Data processing method and system

Abstract

The embodiments of the present specification provide a data processing method and system, wherein the data processing method is applied to a server, and the server includes a storage management module and an encryption card, wherein the storage management module sends the data to be encrypted to the encryption card; the encryption card encrypts the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then saved; the data encryption key is encrypted by another key, comprising: the storage management module instructs the encryption card to encrypt the data encryption key using the other key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system; the storage management module sends the data to be decrypted to the encryption card.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to a data processing method. Background Art

[0002] In actual applications, the storage software in the server will encrypt or decrypt the data to ensure the security of the data. In the process of encrypting or decrypting the data by the storage software, due to the use of encryption algorithms, a secret key is required to complete the execution of the encryption algorithm (such as encryption or decryption), thereby further ensuring the security of the data. However, the secret key also has problems such as leakage, which will further increase the risk of data leakage and reduce the security of the data. Summary of the invention

[0003] In view of this, an embodiment of this specification provides a data processing method. One or more embodiments of this specification also relate to a data processing system, a computing device, a computer-readable storage medium, and a computer program to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a data processing method is provided, which is applied to a server, wherein the server includes a storage management module and an encryption card, wherein:

[0005] The storage management module sends the data to be encrypted to the encryption card;

[0006] The encryption card encrypts the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then stored;

[0007] The data encryption key is encrypted by another key, comprising: the storage management module instructs the encryption card to encrypt the data encryption key using the other key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system;

[0008] The storage management module sends the data to be decrypted to the encryption card.

[0009] According to a second aspect of the embodiments of this specification, a data processing system is provided, the system comprising a server and a key management system, the server comprising a storage management module and an encryption card, wherein:

[0010] The storage management module is configured to send the data to be encrypted to the encryption card;

[0011] The encryption card is configured to encrypt the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then stored;

[0012] The data encryption key is encrypted by another key, comprising: the storage management module instructs the encryption card to encrypt the data encryption key using the other key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system;

[0013] The storage management module is further configured to send the data to be decrypted to the encryption card.

[0014] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0015] Memory and processor;

[0016] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the data processing method applied to the storage management module are implemented, or the steps of the data processing method applied to the encryption card are implemented.

[0017] According to the fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps of the data processing method applied to the storage management module are implemented, or the steps of the data processing method applied to the encryption card are implemented.

[0018] According to the fifth aspect of the embodiments of this specification, a computer program is provided, wherein, when the computer program is executed in a computer, the computer is caused to execute the steps of the data processing method applied to the storage management module, or to execute the steps of the data processing method applied to the encryption card.

[0019] The data processing method provided in the present specification is applied to a server, and the server includes a storage management module and an encryption card, wherein the storage management module sends the data to be encrypted to the encryption card; the encryption card encrypts the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then saved; the data encryption key is encrypted by another key, including: the storage management module instructs the encryption card to encrypt the data encryption key using the other key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system; the storage management module sends the data to be decrypted to the encryption card.

[0020] Specifically, the method sends the data to be encrypted and the data to be decrypted to the encryption card through the storage management module, and the encryption card saves the data encryption key after being encrypted by another secret key, and encrypts and decrypts the encrypted data or the data to be decrypted, thereby realizing that the encryption card re-encrypts the data encryption key based on another secret key, thereby ensuring the security of the secret key, avoiding the occurrence of secret key leakage problems, further reducing the risk of data leakage caused by secret key leakage, and improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a schematic diagram of an application scenario of a data processing system provided by an embodiment of this specification;

[0022] Figure 2 is a flow chart of a data processing method provided by an embodiment of this specification;

[0023] Figure 3 is a processing flow chart of a data processing method provided by an embodiment of this specification;

[0024] Figure 4 is a structural diagram of a data processing system provided by an embodiment of this specification;

[0025] Figure 5 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0026] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0027] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0029] First, the terms involved in one or more embodiments of this specification are explained.

[0030] Storage software: refers to writing data in memory to disk, flash memory and other devices to achieve the purpose of long-term data preservation and retention. The storage software here can be a complete system deployed independently, or it can be a module or subsystem responsible for data storage in a large system such as a database.

[0031] Hardware cryptographic module: A hardware cryptographic module is a physical device with a cryptographic boundary. Its working scope is limited within the cryptographic boundary. It provides cryptographic technical capabilities for software, systems, and services outside the cryptographic boundary, including but not limited to cryptographic algorithms, key management, random number generation and other capabilities.

[0032] Encryption card: An encryption card is a specific type of hardware cryptographic module, which is generally inserted into the motherboard of the server in the form of a PCIE bus. It should be noted that in the data processing method and system provided in this specification, a hardware encryption card with a third-level cryptographic module qualification issued by an authoritative organization can be used to better achieve a better implementation effect.

[0033] Key management system: also known as secret key management system, is a system for key lifecycle management implemented by hardware or software. It can be an independent host, software system or service.

[0034] Key: Also known as secret key, it is the core concept of cryptography and one of the necessary parameters for executing a certain encryption algorithm. The security of the key determines the security of the data.

[0035] Storage encryption keys: Stores the keys that the software uses to encrypt data.

