Multi-cloud key management and BYOK-based data security management method

Abstract

The present invention discloses a multi-cloud key management and BYOK-based data security management method to effectively protect the security of encrypted data of an enterprise. The method comprises: using KMS provided by multiple cloud service providers to obtain SK and AK; obtaining BYOK; generating an encryption key EK corresponding to the KMS of each cloud service provider by calling the pre-written encryption and decryption API corresponding to each cloud service provider, combined with BYOK; storing the SK, AK and EK in a configuration file; and calling the API of KMS to obtain the BYOK during the startup of the software or program. The present invention allows organizations to retain full control over data and encryption keys while using key management services of different cloud service providers, enabling organizations to use their own keys to encrypt data in cloud services while still continuing to use the native encryption services of cloud providers to ensure the security of their data.

Description

Technical Field

[0001] The present application relates to the technical field of cloud data security management, and in particular to a data security management method utilizing a cloud vendor's KMS key management service. Background Art

[0002] With the introduction of the national "Data Security Law" and "Personal Information Protection Law (Draft)", together with the "Cybersecurity Law", they will further protect the information security of domestic enterprises and individuals. At the same time, the products of Internet companies will face new security challenges.

[0003] When protecting data security, enterprises need to encrypt sensitive data. However, when enterprises process data keys used to encrypt data. Usually, most companies or service providers store them in configuration files or persist them in databases. When software or applications need to be encrypted or decrypted, they are read from the configuration files or databases for use. However, if the data key is directly stored in the configuration file or in the database, then when someone obtains the source code of the product or directly drags the database through vulnerabilities or program backdoors, it is easy to cause the data key to be leaked, and the attacker can directly decrypt the encrypted data, which is very unsafe, unable to protect the encrypted data, and unable to meet compliance and reporting requirements.

[0004] Some companies will also directly use the KMS key management service provided by cloud vendors, directly entrust the key to a third party, and when the software or application needs to use the key, it directly calls the API of the KMS service to encrypt and decrypt. Although this can meet compliance and reporting requirements, if the key is entrusted to a third party, when the third party leaks information, it will lead to the leakage of data keys, and then lead to the leakage of sensitive data we encrypt. In addition, it cannot meet the needs of some customers who want to use their own keys to encrypt data. Summary of the invention

[0005] Based on this, in response to the above technical problems, a multi-cloud key management and BYOK-based data security management method is provided to effectively protect the enterprise's encrypted data security.

[0006] The first aspect is multi-cloud key management and BYOK-based data security management methods, including:

[0007] (1) Use KMS provided by multiple cloud service providers to obtain SK and AK;

[0008] (2) Obtain BYOK key;

[0009] (3) Generate the encryption key EK corresponding to the KMS of each cloud service provider by calling the pre-written encryption and decryption API corresponding to the KMS of each cloud service provider in combination with the BYOK key;

[0010] (4) storing the SK, AK and EK in a configuration file;

[0011] (5) Determine the type of data that needs to be encrypted and stored based on the classification and grading of data within the system;

[0012] (6) During the software or program startup process, the KMS API is called to obtain the BYOK key; for the plaintext data that needs to be encrypted and stored in the memory cache, BYOK is used to encrypt and store it in the database; for the ciphertext data stored in the database, BYOK is used to decrypt it into the memory.

[0013] Optionally, the encryption and decryption process in step (6) is specifically implemented by introducing a pre-written Starter to realize automatic encryption and decryption based on annotations and Mybatis typeHandler.

[0014] Furthermore, the pre-written Starter specifically includes:

[0015] c) Write a mybatis interceptor to intercept objects with @DataSecurity annotated attributes for encryption;

[0016] d) Write the typeHandler type processor of mybatis to intercept objects containing the prefix and suffix of encrypted text for decryption.

[0017] Optionally, the multiple cloud service providers include Huawei Cloud and AWS.

[0018] Furthermore, the encryption and decryption API of Huawei Cloud's KMS is written, including:

[0019] Use the getToken method to obtain authorization from Huawei Cloud using AK, SK, and keyId information;

[0020] Use the encryptKms method to call the encryption API of Huawei Cloud's key management service;

[0021] Use the decryptKms method to call the decryption API of Huawei Cloud's key management service.

[0022] Furthermore, write the encryption and decryption API of ASW's KMS, including:

[0023] Use the getAuthorize method to obtain AWS authorization through AK, SK, and keyId information;

[0024] Use the encrypt method to call the encryption API of AWS's key management service;

[0025] Use the decrypt method to call the decryption API of AWS's key management service.

[0026] Optionally, in step (5), the type of data to be encrypted and stored is determined to be C3 or C4 level data; wherein C3 is user secret data and C4 is user confidential data.

[0027] In a second aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and the special feature of the computer device is that when the processor executes the computer program, the steps of the multi-cloud key management and BYOK-based data security management method are implemented.

[0028] In a third aspect, a computer-readable storage medium stores a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the multi-cloud key management and BYOK-based data security management method.

