Data management method, device and system, and storage medium

Abstract

A data management method, device and system, and a storage medium belong to the technical field of cloud computing. A first processing node obtains a secure storage key according to a first external key material corresponding to the first processing node, encrypts data corresponding to an application program in the first processing node by using the secure storage key, and sends the encrypted data to a second processing node. The second processing node obtains a secure storage key according to a second external key material corresponding to the second processing node, and decrypts the encrypted data corresponding to the application program sent by the first processing node by using the secure storage key. The second external key material is the same as the first external key material, the second processing node and the first processing node can obtain the same secure storage key, the second processing node can successfully decrypt the encrypted data corresponding to the application program sent by the first processing node, and the flexibility of data management is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud computing, and particularly relates to a data management method, device and system, and a storage medium. BACKGROUND

[0002] A cloud computing system is a service system implemented based on cloud computing technology, which includes multiple processing nodes and storage nodes. The processing nodes are used to process data corresponding to an application deployed therein and store the processed data into a storage volume corresponding to the application in the storage nodes. After migrating an application from a processing node (hereinafter referred to as a source processing node) to another processing node (hereinafter referred to as a target processing node), the mounting node of the storage volume corresponding to the application in the storage nodes can be switched from the source processing node to the target processing node, so that the target processing node can use the data corresponding to the application stored in the storage nodes by the source processing node.

[0003] In order to ensure the security of data, the processing nodes usually encrypt the data corresponding to the application and store it in the storage nodes. In a typical example, the processing nodes derive a secure storage key according to the hardware unique key (HUK) of the processor of the processing node, encrypt the data corresponding to the application in the processing node using the secure storage key, and store the encrypted data corresponding to the application into the storage volume corresponding to the application in the storage nodes. The HUK is configured when the processor or the device containing the processor is manufactured, and the HUKs of different processors are different.

[0004] However, in the scheme in which the processing nodes encrypt data using the secure storage key derived from the HUK, after migrating an application from a source processing node to a target processing node, the secure storage key derived by the target processing node is different from the secure storage key derived by the source processing node due to the difference between the HUK of the processor of the source processing node and the HUK of the processor of the target processing node, so that the target processing node cannot recover the data corresponding to the application stored in the storage nodes by the source processing node, and therefore the flexibility of data management is poor. SUMMARY

[0005] The present application provides a data management method, device and system, and a storage medium, which helps to improve the flexibility of data management. The technical scheme of the present application is as follows:

[0006] In a first aspect, a data management method is provided, which is applied to a first processing node in a data management system, the data management system further comprising a second processing node, and the method comprises: obtaining a secure storage key according to a first external key material corresponding to the first processing node; encrypting data corresponding to an application in the first processing node by using the secure storage key; and sending the encrypted data to the second processing node, wherein a second external key material corresponding to the second processing node is the same as the first external key material.

[0007] According to the technical scheme provided in the present application, since the first external key material corresponding to the first processing node is the same as the second external key material corresponding to the second processing node, the secure storage key obtained by the first processing node according to the first external key material can be the same as the secure storage key obtained by the second processing node according to the second external key material, and the data encrypted by the secure storage key obtained by the first processing node can be successfully decrypted by the secure storage key obtained by the second processing node, which helps to improve the flexibility of data management.

[0008] Optionally, obtaining the secure storage key according to the first external key material comprises: obtaining the secure storage key according to the first external key material, a first internal key material corresponding to the first processing node, or an application internal key material corresponding to the application, wherein a second internal key material corresponding to the second processing node is the same as the first internal key material.

[0009] According to the technical scheme provided in the present application, the first processing node obtains the secure storage key according to the first external key material, the first internal key material, or the application internal key material, so that the secure storage key is obtained by the first processing node according to at least two key materials, which helps to ensure the security of the secure storage key.

[0010] Optionally, the first processing node is configured with a trusted operating system, the application comprises a trusted application, the first internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

[0011] Optionally, an execution environment of an operating system of the first processing node comprises a trusted execution environment (TEE), and the trusted operating system and the trusted application are placed in the TEE.

[0012] Optionally, the obtaining the secure storage key according to the first external key material, the first internal key material corresponding to the first processing node, and the application internal key material corresponding to the application program comprises: generating the secure storage key based on a target key derivation algorithm according to the first external key material, the first internal key material, and the application internal key material.

[0013] The first processing node generates the secure storage key based on the target key derivation algorithm according to the first external key material, the first internal key material, and the application internal key material, which helps to ensure the security of the secure storage key.

[0014] Optionally, the obtaining the secure storage key according to the first external key material corresponding to the first processing node comprises: obtaining the secure storage key according to the first external key material, the first internal key material corresponding to the first processing node, and the application internal key material corresponding to the application program, wherein the second internal key material corresponding to the second processing node is the same as the first internal key material.

[0015] The first processing node obtains the secure storage key according to the first external key material, the first internal key material, and the application internal key material, so that the secure storage key is obtained by the first processing node according to at least two key materials, which helps to ensure the security of the secure storage key.

[0016] Optionally, the obtaining the secure storage key according to the first external key material, the first internal key material corresponding to the first processing node, and the application internal key material corresponding to the application program comprises: generating the secure storage key based on a target key derivation algorithm according to the first external key material, the first internal key material, and the application internal key material.

[0017] The first processing node generates the secure storage key based on the target key derivation algorithm according to the first external key material, the first internal key material, and the application internal key material, which helps to ensure the security of the secure storage key.

[0018] Optionally, the generating the secure storage key based on the target key derivation algorithm according to the first external key material, the first internal key material, and the application internal key material comprises: determining a first initial key according to the application internal key material; determining a second initial key according to the first internal key material and the first external key material; and generating the secure storage key based on the target key derivation algorithm according to the first initial key and the second initial key.

[0019] The technical scheme provided in the application can facilitate the first processing node to generate a secure storage key by determining a first initial key according to application internal key material, and determining a second initial key according to the first internal key material and a first external key material.

[0020] Optionally, before obtaining the secure storage key according to the first external key material corresponding to the first processing node, the method further includes: receiving the first external key material distributed by a key management node, wherein the key management node distributes the same external key material to processing nodes in the same cluster.

[0021] The technical scheme provided in the application can facilitate the first processing node to obtain the first external key material corresponding to the first processing node by the key management node distributing the first external key material to the first processing node.

[0022] Optionally, the cluster satisfies at least one of the following conditions: the processing nodes in the cluster have the same business scenario; the number of the processing nodes in the cluster is less than a preset number; and the processing nodes in the cluster are in the same network topology.

[0023] The technical scheme provided in the application can facilitate application program migration between the processing nodes in the cluster when the processing nodes in the cluster have the same business scenario; the number of the processing nodes in the cluster is less than a preset number, so that the number of the processing nodes with the same external key material is small, thereby ensuring the security of the external key material corresponding to the processing nodes in the cluster; and the processing nodes in the cluster are in the same network topology, thereby facilitating the processing nodes in the cluster to communicate with each other.

[0024] Optionally, receiving the first external key material distributed by the key management node includes: receiving the encrypted first external key material sent by the key management node, wherein the encrypted first external key material is encrypted by the key management node based on a first encryption algorithm by using a first security key, and the first security key and the first encryption algorithm are held by both the first processing node and the key management node.

[0025] The technical scheme provided in the application can ensure the transmission security of the first external key material, that is, the security of the first external key material during the process in which the key management node sends the first external key material to the first processing node, because the first external key material sent by the key management node to the first processing node is encrypted by the key management node based on a first encryption algorithm by using a first security key.

[0026] Optionally, before receiving the first external key material assigned by the key management node, the method further includes: sending a key application request to the key management node, the key application request carrying a node identifier of the first processing node, the key management system being configured to determine the first external key material corresponding to the first processing node according to the node identifier of the first processing node.

[0027] The technical scheme provided in the application can facilitate the key management node to send the first external key material corresponding to the first processing node to the first processing node, thereby facilitating the first processing node to obtain the first external key material corresponding to the first processing node.

[0028] Optionally, after receiving the first external key material assigned by the key management node, the method further includes: decrypting the first external key material based on a first encryption algorithm by using a first security key; encrypting the decrypted first external key material by using a first material key; and storing the encrypted first external key material into a trusted storage unit in the first processing node, an execution environment of an operating system of the first processing node including a rich executing environment (REE), and the trusted storage unit being placed in the REE.

[0029] The technical scheme provided in the application can ensure the storage security of the first external key material.

[0030] Optionally, before encrypting the decrypted first external key material by using the first material key, the method further includes: obtaining the first material key according to a hardware identifier of the first processing node. In this way, the first processing node can encrypt and store the first external key material corresponding to the first processing node by using the first material key.

[0031] Optionally, sending the encrypted data to the second processing node includes: sending the encrypted data to a storage node, wherein the storage node is configured to send the encrypted data to the second processing node.

[0032] In a second aspect, a data management method is provided, which is applied to a second processing node in a data management system, the data management system further comprising a first processing node, and the method comprises: receiving encrypted data corresponding to an application program sent by the first processing node; obtaining a secure storage key according to second external key material corresponding to the second processing node, wherein the second external key material is the same as first external key material corresponding to the first processing node; and decrypting the encrypted data corresponding to the application program by using the secure storage key.

[0033] According to the technical scheme provided in the present application, the first external key material corresponding to the first processing node is the same as the second external key material corresponding to the second processing node, so that the secure storage key obtained by the first processing node according to the first external key material is the same as the secure storage key obtained by the second processing node according to the second external key material, and the data encrypted by the secure storage key obtained by the first processing node can be successfully decrypted by the secure storage key obtained by the second processing node, which helps to improve the flexibility of data management.

[0034] Optionally, obtaining the secure storage key according to the second external key material corresponding to the second processing node comprises: obtaining the secure storage key according to the second external key material, second internal key material corresponding to the second processing node or application internal key material corresponding to the application program, wherein the second internal key material is the same as first internal key material corresponding to the first processing node.

[0035] According to the technical scheme provided in the present application, the second processing node obtains the secure storage key according to the second external key material, the second internal key material or the application internal key material, so that the secure storage key is obtained by the second processing node according to at least two key materials, which helps to ensure the security of the secure storage key.

[0036] Optionally, the second processing node is configured with a trusted operating system, the application program comprises a trusted application, the second internal key material is internal key material corresponding to the trusted operating system, and the application internal key material is internal key material corresponding to the trusted application.

[0037] Optionally, an execution environment of an operating system of the second processing node comprises a TEE, and the trusted operating system and the trusted application are placed in the TEE.

[0038] Optionally, obtaining the secure storage key according to the second external key material corresponding to the second processing node and the second internal key material corresponding to the second processing node or the application internal key material corresponding to the application program comprises: generating the secure storage key based on a target key derivation algorithm according to the second external key material, the second internal key material or the application internal key material.

[0039] The second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material, the second internal key material, and the application internal key material, which helps to ensure the security of the secure storage key.

[0040] Optionally, the second processing node obtains the secure storage key according to the second external key material includes: the second processing node obtains the secure storage key according to the second external key material, the second internal key material corresponding to the second processing node, and the application internal key material corresponding to the application program, wherein the second internal key material is the same as the first internal key material corresponding to the first processing node.

[0041] The second processing node obtains the secure storage key according to the second external key material, the second internal key material, and the application internal key material, so that the secure storage key is obtained by the second processing node according to at least two key materials, which helps to ensure the security of the secure storage key.

[0042] Optionally, the second processing node obtains the secure storage key according to the second external key material, the second internal key material corresponding to the second processing node, and the application internal key material corresponding to the application program includes: the second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material, the second internal key material, and the application internal key material.

[0043] The second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material, the second internal key material, and the application internal key material, which helps to ensure the security of the secure storage key.

[0044] Optionally, the second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material, the second internal key material, and the application internal key material includes: determining a first initial key according to the application internal key material; determining a second initial key according to the second internal key material and the second external key material; and generating the secure storage key based on the target key derivation algorithm according to the first initial key and the second initial key.

[0045] The second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material, the second internal key material, and the application internal key material, which helps to ensure the security of the secure storage key.

[0046] Optionally, before obtaining the secure storage key according to the second external key material corresponding to the second processing node, the method further includes: receiving the second external key material distributed by a key management node, wherein the key management node distributes the same external key material to processing nodes in the same cluster.

[0047] The technical scheme provided in the application can facilitate the second processing node to obtain the second external key material corresponding to the second processing node by the key management node distributing the second external key material to the second processing node.

[0048] Optionally, the cluster satisfies at least one of the following conditions: the processing nodes in the cluster have the same business scenario; the number of the processing nodes in the cluster is less than a preset number; and the processing nodes in the cluster are in the same network topology.