[0036] KEK: Key Encryption Key, a key used to encrypt the storage encryption key so that the storage encryption key is not saved in plain text.

[0037] In actual applications, the storage software in the server will encrypt or decrypt the data to ensure data security. In the process of encrypting or decrypting data, the storage software needs to use a key to complete the execution of the encryption algorithm (such as encryption or decryption) due to the use of encryption algorithms. Therefore, the key becomes the most sensitive and core object in the entire encryption process. The key needs to be used and protected safely to prevent unauthorized use of the key and prevent the key content from being leaked to attackers.

[0038] In the process of secure use and protection of keys by storage software, since the storage software needs to use storage encryption keys to encrypt data, from the perspective of key security, it is necessary to introduce additional mechanisms to protect the keys and manage the key life cycle, such as the generation, rotation, use and destruction of storage encryption keys, and the generation, rotation, use and destruction of KEKs.

[0039] Based on this, this specification provides a storage software plus key management system solution, which protects the security of the key through an additional mechanism. Specifically, the solution uses a key management system to jointly implement the secure management of the stored encryption key with the storage software. The specific workflow is as follows:

[0040] 1. After the storage software is started, first connect to the remote key management system.

[0041] 2. The storage software needs to use locally stored identity credentials (such as certificates and private keys) to authenticate on the key management system.

[0042] 3. After the storage software passes the identity authentication on the key management system, it obtains the KEK from the key management system.

[0043] 4. The storage software generates a storage encryption key, encrypts the storage encryption key with the KEK, and saves the ciphertext storage encryption key locally.

[0044] 5. When the storage software needs to use the storage encryption key to encrypt data, it needs to obtain the KEK from the key management system and decrypt the ciphertext storage encryption key to obtain the plaintext storage encryption key.

[0045] 6. Storage encryption keys are generally not rotated, but KEKs are rotated. The rotation of KEKs is handled by the key management system. When KEKs are rotated, when the storage software obtains a new KEK from the key management system, it needs to use the old KEK to decrypt the ciphertext storage encryption key, and then reuse the new KEK.

[0046] However, the disadvantages of this solution are:

[0047] 1. The storage system needs identity credentials to connect to the key management system, but the identity credentials are not managed securely.

[0048] 2. The storage encryption key is generally called directly by the storage software, and the encryption algorithm is calculated on the CPU. The security of storing the encryption key in the memory is not high.

[0049] Based on this, considering that the risk of data leakage will be further increased due to problems such as key leakage, the problem of reducing data security, and the defects of the above-mentioned storage software plus key management system solution. This specification provides a data processing method, which is applied to a server including a storage management module and an encryption card. Specifically, the data to be encrypted and the data to be decrypted are sent to the encryption card through the storage management module; and the encryption card itself holds a data encryption key, which is a key that the encryption card encrypts and saves based on another key obtained from the key management system. Therefore, after receiving the data to be encrypted and the data to be decrypted sent by the storage management module, the encryption card can encrypt and decrypt the data to be encrypted and the data to be decrypted based on the data encryption key to obtain encrypted data and decrypted data. Thereby, while ensuring the security of the key and avoiding the occurrence of the key leakage problem, the risk of data leakage caused by the key leakage is further reduced, and the security of the data is improved. In addition, this specification provides a data processing method, which introduces an encryption card and deeply combines the encryption card and the storage management module, thereby avoiding the defects of the above-mentioned storage software plus key management system solution, solving the security of the key management system identity credentials and storage encryption keys, and can improve the performance of the storage software when executing encryption algorithm operations.

[0050] Specifically, in this specification, a data processing method is provided. This specification also relates to a data processing system, a computing device, a computer-readable storage medium and a computer program, which are described in detail one by one in the following embodiments.

[0051] Figure 1 A schematic diagram of an application scenario of a data processing system provided according to an embodiment of this specification is shown. Figure 1It can be seen that the data processing system provided in this specification introduces a hardware encryption card in the storage server and deeply combines the encryption card with the storage software, thereby solving the security of the key management system identity credentials and storage encryption keys, and can improve the performance of the storage software when executing encryption algorithm operations.

[0052] Specifically, the workflow of the data processing system is divided into three stages: initialization stage, key rotation stage and use stage. The initialization stage refers to the stage in which the storage software performs necessary preparations before encrypting and decrypting data, mainly including identity authentication from the key management system and obtaining KEK, etc. Figure 1 The steps between the storage software and the key management system to obtain the KEK based on the credentials.

[0053] Among them, the key rotation phase refers to the process in which the KEK rotates and the initialization phase needs to be re-executed; this process is generally included in the initialization process. The specific process includes: after the storage software receives the KEK, it calls the encryption card interface and writes the KEK into the encryption card. Figure 1 The steps of KEK storage between the storage software and the encryption card.

[0054] Subsequently, the encryption card uses the KEK to encrypt the existing stored encryption key in the encryption card.

[0055] In addition, after the storage software sends the KEK to the encryption card, if the encryption card does not have an existing storage encryption key, the encryption card returns a message M1 to the storage software. The storage software key is a key generated by the storage software based on the encryption card and used to encrypt and decrypt data.