[0029] The present invention has at least the following beneficial effects:

[0030] The present invention uses BYOK (bring your own key) to help enterprises solve compliance and reporting requirements more comprehensively. At the same time, combined with the KMS (key management service) provided by different cloud service providers, it allows organizations (enterprise users) to retain full control over data and encryption keys while using the key management services of different cloud service providers, enabling organizations to use their own keys to encrypt data in cloud services while still continuing to use the cloud provider's native encryption services to protect their data security.

[0031] Enterprise users can ensure that encryption keys are generated using sufficient entropy sources and that the keys are protected from being leaked, thereby protecting the security of the enterprise's encrypted data. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A schematic diagram of the operation flow of a multi-cloud key management and BYOK-based data security management method provided by an embodiment of the present invention;

[0033] Figure 2 A schematic diagram of the principle (key acquisition and use process) of implementing multi-cloud key management and a BYOK-based data security management method according to an embodiment of the present invention;

[0034] Figure 3 A sample KMS management console interface provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0036] The purpose of the embodiments of the present invention is to ensure that when organizations (especially enterprise users) use keys to encrypt sensitive data, sufficient entropy sources are used to generate data keys, so that data keys can be protected more securely and risks caused by key leakage can be prevented, while meeting compliance and reporting requirements and meeting the needs of customers who want to use their own data keys.

[0037] In one embodiment, Figure 1 As shown, the multi-cloud key management and BYOK-based data security management method is applied to enterprise user terminals, including the following steps:

[0038] S1: Use KMS provided by multiple cloud service providers to obtain SK and AK;

[0039] S2: Get BYOK key;

[0040] S3: Generate an encryption key EK corresponding to the KMS of each cloud service provider by calling the pre-written encryption and decryption API corresponding to the KMS of each cloud service provider in combination with the BYOK key;

[0041] S4: storing the SK, AK and EK in a configuration file;

[0042] S5: Determine the type of data that needs to be encrypted and stored based on the classification and grading of the data in the system;

[0043] S6: During the software or program startup process, the API of KMS is called to obtain the BYOK key; for the plaintext data that needs to be encrypted and stored in the memory cache, BYOK is used to encrypt and store it in the database; for the ciphertext data stored in the database, BYOK is used to decrypt it into the memory.

[0044] In one embodiment, Figure 2 As shown, the implementation of the data security management method specifically includes the following steps:

[0045] 1) Create a new master key in KMS and obtain SK (Secret Access Key) and AK (Access Key Id);

[0046] a) Log in to the KMS service console provided by cloud service providers such as Huawei Cloud and AWS; Figure 3 This is a sample of the KMS management console interface;

[0047] b) Create a key;

[0048] c) Save AK, SK, keyId and other information;

[0049] 2) Write the encryption and decryption API of KMS of different cloud service providers. This invention mainly connects Huawei Cloud and AWS

[0050] a) Write the KMS encryption and decryption tool class for ASW;

[0051] Use the getAuthorize method to obtain AWS authorization through AK, SK, keyId and other information, use the encrypt method to call the encryption API of AWS's key management service, and use the decrypt method to call the decryption API of AWS's key management service.

[0052] b) Write KMS encryption and decryption tools for Huawei Cloud;

[0053] Use the getToken method to obtain Huawei Cloud authorization through AK, SK, keyId and other information, use the encryptKms method to call the encryption API of Huawei Cloud's key management service, and use the decryptKms method to call the decryption API of Huawei Cloud's key management service.

[0054] 3) Generate data keys using a cryptographic machine or other key generation device (BYOK);

[0055] 4) Use the encryption and decryption API to obtain EK

[0056] a) Call the API provided by Huawei Cloud's KMS service and use the encryptKms method plus the key (BYOK) obtained in step 3) to generate Huawei Cloud's EK; for example:

[0057] i. Introduce SDK dependencies provided by Huawei Cloud vendors into the project;

[0058] ii. Write a program to call the encryption API in the SDK;

[0059] iii. Run the program and use the encryptKms method plus the data key (BYOK) obtained in step 3) to generate the EK of Huawei Cloud;

[0060] b) Call the API provided by the ASW KMS service and use the encrypt method plus the key obtained in step 3) to generate the AWS EK; for example:

[0061] i. Introduce SDK dependencies provided by Huawei Cloud vendors into the project;

[0062] ii. Write a program to call the encryption API in the SDK;

[0063] iii. Run the program and use the encryptKms method plus the data key (BYOK) obtained in step 3) to generate the EK of Huawei Cloud;

[0064] 5) Configure the SK, AK, EK and other information obtained in the above steps 1) and 3) in the CM;

[0065] 6) Write Starter to implement automatic encryption and decryption based on annotations and Mybatis typeHandler;

[0066] a) Write a mybatis interceptor to intercept objects with @DataSecurity annotated attributes for encryption;

[0067] b) Write the typeHandler type processor of mybatis to intercept objects containing the prefix and suffix of encrypted text for decryption;

[0068] 7) Classify and grade the data in the system, and encrypt and store C3 and C4 level data

[0069] a) Customer Confidential C3

[0070] Example: Employee information in the organizational structure;

[0071] b) Customer Secret C4

[0072] Examples: ID card, etc.