[0049] The technical scheme provided in the application can facilitate the application program migration between the processing nodes in the cluster when the processing nodes in the cluster have the same business scenario; the number of the processing nodes having the same external key material can be small when the number of the processing nodes in the cluster is less than a preset number, thereby ensuring the security of the external key material corresponding to the processing nodes in the cluster; and the processing nodes in the cluster can communicate with each other when the processing nodes in the cluster are in the same network topology.

[0050] Optionally, receiving the second external key material distributed by the key management node includes: receiving the encrypted second external key material sent by the key management node, wherein the encrypted second external key material is obtained by the key management node encrypting the second external key material based on a second encryption algorithm by using a second security key, and the second security key and the second encryption algorithm are held by both the second processing node and the key management node.

[0051] The technical scheme provided in the application can ensure the transmission security of the second external key material, that is, the security of the second external key material in the process of the key management node sending the second external key material to the second processing node, because the second external key material sent by the key management node to the second processing node is obtained by the key management node encrypting the second external key material based on a second encryption algorithm by using a second security key.

[0052] Optionally, before receiving the second external key material distributed by the key management node, the method further includes: sending a key application request to the key management node, wherein the key application request carries a node identifier of the second processing node, and the key management system is configured to determine the second external key material corresponding to the second processing node according to the node identifier of the second processing node.

[0053] The technical scheme provided in the application can facilitate the second processing node to obtain the second external key material corresponding to the second processing node by sending a key application request to the key management node, so that the second processing node obtains the second external key material corresponding to the second processing node.

[0054] Optionally, after receiving the second external key material distributed by the key management node, the method further comprises: decrypting the second external key material based on a second encryption algorithm by using a second security key; encrypting the decrypted second external key material by using a second material key; and storing the encrypted second external key material into a trusted storage unit in the second processing node, an execution environment of an operating system of the second processing node comprising a REE, and the trusted storage unit being placed in the REE.

[0055] The technical scheme provided in the application can ensure the storage security of the second external key material by decrypting and then encrypting and storing the second external key material corresponding to the second processing node sent by the key management node.

[0056] Optionally, before encrypting the decrypted second external key material by using a second material key, the method further comprises: obtaining the second material key according to a hardware identifier of the second processing node. In this way, the second processing node can encrypt and store the second external key material corresponding to the second processing node by using the second material key.

[0057] Optionally, receiving the encrypted data corresponding to the application program sent by the first processing node comprises: receiving the encrypted data sent by a storage node, the storage node being configured to store the encrypted data corresponding to the application program sent by the first processing node.

[0058] In a third aspect, a data management apparatus is provided, which comprises various modules for performing the method provided in the first aspect or any possible implementation manner of the first aspect.

[0059] In a fourth aspect, a data management apparatus is provided, which comprises various modules for performing the method provided in the second aspect or any possible implementation manner of the second aspect.

[0060] In a fifth aspect, a computer device is provided, which comprises a memory and a processor.

[0061] The memory is configured to store a computer program.

[0062] The processor is configured to execute the computer program stored in the memory to implement the method provided in the first aspect or any of the optional manners of the first aspect, or implement the method provided in the second aspect or any of the optional manners of the second aspect.

[0063] In a sixth aspect, a computer-readable storage medium is provided, and the computer-readable storage medium stores a computer program. The computer program is executed by a processor to implement the method provided in the first aspect or any of the optional manners of the first aspect, or implement the method provided in the second aspect or any of the optional manners of the second aspect.

[0064] In a seventh aspect, a computer program product containing instructions is provided. When the computer program product is run on a computer, the computer is caused to execute the method provided in the first aspect or any of the optional manners of the first aspect, or execute the method provided in the second aspect or any of the optional manners of the second aspect.

[0065] In an eighth aspect, a chip is provided. The chip includes programmable logic circuitry and / or program instructions. When the chip is running, the chip is configured to implement the method provided in the first aspect or any of the optional manners of the first aspect, or implement the method provided in the second aspect or any of the optional manners of the second aspect.

[0066] In a ninth aspect, a data management system is provided. The data management system includes: a first processing node and a second processing node. The first processing node includes the data management apparatus provided in the third aspect, and the second processing node includes the data management apparatus provided in the fourth aspect. Alternatively, at least one of the first processing node and the second processing node is the computer device provided in the fifth aspect.

[0067] Optionally, the data management system further includes a storage node, and the first processing node is configured to send, to the second processing node through the storage node, data corresponding to an application program.

[0068] Optionally, the data management system further includes a management node, and the management node is configured to perform cluster division on the processing nodes in the data management system in response to a cluster division instruction.

[0069] The cluster division on the processing nodes in the data management system by the management node can obtain at least one cluster, and the cluster satisfies at least one of the following conditions: the processing nodes in the cluster have the same business scenario; the number of the processing nodes in the cluster is less than a preset number; and the processing nodes in the cluster are in the same network topology.

[0070] The technical scheme provided in the present application has the following beneficial effects:

[0071] The data management method, device and system, and storage medium provided in the application, the data management system comprises a first processing node and a second processing node. After the first processing node acquires a secure storage key according to a first external key material corresponding to the first processing node, the first processing node encrypts data corresponding to an application program in the first processing node by using the secure storage key, and sends the encrypted data corresponding to the application program to the second processing node. The second processing node receives the encrypted data corresponding to the application program sent by the first processing node, acquires a secure storage key according to a second external key material corresponding to the second processing node, and decrypts the encrypted data corresponding to the application program by using the secure storage key. The second external key material is the same as the first external key material, so that the second processing node and the first processing node can acquire the same secure storage key, the second processing node can successfully decrypt the encrypted data corresponding to the application program sent by the first processing node, and the flexibility of data management is improved. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 FIG. 1 is a schematic diagram of application program migration;

[0073] Figure 2 FIG. 2 is a schematic diagram of a system architecture based on TrustZone technology;

[0074] Figure 3 FIG. 3 is a schematic diagram of a secure storage scheme;

[0075] Figure 4 FIG. 4 is a schematic diagram of another application program migration;

[0076] Figure 5 FIG. 5 is a schematic diagram of a data management system provided by an embodiment of the application;

[0077] Figure 6 FIG. 6 is a structural schematic diagram of a processing node provided by an embodiment of the application;

[0078] Figure 7 FIG. 7 is a flowchart of a data management method provided by an embodiment of the application;

[0079] Figure 8 FIG. 8 is a flowchart of another data management method provided by an embodiment of the application;

[0080] Figure 9 FIG. 9 is a schematic diagram of a key material import process provided by an embodiment of the application;

[0081] Figure 10 FIG. 10 is a schematic diagram of a data encryption process provided by an embodiment of the application;

[0082] Figure 11is a schematic diagram of a data decryption process provided by an embodiment of the present application;

[0083] Figure 12 is a schematic diagram of a data management process provided by an embodiment of the present application;

[0084] Figure 13 is a schematic diagram of a logical structure of a data management apparatus provided by an embodiment of the present application;

[0085] Figure 14 is a schematic diagram of a logical structure of another data management apparatus provided by an embodiment of the present application;

[0086] Figure 15 is a schematic diagram of a hardware structure of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0087] In order to make the principles, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0088] Cloud computing technology refers to a technology of dividing a huge data computing process into multiple small programs through a network "cloud", analyzing and processing the small programs through a system composed of multiple servers, and feeding back processing results to a user. A cloud computing system (also referred to as a cloud computing platform) is a service system (also referred to as a service platform) realized based on cloud computing technology, which includes multiple processing nodes and storage nodes. An application program is deployed in the processing nodes, and the processing nodes are used to process data corresponding to the application program deployed therein and store the processed data into a storage volume corresponding to the application program in the storage nodes. The operating system of the processing node is used to provide a running platform for the application program deployed in the processing node, so that the application program can run in the processing node. Optionally, the processing node and the storage node can be servers.

[0089] With the rapid development of cloud computing technology, the isolation, easy deployment and hardware independence of virtualization technology make it increasingly become the basis for providing cloud computing services to the outside. Application programs can be deployed in processing nodes based on virtualization technology to realize the mutual isolation of different application programs in the same processing node. The mainstream virtualization technologies currently include two categories, namely virtual machine technology and container technology, which can be used to virtualize resources including central processing unit (CPU), memory, input / output (I / O), network, etc. Among them, the container technology is a virtualization technology of computer operating system, which enables processes to run in a relatively independent and isolated environment (including independent file system, namespace, resource view, etc.), thereby simplifying the deployment process of software (such as application programs), enhancing the portability and security of software, and improving the utilization rate of system resources. The container technology is widely used in service scenarios in the field of cloud computing. The container technology provides a logical packaging mechanism. The application program packaged by this mechanism can be decoupled from its actual execution environment (also known as running environment). With this decoupling, application programs can be easily and consistently deployed based on containers in private data centers, public clouds, or personal computers, that is, application programs can be deployed in processing nodes in units of containers, so that the application programs are decoupled from their actual execution environment.

[0090] In order to provide more stable services and reduce service overhead, in cloud computing technology, resource management not only needs to have low management overhead and high scalability, but also the cloud computing system needs to provide load balancing and other functions. These key features are important means to ensure the efficient and stable service of the cloud computing system. In order to ensure the load balancing of multiple processing nodes in the cloud computing system, application programs can be migrated between multiple processing nodes in the cloud computing system. For example, based on live migration technology, application programs are migrated between multiple processing nodes in the cloud computing system. Among them, the live migration technology is also known as the hot migration technology, which is one of the core technologies for realizing resource management of the cloud computing system, and is also an important means for realizing load balancing of the cloud computing system. In the virtualization technology of deploying application programs based on containers, application programs can be migrated based on containers, that is, application programs are migrated between different processing nodes in units of containers.

[0091] For example, please refer to Figure 1 which shows a schematic diagram of application program migration, which Figure 1 Take the application program migration based on containers as an example. As Figure 1As shown, the cloud computing system 10 includes a processing node 11, a processing node 12, and a storage node 13, which can be servers. An application A deployed in the processing node 11 is located in a container A of the processing node 11, and the processing node 11 can store data A corresponding to the application A in a storage volume A corresponding to the application A in the storage node 13. The application A can be migrated from the processing node 11 to the processing node 12 in a container unit (i.e., the container A in which the application A is located is migrated from the processing node 11 to the processing node 12). After the application A is migrated from the processing node 11 to the processing node 12, the mounting node of the storage volume A corresponding to the application A in the storage node 13 can be switched from the processing node 11 to the processing node 12, so that the processing node 12 can use the data A corresponding to the application A stored in the storage node 13 by the processing node 11. Alternatively, after the application A is migrated from the processing node 11 to the processing node 12, the storage volume A can be unmapped from the processing node 11 and mapped to the processing node 12, so that the mounting node of the storage volume A corresponding to the application A in the storage node 13 is switched from the processing node 11 to the processing node 12. The migration of the application A and the switching of the mounting node of the storage volume A corresponding to the application A can be completed by a high-level management node controlling the processing node 11, the processing node 12, and the storage node 13 to interact with each other. The high-level management node can be a management node for managing the processing nodes and the storage nodes in the cloud computing system 10, or a node for managing the cloud computing system 10, and the embodiments of the present application do not limit the high-level management node.

[0092] The execution environment of the operating system of the processing node is usually an open REE, and there are certain security problems. In order to ensure the security of data, the processing node usually encrypts the data corresponding to the application and stores it in the storage node. In a typical example, the processing node supports ARM (advanced RISC machines) TrustZone technology, and the processing node encrypts the data corresponding to the application based on the ARM TrustZone technology. The ARM TrustZone technology is introduced as follows.

[0093] ARM TrustZone technology, referred to as TrustZone technology, is a CPU underlying hardware isolation technology implemented by ARM Company to build a TEE. The TrustZone technology can provide a device (for example, a processing node) with a system architecture including an REE and a TEE, that is, in the system architecture based on the TrustZone technology, there are two parallel execution environments, that is, an open REE and a relatively closed TEE. Among them, the TEE is a main research field of the global platform (GP) international standard organization, which comprehensively uses technologies such as trusted computing and virtualization isolation to provide a trusted execution environment for security-sensitive applications, while protecting the confidentiality and integrity of related data. The GP international standard organization is a cross-industry international standard organization dedicated to developing, formulating and publishing technical standards for secure chips to promote the management of multi-application industrial environments and the secure, interoperable business deployment thereof, and the focus of its work mainly concentrates on the fields of secure elements (SEs), TEEs and mobile messaging.

[0094] The system architecture based on the TrustZone technology includes a secure world and a normal world, the execution environment corresponding to the secure world is the TEE, the execution environment corresponding to the normal world is the REE, the normal world is also referred to as a non-secure world, and the secure world and the normal world have independent system resources, the system resources including at least one of hardware resources and software resources, the hardware resources including but not limited to registers, physical memories and peripherals and the like, wherein the system resources in the secure world can be referred to as secure resources, and the system resources in the normal world can be referred to as normal resources. The code and resources in the secure world are protected by strict access control policies, and the processes in the normal world are prohibited from accessing the secure world, so as to ensure that the resources stored in the secure world are not illegally accessed or stolen, and effectively reduce attacks and virus invasions from the outside world.

