo file format, based on existing file storage systems, including HDFS, Ceph, and NFS file systems.

5. A ciphertext key rotation and version control system according to claim 4, characterized in that: The cache system comprises: Fibo file header parsing and generation module, ciphertext file encryption and decryption module.

6. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 3 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

Images