Key management service system, key management method, gateway and device

Abstract

The embodiment of the present invention provides a key management service system, a key management method, a gateway and a device. The system includes: a key management service KMS gateway and at least one exclusive KMS connected to the KMS gateway; the KMS gateway is used to obtain a key management request, and when the key management request corresponds to an exclusive KMS, the key management request is forwarded to the exclusive KMS; the exclusive KMS is used to receive the key management request, call the exclusive cryptographic machine resource pool corresponding to the exclusive KMS based on the key management request, and perform key management operations using the exclusive cryptographic machine resource pool. The technical solution provided in this embodiment forwards the key management request to the exclusive KMS through the KMS gateway when the key management request corresponds to the exclusive KMS, and then performs key management operations through the exclusive cryptographic machine resource pool, ensuring that the entire operation of key calculation and storage is exclusive, and improving the security and compliance of key storage and operation.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a key management service system, a key management method, a gateway and a device. Background Art

[0002] Key Management Service (KMS) is a one-stop key management and data encryption service platform. Because it can provide simple, reliable, secure and compliant data encryption protection capabilities, KMS can help users greatly reduce the procurement, operation and maintenance, and R&D expenses on cryptographic infrastructure and data encryption and decryption products, so that users only need to focus on the data processing operations themselves.

[0003] With the advent of the big data era, enterprise-level users on the cloud have increasingly clear demands for their own data security and data compliance. In order to meet users' data security and data compliance needs, related technologies provide a way to implement password management services, which mainly directly accesses users' cloud encryption machine instances through a shared KMS gateway.

[0004] However, in the process of using the above system for key storage and key calculation, part of the key calculation may be performed on the shared KMS gateway. In this way, for users, the key calculation part is shared. For users who are sensitive to key security and compliance, they may question the security and compliance of key storage and key calculation. In addition, in order to access the user's cloud encryption machine instance, a specific software development kit (Software Development Kit, referred to as SDK) is required. The above SDK for accessing the cloud encryption machine instance is often not unified with the SDK for directly accessing the cloud encryption machine instance through the shared KMS gateway. At this time, two SDKs may be used in the same application, and then the user needs to maintain two SDKs in one application, which will increase the user's key service maintenance and management costs. Summary of the invention

[0005] The embodiments of the present invention provide a key management service system, a key management method, a gateway and a device, which can ensure that the entire operation of key calculation and storage is exclusive, thereby improving the security and compliance of key storage and operation.

[0006] In a first aspect, an embodiment of the present invention provides a key management service system, comprising: a key management service KMS gateway and at least one dedicated KMS in communication with the KMS gateway; wherein:

[0007] The KMS gateway is used to obtain a key management request, and when the key management request corresponds to a dedicated KMS, forward the key management request to the dedicated KMS;

[0008] The dedicated KMS is used to receive the key management request, call the dedicated cryptographic machine resource pool corresponding to the dedicated KMS based on the key management request, and use the dedicated cryptographic machine resource pool to perform key management operations.

[0009] In a second aspect, an embodiment of the present invention provides a key management method, which is applied to a key management service KMS gateway, wherein the KMS gateway is communicatively connected to a shared KMS and at least one dedicated KMS; the method comprises:

[0010] Get key management request;

[0011] Identifying, by the shared KMS, whether the key management request corresponds to a dedicated KMS;

[0012] When the key management request corresponds to a dedicated KMS, the key management request is forwarded to the corresponding dedicated KMS.

[0013] In a third aspect, an embodiment of the present invention provides a key management service gateway, wherein the key management service KMS gateway is communicatively connected to a shared KMS and at least one dedicated KMS; the KMS gateway includes:

[0014] A first acquisition module, used to acquire a key management request;

[0015] A first identification module, configured to identify, through the shared KMS, whether the key management request corresponds to a dedicated KMS;

[0016] The first processing module is used to forward the key management request to the corresponding dedicated KMS when the key management request corresponds to the dedicated KMS.

[0017] In a fourth aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the key management method in the above-mentioned second aspect.

[0018] In a fifth aspect, an embodiment of the present invention provides a computer storage medium for storing a computer program, wherein the computer program enables a computer to implement the key management method in the second aspect when executed.

[0019] In a sixth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program, which, when executed by a processor of an electronic device, enables the processor to execute the steps of the key management method in the second aspect above.

[0020] In a seventh aspect, an embodiment of the present invention provides a key management method, which is applied to a dedicated key management service KMS, wherein the dedicated KMS gateway is communicatively connected to a KMS gateway; the method comprises:

[0021] Receiving a key management request sent by the KMS gateway;

[0022] Based on the key management request, call the dedicated cryptographic machine resource pool corresponding to the dedicated KMS;

[0023] The dedicated cryptographic machine resource pool is used to perform key management operations.

[0024] In an eighth aspect, an embodiment of the present invention provides a dedicated key management service device, wherein the dedicated key management service device is communicatively connected to a key management service KMS gateway; the dedicated key management service device includes:

[0025] A second acquisition module is used to receive a key management request sent by the KMS gateway;

[0026] A second calling module is used to call the exclusive cryptographic machine resource pool corresponding to the exclusive KMS based on the key management request;

[0027] The second processing module is used to perform key management operations using the exclusive cryptographic machine resource pool.