[0056] If the storage software determines that the encryption card returns the message M1, it calls the encryption card related interface to instruct the encryption card to generate a new storage encryption key. Then the storage software instructs the encryption card to use the KEK to encrypt the newly generated storage encryption key.

[0057] The use phase refers to the process in which the storage software, after being successfully initialized, uses the encryption card hardware to encrypt or decrypt the data to be encrypted or decrypted and obtains the corresponding ciphertext or plaintext, that is, Figure 1 The steps of encryption and decryption operations between the storage software and the encryption card.

[0058] Based on this, the data processing system provided in this specification, while using an external key management system such as a hardware encryption machine / key management system, introduces a local encryption card for storage software to protect security. Since the key is protected in the local encryption card, the external application (i.e. storage software) cannot directly read the key content, so the use of the key (i.e. encryption and decryption operations) must be performed in the local encryption card and cannot be calculated on the CPU, which also improves the performance of cryptographic calculations.

[0059] At the same time, key rotation is an important part of the modern key management system, which can further reduce the risk of key leakage. The data processing system provided in this specification rotates the KEK instead of the storage encryption key based on the characteristics of storage data encryption. It also saves the performance overhead of frequent encryption and decryption of massive data.

[0060] Figure 2 A flow chart of a data processing method provided according to an embodiment of the present specification is shown. The data processing method is applied to a server, and the server includes a storage management module and an encryption card. The method specifically includes the following steps.

[0061] Step 202: The storage management module sends the data to be encrypted to the encryption card.

[0062] Among them, the server can be understood as a storage server for storing data; the storage management module can be understood as a module in the server for performing storage management on data. For example, the storage management module can be storage software, and the stored data can be managed through the storage software in the storage server, or the storage management module is a hardware device in the storage server that implements the data storage management function, etc.

[0063] It should be noted that, in an embodiment provided in this specification, the storage management module can receive a data processing request and obtain the data to be encrypted or the data to be decrypted from the data processing request; the data processing request can be understood as a request received by the storage management module for processing data, such as a data read request, a data write request, a data encryption request, a data decryption request, etc. In actual applications, when the storage software receives a data encryption request, it will perform a data encryption operation through the encryption card; when the storage software receives a data decryption request, it will perform a data decryption operation through the encryption card; when the storage software receives a data read request, it will respond to the data read request and perform a decryption operation on the encrypted data to be read through the encryption card, and then perform a data read operation on the decrypted data to be read; when the storage software receives a data write request, it will respond to the data write and read request and perform an encryption operation on the data to be written carried in the data write and read request through the encryption card, and then perform a data write operation on the encrypted data to be read.

[0064] The data to be encrypted includes but is not limited to text data, multimedia data, files, logs and other data that need to be encrypted. This specification does not impose any specific restrictions on the data to be encrypted.

[0065] Specifically, the storage management module can obtain the data to be encrypted and send the data to be encrypted to the encryption card. The storage management module can obtain the data to be encrypted or the data to be decrypted in the following manner: the storage management module in the server can receive a data processing request sent by a data processing instruction object, wherein the data processing instruction object can be understood as an object that needs to encrypt the data to be encrypted or decrypt the data to be decrypted, and the data processing instruction object includes but is not limited to other servers, terminals, platforms, systems, programs, etc., and is not specifically limited here.

[0066] Afterwards, the storage management module can determine the data to be encrypted that needs to be encrypted or the data to be decrypted that needs to be decrypted based on the data processing request, and send the data to be encrypted or the data to be decrypted to the encryption card.

[0067] The following takes the application of the data processing method in the data storage encryption and decryption scenario as an example to further illustrate that the storage management module sends the encrypted data to the encryption card. Among them, the server is a storage server, and the storage management module is the storage software in the storage server.

[0068] Based on this, in the case where the data processing request is a data encryption request, the storage software will determine the data to be encrypted in response to the data encryption request when receiving the data encryption request. The data to be encrypted can be the data carried in the data encryption request, the data stored locally by the storage software and need to be encrypted, or the data stored in the storage server and need to be encrypted. This specification does not make specific limitations on this.

[0069] After the storage software determines the data to be encrypted in response to the data encryption request, the storage software sends the data to be encrypted to the encryption card.

[0070] In an embodiment provided in this specification, when the data processing request is a data decryption request, the storage software will determine the data to be decrypted in response to the data decryption request when receiving the data decryption request. The data to be decrypted may be the data carried in the data decryption request, the data stored locally by the storage software and needing to be decrypted, or the data stored in the storage server and needing to be decrypted. This specification does not specifically limit this.

[0071] After the storage software determines the data to be decrypted in response to the data decryption request, the storage software sends the data to be decrypted to the encryption card.

[0072] Step 204: The encryption card encrypts the data to be encrypted based on the data encryption key, wherein the data encryption key is encrypted by another key and then saved; the data encryption key is encrypted by another key including: the storage management module instructs the encryption card to use the other key to encrypt the data encryption key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system.

[0073] Among them, the data encryption key can be understood as a key that can encrypt the encrypted data or decrypt the decrypted data. For example, the above-mentioned storage encryption key, the storage encryption key is stored in the encryption card. It should be noted that the data encryption key is encrypted and stored by another key obtained from the key management system by the encryption card. The key management system can be understood as a system that provides another key to the storage management module. The key management system can exist independently of the server. For example, the key management system can be the above-mentioned key management system.