[0095] The GP international standardization organization began to formulate TEE specification standards since 2011, and most trusted OSs based on the TrustZone technology now comply with the standard specifications of the GP international standardization organization, and a typical system architecture based on the TrustZone technology is as follows Figure 2As shown in FIG. 1, in a system architecture 20 based on the TrustZone technology, the execution environment of an operating system includes a REE and a TEE, a rich operating system (OS) and a client application (CA) are deployed in the REE, a trusted operating system (OS) and a trusted application (TA) corresponding to the CA in the REE are deployed in the TEE, and the trusted OS and the TA are usually stored in a persistent storage medium in the form of data. The rich OS is used to provide a running platform for the CA, the trusted OS is used to provide a running platform for the TA, and a complete application program deployed in a device (for example, a processing node) includes the CA and the TA corresponding to the CA, the CA cooperates with the TA corresponding thereto to realize the complete function of the application program. The CA is also referred to as a normal application, the TA is also referred to as a secure application, the trusted OS is also referred to as a secure OS, and the trusted OS and the TA are used to enable the security function of the TrustZone. The CA is used to interact with a client, and the CA separates the core code, the critical business logic, and the sensitive data that need to be isolated and protected into the TA, thereby greatly reducing the security threat from the REE. For example, after the CA receives data sent by the client, the CA transmits critical data in the data to the corresponding TA, and the TA processes the critical data transmitted by the CA. Figure 2 As shown in FIG. 1, the CA and the rich OS communicate through a TEE client interface, the TA and the trusted OS communicate through a TEE internal interface, and the CA and the TA transmit data through a shared memory. The rich OS has a communication interface with the trusted OS, and the CA and the TA can also communicate by calling the communication interface between the rich OS and the trusted OS. The TEE client interface and the TEE internal interface can both be an application programming interface (API), for example, the TEE client interface is a TEE client API, and the TEE internal interface is a TEE internal API. Because the TA and the trusted OS can communicate through the TEE internal interface, some general functions of the TA can be integrated into the trusted OS, and the trusted OS provides the general functions to the TA in the form of a security service through the TEE internal interface, so as to simplify the complexity of the TA.

[0096] The GP standard defines general security services such as encryption, decryption, and secure storage. In a system architecture based on the TrustZone technology, a mainstream secure storage solution is as shown in FIG. 2. As shown in FIG. 2, the CA and the rich OS communicate through a TEE client interface, the TA and the trusted OS communicate through a TEE internal interface, and the CA and the TA transmit data through a shared memory. The rich OS has a communication interface with the trusted OS, and the CA and the TA can also communicate by calling the communication interface between the rich OS and the trusted OS. The TEE client interface and the TEE internal interface can both be an application programming interface (API), for example, the TEE client interface is a TEE client API, and the TEE internal interface is a TEE internal API. Because the TA and the trusted OS can communicate through the TEE internal interface, some general functions of the TA can be integrated into the trusted OS, and the trusted OS provides the general functions to the TA in the form of a security service through the TEE internal interface, so as to simplify the complexity of the TA. Figure 3 Figure 3 ​The TrustZone-based system architecture is used for processing node 11, and this secure storage solution is applied to... Figure 1 The processing node 11 and storage node 13 shown are used as examples for illustration. Figure 3 As shown, the execution environment of the operating system of processing node 11 includes TEE (and may also include REE). Figure 3 (Not shown in the diagram), both the Trusted OS and the TA are located in the TEE. The Trusted OS derives a secure storage key based on the HUK (Hardware Root of Trust) of the processor of its host device (i.e., processing node 11) and the universally unique identifier (UUID) of the TA, using a key derivation algorithm. Using this secure storage key, it encrypts the plaintext data corresponding to the TA using a data encryption algorithm to obtain ciphertext data, and stores the ciphertext data in storage node 13. The HUK is a key pre-configured at the factory by the processor or the device containing the processor, and is typically only used by the Trusted OS to protect confidentiality. The UUID is a 128-bit identifier used in computer systems to identify information; the UUID of the TA can be considered an identifier of the TA, and the UUID of the TA can be denoted as TA_UUID.

[0097] Currently, TrustZone technology is primarily used on terminal devices (such as mobile phones). In terminal device scenarios, for data that does not involve personal privacy (also known as non-sensitive data), the terminal device typically uses a background cloud service for data backup and recovery. However, for data involving personal privacy (also known as sensitive data, such as fingerprint data, password data, etc.), the terminal device can employ methods such as... Figure 3 The secure storage solution shown uses the processor's HUK (Host Controller) to securely store this data. If this securely stored data cannot be recovered (e.g., due to hardware failure such as processor damage in the terminal device), the user can usually re-enter the data. That is, the terminal device does not need to support the backup and recovery of sensitive data. However, in server scenarios, especially cloud service scenarios, TrustZone technology needs to be used in container environments, and the server needs to support data backup and recovery (e.g., if some data cannot be recovered, some functions will become unusable). However, in server scenarios, if based on... Figure 3 The security storage scheme shown stores the data corresponding to the application. After the application is migrated from one server (hereinafter referred to as the source server) to another server (hereinafter referred to as the target server), the two servers have different HUKs for their processors, so the security storage keys derived from the two servers are different, which makes it impossible for the target server to recover the data corresponding to the application stored on the source server.

[0098] For example, please refer toFigure 4 which shows a schematic diagram of another application migration, Figure 4 Take the application migration based on containers in the server scenario as an example. As shown in Figure 4 The cloud computing system 40 includes a server 41, a server 42, and a storage node 43. The application B Figure 4The application B corresponding data stored in the storage node 43 by the server 41 includes that the CA of the application B in the server 41 receives the application B corresponding data sent by the client, transmits the normal data (referring to non-sensitive data which does not need to be stored securely) in the application B corresponding data to the rich OS in the server 41, and transmits the key data (referring to sensitive data which needs to be stored securely) in the application B corresponding data to the TA of the application B; the rich OS in the server 41 stores the application B corresponding normal data in the storage volume B corresponding to the application B in the storage node 43; the TA of the application B transmits the application B corresponding key data to the trusted OS in the server 41, the trusted OS encrypts the application B corresponding key data by using the secure storage key derived based on the HUK of the processor of the server 41 and the UUID (namely TA_UUID) of the TA to obtain ciphertext data, and stores the ciphertext data in the storage volume B corresponding to the application B in the storage node 43. After the application B is migrated from the server 41 to the server 42 (including migrating the CA and the TA to the server 42), the mounting node of the storage volume B corresponding to the application B in the storage node 43 is switched from the server 41 to the server 42, and the server 42 obtains the application B corresponding data from the storage node 43 under the triggering of the client. The server 42 obtains the application B corresponding data from the storage node 43 specifically includes that the rich OS in the server 42 obtains the application B corresponding normal data from the storage node 43, and transmits the application B corresponding normal data to the CA of the application B in the server 42; the trusted OS in the server 42 obtains the application B corresponding ciphertext data from the storage node 43, but since the HUK of the processor of the server 42 is different from the HUK of the processor of the server 41, the secure storage key based on the HUK of the processor of the server 42 and the UUID (namely TA_UUID) of the TA of the application B in the trusted OS in the server 42 is different from the secure storage key derived by the foregoing server 41, so that the trusted OS in the server 42 cannot decrypt the application B corresponding ciphertext data, that is, the server 42 cannot recover the ciphertext data stored by the server 41.It can be seen that the server 42 can only obtain the normal data corresponding to the application B from the storage node 43, and cannot recover the key data corresponding to the application B from the storage node 43, so that the secure storage scheme based on the TrustZone technology is difficult to apply to the scenario of migrating the application across servers.

[0099] In order to realize the sharing of the ciphertext data of the source server and the target server in the scenario of migrating the application across servers, the related technologies provide two technical solutions, which are respectively a solution based on an enclave application and a solution of sharing a secure storage key. The two technical solutions are briefly introduced as follows.

[0100] Solution one: the solution based on the enclave application.

[0101] In the solution, the source server and the target server respectively have an enclave application, a secure communication channel can be established between the enclave application in the source server and the enclave application in the target server, after the application is migrated from the source server to the target server, the enclave application in the source server obtains the ciphertext data corresponding to the application from the storage node, decrypts the ciphertext data corresponding to the application by using a secure storage key (for example, sealing_key-AX) derived based on the HUK of the processor of the source server to obtain plaintext data, and transmits the plaintext data corresponding to the application to the enclave application in the target server through the secure communication channel, so that the target server can obtain the plaintext data. The enclave application in the target server can encrypt the plaintext data corresponding to the application sent by the source server by using a secure storage key (for example, sealing_key-BX) derived based on the HUK of the processor of the target server to obtain ciphertext data, and store the ciphertext data corresponding to the application into the storage volume corresponding to the application in the storage node.

[0102] However, the solution needs the enclave application to decrypt, transmit and encrypt the data at the business layer, which increases the complexity of the enclave application, and easily affects the performance of the server.

[0103] Solution two: the solution of sharing the secure storage key.

[0104] In the scheme, a key management system (or referred to as a key management node) shares the same secure storage key with a source server and a target server, an application in the source server encrypts data corresponding to the application by using the secure storage key to obtain ciphertext data, and stores the ciphertext data corresponding to the application to a storage node; after the application is migrated from the source server to the target server, the application in the target server obtains the ciphertext data corresponding to the application from the storage node, and decrypts the ciphertext data corresponding to the application by using the same secure storage key as the source server to obtain plaintext data corresponding to the application.

[0105] However, the process of sharing the secure storage key is easy to cause the secure storage key to be leaked, for example, the secure storage key is maliciously intercepted in the process that the key management system shares the secure storage key with the server, and the security of the scheme is poor; and the scheme needs the application to encrypt and decrypt the data, which increases the complexity of the application.

[0106] Therefore, embodiments of the present application provide a data management scheme, which can realize the migration of an application across servers based on the TrustZone technology, can realize the sharing of ciphertext data of a source server and a target server, does not need to increase the complexity of the application, does not affect the performance of the server, and has high security. The technical scheme provided by the present application is introduced below.

[0107] First, the implementation environment of the present application is introduced.

[0108] The technical scheme provided by the embodiments of the present application can be applied to a data management system, which can be a cloud computing system. The data management system includes at least two processing nodes, the application can be deployed in the at least two processing nodes, the migration of the application can be performed between the at least two processing nodes, and the data corresponding to the application can be shared. The at least two processing nodes can be servers or terminal devices, which are not limited by the embodiments of the present application.

[0109] Optionally, the data management system can further include a storage node (which can be one or more), the storage node can be in communication connection with at least one processing node in the data management system, the storage node includes a storage volume corresponding to the application in the processing node, the processing node can store the data corresponding to the application to the corresponding storage volume in the storage node, and the processing node can encrypt and store the data corresponding to the application to the storage node to ensure the security of the data. The storage node can be a server or a terminal device, which is not limited by the embodiments of the present application.

[0110] Optionally, the data management system can further comprise a key management node, which is communicatively connected with the processing nodes in the data management system, and is configured to assign external key material to the processing nodes, to enable the processing nodes to derive secure storage keys based on the external key material assigned by the key management node, and to enable the processing nodes to encrypt the data corresponding to the application by using the derived secure storage keys. The key management node can be a server, a server cluster (also referred to as a key management system) composed of multiple servers, or a terminal device, and the embodiments of the present application do not limit the key management node.

[0111] For example, refer to Figure 5 Fig. 1 shows a schematic diagram of a data management system 50 according to an embodiment of the present application, which comprises a processing node 51, a processing node 52, a storage node 53, and a key management node 54. The storage node 53 is communicatively connected with the processing node 51 and the processing node 52, and the key management node 54 is communicatively connected with the processing node 51 and the processing node 52. At least one of the processing node 51 and the processing node 52 is deployed with an application, and the application can be migrated between the processing node 51 and the processing node 52, for example, an application (e.g., application C) in the processing node 51 can be migrated from the processing node 51 to the processing node 52.

[0112] The processing node (e.g., the processing node 51) where the application (e.g., the application C) is located can store the data corresponding to the application (e.g., the application C) in the storage node 53. Optionally, the storage node 53 comprises a storage volume corresponding to the application (e.g., the application C), and the processing node where the application (e.g., the application C) is located can store the data corresponding to the application (e.g., the application C) in the storage volume corresponding to the application (e.g., the application C) in the storage node 53. In order to ensure the security of data storage, the processing node where the application (e.g., the application C) is located can encrypt the data corresponding to the application (e.g., the application C) by using a secure storage key, and store the encrypted data in the storage volume corresponding to the application (e.g., the application C) in the storage node 53.