[0028] In the ninth aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the key management method in the above-mentioned seventh aspect.

[0029] In a tenth aspect, an embodiment of the present invention provides a computer storage medium for storing a computer program, wherein the computer program implements the key management method in the seventh aspect when executed by a computer.

[0030] In the eleventh aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program, when the computer program is executed by a processor of an electronic device, the processor executes the steps in the key management method in the seventh aspect above.

[0031] In a twelfth aspect, an embodiment of the present invention provides a key management method, which is applied to a shared key management service KMS, wherein the shared KMS is communicatively connected to a KMS gateway; the method comprises:

[0032] Get key management requests through the KMS gateway;

[0033] Determining a user master key corresponding to the key management request;

[0034] The user master key is sent to the KMS gateway, so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

[0035] In a thirteenth aspect, an embodiment of the present invention provides a shared key management service device, wherein the shared key management service device is communicatively connected to a KMS gateway; the shared KMS includes:

[0036] The third acquisition module is used to obtain the key management request through the KMS gateway;

[0037] A third determining module, configured to determine a user master key corresponding to the key management request;

[0038] The third processing module is used to send the user master key to the KMS gateway, so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

[0039] In the fourteenth aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the key management method in the above-mentioned twelfth aspect.

[0040] In a fifteenth aspect, an embodiment of the present invention provides a computer storage medium for storing a computer program, wherein the computer program implements the key management method in the twelfth aspect when executed by a computer.

[0041] In the sixteenth aspect, an embodiment of the present invention provides a computer program product, comprising: a computer program, which, when executed by a processor of an electronic device, enables the processor to execute the steps of the key management method in the above-mentioned twelfth aspect.

[0042] The technical solution provided in this embodiment directly forwards the key management request to the exclusive KMS through the KMS gateway when the key management request corresponds to the exclusive KMS. Since the key management request is forwarded through the KMS gateway, there is no need to specifically configure the SDK for accessing the exclusive KMS gateway. This not only reduces the user's software maintenance cost, but also facilitates the user to access the exclusive KMS. In addition, after the exclusive KMS obtains the key management request, the corresponding key management operation is performed through the exclusive cryptographic machine resource pool corresponding to the user, which effectively realizes the ability to provide the user with an exclusive exclusive cryptographic machine resource pool, thereby ensuring that the entire computing and storage operations corresponding to the key management request are exclusive, which effectively improves the security and compliance of key storage and key operations, further improves the security and reliability of the use of the system, and is conducive to meeting the usage needs of different users. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1 A schematic diagram of the principle of a key management service system provided by an embodiment of the present invention;

[0045] Figure 2 A schematic diagram of the structure of a key management service system provided by an embodiment of the present invention Figure 1 ;

[0046] Figure 3 A schematic diagram of the structure of a key management service system provided by an embodiment of the present invention Figure 2 ;

[0047] Figure 4 A schematic diagram of the structure of a key management service system provided by an application embodiment of the present invention;

[0048] Figure 5 A schematic diagram of a key management method provided by an embodiment of the present invention;

[0049] Figure 6 A schematic diagram of a flow chart of another key management method provided by an embodiment of the present invention;

[0050] Figure 7 A flowchart of another key management method provided by an embodiment of the present invention;

[0051] Figure 8A schematic diagram of a key management method according to another embodiment of the present invention;

[0052] Fig. 9 A schematic diagram of the structure of a key management service gateway provided by an embodiment of the present invention;

[0053] Fig.10 For Fig. 9 A schematic diagram of the structure of an electronic device corresponding to the key management service gateway provided in the illustrated embodiment;

[0054] Fig.11 A structural diagram of a dedicated key management service device provided by an embodiment of the present invention;

[0055] Fig.12 For Fig.11 A schematic diagram of the structure of an electronic device corresponding to the dedicated key management service device provided in the illustrated embodiment;

[0056] Fig.13 A schematic diagram of a key management method according to another embodiment of the present invention;

[0057] Fig.14 A schematic diagram of the structure of a shared key management service device provided by an embodiment of the present invention;

[0058] Fig.15 For Fig.14 A schematic diagram of the structure of an electronic device corresponding to the shared key management service device provided in the illustrated embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two, but does not exclude the inclusion of at least one.

[0061] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0062] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0063] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such a product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0064] In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0065] Definition of terms:

[0066] Key Management Service (KMS): is a one-stop key management and data encryption service platform. Because it can provide simple, reliable, secure and compliant data encryption protection capabilities, KMS can help users greatly reduce the procurement, operation and maintenance, and R&D expenses on cryptographic infrastructure and data encryption and decryption products, so that users only need to focus on the data processing operations themselves.

[0067] Dedicated KMS: A private key management service on the cloud that is exclusively for the user side. Users can fully control their own dedicated KMS to achieve user-side data encryption and cloud product integration. The key computing resources and storage resources of the dedicated KMS are exclusive to a single user, and the network communication is also a user-exclusive network link.

[0068] Shared KMS: A one-stop key management and data encryption service platform for users, providing simple, reliable, secure, and compliant data encryption protection capabilities. The key computing resources and storage resources of the shared KMS are shared by multiple users, and network communications are also shared network links.