[0074] The other key may be understood as a key of the key management system that can encrypt the data encryption key; for example, the other key may be a KEK.

[0075] Using the above example, after the storage software sends the encrypted data to be encrypted to the encryption card, the encryption card encrypts the encrypted data by storing the encrypted data to obtain the ciphertext data. Afterwards, the storage software can obtain the corresponding ciphertext data from the encryption card, or receive the ciphertext data sent by the encryption card.

[0076] It should be noted that the storage encryption data is encrypted by the KEK and stored in the encryption card, and the storage encryption data is encrypted by the KEK including: the storage software instructs the encryption card to use the KEK to encrypt the storage encryption key; wherein the KEK is obtained by the storage software from the key management system. The encryption card encrypts the storage encryption key by the KEK based on the instruction of the storage software.

[0077] In practical applications, in order to avoid the negative impact of key leakage on data security, the data processing method provided in this manual ensures the security of the data encryption key by encrypting the data encryption key based on another key through the encryption card, avoids the occurrence of data encryption key leakage, further reduces the risk of data leakage caused by data encryption key leakage, and improves data security.

[0078] After the initialization phase is completed, the storage management module determines that there is a data encryption key in the storage management module, so that the data can be encrypted or decrypted later. The initialization phase can be understood as: the phase in which the storage software performs necessary preparations before the data needs to be encrypted or decrypted. The initialization process mainly includes identity authentication from the key management system and obtaining the KEK. Specifically, the storage management module instructs the encryption card to use the other key to encrypt the data encryption key, including:

[0079] The storage management module requests the other key from the key management system, and receives the other key sent by the key management system;

[0080] The other key is sent to the encryption card, and the encryption card is instructed to encrypt the data encryption key using the other key.

[0081] Continuing with the above example, during the initialization process, the storage software will request the key management system to obtain the KEK, and the key management system will return the KEK to the storage software. The storage software will then send the KEK to the encryption card, instructing the encryption card to encrypt the saved storage encryption key using the KEK, thereby ensuring the security of the storage encryption key and avoiding leakage of the storage encryption key.

[0082] Furthermore, in the embodiment provided in this specification, the key management system shall authenticate the storage software when sending the KEK to the storage software, and send the KEK to the storage software only when the authentication is passed, thereby ensuring the security of the storage encryption key and avoiding security issues caused by KEK leakage. At the same time, in order to ensure the security of the identity credential, the storage management module will store the identity credential in the encryption card. Specifically, the storage management module requests another key from the key management system, and sends the other key sent by the key management system to the encryption card, including:

[0083] The storage management module reads the identity credential from the encryption card and requests another key from the key management system based on the identity credential;

[0084] The other key is received when the key management system determines that the identity authentication for the identity credential is passed and the storage management module meets the key sending condition.

[0085] Among them, the identity credential can be understood as the information corresponding to the storage management module and used for identity authentication of the key management system. The identity credential includes but is not limited to certificates, private keys, etc., and this manual does not make specific restrictions on this.

[0086] Among them, in one embodiment provided in this specification, the key sending condition includes:

[0087] The key management system does not send the other key to the storage management module; or

[0088] The key management system determines that the time difference between the key sending time corresponding to the storage management module and the current time is greater than a preset time threshold, wherein the key sending time is the time when the key management system sends the other key to the storage management module.

[0089] The preset time threshold may be set according to actual application scenarios, and this specification does not impose any specific restrictions on this. For example, the preset time threshold may be one month, one week, etc.

[0090] Continuing with the above example, the key sending conditions include: the key management system determines based on historical key sending records that it has not sent a KEK to the storage software; or the key management system has sent a KEK to the storage software, but the time difference between the time of sending the KEK and the current time is greater than a preset time threshold of one month; that is, the KEK has expired.

[0091] Based on this, determining that the storage management module meets the key sending conditions can be understood as the key management system determining that the storage software meets the key sending conditions when it determines that the KEK has never been sent to the storage software; or the key management system has sent a KEK to the storage software, but when it is determined that the time difference between the time of sending the KEK and the current time is greater than a preset time threshold of one month, it determines that the storage software meets the key sending conditions.

[0092] Specifically, during the initialization process, the storage management module first obtains its own identity certificate from the encryption card, and sends the identity certificate to the key management system to request to obtain the other key.

[0093] After receiving the identity credentials sent by the storage management module, the key management system authenticates the identity credentials and, if the identity authentication is successful, determines whether the storage management module meets the key sending conditions. If it is determined that the storage management module meets the key sending conditions, another key is sent to the storage management module; subsequently, the storage management module can receive the other key.

[0094] Continuing with the above example, the storage software needs to perform an initialization phase before performing data encryption or decryption. The initialization node is that after the storage software is started, it will obtain its own corresponding identity credentials (such as a digital certificate and its corresponding private key) from the encryption card, and send the identity credentials to the key management system connected to the storage software. Among them, the process of obtaining the corresponding identity credentials from the encryption card includes: when the storage software executes the initialization phase, it will send an identity credential acquisition request to the encryption card, and the encryption card will send the storage software's identity credentials to the storage software based on the identity credential acquisition request, thereby realizing that the storage software reads the identity credentials from the encryption card when executing the initialization phase.

