A MySQL key security management method based on a key management system

Abstract

This invention discloses a MySQL key security management method based on a key management system, belonging to the field of database technology. The method securely manages keys through a key management system, encrypts generated keys using OpenSSL, and uploads the key to the key management system by creating an import key table, downloading import materials, uploading the key encryption package, and uploading an import token. Clients obtain a valid key list from the key management system through user authentication and store it in their local cache, ensuring real-time synchronization between the local cache and the key management system. The client then retrieves the keys locally. This MySQL key security management method based on a key management system encrypts key data, improving key security, persistence, and overall security, and has significant potential for widespread application.

Description

Technical Field

[0001] This invention relates to the field of database technology, and specifically provides a MySQL key security management method based on a key management system. Background Technology

[0002] MySQL is a secure, cross-platform, and efficient database system that is tightly integrated with mainstream programming languages ​​such as PHP and Java. Currently, MySQL is widely used in small and medium-sized websites on the Internet.

[0003] Starting with MySQL Community Edition version 5.7.11, it supports table-based data encryption using a module named Keyring_file, which can encrypt the entire table. This encryption method is actually file-based. Once MySQL starts reading the key, it decrypts the entire table's data. Within the MySQL service, all data read is decrypted, meaning it's transparent to the client. However, the key is stored locally, posing a security risk of key loss and theft.

[0004] Key Management System (KMS) provides a web service for uploading, downloading, updating, and deleting keys. However, issues such as network problems, network hardware issues, and bandwidth issues can cause KMS process blocking or interruptions, impacting work efficiency. Summary of the Invention

[0005] The technical objective of this invention is to address the aforementioned problems by providing a MySQL key security management method based on a key management system, which encrypts key data, improves key security, and enhances key persistence and security.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A MySQL key security management method based on a key management system is proposed. The key management system is used to securely manage the keys. The generated keys are encrypted using OpenSSL. The key is uploaded to the key management system by creating an import key table, downloading import materials, uploading the key encryption package, and uploading the import token. The client obtains a list of valid keys from the key management system through user authentication and saves them in the local cache. The local cache is kept in real time and synchronized with the key management system. The client retrieves the keys from the local machine.

[0008] Preferably, the MySQL key security management method based on a key management system specifically includes the following steps:

[0009] S1. Configure the MySQL configuration file and load the key management plugin;

[0010] S2. Start the MySQL service;

[0011] S3. Load and initialize the key management plugin;

[0012] S4. Obtain the created key package from the key management system;

[0013] S5. Parse, analyze, and filter key packet data;

[0014] S6. Local key packet storage, which is encrypted with encrypted material and stored locally as plain text, unlike the Keyring_file;

[0015] S7, trigger the encryption module;

[0016] S8. Obtain the masterkey from the local key packet based on the unique identifier of the key packet;

[0017] S9. If the key packet is successfully obtained in step S8 and the key is obtained as the masterkey, then proceed to step S20. If the correct key is not obtained or the obtained key is empty, then proceed to step S10.

[0018] S10. Create and import the key package locally;

[0019] S11. Generate key data;

[0020] S12. Download and import materials;

[0021] S13. Encrypt the key data by importing materials using OpenSSL;

[0022] S14. Import the user's authentication token into the key package;

[0023] S15. Complete the packaging of the key packet data;

[0024] S16. Inotify monitors the addition, deletion, modification, and movement of key packages in the local file system and reports them to Inotifywatch, Inotify's event monitoring tool.

[0025] S17, Inotifywatch collects various events such as adding, deleting, modifying, and moving key packages in the local file system, triggering the Rsync client;

[0026] S18: The RSync client obtains key package data that has been added, deleted, modified, or moved in the local file system, and pushes the changed key package data to the RSync server's key package storage space, thus realizing the synchronization of local and KMS key package data.

[0027] S19. Use the key obtained by decrypting the created key packet as the masterkey;

[0028] S20. Encrypt the newly created table using the masterkey to end the table creation process in the encrypted tablespace.

[0029] Preferably, the key packet mentioned in step S3 is a storage unit for encrypted key data.

[0030] Preferably, in step S5, the filtering rules include whether the length of the key packet's id is greater than 0, whether it matches the key_id and user_id, and whether the encryption type is a predefined type.

[0031] Preferably, in step S7, the encryption module is triggered to create a table in the encrypted space.

[0032] Preferably, the import materials downloaded in step S12 include importMaterial data and importToken data.

[0033] Preferably, in step S16, Inotify is a Linux feature that monitors file system operations such as reading, writing, and creating.

[0034] Preferably, in step S17, the data mirroring tool under the Linux system can be remotely synchronized using the fast incremental backup tool Remote Sync, which supports local copying or synchronization with other SSH or RSync hosts.

[0035] Compared with the prior art, the MySQL key security management method based on the key management system of the present invention has the following outstanding advantages: The MySQL key security management method based on the key management system encrypts the key, thereby improving the key security. At the same time, it extends the key management method from local to cloud service management, thereby increasing the persistence and security of the key. By combining local caching and the key management system, it solves the problem of blocking or interruption of the access key management system process caused by objective factors such as network, network hardware, and bandwidth. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the process of the MySQL key security management method based on the key management system described in this invention;

[0037] Figure 2 This is a schematic diagram illustrating the principle of synchronizing local data with the KMS database using the Rsync+Inotify mechanism in the MySQL key security management method based on the key management system described in this invention. Detailed Implementation

[0038] The MySQL key security management method based on a key management system of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0039] Example

[0040] The MySQL key security management method based on a key management system of the present invention manages keys securely through the key management system, encrypts the generated keys using OpenSSL, and uploads the keys to the key management system by creating an import key table, downloading import materials, uploading the key encryption package, and uploading the import token. The client obtains a valid key list from the key management system through user authentication, saves it in the local cache, and ensures real-time synchronization between the local cache and the key management system. The client then retrieves the keys from the local machine.