[0069] To facilitate understanding of the specific implementation process of the technical solution in this embodiment, the relevant technology is explained below: With the advent of the big data era, enterprise-level users on the cloud have increasingly clear demands for their own data security and data compliance. In order to meet users' data security and data compliance requirements, the relevant technology provides a password management service implementation method, which mainly directly accesses the user's cloud encryption machine instance through a shared KMS gateway.

[0070] However, in the process of using the above system for key storage and key calculation, part of the key calculation may be performed on the shared KMS gateway. In this way, for users, the key calculation part is shared. Specifically, for the current key management architecture, users share the network link, which is forwarded through a shared gateway, authenticated through an authentication logic, managed through a key management logic, and the same resource pool is used for key calculation. In this way, for the encryption machine, the user-side data is not isolated. For users who are sensitive to key security and compliance, they may question the security and compliance of key storage and key calculation.

[0071] In addition, in order to access the user's cloud encryption machine instance, a specific software development kit (Software Development Kit, SDK for short) is required. The SDK used to access the cloud encryption machine instance is often not unified with the SDK for directly accessing the cloud encryption machine instance through the shared KMS gateway. At this time, two SDKs may be used in the same application, and then the user needs to maintain two SDKs in one application, which will increase the user's usage and maintenance costs.

[0072] In addition, the cloud encryption machine instances provided in the relevant technologies are often operated and maintained by users. Therefore, the encryption machine products do not need to make service level agreements (SLA) guarantees. That is, the key management products will not be provided to the outside world and there is no clear SLA service agreement. This makes it impossible to guarantee the stability and reliability of the key management product services.

[0073] In order to solve the above technical problems, this embodiment proposes a key management service system, method, gateway and device, wherein, with reference to the attached Figure 1 As shown, the key management service system may include a key management service KMS gateway 101 and at least one exclusive KMS 102 communicatively connected to the KMS gateway 101. In specific implementation, the KMS gateway 101 may be deployed on a server, which is communicatively connected to a client to implement the user's key management service operation.

[0074] Among them, the client can be any computing device with a certain data transmission capability. Specifically, the basic structure of the client may include: at least one processor. The number of processors depends on the configuration and type of the client. The client may also include a memory, which may be volatile, such as RAM, or non-volatile, such as read-only memory (ROM), flash memory, etc., or may include both types. The memory usually stores an operating system (OS), one or more application programs, and may also store program data, etc. In addition to the processing unit and the memory, the client also includes some basic configurations, such as a network card chip, an IO bus, a display component, and some peripheral devices, etc. Optionally, some peripheral devices may include, for example, a keyboard, a mouse, an input pen, a printer, etc. Other peripheral devices are well known in the art and will not be described in detail here.

[0075] A server is a device that can provide exclusive key management services in a network virtual environment. It usually refers to a device that uses the network to perform information planning and exclusive key management service operations. In physical implementation, a server can be any device that can provide computing services, respond to service requests, and perform processing. For example, it can be a cluster server, a regular server, a server in the cloud, a cloud host, a virtual center, etc. The composition of a server mainly includes a processor, a hard disk, a memory, a system bus, etc., which is similar to a general computer architecture.

[0076] In the above embodiment, the server can establish a network connection with the client, and the network connection can be a wireless or wired network connection. If the server and the client are connected by communication, the network standard of the mobile network can be any one of 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS), 4G (LTE), 4G+ (LTE+), WiMax, 5G, etc.

[0077] The KMS gateway 101 is used to obtain a key management request. When the key management request corresponds to a dedicated KMS 102, the key management request is forwarded to the dedicated KMS 102. The key management request is used to implement key management operations. In different application scenarios, the key management request can be a request for implementing different management operations. For example, the key management request may include at least one of the following: a key generation request for implementing a key generation operation, a key update request for implementing a key update operation, a key editing request for implementing a key editing operation, or a key deletion request for implementing a key deletion operation, etc. In addition, the key management request may be generated based on an execution operation input by a user to the key management service system. In this case, obtaining the key management request may include: displaying a display interface for interactive operations with the user, obtaining the execution operation input by the user in the display interface, and generating the key management request based on the execution operation.

[0078] After obtaining the key management request, the key management request can be analyzed and processed to identify whether the key management request corresponds to a dedicated KMS 102. When the key management request corresponds to a dedicated KMS 102, it means that the key management request at this time needs to implement corresponding operations in the dedicated KMS 102. Therefore, the key management request can be forwarded to the corresponding dedicated KMS 102.

[0079] The dedicated KMS 102 is used to receive the key management request sent by the KMS gateway 101, call the dedicated cryptographic machine resource pool 1021 corresponding to the dedicated KMS 102 based on the key management request, and perform key management operations using the dedicated cryptographic machine resource pool 1021. It should be noted that for the dedicated KMS 102 that does not correspond to the key management request, since the key management request does not correspond to the dedicated KMS 102, no key management operation is required.