[0073] 8) Business services introduce Starter to implement encryption protection for sensitive data

[0074] a) Introduce the Maven dependency of srm-starter-security in the pom file of each service and put it at the front;

[0075] b) Change the data type of the database field that needs to be encrypted to VARCHAR, and expand varchar (32 + character length * 8);

[0076] c) Add @DataSecurity annotation to the entity class for the fields that need to be encrypted;

[0077] d) Fuzzy search is not supported after field encryption;

[0078] e) After the field is encrypted, if you want to use it as a query condition, you need to call the following method to manually encrypt it and then pass it to the database for query DataSecurityInterceptor.encrypt("xxx");

[0079] f) After the field is encrypted, it cannot be processed using database functions. For example, after the amount is encrypted, the FORMAT() function cannot be used for precision processing.

[0080] The embodiments of the present invention use BYOK (bring your own key) in combination with the KMS key management service provided by different cloud service providers. By combining BYOK with the EK (encryption key) generated by KMS and storing it in a configuration file, and then calling the KMS API to obtain the data key (BYOK) into the memory during the software or program startup process, the data key is not stored on the disk, thereby further ensuring the security of encrypted sensitive data.

[0081] The embodiments of the present invention allow organizations to retain full control over data and encryption keys while using key management services (KMS) of different cloud service providers, enabling organizations to use their own keys to encrypt data in cloud services while still continuing to use the cloud provider's native encryption services to protect their data security. BYOK can help enterprises address compliance and reporting requirements more comprehensively. Moreover, enterprise users can ensure that encryption keys are generated using sufficient entropy sources, and that the keys can be protected from being leaked, thereby protecting the enterprise's encrypted data security.

[0082] In one embodiment, a computer device is also provided, which may be an enterprise user terminal. The computer device includes a memory and a processor, wherein a computer program is stored in the memory, which involves all or part of the processes in the above-mentioned embodiment method.

[0083] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, which involves all or part of the processes in the above-mentioned embodiment method.

[0084] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0085] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. Multi-cloud key management and BYOK-based data security management method, characterized in that: include: (1) Use KMS provided by multiple cloud service providers to obtain SK and AK; (2) Obtain BYOK key; (3) Generate the encryption key EK corresponding to the KMS of each cloud service provider by calling the pre-written encryption and decryption API corresponding to the KMS of each cloud service provider in combination with the BYOK key; (4) storing the SK, AK and EK in a configuration file; (5) Determine the type of data that needs to be encrypted and stored based on the classification and grading of data within the system; (6) During the software or program startup process, the KMS API is called to obtain the BYOK key and store it in the memory; for the plaintext data that needs to be encrypted and stored in the memory cache, BYOK is used to encrypt and store it in the database; for the ciphertext data stored in the database, BYOK is used to decrypt it into the memory; The encryption and decryption process in step (6) is specifically achieved by introducing a pre-written Starter to realize automatic encryption and decryption based on annotations and Mybatis typeHandler.

2. The multi-cloud key management and BYOK-based data security management method according to claim 1 is characterized in that: The pre-written Starter specifically includes: a) Write a mybatis interceptor to intercept objects with @DataSecurity annotated attributes for encryption; b) Write the typeHandler type processor of mybatis to intercept objects containing the prefix and suffix of encrypted text for decryption.

3. The multi-cloud key management and BYOK-based data security management method according to claim 1 is characterized in that: The multiple cloud service providers include Huawei Cloud and AWS.

4. The multi-cloud key management and BYOK-based data security management method according to claim 3 is characterized in that: Write the encryption and decryption API of Huawei Cloud's KMS, including: Use the getToken method to obtain authorization from Huawei Cloud using AK, SK, and keyId information; Use the encryptKms method to call the encryption API of Huawei Cloud's key management service; Use the decryptKms method to call the decryption API of Huawei Cloud's key management service.

5. The multi-cloud key management and BYOK-based data security management method according to claim 3 is characterized in that: Write the encryption and decryption API of ASW's KMS, including: Use the getAuthorize method to obtain AWS authorization through AK, SK, and keyId information; Use the encrypt method to call the encryption API of AWS's key management service; Use the decrypt method to call the decryption API of AWS's key management service.

6. The multi-cloud key management and BYOK-based data security management method according to claim 1, characterized in that: In step (5), it is determined that the data type that needs to be encrypted and stored is C3 or C4 level data; wherein C3 is user secret data and C4 is user confidential data.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the multi-cloud key management and BYOK-based data security management method according to any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the multi-cloud key management and BYOK-based data security management method according to any one of claims 1 to 6 are implemented.

Images