[0113] The key management node 54 can allocate external key materials to processing nodes 51 and 52. The processing node (e.g., processing node 51) containing the application (e.g., application C) can obtain (e.g., derive) a secure storage key based on the external key materials allocated by the key management node 54, and use this secure storage key to encrypt the data corresponding to the application (e.g., application C). Optionally, the key management node 54 allocates the same external key materials to processing nodes 51 and 52, so that processing nodes 51 and 52 can obtain the same secure storage key based on the same external key materials. If an application migration occurs between processing nodes 51 and 52, processing nodes 51 and 52 can recover the data corresponding to the application stored in storage node 53, thus achieving data sharing. For example, after migrating application C from processing node 51 to processing node 52, the mount node of the storage volume C corresponding to application C in storage node 53 can be switched from processing node 51 to processing node 52. Processing node 52 can obtain the encrypted data (i.e., ciphertext data) corresponding to application C stored in storage node 53 by processing node 51 from storage volume C of storage node 53, and decrypt the encrypted data using the secure storage key obtained based on the same external key material.

[0114] It should be noted that, in this embodiment, the application can be deployed on the processing node based on virtualization technology, and the migration of the application can be based on virtualization technology, which may include virtual machine technology and container technology. For example, if application C is deployed on processing node 51 based on a container (or virtual machine), application C can be migrated from processing node 51 to processing node 52 based on the container (or virtual machine), that is, the container (or virtual machine) containing application C is migrated from processing node 51 to processing node 52.

[0115] It should also be pointed out that, Figure 5 The implementation environment shown is for illustrative purposes only and is not intended to limit the technical solutions of the embodiments of this application. In actual implementation, the data management system may include more... Figure 5 The number of nodes (or devices) can be more or less. For example, the number of processing nodes and storage nodes in the data management system can be configured as needed; for another example, the data management system may also include a high-level management node that manages the processing nodes and storage nodes and controls application migration; yet another example is that the key management node may not belong to the data management system, but may exist as a node or system independent of the data management system, and this application embodiment does not limit this.

[0116] The above is an introduction to the implementation environment of the present application. The following introduces the system architecture of the processing node of the present application.

[0117] Please refer to Figure 6 which shows a structural diagram of a processing node provided by an embodiment of the present application. The processing node can be a server or a terminal device. Figure 5 The processing node shown in the data management system 50 can be a server or a terminal device. The system architecture of the processing node in an embodiment of the present application is a system architecture based on the TrustZone technology.

[0118] Please refer to Figure 6 The execution environment of the operating system of the processing node includes a REE and a TEE. The operating system of the processing node includes a rich OS and a trusted OS. A complete application program deployed in the processing node includes a CA and a TA corresponding to the CA. The rich OS and the CA are both placed in the REE. The trusted OS and the TA are both placed in the TEE. The trusted OS and the TA are usually encrypted in the form of data and stored in a persistent storage medium. The rich OS and the CA communicate through a TEE client API. The trusted OS and the TA communicate through a TEE internal API. The CA and the TA transmit data through a shared memory. The CA and the TA can also communicate through a communication interface between the rich OS and the trusted OS. The rich OS is used to provide a running platform for the CA. The trusted OS is used to provide a running platform for the TA. The CA and the TA work together to realize the complete function of the application program.

[0119] Optionally, the processing node further includes a key import unit and a trusted storage unit. The trusted storage unit is also called a secure storage unit. The trusted storage unit is placed in the REE. The trusted storage unit is in communication connection with the trusted OS. The trusted storage unit is a data encryption protection storage unit implemented by the trusted OS on the REE side. The key import unit is placed in the TEE. The key import unit is in communication connection with the trusted OS and the trusted storage unit respectively. The key import unit is used to securely communicate with a key management node (not shown in the figure) outside the processing node to obtain an external key material allocated by the key management node for the processing node. The key import unit is used to derive a material key by using the HUK of the processor of the processing node by calling the secure storage interface of the trusted OS. The key import unit is used to encrypt the external key material by using the material key. The key import unit is used to store the encrypted external key material to the trusted storage unit. In this way, the secure storage of the external key material is ensured. Figure 6

[0120] It should be noted that Figure 6 ​The structure of the processing node shown is only for example and is not intended to limit the technical solutions of the embodiments of the present application. In actual implementation, other functional units can also be included in the processing node, which will not be listed one by one herein.

[0121] The above is an introduction to the system architecture of the processing node of the present application. The data management method provided by the present application is introduced below.

[0122] Please refer to Figure 7 , which shows a flowchart of a data management method provided by an embodiment of the present application. The data management method can be applied to a data management system, which can include a first processing node (for example Figure 5 the processing node 51) and a second processing node (for example Figure 5 the processing node 52). The system architecture of any of the first processing node and the second processing node can be as shown in Figure 6 . Referring to Figure 7 , the data management method includes the following steps:

[0123] Step 701, the first processing node obtains a secure storage key according to a first external key material corresponding to the first processing node.

[0124] Optionally, the first processing node generates a secure storage key based on a target key derivation algorithm according to a first external key material corresponding to the first processing node. For example, the target key derivation algorithm can be a password-based key derivation function 2 (PBKDF2) algorithm.

[0125] Optionally, the first processing node obtains the secure storage key according to the first external key material corresponding to the first processing node, and the first internal key material corresponding to the first processing node and / or the application internal key material corresponding to the application (e.g., application C) in the first processing node. For example, the first processing node generates the secure storage key according to the first external key material, and the first internal key material and / or the application internal key material (e.g., the internal key material corresponding to application C) based on a target key derivation algorithm. The first processing node uses the first external key material when generating the secure storage key, and also uses at least one of the first internal key material and the application internal key material (e.g., the internal key material corresponding to application C). For example, the first processing node generates the secure storage key according to the first external key material and the first internal key material based on a target key derivation algorithm; or the first processing node generates the secure storage key according to the first external key material and the application internal key material (e.g., the internal key material corresponding to application C) based on a target key derivation algorithm; or the first processing node generates the secure storage key according to the first external key material, the first internal key material and the application internal key material (e.g., the internal key material corresponding to application C) based on a target key derivation algorithm.

[0126] For example, the first processing node generates the secure storage key according to the first external key material, the first internal key material and the application internal key material (e.g., the internal key material corresponding to application C) based on a target key derivation algorithm. The first processing node can determine a first initial key according to the application internal key material (e.g., the internal key material corresponding to application C), determine a second initial key according to the first internal key material and the first external key material, and then generate the secure storage key according to the first initial key and the second initial key based on a target key derivation algorithm.

[0127] Optionally, the first processing node is configured with a trusted operating system (i.e., trusted OS), the application (e.g., application C) includes a trusted application (i.e., TA), and the execution environment of the operating system of the first processing node includes a TEE, and the trusted OS and the TA are both placed in the TEE. The first internal key material can be an internal key material corresponding to the trusted OS in the first processing node, and the internal key material corresponding to the trusted OS can be a key material related to version information of the trusted OS (denoted as KM_OS). The application internal key material can be an internal key material corresponding to the TA included in the application (e.g., application C), and the internal key material corresponding to the TA included in the application (e.g., application C) can include a key material related to version information of the TA (denoted as KM_TA) and an identifier of the TA, and the identifier of the TA can be a UUID of the TA (i.e., TA_UUID). The first processing node can perform an exclusive OR operation on the KM_TA and the TA_UUID to obtain a first initial key (denoted as SALT1), perform an exclusive OR operation on the KM_OS and the first external key material (denoted as KM_Cux) to obtain a second initial key (denoted as KM2), and derive a secure storage key (denoted as Cluster_TA_key-nx) based on a PBKDF2 algorithm according to the first initial key (i.e., SALT1) and the second initial key (i.e., KM2).

[0128] It should be noted that the system architecture of the first processing node can be as follows Figure 6As shown, the first internal key material (i.e., KM_OS) can be stored in the trusted OS, and the application internal key material (i.e., KM_TA and TA_UUID) can be stored in the TA of the application (e.g., application C). Since the trusted OS and the TA are both located in the TEE, the first internal key material and the application internal key material (e.g., the internal key material corresponding to the application C) are both stored in the TEE, which helps to ensure the security of the first internal key material and the application internal key material. The step 701 can be performed by the trusted OS in the first processing node, and the trusted OS can perform the step 701 based on the triggering of the TA of the application (e.g., application C). For example, the trusted OS performs the step 701 when receiving an encrypted storage request sent by the TA of the application (e.g., application C). Alternatively, the client can send the data corresponding to the application (e.g., application C) to the first processing node, the data corresponding to the application (e.g., application C) is received by the CA of the application (e.g., application C) in the first processing node, the CA of the application (e.g., application C) transmits the data corresponding to the application (e.g., application C) to the TA of the application (e.g., application C), the TA of the application (e.g., application C) processes the data corresponding to the application (e.g., application C) transmitted by the CA, and sends an encrypted storage request to the trusted OS after the processing is completed to trigger the trusted OS to perform the step 701, the encrypted storage request can carry the data corresponding to the application (e.g., application C). Alternatively, the client sends the data corresponding to the application (e.g., application C) to the CA through a secure channel between the client and the CA; the CA transmits the data corresponding to the application (e.g., application C) to the TA through a secure channel (e.g., shared memory) between the CA and the TA. Alternatively, after receiving the data corresponding to the application (e.g., application C) sent by the client, the CA of the application (e.g., application C) transmits the key data in the data corresponding to the application (e.g., application C) to the corresponding TA, which is not limited in the embodiments of the present application.

[0129] In step 702, the first processing node encrypts the data corresponding to the application in the first processing node by using the secure storage key.

[0130] After the first processing node obtains the secure storage key, the first processing node can encrypt data corresponding to an application (e.g., application C) in the first processing node using the secure storage key to obtain ciphertext data corresponding to the application (e.g., application C). After the first processing node encrypts the data corresponding to the application (e.g., application C), the first processing node can store the encrypted data corresponding to the application (e.g., application C).

[0131] It should be noted that step 702 can be performed by a trusted OS in the first processing node. After receiving an encrypted storage request sent by the TA of the application (e.g., application C), the trusted OS in the first processing node encrypts data corresponding to the application (e.g., application C) carried in the encrypted storage request using the secure storage key generated in step 701.

[0132] In step 703, the first processing node sends the encrypted data to a second processing node. The second external key material corresponding to the second processing node is the same as the first external key material corresponding to the first processing node.

[0133] After the first processing node encrypts the data corresponding to the application (e.g., application C) in the first processing node using the secure storage key, the first processing node can send the encrypted data corresponding to the application (e.g., application C) to a second processing node. The second external key material corresponding to the second processing node is the same as the first external key material corresponding to the first processing node.

[0134] Optionally, the first processing node can directly send the encrypted data corresponding to the application (e.g., application C) to the second processing node, or send the encrypted data corresponding to the application (e.g., application C) to the second processing node through a third node (i.e., a node other than the first processing node and the second processing node). The embodiments of the present application do not limit this. The embodiments of the present application take an example in which the first processing node sends the encrypted data corresponding to the application (e.g., application C) to the second processing node through a third node. Optionally, the data management system further includes a storage node. The first processing node can send the encrypted data corresponding to the application (e.g., application C) to the second processing node through the storage node. For example, the first processing node sends the encrypted data corresponding to the application (e.g., application C) to the storage node. The storage node is configured to send the encrypted data corresponding to the application (e.g., application C) to the second processing node.

[0135] For example, the first processing node sends the encrypted data corresponding to the application (e.g., application C) to a storage node, and the storage node stores the encrypted data corresponding to the application (e.g., application C). Alternatively, the storage node can have a storage volume corresponding to the application (e.g., application C), and the storage node can store the encrypted data corresponding to the application (e.g., application C) in the storage volume corresponding to the application (e.g., application C) in the storage node.

[0136] It should be noted that the step 703 can be performed by the trusted OS in the first processing node.

[0137] In step 704, the second processing node receives the encrypted data corresponding to the application sent by the first processing node.

[0138] To ensure load balancing of the processing nodes in the data management system, application migration can be performed between the processing nodes in the data management system. Alternatively, after the application (e.g., application C) is migrated from the first processing node to the second processing node, the second processing node can receive the encrypted data corresponding to the application (e.g., application C) sent by the first processing node. It can be understood that the embodiments of the present application take the second processing node receiving the encrypted data corresponding to the application (e.g., application C) sent by the first processing node after the application (e.g., application C) is migrated as an example for illustration, and in actual application, the second processing node can receive the encrypted data corresponding to the application (e.g., application C) sent by the first processing node before the application (e.g., application C) is migrated from the first processing node to the second processing node, or can receive the encrypted data corresponding to the application (e.g., application C) sent by the first processing node during the migration of the application (e.g., application C) from the first processing node to the second processing node, and the embodiments of the present application do not limit this.