[0080] The technical solution provided in this embodiment directly forwards the key management request to the exclusive KMS 102 through the KMS gateway 101 when the key management request corresponds to the exclusive KMS 102. Since the above-mentioned operation of accessing the exclusive KMS 102 is forwarded through the KMS gateway 101, there is no need to specifically configure the SDK for accessing the exclusive KMS 102, which not only reduces the user's software maintenance cost, but also facilitates the user to access the exclusive KMS 102. In addition, after the exclusive KMS 102 obtains the key management request, the corresponding key management operation is performed through the user's exclusive cryptographic machine resource pool 1021, thereby effectively realizing the ability to provide the user with an exclusive exclusive cryptographic machine resource pool, thereby ensuring that the entire computing and storage operations corresponding to the key management request are exclusive, which effectively improves the security and compliance of key storage and key operations, further improves the security and reliability of the use of the system, and is conducive to meeting the usage needs of different users.

[0081] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the case where there is no conflict between the embodiments, the following embodiments and the features in the embodiments can be combined with each other. In addition, the step sequence in the following method embodiments is only an example and not a strict limitation.

[0082] Figure 2 A schematic diagram of the structure of a key management service system provided by an embodiment of the present invention Figure 1 ; Reference Attachment Figure 2 As shown, this embodiment provides a key management service system, and the key management service system 100 may include a key management service KMS gateway 101 and at least one dedicated KMS 102 that is communicatively connected to the KMS gateway 101, that is, one KMS gateway 101 may be connected to one or more dedicated KMS 102, wherein each dedicated KMS 102 may be used by one user, and different users may have different dedicated KMS 102. Specifically, the KMS gateway 101 and the dedicated KMS 102 may be used to perform the following steps respectively:

[0083] The KMS gateway 101 is used to obtain a key management request, and when the key management request corresponds to a dedicated KMS 102 , forward the key management request to the dedicated KMS 102 .

[0084] The dedicated KMS 102 is used to receive a key management request, call a dedicated cryptographic machine resource pool 1021 corresponding to the dedicated KMS 102 based on the key management request, and use the dedicated cryptographic machine resource pool 1021 to perform key management operations.

[0085] Among them, the key management request refers to the request information that can realize the management operation of the key. The key management requests corresponding to different application scenarios may be different. For example, in the application scenario where the key generation operation needs to be implemented, the key management request is a key generation request; in the application scenario where the key update operation needs to be implemented, the key management request is a key update request; in the application scenario where the key editing operation needs to be implemented, the key management request is a key editing request; in the application scenario where the key deletion operation needs to be implemented, the key management request is a key deletion request.

[0086] In addition, this embodiment does not limit the specific implementation method of obtaining the key management request. In some instances, the key management request can be generated based on the execution operation input by the user to the key management service system 100. In this case, obtaining the key management request can include: displaying a display interface for interactive operation with the user through the display module in the key management service system 100, obtaining the execution operation input by the user in the display interface, and generating the key management request based on the execution operation. In other instances, the key management request can be sent by a third device. In this case, the key management service system 100 is connected to the third device in communication, and the third device can generate the key management request, and then the key management service system 100 can actively or passively obtain the key management request through the third device.

[0087] Since the KMS gateway 101 can forward key management requests in various application scenarios, for example, it can forward key management requests corresponding to the shared KMS 103, or it can forward key management requests corresponding to the dedicated KMS 102. Therefore, in order to accurately forward the key management request, after obtaining the key management request, the key management request can be analyzed and processed to identify whether the key management request corresponds to the dedicated KMS 102. Specifically, the key management request may include the identification information of the KMS to be controlled, and the identification information of the KMS to be controlled is searched and matched with the identification information of the exclusive KMS. If there is target identification information of the exclusive KMS that matches the identification information of the KMS to be controlled, it is determined that the key management request corresponds to an exclusive KMS 102, and the exclusive KMS 102 corresponds to the target identification information; if there is no target identification information of the exclusive KMS 102 that matches the identification information of the KMS, it is determined that the key management request does not correspond to the exclusive KMS 102, thereby effectively realizing the technical solution of identifying whether the key management request corresponds to the exclusive KMS 102.

[0088] When the key management request corresponds to a dedicated KMS 102 , the key management operation corresponding to the key management request needs to be performed in the dedicated KMS 102 . Therefore, the KMS gateway 101 may send the key management request to the dedicated KMS 102 .

[0089] For the exclusive KMS 102, each exclusive KMS 102 is configured with a corresponding exclusive cryptographic machine resource pool 1021, that is, a cryptographic machine resource pool exclusively configured for the user, and the exclusive cryptographic machine resource pools 1021 corresponding to different exclusive KMS 102 are independent of each other, wherein the exclusive cryptographic machine resource pool 1021 includes various resource information for implementing key management operations, and specifically, the exclusive cryptographic machine resource pool 1021 can be stored in the exclusive KMS 102. Therefore, after the exclusive KMS 102 receives the key management request sent by the KMS gateway 101, in order to implement the key management operation using the user's exclusive key resources, the exclusive cryptographic machine resource pool 1021 corresponding to the exclusive KMS 102 can be called, and the exclusive cryptographic machine resource pool 1021 can be used to perform key management operations, for example: a data key for encrypting and decrypting data can be created through the resources in the exclusive cryptographic machine resource pool 1021, a data key for encrypting and decrypting data can be updated, a data key for encrypting and decrypting data can be deleted, and the like.