[0095] The key management system uses the identity credential to authenticate the storage module, wherein the key management system may authenticate the storage module in any manner that can implement identity authentication based on the identity credential, and this specification does not impose any specific restrictions on this.

[0096] If the identity authentication is passed, the key management system determines the status of the current KEK corresponding to the storage software. If it is determined that the current KEK of the storage software does not exist or needs to be rotated, a new KEK is returned to the storage software to facilitate the subsequent rotation phase based on the KEK. The need for rotation can be understood as the storage software has a corresponding KEK, but the KEK has expired and needs to be updated with a new KEK.

[0097] In one embodiment provided in this specification, in order to ensure the security of the data encryption key, the encryption card will encrypt the data encryption key using another key under the instruction of the storage management module. Specifically, the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module, including:

[0098] In response to the instruction of the storage management module, the encryption card encrypts the data encryption key based on the other key when it is determined that the data encryption key exists.

[0099] Continuing with the above example, the encryption card receives the KEK sent by the storage management module and the key encryption instruction sent by the storage management module; the encryption card then responds to the key encryption instruction, and when it determines that it has the data encryption key stored, encrypts the data encryption key based on the KEK.

[0100] Further, in the data processing method provided in this specification, when the storage software determines that the KEK needs to be rotated during the initialization phase, in order to ensure the validity of the KEK and further ensure the security of the target encryption key obtained after encrypting the encryption key based on the KEK, the storage software will perform a rotation operation (i.e., a key rotation phase). Specifically, encrypting the data encryption key based on the other key includes:

[0101] The encryption card determines a historical key corresponding to the data encryption key, wherein the historical key is a key used to encrypt the data encryption key in the past;

[0102] The data encryption key is decrypted based on the historical key, and the decrypted data encryption key is encrypted using the other key.

[0103] The historical key can be understood as another key that has been used in the encryption card to encrypt the data encryption key and has expired, for example, an expired KEK.

[0104] Specifically, when the encryption card receives another key sent by the storage management module, it can determine its own historical key, and decrypt the data encryption key based on the historical key to obtain the plaintext data encryption key; then re-encrypt the data encryption key based on the other key to ensure the security of the data encryption key. After completing the above steps, the encryption card will delete the historical key.

[0105] Continuing with the above example, during the key (KEK) rotation phase, the storage software will receive the KEK and call the encryption card's interface. After writing the KEK to the encryption card, if the encryption card determines that it has a storage encryption key encrypted by the expired KEK, it will determine to encrypt the existing storage encryption key this time. The encryption card needs to use the previous KEK (i.e., the historical key) to decrypt the encrypted storage encryption key, and re-encrypt the decoded storage encryption key through the KEK, thereby ensuring the security of the storage encryption key.

[0106] In addition, if the encryption card determines that it does not have the storage encryption key encrypted by the KEK, the encryption card needs to use the received KEK to encrypt the storage, thereby ensuring the security of the storage encryption key.

[0107] In actual applications, the encryption card may not have a storage encryption key. In this case, the encryption card needs to send a key creation notification to the storage software, and the storage module calls the encryption card related interface based on the notification to instruct the encryption card to generate a new storage encryption key. Specifically, the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module, including:

[0108] The encryption card, in response to an instruction of the storage management module, sends a key generation notification to the storage management module when it is determined that the data encryption key does not exist;

[0109] The storage management module, in response to the key generation notification, instructs the encryption card to generate the data encryption key by calling a key creation interface;

[0110] The encryption card generates the data encryption key based on the instruction of the storage management module, and encrypts the data encryption key by using the other key.

[0111] Continuing with the above example, in the rotation phase, the storage software receives the KEK and calls the interface of the encryption card to write the KEK into the encryption card. If the encryption card does not have a storage encryption key, the encryption card returns message M1 (i.e., key creation notification). If the storage software determines that the encryption card returns message M1, the storage software calls the encryption card related interface to instruct the encryption card to generate a new storage encryption key. Afterwards, the storage software instructs the encryption card to use the KEK to encrypt the newly generated storage encryption key, and the encryption card will encrypt the newly generated storage encryption key using the KEK according to the instructions of the storage software, thereby ensuring the security of the storage encryption key.

[0112] In one embodiment provided in this specification, during the initialization phase, the key management system needs to authenticate the storage software when sending the KEK to the storage software; however, if the authentication is passed and the storage software does not meet the key sending conditions, the new KEK will not be sent, but the storage software will be instructed to continue to use the previous KEK, thereby avoiding problems such as KEK leakage caused by frequent KEK sending. Specifically, the storage management module sends the encrypted data to the encryption card, including:

[0113] The storage management module reads the identity credential from the encryption card and requests another key from the key management system based on the identity credential;

[0114] Receiving a key availability notification sent by the key management system when it is determined that the identity credential is verified and the storage management module does not meet the key sending condition;

[0115] Based on the key availability notification, the data to be encrypted is sent to the encryption card.

[0116] Among them, the explanation of the identity certificate and the conditions for sending the secret key can be found in the above description, which will not be elaborated here.