[0041] like Figure 1 and Figure 2 As shown, this MySQL key security management method based on a key management system specifically includes the following steps:

[0042] S1. Configure the MySQL configuration file and load the key management plugin.

[0043] S2. Start the MySQL service.

[0044] S3. Load and initialize the key management plugin.

[0045] The key packet is a storage unit for encrypted key data.

[0046] S4. Obtain the created key package from the key management system.

[0047] S5. Parse, analyze, and filter the key packet data.

[0048] The filtering rules include whether the length of the key packet ID is greater than 0, whether it matches the key_id and user_id, and whether the encryption type is a predefined type.

[0049] S6. Local key packet storage, which is encrypted with encrypted material, unlike the plaintext storage of Keyring_file.

[0050] S7, trigger the encryption module.

[0051] Triggering encryption modules can lead to the creation of tables within encrypted spaces.

[0052] S8. Obtain the masterkey from the local key packet based on the unique identifier of the key packet.

[0053] S9. If the key packet is successfully obtained in step S8 and the key is obtained as the masterkey, then proceed to step S20. If the correct key is not obtained or the obtained key is empty, then proceed to step S10.

[0054] S10. Create and import the key package locally.

[0055] S11. Generate key data.

[0056] S12. Download and import materials.

[0057] The downloaded import materials include importMaterial and importToken data.

[0058] S13. Encrypt the key data by importing materials using OpenSSL.

[0059] S14. Import the user's authentication token into the key package.

[0060] S15. Complete the packaging of the key packet data.

[0061] S16. Inotify monitors the addition, deletion, modification, and movement of key packages in the local file system and reports them to Inotifywatch, Inotify's event monitoring tool.

[0062] Inotify is a Linux feature that monitors file system operations such as reading, writing, and creating.

[0063] S17 and Inotifywatch collect various events such as adding, deleting, modifying, and moving key packages in the local file system, triggering the Rsync client.

[0064] Data mirroring tools for Linux systems can be used for remote synchronization with the fast incremental backup tool Remote Sync, and can also be used for local copying or synchronization with other SSH or RSync hosts.

[0065] S18: The RSync client obtains key package data that has been added, deleted, modified, or moved from the local file system, and pushes the changed key package data to the RSync server's key package storage space, thus achieving synchronization between local and KMS key package data.

[0066] S19. Use the key obtained by decrypting the created key packet as the masterkey.

[0067] S20. Encrypt the newly created table using the masterkey to end the table creation process in the encrypted tablespace.

[0068] The embodiments described above are merely preferred embodiments of the present invention. Ordinary variations and substitutions made by those skilled in the art within the scope of the technical solutions of the present invention should be included within the protection scope of the present invention.

Claims

1. A MySQL key security management method based on a key management system, characterized in that: The key is securely managed by the key management system, and the generated key is encrypted by Openssl. The key is uploaded to the key management system by creating an import key table, downloading import materials, uploading a key encryption package, and uploading an import Token. The client obtains the valid key list from the key management system through user authentication and saves it in the local cache to ensure real-time synchronization between the local cache and the key management system. The client obtains the key from the local cache, which includes the following steps: S1, configure the MySQL configuration file and load the key management plug-in; S2, start the MySQL service; S3, load the key management plug-in and initialize; S4, obtain the created key package from the key management system; S5, parse and analyze, filter the key package data; S6, local key package storage, the key package is encrypted by encrypted materials, which is different from the plaintext local storage of Keyring_file; S7, trigger the encryption module; S8, obtain the masterkey from the local key package according to the unique identifier of the key package; S9, if the key package is correctly obtained and the key is obtained as masterkey, execute step S20, if no correct key is obtained or the obtained key is empty, execute step S10; S10, create an import key package locally; S11, generate key data; S12, download import materials; S13, encrypt the key data based on Openssl through the import materials; S14, import the user's authentication Token into the secret key package; S15, complete the packaging of the key package data; S16, Inotify monitors the addition, deletion, modification, and movement of key packages in the local file system and reports to the Inotify event monitoring tool Inotifywatch; S17, Inotifywatch collects various events such as addition, deletion, modification, and movement of key packages in the local file system, and triggers the Rsync client; S18, the Rsync client obtains the key package data added, deleted, modified, and moved in the local file system, and pushes the changed key package data to the storage space of the Rsync server key package, realizing the synchronization of the local and KMS key package data; S19, the key obtained by decrypting the created key package is used as masterkey; S20, encrypt the newly created table through masterkey, and end the table creation process in the encrypted table space.

2. The MySQL key security management method based on a key management system according to claim 1, characterized in that: The key package in step S3 is the storage unit of the encrypted key data.

3. The MySQL key security management method based on a key management system according to claim 2, characterized in that: In step S5, the filtering rules include whether the length of the key package id is greater than 0, whether it matches key_id and user_id, and whether the encryption type is a predefined type.

4. The MySQL key security management method based on a key management system according to claim 3, characterized in that: In step S7, the encryption module is triggered, such as creating a table in the encryption space.

5. The MySQL key security management method based on a key management system according to claim 4, characterized in that: The import materials downloaded in step S12 include importMaterial data and importToken data.

6. The MySQL key security management method based on a key management system according to claim 5, characterized in that: Step S16 Inotify is a Linux feature that monitors file system operations such as read, write and create.

7. The MySQL key security management method based on a key management system according to claim 6, characterized in that: Step S17 The data mirroring tool under Linux system uses Remote Sync, a fast incremental backup tool, to synchronize remotely, support local replication, or synchronize with other SSH, Rsync hosts.

Images