[0090] In the key management service system 100 provided in this embodiment, when the key management request corresponds to the exclusive KMS 102, the KMS gateway 101 can directly forward the key management request to the exclusive KMS 102. Since the above key management request is forwarded through the KMS gateway 101, that is, the operation of accessing the exclusive KMS 102 can be realized through the KMS gateway 101, there is no need to specifically configure the SDK for accessing the exclusive KMS 102 (or the exclusive cryptographic machine resource pool 1021 in the exclusive KMS 102), which can not only reduce the software maintenance cost of the user, but also facilitate the user to access the exclusive KMS 102; in addition, after the exclusive KMS 102 obtains the key management request, the key management operation is performed through the exclusive cryptographic machine resource pool 1021 corresponding to the exclusive KMS 102, thereby effectively realizing the ability to provide the user with an exclusive exclusive cryptographic machine resource pool 1021 (that is, a service instance), and when the exclusive cryptographic machine resource pool 1021 is used to perform the key management operation, it can ensure that the entire calculation and storage operations of the key management operation are in the exclusive KMS 102, that is, the implementation process of key management is completely exclusive, which effectively improves the security and compliance of key storage and key operations, further improves the security and reliability of the use of the system, and is conducive to meeting the use needs of different users.

[0091] Figure 3 A schematic diagram of the structure of a key management service system provided by an embodiment of the present invention Figure 2 Based on the above embodiments, refer to the attached Figure 3 As shown, since the exclusive KMS 102 can provide users with exclusive key management services, in order to facilitate users to implement data encryption and decryption operations, when the exclusive KMS 102 is located in a private network, users can directly access the exclusive KMS 102 through the private gateway 103 in the private network without going through the KMS gateway 101. At this time, the exclusive KMS 102 is communicated with the private gateway 103 of the private network. The exclusive KMS 102 in this embodiment is also used to: obtain data encryption and decryption requests through the private gateway 103; based on the data encryption and decryption requests, call the exclusive cryptographic machine resource pool 1021 to generate a data key corresponding to the data encryption and decryption request; and perform data encryption and decryption operations based on the data key.

[0092] Among them, when the user has a data encryption and decryption demand (including data encryption demand or data decryption demand), a data encryption and decryption request (including data encryption request or data decryption request) can be sent to the exclusive KMS 102 through the exclusive gateway 103, and the data encryption and decryption request can include the data to be encrypted or the data to be decrypted. After the exclusive KMS 102 obtains the data encryption and decryption request through the exclusive gateway 103, in order to realize the data encryption and decryption operation, the exclusive cryptographic machine resource pool 1021 can be called based on the data encryption and decryption request to generate a data key corresponding to the data encryption and decryption request. It should be noted that the above-mentioned data key is randomly generated based on the resources in the exclusive cryptographic machine resource pool 1021, and then the generated data key can be used to perform encryption and decryption operations on the data to be encrypted or the data to be decrypted corresponding to the data encryption and decryption request. For example, the data key can be used to perform encryption operations on the encrypted data, or the data key can be used to perform decryption operations on the decrypted data.

[0093] Similarly, users can not only access the exclusive KMS 102 through the proprietary network to implement data encryption and decryption operations, but also access the exclusive KMS 102 through the proprietary network to implement key storage operations. At this time, the exclusive KMS 102 in this embodiment is also used to: obtain a key storage request through a proprietary gateway, the key storage request includes the key to be stored; store the key to be stored based on the key storage request, thereby realizing the key storage operation using the exclusive KMS 102, thereby improving the security and reliability of key storage.

[0094] In this embodiment, the exclusive KMS 102 obtains the data encryption and decryption request through the exclusive gateway 103, and then calls the exclusive cryptographic machine resource pool 1021 to generate a data key, and uses the data key to perform data encryption and decryption operations, thereby effectively realizing that for the exclusive KMS 102, the user can directly access the exclusive KMS 102 through the exclusive gateway 103 of the private network, and quickly implement data encryption and decryption operations or key storage operations, which effectively facilitates users to perform data encryption and decryption operations, and also ensures the security and reliability of data encryption and decryption operations.

[0095] Based on the above embodiments, continue to refer to the attached Figure 2 or Figure 3 As shown, for the KMS gateway 101, since it can forward key management requests in various application scenarios, and for the dedicated KMS 102, key management requests often include legal requests and illegal requests. Therefore, in order to ensure the security and reliability of the key management requests, after the KMS gateway 101 obtains the key management request, the KMS gateway 101 in this embodiment can also implement a legality identification operation on the key management request. Specifically, the KMS gateway 101 in this embodiment is also used to: determine the request type corresponding to the key management request and the network where the request is located; when the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS 102; when the request type is a preset key operation request or a key storage request, or when the network where the request is located is an illegal network, the key management request is prohibited from being sent to the dedicated KMS 102.

[0096] Specifically, for key management requests, key management requests can be divided into two categories according to the request type: (1) preset control requests, which may include at least one of the following: key generation request, key update request, key editing request, key deletion request and other requests related to the key generation cycle. (2) key operation request or key storage request. A key operation request refers to a request to operate on data based on a data key, and a key storage request is used to implement a key storage operation.