[0117] Continuing with the above example, after the storage software is started, it obtains its own corresponding identity credentials (such as certificate / private key) and sends the identity credentials to the key management system connected to the storage software. The key management system uses this identity credential to authenticate the storage module. After the storage software successfully verifies the identity, the key management system determines the status of the current KEK corresponding to the storage software. When the key management system determines that the current KEK exists and is valid, it does not return any KEK, but returns a message M (i.e., key availability notification) indicating that the previous KEK will continue to be used. The storage software determines that the initialization phase is over based on the message M returned by the key management system; the storage software then sends the data to be encrypted to the encryption card and instructs the encryption card to encrypt the data to be encrypted.

[0118] In actual applications, after determining that the initialization phase is over, the storage software may also send the data to be decrypted to the encryption card and instruct the encryption card to decrypt the data to be decrypted.

[0119] Step 206: The storage management module sends the data to be decrypted to the encryption card.

[0120] Among them, the data to be decrypted includes but is not limited to encrypted text data, encrypted multimedia data, encrypted files, encrypted logs and other data that need to be decrypted. This specification does not make specific restrictions on the data to be decrypted; it should be noted that the interpretation and processing steps of the data to be decrypted can refer to the interpretation and processing steps of the data to be encrypted in the above embodiments, and this specification does not elaborate on this.

[0121] Specifically, after the storage management module sends the data to be decrypted to the encryption card, it also includes:

[0122] The encryption card decrypts the data to be decrypted based on the data encryption key, obtains the decrypted data, and returns the decrypted data to the storage management module.

[0123] Using the above example, after the storage software sends the data to be decrypted to the encryption card, the encryption card decrypts the decrypted data based on the stored encrypted data encrypted by the KEK to obtain the plaintext data (i.e., decrypted data). Subsequently, the storage software obtains the corresponding plaintext data from the encryption card, or receives the plaintext data sent by the encryption card.

[0124] The data processing method provided in this specification sends the data to be encrypted and the data to be decrypted to the encryption card through the storage management module, and the encryption card encrypts and decrypts the encrypted data or the data to be decrypted based on the data encryption key saved after being encrypted by another secret key, thereby realizing that the encryption card re-encrypts the data encryption key based on another secret key, thereby ensuring the security of the secret key, avoiding the occurrence of the secret key leakage problem, further reducing the risk of data leakage caused by the secret key leakage, and improving the security of the data

[0125] The following combination Figure 3 , taking the application of the data processing method provided in this specification in the data storage encryption scenario as an example, the data processing method is further described. Figure 3 A processing flow chart of a data processing method provided by an embodiment of the present specification is shown. The data processing method includes an initialization phase, a rotation phase and a use phase, and specifically includes the following steps.

[0126] Step 302: After the storage software is started, it reads the identity certificate from the encryption card.

[0127] Step 304: The storage software sends the identity credentials to the key management system for identity verification.

[0128] Step 306: When the identity credential verification is successful, the key management system determines the KEK corresponding to the storage software and determines the current state of the KEK.

[0129] Step 308 : The key management system determines whether the current KEK exists and is valid based on the current state. If so, step 310 is executed; if not, step 314 is executed.

[0130] Step 310: The key management system returns a message M to the storage software.

[0131] Specifically, the key management system determines based on the current state that if the current KEK exists and is valid, no KEK is returned to the storage software, but a message M indicating that the previous KEK continues to be used is returned.

[0132] Step 312: After receiving the message M, the storage software determines that the initialization phase is finished and executes step 328.

[0133] Specifically, the storage software determines that the current KEK exists and is valid based on the message M returned by the key management system, and then continues to use the previous KEK to encrypt and decrypt the data.

[0134] Step 314: The key management system returns a new KEK to the storage software.

[0135] Step 316: The storage software receives the new KEK and calls the encryption card interface to write the KEK into the encryption card.

[0136] Specifically, after receiving the new KEK returned by the key management system, the storage software enters the key rotation phase; the KEK is written into the encryption card by calling the interface of the encryption card.

[0137] Step 318: The encryption card determines whether the encryption key is stored locally. If so, execute step 326; otherwise, execute step 320.

[0138] Step 320: The encryption card returns a message M1 to the storage software.

[0139] Step 322: When the storage software receives the message M1 returned by the encryption card, it calls the relevant interface of the encryption card to send a key generation instruction to the encryption card.

[0140] The key generation instruction may be understood as an instruction for instructing the encryption card to generate a new storage encryption key.

[0141] Step 324: The encryption card generates a new storage encryption key based on the key generation instruction.

[0142] Step 326: The encryption card encrypts the storage encryption key using the new KEK based on the instruction of the storage software.

[0143] In actual applications, the encryption card can use the new KEK to encrypt the newly generated storage encryption key.

[0144] Alternatively, if the encryption card is encrypting an existing storage encryption key, the previously encrypted storage encryption key needs to be decrypted using the previous KEK, and then the decrypted storage encryption key is encrypted using the new KEK. At the same time, after the encryption of the storage encryption key is completed, the previously rotated KEK is destroyed.