[0139] Corresponding to step 703, the second processing node can receive the encrypted data corresponding to the application (for example, application C) sent directly by the first processing node, or receive the encrypted data corresponding to the application (for example, application C) sent by the first processing node through a third party node. Embodiments of the present application take the second processing node receiving the encrypted data corresponding to the application (for example, application C) sent by the first processing node through a third party node as an example for illustration. The first processing node sends the encrypted data corresponding to the application (for example, application C) to the storage node, and the storage node can send the encrypted data corresponding to the application (for example, application C) to the second processing node, and the second processing node can receive the encrypted data corresponding to the application (for example, application C) sent by the storage node. Alternatively, the second processing node can send a data acquisition request corresponding to the application to the storage node at the trigger of the client, so as to trigger the storage node to send the encrypted data corresponding to the application (for example, application C) to the second processing node. For example, the second processing node sends a data acquisition request corresponding to the application to the storage node when receiving a service request sent by the client.

[0140] It should be noted that the system architecture of the second processing node can be as shown in Figure 6 Step 704 can be executed by the trusted OS in the second processing node, and the trusted OS can execute step 704 based on the trigger of the TA of the application (for example, application C) in the second processing node (which is migrated from the first processing node to the second processing node), for example, the trusted OS executes step 704 when receiving a service request sent by the TA of the application (for example, application C). Alternatively, the client can send a service request corresponding to the application (for example, application C) to the second processing node, the service request is received by the CA of the application (for example, application C) in the second processing node, the CA of the application (for example, application C) transmits the service request to the corresponding TA for processing, and the TA sends the service request to the trusted OS to trigger the trusted OS to execute step 704.

[0141] In embodiments of the present application, the migration of the application is controlled by a high-level management node, and the high-level management node controls the migration of the application between different processing nodes according to the load of the processing node in the data management system. As described above, a complete application includes a CA and a TA corresponding to the CA, and the migration of the application means that the CA and the TA are migrated from one processing node to another processing node. The migration process of the application is briefly introduced below.

[0142] For example, the process of migrating the application (e.g., application C) from the first processing node to the second processing node includes: the high-level management node sending an application migration indication to the first processing node, instructing the first processing node to migrate the application (e.g., application C) from the first processing node to the second processing node; the first processing node migrating the CA of the application (e.g., application C) from the first processing node to the second processing node according to the instruction of the high-level management node (e.g., migrating the container where the CA is located from the first processing node to the second processing node); the high-level management node switching the mounting node of the storage volume corresponding to the application (e.g., application C) in the storage node from the first processing node to the second processing node; then, the second processing node triggers the TA of the application (e.g., application C) to load and run to migrate the TA of the application (e.g., application C) to the second processing node. For example, the CA of the application (e.g., application C) in the second processing node initiates a TEE service request to the operating system in the second processing node, triggering the operating system in the second processing node to load and run the TA of the application (e.g., application C) to migrate the TA of the application (e.g., application C) to the second processing node. At this point, the application (e.g., application C) is migrated from the first processing node to the second processing node as a whole.

[0143] Step 705, the second processing node obtains the secure storage key according to the second external key material corresponding to the second processing node.

[0144] Optionally, the second processing node generates the secure storage key based on a target key derivation algorithm according to the second external key material corresponding to the second processing node, which is the same as the first external key material in the aforementioned step 701, so that the second processing node can generate the same secure storage key as in step 701 based on the target key derivation algorithm according to the second external key material. Wherein, the target key derivation algorithm can be PBKDF2 algorithm.

[0145] Optionally, the second processing node derives the secure storage key according to the second external key material corresponding to the second processing node, and the second internal key material corresponding to the second processing node and / or the application internal key material corresponding to the application (e.g., application C) in the second processing node, the second internal key material being the same as the first internal key material in the step 701. For example, the second processing node derives the secure storage key according to the second external key material, and the second internal key material and / or the application internal key material (e.g., the internal key material corresponding to application C) based on a target key derivation algorithm. The second processing node uses the second external key material, and at least one of the second internal key material and the application internal key material (e.g., the internal key material corresponding to application C) when deriving the secure storage key. For example, the second processing node derives the secure storage key according to the second external key material and the second internal key material based on the target key derivation algorithm; or the second processing node derives the secure storage key according to the second external key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm; or the second processing node derives the secure storage key according to the second external key material, the second internal key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm. It should be noted that the material used by the second processing node to derive the secure storage key in the step 705 is the same as the material used by the first processing node to derive the secure storage key in the step 701, and the target key derivation algorithm used is the same. For example, if the first processing node derives the secure storage key according to the first external key material and the first internal key material based on the target key derivation algorithm in the step 701, the second processing node derives the secure storage key according to the second external key material and the second internal key material based on the target key derivation algorithm in the step 705; if the first processing node derives the secure storage key according to the first external key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm in the step 701, the second processing node derives the secure storage key according to the second external key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm in the step 705; if the first processing node derives the secure storage key according to the first external key material, the first internal key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm in the step 701, the second processing node derives the secure storage key according to the second external key material, the second internal key material and the application internal key material (e.g., the internal key material corresponding to application C) based on the target key derivation algorithm in the step 705.

[0146] For example, the second processing node can determine a first initial key according to the application internal key material (e.g., the internal key material corresponding to application program C), determine a second initial key according to the second internal key material and the second external key material, and then generate the secure storage key based on the target key derivation algorithm according to the first initial key and the second initial key.

[0147] Optionally, the second processing node is configured with a trusted OS, the application program (e.g., application program C) includes a TA, and the execution environment of the operating system of the second processing node includes a TEE, and the trusted OS and the TA are both placed in the TEE. The second internal key material can be an internal key material corresponding to the trusted OS in the second processing node, and the internal key material corresponding to the trusted OS can be a key material related to version information of the trusted OS, etc. (denoted as KM_OS). The application internal key material can be an internal key material corresponding to a TA included in the application program (e.g., application program C), and the internal key material corresponding to the TA included in the application program (e.g., application program C) can include a key material (denoted as KM_TA) related to version information of the TA and an identifier (e.g., TA_UUID) of the TA. The second processing node can perform XOR operation on KM_TA and TA_UUID to obtain a first initial key (denoted as SALT1), perform XOR operation on KM_OS and the second external key material (denoted as KM_Cux) to obtain a second initial key (denoted as KM2), and derive a secure storage key (denoted as Cluster_TA_key-nx) based on the PBKDF2 algorithm according to the first initial key (i.e., SALT1) and the second initial key (i.e., KM2). Since the second external key material is the same as the first external key material described in step 701, the second internal key material is the same as the first internal key material described in step 701, and TA_UUID is the UUID of the same TA, KM_TA is the KM of the same TA, the secure storage key derived by the second processing node is the same as the secure storage key derived by the first processing node in step 701.

[0148] It should be noted that the system architecture of the second processing node can be as shown in FIG. 6. Figure 6As shown, the second internal key material (i.e., KM_OS) can be stored in the trusted OS, and the application internal key material (e.g., the internal key material corresponding to the application C, including KM_TA and TA_UUID) can be stored in the TA of the application (e.g., the application C). Since the trusted OS and the TA are both located in the TEE, the second internal key material and the application internal key material (e.g., the internal key material corresponding to the application C) are both stored in the TEE, which helps to ensure the security of the second internal key material and the application internal key material. The step 705 can be performed by the trusted OS in the second processing node. For example, the trusted OS performs the step 705 after obtaining the encrypted data corresponding to the application (e.g., the application C). The embodiments of the present application do not limit this.

[0149] Step 706: The second processing node decrypts the encrypted data corresponding to the application by using the secure storage key.

[0150] After obtaining the secure storage key, the second processing node can decrypt the encrypted data corresponding to the application (e.g., the application C) obtained in the step 704 by using the secure storage key. Optionally, after decrypting the encrypted data corresponding to the application (e.g., the application C), the second processing node can send the decrypted data corresponding to the application (e.g., the application C) to the client to respond to the service request of the client.

[0151] It should be noted that the step 706 can be performed by the trusted OS in the second processing node. After decrypting the encrypted data corresponding to the application (e.g., the application C), the trusted OS can transmit the decrypted data corresponding to the application (e.g., the application C) to the TA of the application (e.g., the application C). After processing the decrypted data corresponding to the application (e.g., the application C), the TA of the application (e.g., the application C) transmits the processed data corresponding to the application (e.g., the application C) to the CA of the application (e.g., the application C). The CA of the application (e.g., the application C) sends the processed data corresponding to the application (e.g., the application C) to the client to respond to the service request of the client.

[0152] In conclusion, the data management method provided by the embodiments of the present application, after the first processing node obtains the secure storage key according to the first external key material corresponding to the first processing node, the first processing node encrypts the data corresponding to the application program in the first processing node by using the secure storage key, and sends the encrypted data corresponding to the application program to the second processing node; the second processing node receives the encrypted data corresponding to the application program sent by the first processing node, obtains the secure storage key according to the second external key material corresponding to the second processing node, and decrypts the encrypted data corresponding to the application program by using the secure storage key; the second external key material is the same as the first external key material, so the second processing node and the first processing node can obtain the same secure storage key, the second processing node can successfully decrypt the encrypted data corresponding to the application program sent by the first processing node, and the flexibility of data management is improved.

[0153] In the embodiments of the present application, the external key material corresponding to the processing node is allocated by the key management node for the processing node, and the processing node can obtain the external key material allocated by the key management node before obtaining the secure storage key. Therefore, as an optional implementation manner, before the step 701, the method further includes: the first processing node receives the first external key material corresponding to the first processing node allocated by the key management node; and before the step 705, the method further includes: the second processing node receives the second external key material corresponding to the second processing node allocated by the key management node. The process of the processing node obtaining the external key material will be combined into the present application to introduce the data management method provided by the embodiments of the present application.

[0154] For example, referring to Figure 8 , a flowchart of another data management method provided by the embodiments of the present application is shown, and the data management method can be applied to a data management system, and the data management system can include a first processing node (for example, the processing node 51 shown in Figure 5 ) and a second processing node (for example, the processing node 52 shown in Figure 5 ), and the system architecture of any one of the first processing node and the second processing node can be as shown in Figure 6 . Referring to Figure 8 , the data management method includes the following steps:

[0155] Step 801, the first processing node receives the first external key material corresponding to the first processing node allocated by the key management node.

[0156] The key management node assigns the same external key material to the processing nodes in the same cluster. Optionally, the cluster satisfies at least one of the following conditions: the number of processing nodes in the cluster is less than a preset number; the processing nodes in the cluster are in the same business scenario (for example, the processing nodes in the cluster are all processing nodes of xx business); and the processing nodes in the cluster are in the same network topology. The number of processing nodes in the cluster being less than the preset number can make the number of processing nodes with the same external key material smaller, thereby ensuring the security of the external key material corresponding to the processing nodes in the cluster. The processing nodes in the cluster being in the same business scenario can facilitate application migration between the processing nodes in the cluster. The processing nodes in the cluster being in the same network topology can facilitate communication between the processing nodes in the cluster. Those skilled in the art can understand that the three conditions are only exemplary and cannot be used to limit the embodiments of the present application. In actual implementation, the cluster can also satisfy other conditions, which are not limited in the embodiments of the present application.

[0157] Optionally, the management node (for example, the key management node or other management node in the data management system, for example, a high-level management node) can perform cluster division on the plurality of processing nodes in the cloud computing system to obtain at least one cluster, each cluster including at least one processing node, and each cluster satisfying the above condition. The key management node can assign external key material to the at least one cluster, the external key material of each cluster being the external key material corresponding to the processing nodes in the cluster, the external key material corresponding to the processing nodes in the same cluster being the same, and the key management node assigning different external key material to different clusters. Optionally, the key management node generates the external key material corresponding to each cluster using a secure random number generator, the external key material satisfying a certain strength requirement to ensure security. For example, the length of the external key material is greater than or equal to 256 bits. In the embodiments of the present application, the length of the external key material can be equal to 256 bits.

[0158] After the key management node allocates the external key material for the at least one cluster, the key management node can send the external key material corresponding to each cluster (i.e., the external key material corresponding to each processing node in the cluster) to each processing node in the cluster, and each processing node can receive the external key material corresponding to the processing node sent by the key management node. The plurality of processing nodes includes a first processing node, and the external key material corresponding to the first processing node can be a first external key material. Embodiments of the present application take the first processing node obtaining the first external key material from the key management node as an example for illustration. The first processing node can establish a secure communication channel with the key management node, and the first processing node can send a key application request carrying the identifier of the first processing node to the key management node through the secure communication channel. After receiving the key application request, the key management node can determine the cluster to which the first processing node belongs according to the identifier of the first processing node carried in the key application request, determine the external key material corresponding to the cluster to which the first processing node belongs as the first external key material corresponding to the first processing node, and send the first external key material to the first processing node through the secure communication channel between the first processing node and the key management node. The identifier of the first processing node can be an electronic serial number (ESN) of the first processing node. The first processing node and the key management node each have an X509 identity certificate, and the first processing node and the key management node can perform transport layer security (TLS) two-way authentication based on the X509 identity certificate, and establish a secure communication channel after the authentication is passed. Optionally, the first processing node has a key import unit (for example, a key import application), which can include a normal import subunit (also known as a key import CA, a key management CA, or a key privilege CA) and a secure import subunit (also known as a key import TA, a key management TA, or a key privilege TA). The execution environment of the operating system of the first processing node includes a TEE and a REE, the normal management subunit is placed in the REE, and the secure management subunit is placed in the TEE. The normal management subunit can perform TLS two-way authentication with the key management node, establish a secure communication channel, send a key application request to the key management node, and receive the first external key material sent by the key management node.