[0097] There are two access methods for the exclusive KMS 102. Method one is that the user accesses the exclusive KMS 102 through the KMS gateway 101, and method two is that the user accesses the exclusive KMS 102 through the exclusive gateway 103 of the private network. Since the security level or security requirement corresponding to the key calculation request or the key storage request is higher than the security level or security requirement corresponding to the preset management and control request, the key calculation request or the key storage request can be configured to be implemented only through the above-mentioned access method two, while the preset management and control request can be implemented through the above-mentioned access method one.

[0098] Based on the above description, it can be known that for the KMS gateway 101, after the KMS gateway 101 receives the key management request, in order to improve the security and reliability of the key management operation, the request type corresponding to the key management request and the network where the request is located can be determined, wherein the request type may include any one of the following: preset control request, or key operation request / key storage request, and the request type can be obtained by analyzing and identifying the preset field, keyword or request type identifier of the key management request. The network where the request is located can include a legal network for the exclusive KMS 102 and an illegal network for the exclusive KMS 102, and the network where the request is located can be obtained by analyzing and identifying the transmission port information and / or preset field corresponding to the key management request.

[0099] After obtaining the network where the request is located, the KMS gateway 101 can also perform a legitimacy identification operation on the network where the request is located. At this time, the KMS gateway 101 is specifically used to perform the following steps: obtain a preset network list for identifying the network where the request is located, the preset network list includes multiple standard network identifiers of legal networks, specifically, each exclusive KMS 102 corresponds to a preset network list, the preset network list includes multiple standard network identifiers of legal networks for the exclusive KMS 102, and the preset network lists corresponding to different exclusive KMS 102 are independent of each other. The above-mentioned preset network list can be stored in the KMS gateway 101 or the exclusive KMS 102. After obtaining the key management request, the above-mentioned pre-configured preset network list can be obtained, and then the identifier of the network where the request is located is searched and compared with the preset network list. When there is a standard network identifier matching the network where the request is located in the preset network list, it is determined that the network where the request is located is a legal network; when there is no standard network identifier matching the network where the request is located in the preset network list, it is determined that the network where the request is located is an illegal network.

[0100] In some instances, when a key management request is obtained through a preset cloud network, the network where the request is located corresponding to the key management request can be obtained, and then the network where the request is located is searched and matched with the preset network list. When the preset network list includes the network where the request is located, it means that the preset cloud network at this time is a legal network, and the key management request is allowed to be forwarded. Alternatively, when the KMS gateway 101 obtains a key management request through a preset network, the network domain name of the preset network is the same as the private network domain name, and the private network is directly connected to the exclusive KMS 102; the network where the request is located corresponding to the key management request can be obtained, and the network where the request is located includes network domain name information, and then the network where the request is located is searched and matched with the preset network list. Since the network domain name information of the request is the same as the private network domain name, the preset network can be considered to be a legal network, and the key management request is allowed to be forwarded.

[0101] After obtaining the request type and the network where the request is located corresponding to the key management request, since different types of key management requests and different networks have different corresponding forwarding strategies, in order to ensure the security and reliability of the key management operation, when the request type is a preset control request and the network where the request is located is a preset legal network, it means that the key management request at this time is a legal request for the exclusive KMS 102. Therefore, the KMS gateway 101 can directly forward the key management request, that is, allow the key management request to be sent to the exclusive KMS 102. Correspondingly, when the request type is a preset key operation request or a key storage request, or the network where the request is located is an illegal network, it means that the key management request at this time is an illegal request for the exclusive KMS 102. Therefore, the KMS gateway 101 will not forward the key management request, that is, it is prohibited to send the key management request to the exclusive KMS 102.

[0102] In this embodiment, after the KMS gateway 101 obtains the key management request, the KMS gateway 101 implements a legitimacy identification operation on the key management request. When the key management request is determined to be a legitimate request, the key management request will be forwarded to the exclusive KMS 102. When the key management request is determined to be an illegal request, the key management request will not be forwarded to the exclusive KMS 102, thereby achieving forwarding operations only for key management requests that are safe for the exclusive KMS 102, effectively avoiding the occurrence of illegal access operations, and further improving the security and reliability of the use of the system.

[0103] Based on the above embodiments, Figure 2 or Figure 3As shown, the system in this embodiment may also include a shared KMS 103 that is in communication with the KMS gateway 101. In this case, this embodiment provides an operation in which the KMS gateway 101 analyzes and identifies the key management request with the help of the shared KMS 103. Specifically,

[0104] The KMS gateway 101 is also used to send the key management request to the shared KMS 103 after obtaining the key management request;

[0105] The shared KMS 103 is used to receive a key management request, determine a user master key corresponding to the key management request, and send the user master key to the KMS gateway 101 .

[0106] The KMS gateway 101 is used to obtain a user master key and identify whether a key management request corresponds to a dedicated KMS 102 based on the user master key.

[0107] For all key management requests received by the KMS gateway 101, all key management requests need to be sent to the shared KMS 103 for processing. Specifically, after the shared KMS 103 obtains the key management request, it can call the shared cryptographic machine resource pool 1031 to establish a customer master key (Customer Master Key, referred to as CMK) corresponding to the key management request. The customer master key is a key encryption key, which is mainly used to encrypt and protect data encryption keys. After the customer master key corresponding to the key management request is established, in order to facilitate the user to call, view and use the customer master key, the customer master key can be stored in the shared database in the shared KMS 103, and the customer master key can be sent to the KMS gateway 101.