[0145] Step 328: The storage software sends the data to be encrypted or decrypted to the encryption card.

[0146] Step 330: The encryption card encrypts or decrypts the data to be encrypted or decrypted based on the stored encryption key to obtain corresponding ciphertext data or plaintext data.

[0147] The storage encryption key is encrypted by the KEK and stored in the encryption card.

[0148] Step 332: The storage software obtains the corresponding ciphertext or plaintext data from the encryption card.

[0149] In addition, in the data processing method provided in this specification, the ciphertext and the storage encryption key can be stored in the encryption card. It should be noted that the step of "storing the ciphertext and the storage encryption key in the encryption card" can be understood as storing the ciphertext and the storage encryption key in the internal chip of the encryption card, wherein the encryption card is configured with a storage unit (e.g., cache, register, etc.) for storing the ciphertext and the storage encryption key.

[0150] Alternatively, in the data processing method provided in this specification, the ciphertext and storage encryption key can be stored in the service disk. In addition, it should be noted that the above steps of storing the ciphertext and storage encryption key in the encryption card or storing the ciphertext and storage encryption key in the service disk depend on the model and working mode of the encryption card. For encryption cards of different models or different working modes, the above two methods can be selected to store the ciphertext and storage encryption key.

[0151] The data processing method provided in this specification uses an external key management system such as a hardware encryption machine / key management system, and introduces a local encryption card for storage software to protect security. Since the key is protected in the local encryption card, the external application (i.e., storage software) cannot directly read the key content. Therefore, the use of the key (i.e., encryption and decryption operations) must be performed in the local encryption card and cannot be calculated on the CPU, which also improves the performance of cryptographic calculations.

[0152] At the same time, key rotation is an important part of the modern key management system, which can further reduce the risk of key leakage. The data processing system provided in this specification rotates the KEK instead of the storage encryption key based on the characteristics of storage data encryption. It also saves the performance overhead of frequent encryption and decryption of massive data.

[0153] Corresponding to the above method embodiment, this specification also provides a data processing system embodiment. Figure 5 FIG. 1 shows a schematic diagram of a data processing system provided by an embodiment of the present specification. Figure 4 As shown, the system includes a server and a key management system, wherein the server includes a storage management module 402 and an encryption card 404, wherein:

[0154] The storage management module 402 is configured to send the data to be encrypted to the encryption card 404;

[0155] The encryption card 404 is configured to encrypt the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then stored;

[0156] The data encryption key is encrypted by another key, including: the storage management module 402 instructs the encryption card 404 to encrypt the data encryption key using the other key; the encryption card 404 encrypts the data encryption key based on the other key based on the instruction of the storage management module 402; wherein the other key is sent to the storage management module 402 by the key management system;

[0157] The storage management module 402 is further configured to send the data to be decrypted to the encryption card 404 .

[0158] Optionally, the storage management module 402 is further configured to:

[0159] Requesting the other key from the key management system, and receiving the other key sent by the key management system;

[0160] The other key is sent to the encryption card 404, and the encryption card 404 is instructed to use the other key to encrypt the data encryption key.

[0161] Optionally, the storage management module 402 is further configured to:

[0162] Reading the identity credential from the encryption card 404, and requesting another key from the key management system based on the identity credential;

[0163] The other key sent by the key management system is received when it is determined that the identity authentication for the identity credential is passed and the storage management module 402 meets the key sending condition.

[0164] Optionally, the encryption card 404 is further configured to:

[0165] In response to the instruction of the storage management module 402, when it is determined that the data encryption key exists, the data encryption key is encrypted based on the other key.

[0166] Optionally, the encryption card 404 is further configured to:

[0167] Determine a historical key corresponding to the data encryption key, wherein the historical key is a key used to encrypt the data encryption key in the past;

[0168] The data encryption key is decrypted based on the historical key, and the decrypted data encryption key is encrypted using the other key.

[0169] Optionally, the encryption card 404 is further configured to: in response to an instruction of the storage management module 402, when it is determined that the data encryption key does not exist, send a key generation notification to the storage management module 402;

[0170] The storage management module 402 is further configured to: in response to the key generation notification, instruct the encryption card 404 to generate the data encryption key by calling the key creation interface;

[0171] The encryption card 404 is further configured to generate the data encryption key based on the instruction of the storage management module 402, and encrypt the data encryption key by using the other key.

[0172] Optionally, the storage management module 402 is further configured to:

[0173] Reading the identity credential from the encryption card 404, and requesting another key from the key management system based on the identity credential;

[0174] Receiving a key availability notification sent by the key management system when it is determined that the identity credential is verified and the storage management module 402 does not meet the key sending condition;

[0175] Based on the key availability notification, the data to be encrypted is sent to the encryption card 404 .

[0176] Optionally, the key sending condition includes:

[0177] The key management system does not send the other key to the storage management module 402; or

[0178] The key management system determines that the time difference between the key sending time corresponding to the storage management module 402 and the current time is greater than a preset time threshold, wherein the key sending time is the time when the key management system sends the other key to the storage management module 402.

[0179] Optionally, the encryption card 404 is further configured to:

[0180] The data to be decrypted is decrypted based on the data encryption key to obtain decrypted data, and the decrypted data is returned to the storage management module 402 .