[0159] Optionally, the first external key material sent by the key management node to the first processing node is encrypted by the key management node based on a first encryption algorithm using a first security key, the first security key and the first encryption algorithm are held by both the first processing node and the key management node, and the first processing node can receive the encrypted first external key material sent by the key management node. For example, the first security key and the first encryption algorithm are negotiated by the first processing node and the key management node, and the first processing node and the key management node can negotiate the first security key and the first encryption algorithm in a secure environment to ensure the security of the first security key and the first encryption algorithm. Optionally, as described above, the key import unit of the first processing node includes a normal import subunit and a secure import subunit, the normal import subunit is placed in the REE, and the secure import subunit is placed in the TEE. The first security key and the first encryption algorithm can be negotiated by the secure import subunit in the TEE and the key management node, so that the first security key and the first encryption algorithm can be prevented from being known by the normal management subunit.

[0160] After receiving the first external key material corresponding to the first processing node sent by the key management node, the first processing node can securely store the first external key material to ensure the security of the first external key material. Optionally, the first processing node comprises a trusted storage unit, and the first processing node can encrypt the first external key material by using the first material key and store the corresponding encrypted first external key material into the trusted storage unit. Optionally, the first external key material sent by the key management node to the first processing node is encrypted by the key management node based on a first encryption algorithm by using a first security key, and the first processing node first decrypts the first external key material sent by the key management node based on the first encryption algorithm by using the first security key, then encrypts the decrypted first external key material by using the first material key, and stores the first external key material into the trusted storage unit in the first processing node after encryption. Optionally, before encrypting the first external key material by using the first material key, the first processing node can obtain the first material key according to the hardware identifier of the first processing node. As described above, the key import unit of the first processing node comprises a secure import subunit, and the first processing node can generate the first material key based on a target key derivation algorithm (for example, the PBKDF2 algorithm) according to the hardware identifier of the first processing node and the identifier (for example, the UUID) of the secure import subunit. The hardware identifier of the first processing node may, for example, be the HUK of the processor of the first processing node, and the first material key is a trusted storage key (TSK). In the embodiments of the present application, the secure storage of the first external key material can be performed by the trusted OS in the first processing node and the secure import subunit in the key import unit in the first processing node. For example, the key import unit in the first processing node comprises a normal import subunit and a secure import subunit, and a secure communication channel is established between the normal import subunit and the secure import subunit. After receiving the first external key material sent by the key management node, the normal import subunit sends the first external key material to the secure import subunit through the secure communication channel between the normal import subunit and the secure import subunit. After the secure import subunit decrypts the first external key material, the trusted OS encrypts the first external key material by using the first material key, and the embodiments of the present application do not limit this.

[0161] In step 802, the second processing node receives the second external key material corresponding to the second processing node distributed by the key management node, and the second external key material is the same as the first external key material corresponding to the first processing node.

[0162] Optionally, the external key material sent by the key management node to the second processing node is encrypted by the key management node based on a second encryption algorithm using a second security key, and the second processing node can receive the encrypted second external key material sent by the key management node, and the second security key can be the same as or different from the first security key in step 801, and the second encryption algorithm can be the same as or different from the first encryption algorithm in step 801, which is not limited in the embodiments of the present application. After receiving the second external key material sent by the key management node, the second processing node can securely store the second external key material. Optionally, the second processing node first decrypts the second external key material sent by the key management node based on the second encryption algorithm using the second security key, then encrypts the decrypted second external key material using a second material key, and stores the encrypted second external key material to a trusted storage unit in the second processing node. Before encrypting the second external key material using the second material key, the second processing node can obtain the second material key according to the hardware identifier of the second processing node, for example, the second processing node generates the second material key based on a target key derivation algorithm (for example, PBKDF2 algorithm) according to the hardware identifier of the second processing node and the identifier (for example, UUID) of the security import subunit in the second processing node. The hardware identifier of the second processing node can be, for example, the HUK of the processor of the second processing node, and the second material key is a kind of TSK.

[0163] The detailed implementation process of step 802 is similar to the implementation process of the foregoing step 801, which will not be described here.

[0164] In step 803, the first processing node obtains a secure storage key according to the first external key material corresponding to the first processing node.

[0165] Optionally, the first processing node obtains the first external key material corresponding to the first processing node from the trusted storage unit of the first processing node, and the first external key material obtained by the first processing node is encrypted using a first material key. The first processing node obtains the first material key according to the hardware identifier of the first processing node, decrypts the first external key material obtained from the trusted storage unit using the first material key to obtain decrypted first external key material, and generates a secure storage key based on a target key derivation algorithm according to the decrypted first external key material. Wherein, the process that the first processing node obtains the first material key according to the hardware identifier of the first processing node can refer to the foregoing step 801, and the process that the first processing node generates a secure storage key based on a target key derivation algorithm according to the first external key material can refer to the foregoing step 801. Figure 7In step 701 in the illustrated embodiment, the embodiments of the present application will not be repeated here.

[0166] In step 804, the first processing node encrypts data corresponding to the application in the first processing node by using the secure storage key.

[0167] In step 805, the first processing node sends the encrypted data to the second processing node.

[0168] In step 806, the second processing node receives the encrypted data corresponding to the application sent by the first processing node.

[0169] The implementation process of steps 804 to 806 can be referred to Figure 7 In steps 702 to 704 in the illustrated embodiment, the embodiments of the present application will not be repeated here.

[0170] In step 807, the second processing node obtains the secure storage key according to the second external key material corresponding to the second processing node.

[0171] Optionally, the second processing node obtains the second external key material corresponding to the second processing node from the trusted storage unit of the second processing node, and the second external key material obtained by the first processing node is encrypted by using a second material key. The second processing node obtains the second material key according to the hardware identifier of the second processing node, decrypts the second external key material obtained from the trusted storage unit by using the second material key to obtain decrypted second external key material, and generates the secure storage key based on the target key derivation algorithm according to the decrypted second external key material. The process in which the second processing node obtains the second material key according to the hardware identifier of the second processing node can be referred to the aforementioned step 802, and the process in which the second processing node generates the secure storage key based on the target key derivation algorithm according to the second external key material can be referred to Figure 7 In step 705 in the illustrated embodiment, the embodiments of the present application will not be repeated here.

[0172] In step 808, the second processing node decrypts the encrypted data corresponding to the application by using the secure storage key.

[0173] The implementation process of step 808 can be referred to Figure 7 In step 706 in the illustrated embodiment, the embodiments of the present application will not be repeated here.

[0174] In summary, the data management method provided in the embodiments of the present application, after the first processing node obtains the secure storage key according to the first external key material corresponding to the first processing node, the secure storage key is used to encrypt the data corresponding to the application program in the first processing node, and the encrypted data corresponding to the application program is sent to the second processing node; the second processing node receives the encrypted data corresponding to the application program sent by the first processing node, obtains the secure storage key according to the second external key material corresponding to the second processing node, and decrypts the encrypted data corresponding to the application program by using the secure storage key; the second external key material is the same as the first external key material, so the second processing node and the first processing node can obtain the same secure storage key, the second processing node can successfully decrypt the encrypted data corresponding to the application program sent by the first processing node, and the flexibility of data management is improved.

[0175] The data management method provided in the embodiments of the present application provides a general ciphertext data migration service, can realize decoupling of the secure storage key and the HUK of the processing node (for example, a server), does not need to increase the complexity of the application program, has less influence on the performance of the processing node, and the migration process of the ciphertext data does not need to decrypt and re-encrypt the ciphertext data, the migration efficiency of the ciphertext data is higher, the ciphertext data can still be recovered in the case of hardware failure such as processor damage of the processing node, efficient cross-node data secure storage, migration and recovery are realized, and compared with the scheme of sharing the secure storage key, the secure storage key provided in the data management method is obtained based on multiple key materials, and the security of the secure storage key is higher.

[0176] As mentioned above, it is easy to understand that the data management method provided in the embodiments of the present application includes three stages, which are a key material import stage (that is, the key management node imports the external key material to the processing node), a data encryption stage and a data decryption stage after application program migration. The three stages will be introduced respectively in combination with the system architecture of the processing node.

[0177] For example, please refer to Figure 9 which shows a schematic diagram of a key material import process provided in the embodiments of the present application, which Figure 9 For example, the external key material is imported to the first processing node (for example Figure 5 the processing node 51 in FIG. 1). As shown in Figure 9As shown, the secure random number generator in the key management node generates a plurality of external key materials, KM_Cu1, KM_Cu2... KM_Cux respectively, and the cluster grouping unit in the key management node can assign the external key materials to a plurality of clusters (each cluster including at least one processing node), which is illustrated by taking the cluster grouping unit in the key management node as an example of assigning the first external key material to the first processing node. The key management CA in the first processing node and the cluster grouping unit in the key management node perform TLS mutual authentication based on X509 identity certificate (the X509 identity certificate in the first processing node is located in the key management TA in the first processing node to ensure security), and a secure communication channel is established between the key management CA in the first processing node and the cluster grouping unit in the key management node after the authentication is passed. After the secure communication channel is successfully established, the key management TA in the first processing node negotiates the first security key and the first encryption algorithm with the cluster grouping unit in the key management node through the key management CA in the first processing node. After the negotiation is completed, the key management CA in the first processing node sends a key application request carrying the identifier of the first processing node to the cluster grouping unit in the key management node through the secure communication channel between the key management CA and the cluster grouping unit in the key management node. After receiving the key application request, the cluster grouping unit in the key management node determines that the first external key material corresponding to the first processing node is KM_Cux according to the identifier of the first processing node carried by the key application request. Then, the cluster grouping unit in the key management node encrypts the first external key material KM_Cux using the first security key and the first encryption algorithm negotiated with the key management TA in the first processing node to obtain KM_Cux ciphertext 1, and transmits the KM_Cux ciphertext 1 to the key management CA in the first processing node through the secure communication channel between the key management CA and the first processing node. After receiving the KM_Cux ciphertext 1, the key management CA in the first processing node transmits the KM_Cux ciphertext 1 to the key management TA in the first processing node. The key management TA in the first processing node decrypts the KM_Cux ciphertext 1 using the first security key and the first encryption algorithm negotiated with the cluster grouping unit in the key management node to obtain KM_Cux (i.e. KM_Cux plaintext), and transmits the KM_Cux and the UUID of the key management TA in the first processing node to the key management CA in the first processing node. After receiving the KM_Cux and the UUID of the key management TA in the first processing node, the key management CA in the first processing node transmits the KM_Cux and the UUID of the key management TA in the first processing node to the key management TA in the first processing node. After receiving the KM_Cux and the UUID of the key management TA in the first processing node, the key management TA in the first processing node stores the KM_Cux and the UUID of the key management TA in the first processing node in the key management TA in the first processing node, and the key management TA in the first processing node and the cluster grouping unit in the key management node complete the assignment of the first external key material to the first processing node. Figure 9The first processing node receives the KM_Cux and the key management TA UUID, and generates first key material based on a key derivation algorithm (e.g., a PBKDF2 algorithm) according to the key management TA UUID and the processor of the first processing node. The first key material is used to encrypt the KM_Cux to obtain KM_Cux ciphertext 2, and the KM_Cux ciphertext 2 is stored in the trusted storage unit of the first processing node. At this point, the first external key material KM_Cux is imported into the first processing node.