[0108] After the KMS gateway 101 obtains the user master key, the user master key can be analyzed and processed to identify whether the key management request corresponds to a dedicated KMS 102. Specifically, when the KMS gateway 101 identifies whether the key management request corresponds to a dedicated KMS 102 based on the user master key, the KMS gateway 101 is specifically used to execute: obtaining key metadata in the user master key, wherein the key metadata includes information related to the user master key, such as: the type of the user master key, when the key expires, who owns it, what the user is, etc. The existence of the key metadata can ensure the normal use of the user master key. After obtaining the key metadata, the key metadata can be analyzed and processed to determine whether the key management request corresponds to a dedicated KMS 102, and when the key management request corresponds to a dedicated KMS 102, the dedicated KMS 102 corresponding to the key management request is determined based on the key metadata.

[0109] It should be noted that when key management operations are performed based on the shared KMS 103 and key management operations are performed based on the exclusive KMS 102, the data structure of the output result obtained through the shared KMS 103 is different from the data structure of the output result obtained through the exclusive KMS 102. Specifically, the data structure of the output result of the shared KMS 103 is obtained by integrating multiple structures with different attributes. The data structure of the output result is the ciphertext obtained through the shared KMS 103. At this time, the output result can be split again based on the data attributes; while the data structure of the output result of the exclusive KMS 102 is directly output according to the data attributes, and its output result can no longer be split again. Compared with the output result obtained by the shared KMS 103, the structure of the output result obtained by the exclusive KMS 102 is more transparent, which is convenient for the user to process and configure the output result, and is conducive to making the expression of the output result more accurate.

[0110] In this embodiment, after obtaining the key management request, the KMS gateway 101 sends the key management request to the shared KMS 103, and obtains the user master key corresponding to the key management request through the shared KMS 103, and then identifies whether the key management request corresponds to a dedicated KMS 102 based on the key metadata corresponding to the user master key, thereby effectively ensuring the accuracy and reliability of the identification of the key management request, and further improving the quality and effect of key management through the system.

[0111] Based on the above embodiments, continue to refer to the attached Figure 2 or Figure 3 As shown, for the exclusive KMS 102 in the present system, since it can provide exclusive key service resources for users and can implement exclusive key calculation and key storage operations through exclusive key service resources, at this time, in order to ensure the security and reliability of the use of the exclusive KMS 102, the present embodiment also provides an implementation process in which the user can configure the information of the exclusive KMS 102. At this time, before the exclusive KMS 102 obtains the data encryption and decryption request through the proprietary gateway, or before the exclusive KMS 102 receives the key management request, the exclusive KMS 102 is also used to: obtain the credential configuration information corresponding to the exclusive KMS 102 input by the user; based on the credential configuration information, generate the authorization credential corresponding to the exclusive KMS 102; save the authorization credential to identify the legitimacy of the data encryption and decryption request or the key management request.

[0112] Specifically, since the user can directly access the exclusive KMS 102 through the exclusive gateway 103 of the private network, or access the exclusive KMS 102 through the KMS gateway 101, no matter which method is used to access the exclusive KMS 102, before accessing the exclusive KMS 102, that is, before the exclusive KMS 102 obtains the data encryption and decryption request through the exclusive gateway, or before the exclusive KMS 102 receives the key management request, the exclusive KMS 102 can be configured. At this time, the exclusive KMS 102 can first display a configuration interface for the user to input the configuration operation. The user can enter the credential configuration operation corresponding to the exclusive KMS 102 in the configuration interface. The credential configuration operation may include: user name configuration operation, password configuration operation, etc.; through the credential configuration operation, the credential configuration information received by the exclusive KMS 102 can be obtained, and the credential configuration information can be request information for configuring the user name and / or password information. After the credential configuration information is obtained, a configuration information corresponding to the exclusive KMS can be generated based on the credential configuration information. 102 corresponding authorization credentials, which may include user name information and password information, etc.

[0113] After obtaining the authorization credential, in order to be able to perform identity identification operations on users accessing the exclusive KMS 102 based on the authorization credential, the authorization credential can be saved. Specifically, the authorization credential can be stored in a database in the exclusive KMS 102 so that the legitimacy identification operations can be performed on data encryption and decryption requests or key management requests based on the authorization credential.

[0114] In this embodiment, the credential configuration information corresponding to the exclusive KMS 102 input by the user is obtained through the exclusive KMS 102 in the system; and the authorization credential corresponding to the exclusive KMS 102 is generated based on the credential configuration information; and then the authorization credential is saved, which effectively realizes a process in which the user can configure the information of the exclusive KMS 102, which facilitates the subsequent legitimacy identification of data encryption and decryption requests or key management requests, and further improves the legitimacy and security of access to the exclusive KMS102.