[0181] The data processing system provided in the present specification sends the data to be encrypted and the data to be decrypted to the encryption card through the storage management module, and the encryption card encrypts and decrypts the encrypted data or the data to be decrypted based on the data encryption key saved after being encrypted by another secret key, thereby realizing that the encryption card re-encrypts the data encryption key based on another secret key, thereby ensuring the security of the secret key, avoiding the occurrence of the secret key leakage problem, further reducing the risk of data leakage caused by the secret key leakage, and improving the security of the data.

[0182] The above is a schematic scheme of a data processing system of this embodiment. It should be noted that the technical scheme of the data processing system and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the data processing system can be referred to the description of the technical scheme of the above data processing method.

[0183] Figure 5 The structure block diagram of a computing device 500 provided according to an embodiment of the present specification is shown. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0184] The computing device 500 also includes an access device 540 that enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0185] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0186] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 500 may also be a mobile or stationary server.

[0187] The processor 520 is used to execute the following computer executable instructions, which, when executed by the processor 520, implement the steps of the data processing method applied to the storage management module, or implement the steps of the data processing method applied to the encryption card.

[0188] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above data processing method.

[0189] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the data processing method applied to the storage management module, or implement the steps of the data processing method applied to the encryption card.

[0190] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above data processing method.

[0191] An embodiment of the present specification also provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the data processing method applied to the storage management module, or execute the steps of the data processing method applied to the encryption card.

[0192] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computer program can be referred to the description of the technical scheme of the above data processing method.

[0193] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0194] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0195] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0196] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0197] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data processing method, applied to a server, wherein the server comprises a storage management module and an encryption card, wherein: The storage management module sends the data to be encrypted to the encryption card; The encryption card encrypts the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then stored; The data encryption key is encrypted by another key, including: the storage management module instructs the encryption card to use the other key to encrypt the data encryption key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system when the storage management module passes the identity authentication; The storage management module sends the data to be decrypted to the encryption card.

2. The data processing method according to claim 1, wherein the storage management module instructs the encryption card to use the other key to encrypt the data encryption key, comprising: The storage management module requests the other key from the key management system, and receives the other key sent by the key management system; The other key is sent to the encryption card, and the encryption card is instructed to encrypt the data encryption key using the other key.

3. The data processing method according to claim 2, wherein the storage management module requests the other key from the key management system and receives the other key sent by the key management system, comprising: The storage management module reads the identity credential from the encryption card and requests another key from the key management system based on the identity credential; The other key is received when the key management system determines that the identity authentication for the identity credential is passed and the storage management module meets the key sending condition.

4. The data processing method according to claim 1, wherein the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module, comprising: In response to the instruction of the storage management module, the encryption card encrypts the data encryption key based on the other key when it is determined that the data encryption key exists.

5. The data processing method according to claim 4, wherein encrypting the data encryption key based on the other key comprises: The encryption card determines a historical key corresponding to the data encryption key, wherein the historical key is a key used to encrypt the data encryption key in the past; The data encryption key is decrypted based on the historical key, and the decrypted data encryption key is encrypted using the other key.

6. The data processing method according to claim 1, wherein the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module, comprising: The encryption card, in response to an instruction of the storage management module, sends a key generation notification to the storage management module when it is determined that the data encryption key does not exist; The storage management module, in response to the key generation notification, instructs the encryption card to generate the data encryption key by calling a key creation interface; The encryption card generates the data encryption key based on the instruction of the storage management module, and encrypts the data encryption key by using the other key.

7. The data processing method according to claim 1, wherein the storage management module sends the data to be encrypted to the encryption card, comprising: The storage management module reads the identity credential from the encryption card and requests another key from the key management system based on the identity credential; Receiving a key availability notification sent by the key management system when it is determined that the identity credential is verified and the storage management module does not meet the key sending condition; Based on the key availability notification, the data to be encrypted is sent to the encryption card.

8. The data processing method according to claim 3 or 7, wherein the key sending condition comprises: The key management system does not send the other key to the storage management module; or The key management system determines that the time difference between the key sending time corresponding to the storage management module and the current time is greater than a preset time threshold, wherein the key sending time is the time when the key management system sends the other key to the storage management module.

9. The data processing method according to claim 1, after the storage management module sends the data to be decrypted to the encryption card, further comprises: The encryption card decrypts the data to be decrypted based on the data encryption key, obtains the decrypted data, and returns the decrypted data to the storage management module.

10. A data processing system, the system comprising a server and a key management system, the server comprising a storage management module and an encryption card, wherein: The storage management module is configured to send the data to be encrypted to the encryption card; The encryption card is configured to encrypt the data to be encrypted based on a data encryption key, wherein the data encryption key is encrypted by another key and then stored; The data encryption key is encrypted by another key, including: the storage management module instructs the encryption card to use the other key to encrypt the data encryption key; the encryption card encrypts the data encryption key based on the other key based on the instruction of the storage management module; wherein the other key is sent to the storage management module by the key management system when the storage management module passes the identity authentication; The storage management module is further configured to send the data to be decrypted to the encryption card.

11. A computer program product, characterized in that The method comprises computer instructions which, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 9.

Images