[0178] For example, refer to Figure 10 , which shows a schematic diagram of a data encryption process provided by an embodiment of the present application, which Figure 10 The data encryption process is applied to a first processing node (e.g., the processing node 51 in Figure 5 ). As shown in Figure 10 , the client sends the data corresponding to the application C to the first processing node, and the data corresponding to the application C is received by the CA of the application C in the first processing node. The CA of the application C transmits the data corresponding to the application C to the corresponding TA, and the TA of the application C processes the data transmitted by the CA of the application C to obtain processed data. Then, the TA of the application C sends an encrypted storage request to the trusted OS of the first processing node, which can carry the internal key material KM_TA corresponding to the TA of the application C, the identifier TA_UUID of the TA of the application C, and the processed data. The trusted OS in the first processing node receives the encrypted storage request, obtains the first external key material (i.e., the KM_Cux ciphertext 2) corresponding to the first processing node from the trusted storage unit of the first processing node, and generates first key material based on a key derivation algorithm (e.g., a PBKDF2 algorithm) according to the identifier of the key management TA in the first processing node (i.e., the key management TA UUID in Figure 10 , the key management TA in Figure 10 is not shown, and the key management TA can refer to Figure 9) and the HUK of the processor of the first processing node, to generate first key material based on a key derivation algorithm (e.g., the PBKDF2 algorithm), and to decrypt the KM_Cux ciphertext 2 based on the material decryption algorithm to obtain KM_Cux (i.e., KM_Cux plaintext) using the first key material; then, the trusted OS in the first processing node performs XOR between the internal key material KM_TA corresponding to the TA of the application C and the identifier TA_UUID of the TA of the application C to obtain a first initial key SALT1, and performs XOR between the internal key material KM_OS corresponding to the trusted OS and the first external key material KM_Cux to obtain a second initial key KM2, and generates a secure storage key based on the first initial key SALT1 and the second initial key KM2 based on the key derivation algorithm (e.g., the PBKDF2 algorithm). Then, the trusted OS in the first processing node encrypts the processed data carried in the encrypted storage request using the secure storage key, and stores the encrypted data into the storage volume C corresponding to the application C in the storage node. Thus, the data encryption process described in the embodiments of the present application is completed. Alternatively, after the CA of the application C receives the data corresponding to the application C sent by the client, the CA of the application C can transmit the key data in the data corresponding to the application C to the corresponding TA to perform the above data encryption process, and the CA of the application C processes the normal data in the data corresponding to the application C and stores the processed normal data corresponding to the application C into the storage volume C corresponding to the application C in the storage node, which is not limited in the embodiments of the present application.

[0179] For example, refer to Figure 11 , which shows a schematic diagram of a data decryption process provided by an embodiment of the present application, which Figure 11 is applied to a second processing node (e.g., the processing node 52 in Figure 5 . As Figure 11 shown, the client can send a service request corresponding to the application C to the second processing node to trigger the second processing node to perform the data decryption process. For example, under the trigger of the client, the trusted OS in the second processing node obtains the encrypted data corresponding to the application C from the storage volume C corresponding to the application C in the storage node. Then, the trusted OS in the second processing node obtains the second external key material (i.e., the KM_Cux ciphertext 2) corresponding to the second processing node from the trusted storage unit in the second processing node, and obtains the identifier of the key management TA in the second processing node (i.e., the key management TA_UUID in Figure 11 , the identifier of the key management TA in Figure 11The HUK of the processor of the second processing node and the HUK of the processor of the second processing node that is not shown in the figure generate second key material based on a key derivation algorithm (for example, the PBKDF2 algorithm), and use the second key material to decrypt the KM_Cux ciphertext 2 to obtain KM_Cux (that is, KM_Cux plaintext). Then, the trusted OS in the second processing node performs exclusive OR on the internal key material KM_TA corresponding to the TA of the application program C and the identifier TA_UUID of the TA of the application program C to obtain a first initial key SALT1, performs exclusive OR on the internal key material KM_OS corresponding to the trusted OS (that is, the second internal key material) and the second external key material KM_Cux to obtain a second initial key KM2, and generates a secure storage key based on the first initial key SALT1 and the second initial key KM2 based on a key derivation algorithm (for example, the PBKDF2 algorithm). Then, the trusted OS in the second processing node uses the secure storage key to decrypt the encrypted data corresponding to the application program C obtained from the storage node to obtain decrypted data, and transmits the decrypted data to the TA of the application program C, and the TA of the application program C transmits the decrypted data to the CA of the application program C, and the CA of the application program C transmits the decrypted data to the client to respond to the service request of the client. Thus, the data decryption process described in the embodiments of the present application is completed.

[0180] The data management process provided by the embodiments of the present application will be described below with reference to the accompanying drawings.

[0181] For example, refer to Figure 12 , which shows a schematic diagram of a data management process provided by the embodiments of the present application. The first external key material KM_Cux corresponding to the first processing node is the same as the second external key material KM_Cux corresponding to the second processing node, and the first internal key material KM_OS corresponding to the first processing node is the same as the second internal key material KM_OS corresponding to the second processing node. When the application program C is located in the first processing node, the trusted OS in the first processing node generates a secure storage key based on the first external key material KM_Cux, the first internal key material KM_OS, and the application internal key material (that is, the internal key material corresponding to the application program C, including Figure 12 , KM_TA and TA_UUID) in the first processing node, and uses the secure storage key to encrypt the data corresponding to the application program C (that is, Figure 12The processed data is encrypted and stored in storage volume C corresponding to application C in the storage node. After application C is migrated from the first processing node to the second processing node, the mount node of storage volume C corresponding to application C in the storage node is switched from the first processing node to the second processing node. The trusted OS in the second processing node retrieves the encrypted data corresponding to application C from storage volume C corresponding to application C in the storage node. Then, the trusted OS in the second processing node uses the second external key material KM_Cux, the second internal key material KM_OS, and the application internal key material (that is, the internal key material corresponding to application C, including...) to... Figure 12 The second processing node generates a secure storage key using KM_TA and TA_UUID, and uses this secure storage key to decrypt the encrypted data corresponding to application C. Since the first external key material KM_Cux is the same as the second external key material KM_Cux, the first internal key material KM_OS is the same as the second internal key material KM_OS, and the application internal key material is the same as the internal key material corresponding to application C, the second processing node and the first processing node can generate the same secure storage key. The second processing node can then use this same secure storage key to successfully decrypt the encrypted data corresponding to application C decrypted by the first processing node, thus recovering the encrypted data.

[0182] The following are apparatus embodiments of this application, which can be used to execute the method embodiments of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the method embodiments of this application.

[0183] Please refer to Figure 13 This document illustrates a logical structure diagram of a data management device 1300 provided in an embodiment of this application. The data management device 1300 can be applied to a first processing node in a data management system. For example, the data management device 1300 can be the first processing node or a functional component within the first processing node. The first processing node can be... Figure 5 The first processing node is 51, and this first processing node can be a server. See also... Figure 13 The data management device 1300 may include, but is not limited to:

[0184] The acquisition module 1310 is used to acquire a secure storage key based on the first external key material corresponding to the first processing node; the acquisition module 1310 can be used to execute the aforementioned steps 701 and 803.

[0185] The encryption module 1320 is configured to encrypt data corresponding to the application in the first processing node by using the secure storage key. The encryption module 1320 can be configured to perform the foregoing step 702 and the foregoing step 804.

[0186] The sending module 1330 is configured to send the encrypted data to the second processing node, where the second external key material corresponding to the second processing node is the same as the first external key material. The sending module 1330 can be configured to perform the foregoing step 703 and the foregoing step 805.

[0187] Optionally, the obtaining module 1310 is configured to obtain the secure storage key according to the first external key material and the first internal key material corresponding to the first processing node or the application internal key material corresponding to the application, where the second internal key material corresponding to the second processing node is the same as the first internal key material.

[0188] Optionally, the first processing node is configured with a trusted operating system, the application includes a trusted application, the first internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

[0189] Optionally, an execution environment of an operating system of the first processing node includes a TEE, and the trusted operating system and the trusted application are placed in the TEE.

[0190] Optionally, please continue to refer to Figure 13 The data management apparatus 1300 further includes:

[0191] The receiving module 1340 is configured to receive the first external key material distributed by a key management node before the obtaining module 1310 obtains the secure storage key according to the first external key material corresponding to the first processing node, where the key management node distributes the same external key material to processing nodes in the same cluster. The receiving module 1340 can be configured to perform the foregoing step 801.

[0192] Optionally, the cluster satisfies at least one of the following conditions:

[0193] The processing nodes in the cluster have the same service scenario;

[0194] The number of the processing nodes in the cluster is less than a preset number;

[0195] The processing nodes in the cluster are in the same network topology.

[0196] Optionally, the receiving module 1340 is configured to receive the encrypted first external key material sent by the key management node, where the encrypted first external key material is encrypted by the key management node based on a first encryption algorithm using a first security key, and the first security key and the first encryption algorithm are held by both the first processing node and the key management node.

[0197] Optionally, the sending module 1330 is configured to send the encrypted data to a storage node, where the storage node is configured to send the encrypted data to the second processing node.

[0198] In summary, the data management apparatus provided by the embodiments of the present application is configured to: obtain, by the first processing node, a security storage key based on first external key material corresponding to the first processing node, encrypt data corresponding to an application program in the first processing node using the security storage key, and send the encrypted data corresponding to the application program to a second processing node, where the second external key material corresponding to the second processing node is the same as the first external key material. Therefore, the second processing node can obtain the same security storage key as the first processing node based on the second external key material, and can successfully decrypt the encrypted data corresponding to the application program sent by the first processing node using the security storage key, which helps to improve the flexibility of data management.

[0199] For example, the data management apparatus 1400 can be the second processing node or a functional component in the second processing node. Figure 14 Figure 14 shows a logic structure diagram of another data management apparatus 1400 provided by the embodiments of the present application, which can be applied to a second processing node in a data management system. For example, the data management apparatus 1400 can be the second processing node or a functional component in the second processing node. The second processing node can be the processing node 52 in Figure 1, and the second processing node can be a server. Figure 5 Figure 14 The data management apparatus 1400 can include but is not limited to:

[0200] The receiving module 1410 is configured to receive the encrypted data corresponding to the application program sent by the first processing node. The receiving module 1410 can be configured to perform the foregoing step 704 and the foregoing step 806.

[0201] The obtaining module 1420 is configured to obtain a security storage key based on second external key material corresponding to the second processing node, where the second external key material is the same as the first external key material corresponding to the first processing node. The obtaining module 1420 can be configured to perform the foregoing step 705 and the foregoing step 807.

[0202] ​The decryption module 1430 is configured to decrypt the encrypted data corresponding to the application by using the secure storage key. The decryption module 1430 can be configured to perform the foregoing step 706 and the foregoing step 808.

[0203] Optionally, the obtaining module 1420 is configured to obtain the secure storage key according to the second external key material and the second internal key material corresponding to the second processing node or the application internal key material corresponding to the application, where the second internal key material is the same as the first internal key material corresponding to the first processing node.

[0204] Optionally, the second processing node is configured with a trusted operating system, the application includes a trusted application, the second internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

[0205] Optionally, an execution environment of an operating system of the second processing node includes a TEE, and the trusted operating system and the trusted application are both placed in the TEE.

[0206] Optionally, the receiving module 1410 is further configured to receive the second external key material distributed by a key management node before the obtaining module 1420 obtains the secure storage key according to the second external key material corresponding to the second processing node, where the key management node distributes the same external key material to processing nodes in the same cluster. The receiving module 1410 can also be configured to perform the foregoing step 802.

[0207] Optionally, the receiving module 1410 is configured to receive the encrypted second external key material sent by the key management node, where the encrypted second external key material is encrypted by the key management node based on a second encryption algorithm by using a second secure key, and the second secure key and the second encryption algorithm are both held by the second processing node and the key management node.

[0208] In summary, the data management apparatus provided by the embodiments of the present application is provided. The second processing node receives the encrypted data corresponding to the application sent by the first processing node, obtains a secure storage key according to a second external key material corresponding to the second processing node, and decrypts the encrypted data corresponding to the application by using the secure storage key. The second external key material is the same as a first external key material corresponding to the first processing node. Therefore, the secure storage key obtained by the second processing node according to the second external key material is the same as the secure storage key obtained by the first processing node according to the first external key material. The second processing node can successfully decrypt the encrypted data corresponding to the application sent by the first processing node by using the secure storage key, which helps to improve the flexibility of data management.

[0209] Reference is made to Figure 15 which shows a hardware structure schematic diagram of a computer device 1500 provided by an embodiment of the present application, the computer device 1500 can be the first processing node or the second processing node, and the computer device 1500 can be a server. Referring to Figure 15 The computer device 1500 includes a processor 1502, a memory 1504, a communication interface 1506 and a bus 1508, and the processor 1502, the memory 1504 and the communication interface 1506 are communicatively connected to each other through the bus 1508. Those skilled in the art should understand that Figure 15 The connection mode between the processor 1502, the memory 1504 and the communication interface 1506 shown is only exemplary, and in the implementation process, the processor 1502, the memory 1504 and the communication interface 1506 can also be communicatively connected to each other in other connection modes other than the bus 1508.

[0210] The memory 1504 can be used to store a computer program 15042, which can include instructions and data. In the embodiments of the present application, the memory 1504 can be various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, optical storage and register, etc. And the memory 1504 can include a hard disk and / or an internal memory.

[0211] The processor 1502 can be a general processor, which can be a processor that performs specific steps and / or operations by reading and executing computer programs (e.g., the computer program 15042) stored in a memory (e.g., the memory 1504), and can use data stored in the memory (e.g., the memory 1504) in the process of executing the above steps and / or operations. The general processor can be, for example but not limited to, a CPU. In addition, the processor 1502 can also be a special-purpose processor, which can be a processor specially designed to perform specific steps and / or operations, and can be, for example but not limited to, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or a programmable logic device (PLD), which can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. In addition, the processor 1502 can also be a combination of multiple processors, such as a multi-core processor. The processor 1502 can include at least one circuit to perform all or part of the steps of the data management method provided by the above embodiments.

[0212] The communication interface 1506 can include I / O interfaces, physical interfaces, and logical interfaces for realizing the interconnection of devices inside the computer device 1500, and interfaces for realizing the interconnection of the computer device 1500 and other devices (e.g., user devices where clients are located). The physical interface can be a gigabit Ethernet (GE) interface, which can be used to realize the interconnection of the computer device 1500 and other devices, and the logical interface is an interface inside the computer device 1500, which can be used to realize the interconnection of devices inside the computer device 1500. It is easy to understand that the communication interface 1506 can be used for communication between the computer device 1500 and other devices, for example, the communication interface 1506 is used for sending and receiving information between the computer device 1500 and other devices.

[0213] The bus 1508 can be any type of communication bus for realizing the interconnection of the processor 1502, the memory 1504, and the communication interface 1506, such as a system bus.

[0214] The above devices can be respectively arranged on chips independent of each other, or at least partially or entirely arranged on the same chip. Whether the devices are arranged independently on different chips or integrated on one or more chips often depends on the needs of product design. Embodiments of the present application do not limit the specific implementation forms of the above devices.

[0215] In embodiments of the present application, the computer device 1500 includes a secure world and a normal world, the execution environment corresponding to the secure world is TEE, the execution environment corresponding to the normal world is REE, the secure world and the normal world have independent system resources, the system resources include at least one of hardware resources and software resources, the hardware resources include but are not limited to the above-mentioned processors, memories, communication interfaces, buses and the like, and the system resources in the TEE are mainly used by the computer device 1500 to execute the data management method provided by embodiments of the present application, which is not limited by embodiments of the present application.

[0216] It can be understood that, Figure 15 The computer device 1500 shown is only exemplary, and in the implementation process, the computer device 1500 can also include other components, which are not listed one by one herein. The Figure 15 The computer device 1500 shown can perform data management by executing all or part of the steps of the data management method provided by the above-mentioned embodiments.

[0217] Embodiments of the present application provide a computer readable storage medium, the computer readable storage medium stores a computer program, when the computer program is executed by a processor, all or part of the steps of the method provided by the above-mentioned method embodiment are realized.

[0218] Embodiments of the present application provide a computer program product containing instructions, when the computer program product runs on a computer, so that the computer executes all or part of the steps of the method provided by the above-mentioned method embodiment.

[0219] Embodiments of the present application provide a chip, the chip includes a programmable logic circuit and / or program instructions, when the chip runs to realize all or part of the steps of the method provided by the above-mentioned method embodiment.

[0220] Embodiments of the present application provide a data management system, the data management system at least includes a first processing node and a second processing node. In one possible implementation manner, the first processing node includes the data management apparatus 1300 as shown in Figure 13 The second processing node includes the data management apparatus 1400 as shown in Figure 14 In another possible implementation manner, at least one of the first processing node and the second processing node is the data management apparatus 1300 as shown in Figure 15The computer device 1500 shown.

[0221] Optionally, the data management system further comprises a storage node, and the first processing node is configured to send the data corresponding to the application to the second processing node through the storage node.

[0222] Optionally, the data management system further comprises a management node, and the management node is configured to perform cluster division on the processing nodes in the data management system in response to a cluster division instruction. The cluster division on the processing nodes in the data management system by the management node can obtain at least one cluster, and the cluster satisfies at least one of the following conditions: the business scenarios of the processing nodes in the cluster are the same; the number of the processing nodes in the cluster is less than a preset number; and the processing nodes in the cluster are in the same network topology.

[0223] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product including one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium of the computer, or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media, or semiconductor media (such as solid state disk) and the like.

[0224] In the present application, the terms "first" and "second" and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance. The term "at least one" refers to one or more, and "multiple" refers to two or more, unless otherwise explicitly limited. The term "and / or", only describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone.

[0225] The method embodiments and device embodiments provided by the embodiments of the present application can be mutually referred to, and the embodiments of the present application do not limit this. The order of operations of the method embodiments provided by the embodiments of the present application can be adjusted appropriately, and the operations can also be increased or decreased in response to the situation. Any person skilled in the art can easily think of a method of change within the technical range disclosed by the present application, which should be covered within the protection scope of the present application, and thus will not be described again.

[0226] In the corresponding embodiments provided by the present application, it should be understood that the disclosed apparatuses can be implemented by other configuration manners. For example, the apparatus embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, apparatuses or units, and can be electrical or other forms.

[0227] The units described as separated components can or can not be physically separated, and the components described as units can or can not be physical units, and can be located in one place or distributed on a plurality of network devices (for example, terminal devices). Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0228] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A data management method characterized by, A first processing node applied to a data management system, the data management system further comprising a second processing node, the method comprising: generating a secure storage key according to a first external key material corresponding to the first processing node; encrypting data corresponding to an application in the first processing node by using the secure storage key; sending the encrypted data to the second processing node, wherein a second external key material corresponding to the second processing node is the same as the first external key material, the first external key material is allocated to the first processing node by a key management node, the second external key material is allocated to the second processing node by the key management node, and the key management node allocates the same external key material to processing nodes in a same cluster.

2. The method of claim 1, wherein the generating the secure storage key according to the first external key material corresponding to the first processing node comprises: generating the secure storage key according to the first external key material, a first internal key material corresponding to the first processing node, or an application internal key material corresponding to the application, wherein a second internal key material corresponding to the second processing node is the same as the first internal key material.

3. The method of claim 2, wherein the first processing node is configured with a trusted operating system, the application comprises a trusted application, the first internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

4. The method of claim 3, wherein an execution environment of an operating system of the first processing node comprises a trusted execution environment (TEE), and the trusted operating system and the trusted application are both placed in the TEE.

5. The method of any one of claims 1 to 4, wherein before the generating the secure storage key according to the first external key material corresponding to the first processing node, the method further comprises: receiving the first external key material allocated by the key management node.

6. The method of claim 1, wherein the cluster satisfies at least one of the following conditions: processing nodes in the cluster have the same business scenario; a number of processing nodes in the cluster is less than a preset number; or processing nodes in the cluster are in a same network topology.

7. The method of claim 5, wherein the receiving the first external key material allocated by the key management node comprises: receiving encrypted first external key material sent by the key management node, wherein the encrypted first external key material is encrypted by the key management node based on a first encryption algorithm by using a first secure key, and the first secure key and the first encryption algorithm are held by the first processing node and the key management node.

8. The method of any one of claims 1 to 4, 6 to 7, wherein ​ ​ ​ ​ ​ ​ The sending of the encrypted data to the second processing node comprises: sending the encrypted data to a storage node, wherein the storage node is configured to send the encrypted data to the second processing node.

9. A data management method characterized by, The method applied to the second processing node in the data management system further comprises: receiving the encrypted data corresponding to the application sent by the first processing node; generating a secure storage key according to the second external key material corresponding to the second processing node, wherein the second external key material is the same as the first external key material corresponding to the first processing node, the first external key material is allocated by a key management node for the first processing node, the second external key material is allocated by the key management node for the second processing node, and the key management node allocates the same external key material for the processing nodes in the same cluster; decrypting the encrypted data corresponding to the application by using the secure storage key.

10. The method of claim 9, wherein the generating of the secure storage key according to the second external key material corresponding to the second processing node comprises: generating the secure storage key according to the second external key material, the second internal key material corresponding to the second processing node, or the application internal key material corresponding to the application, wherein the second internal key material is the same as the first internal key material corresponding to the first processing node.

11. The method of claim 10, wherein the second processing node is configured with a trusted operating system, the application comprises a trusted application, the second internal key material is the internal key material corresponding to the trusted operating system, and the application internal key material is the internal key material corresponding to the trusted application.

12. The method of any one of claims 9 to 11, wherein before the generating of the secure storage key according to the second external key material corresponding to the second processing node, the method further comprises: receiving the second external key material allocated by the key management node.

13. A data management apparatus characterized by comprising: The device applied to the first processing node in the data management system further comprises: an obtaining module configured to generate a secure storage key according to a first external key material corresponding to the first processing node; an encryption module configured to encrypt data corresponding to an application in the first processing node by using the secure storage key; a sending module configured to send the encrypted data to the second processing node, wherein a second external key material corresponding to the second processing node is the same as the first external key material, the first external key material is allocated by a key management node for the first processing node, the second external key material is allocated by the key management node for the second processing node, and the key management node allocates the same external key material for the processing nodes in the same cluster.

14. The device of claim 13, wherein The obtaining module is configured to generate a secure storage key according to the first external key material and a first internal key material corresponding to the first processing node or an application internal key material corresponding to the application, wherein a second internal key material corresponding to the second processing node is the same as the first internal key material.

15. The apparatus of claim 14, wherein, the first processing node is configured with a trusted operating system, the application comprises a trusted application, the first internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

16. The apparatus of claim 15, wherein, an execution environment of an operating system of the first processing node comprises a trusted execution environment (TEE), and the trusted operating system and the trusted application are both placed in the TEE.

17. The apparatus of any one of claims 13 to 16, wherein, The apparatus further comprises: a receiving module configured to receive the first external key material allocated by the key management node before the obtaining module generates the secure storage key according to the first external key material corresponding to the first processing node.

18. The apparatus of claim 13, wherein, the cluster satisfies at least one of the following conditions: processing nodes in the cluster have the same service scenario; the number of processing nodes in the cluster is less than a preset number; the processing nodes in the cluster are in the same network topology.

19. The apparatus of claim 17, wherein, the receiving module is configured to receive the encrypted first external key material sent by the key management node, wherein the encrypted first external key material is encrypted by the key management node based on a first encryption algorithm using a first secure key, and the first secure key and the first encryption algorithm are both held by the first processing node and the key management node.

20. The apparatus of any one of claims 13 to 16, 18 to 19, wherein, the sending module is configured to send the encrypted data to a storage node, and the storage node is configured to send the encrypted data to the second processing node.

21. A data management apparatus, characterized by comprising: The second processing node is applied to a data management system, and the data management system further comprises a first processing node. The apparatus comprises: a receiving module configured to receive application data corresponding to an application sent by the first processing node; an obtaining module configured to generate a secure storage key according to a second external key material corresponding to the second processing node, wherein the second external key material is the same as a first external key material corresponding to the first processing node, the first external key material is allocated by a key management node for the first processing node, the second external key material is allocated by the key management node for the second processing node, and the key management node allocates the same external key material for processing nodes in a same cluster; a decryption module configured to decrypt the application data corresponding to the application using the secure storage key.

22. The apparatus of claim 21, wherein the obtaining module is configured to generate a secure storage key based on the second external key material and a second internal key material corresponding to the second processing node or an application internal key material corresponding to the application, wherein the second internal key material is the same as a first internal key material corresponding to the first processing node.

23. The apparatus of claim 22, wherein the second processing node is configured with a trusted operating system, and the application comprises a trusted application, and the second internal key material is an internal key material corresponding to the trusted operating system, and the application internal key material is an internal key material corresponding to the trusted application.

24. The apparatus of any of claims 21 to 23, wherein the receiving module is further configured to receive the second external key material assigned by the key management node before the obtaining module generates the secure storage key based on the second external key material corresponding to the second processing node.

25. A computer device, comprising: a memory; and a processor; wherein the memory is configured to store a computer program; and the processor is configured to execute the computer program stored in the memory to implement the method of any of claims 1 to 8, or to implement the method of any of claims 9 to 12.

26. A computer-readable storage medium having a computer program stored therein, wherein the computer program is executed by a processor to implement the method of any of claims 1 to 8, or to implement the method of any of claims 9 to 12.

27. A system, comprising: a first processing node and a second processing node, wherein the first processing node comprises the data management apparatus of any of claims 13 to 20, and the second processing node comprises the data management apparatus of any of claims 21 to 24; or at least one of the first processing node and the second processing node is the computer device of claim 25.

25. A computer device, comprising:

28. The system of claim 27, further comprising: a storage node, wherein the first processing node is configured to send data corresponding to an application to the second processing node through the storage node.

29. The system of claim 27, further comprising: a management node, wherein the management node is configured to perform cluster division on processing nodes in the data management system in response to a cluster division instruction. ​ 26. A computer-readable storage medium, characterized in that, ​ 27. A data management system, characterized by ​ 28. The system of claim 27, wherein, ​ 29. The system of claim 27 or 28, wherein, ​

Images