[0115] Similarly, based on the above embodiments, refer to the attached Figure 2 or Figure 3As shown, the system in this embodiment can not only realize the configuration operation of the authorization certificate corresponding to the exclusive KMS 102, but also realize the configuration operation of the exclusive cryptographic machine resource pool 1021 corresponding to the exclusive KMS 102. At this time, before the exclusive KMS 102 obtains the data encryption and decryption request through the dedicated gateway, or before the exclusive KMS 102 receives the key management request, the exclusive KMS 102 in this embodiment is also used to: obtain the configuration information of the exclusive cryptographic machine resource pool 1021 input by the user; based on the configuration information, generate the exclusive cryptographic machine resource pool 1021.

[0116] Before accessing the dedicated KMS 102, that is, before the dedicated KMS 102 obtains a data encryption and decryption request through the dedicated gateway 103, or before the dedicated KMS 102 receives a key management request, it is necessary to first configure the dedicated cryptographic machine resource pool 1021 corresponding to the dedicated KMS 102. At this time, the dedicated KMS 102 can first display a configuration interface for the user to input configuration operations. The user can enter the configuration interface corresponding to the dedicated KMS. 102, the configuration information corresponding to the cryptographic machine resource pool may be request information for calling the cryptographic machine resource pool or a generation request for generating the cryptographic machine resource pool; when the configuration information is request information for calling the cryptographic machine resource pool, the request information may include identification information corresponding to the cryptographic machine resource pool to be called; among the pre-configured multiple cryptographic machine resource pools, the target cryptographic machine resource pool corresponding to the identification information is determined, and then the target cryptographic machine resource pool may be determined as the exclusive cryptographic machine resource pool 1021 to be generated; or, when the configuration information is a generation request for generating the cryptographic machine resource pool, the request information may include each cryptographic resource information corresponding to the cryptographic machine resource pool; after obtaining the configuration information, multiple cryptographic resource information may be generated based on the configuration information, and all the cryptographic resource information may be aggregated into the exclusive cryptographic machine resource pool 1021. After the exclusive cryptographic machine resource pool 1021 is generated, in order to be able to perform key management operations on the key management request corresponding to the exclusive KMS 102 based on the exclusive cryptographic machine resource pool 1021.

[0117] In this embodiment, the configuration operation corresponding to the exclusive cryptographic machine resource pool 1021 input by the user is obtained through the exclusive KMS 102 in the system; and the exclusive cryptographic machine resource pool 1021 corresponding to the exclusive KMS 102 is generated based on the configuration operation; and then the exclusive cryptographic machine resource pool 1021 is saved, which effectively realizes a process in which the user can configure the resources of the exclusive cryptographic machine resource pool 1021, thereby facilitating the corresponding processing operations on data encryption and decryption requests or key management requests based on the exclusive cryptographic machine resource pool, further improving the quality and efficiency of the key management service.

[0118] Based on any of the above embodiments, continue to refer to the attached Figure 2 or Figure 3 As shown, the key management service system 100 in this embodiment can be used by one or more users. When multiple users use the key management service system 100, in order to ensure fairness in resource invocation by each user, the KMS gateway 101 in this embodiment can also perform load balancing operations, and specifically can perform flexible flow limiting operations based on the number of times the user calls the key management service system 100. Specifically, the KMS gateway 101 in this embodiment can also be used to execute: within a preset time period, count the number of key management requests sent by the same request end; when the number exceeds a preset threshold, limit the number of key management requests sent by the request end to the preset threshold.

[0119] Specifically, when multiple users use the key management service system 100, within a preset time period (for example, 5 minutes, 10 minutes, 20 minutes or 30 minutes), a user may make multiple key management requests to the key management service system 100. In this way, the key management service system 100 may receive several key management requests sent by multiple users within a preset time period. Then, since the resources corresponding to the key management service system 100 are fixed and limited, in order to ensure the fairness of each user in calling resources, the key management service system 100 can pre-configure a preset threshold for limiting the flow of each user. In some instances, the preset thresholds corresponding to all users may be the same. In other instances, the preset thresholds corresponding to different types of users may be different. For example, the preset threshold corresponding to ordinary users is the first threshold, and the preset threshold corresponding to member users is the second threshold, wherein the second threshold is higher than the first threshold.

[0120] After configuring the preset threshold for the key management service system 100, in the process of key management based on the key management service system 100, since all key management requests obtained by the key management service system 100 need to pass through the KMS gateway 101, the KMS gateway 101 can count the number of key management requests sent by the same request end within a preset time period. For example, the KMS gateway 101 can count the number of key management requests sent by the request end A within a preset 30 minutes as C1, the number of key management requests sent by the request end B as C2, the number of key management requests sent by the request end C as C3, and so on.

[0121] After obtaining the number of key management requests sent by the same request end, the number can be analyzed and compared with the preset threshold. When the number is less than or equal to the preset threshold, it means that the request end is calling the key management service within the specified limit. At this time, there is no need to perform any restrictions or current limiting operations on the key management service calling operation of the request end; when the number is greater than the preset threshold, it means that the request end has exceeded the specified service calling limit. In order to ensure the fairness of resource calling of the key management service system 100 and to ensure the normal and stable operation of the key management service, the key management service calling operation of the above-mentioned request end can be restricted or current limited. Specifically, the number of key management requests sent by the request end is limited to the preset threshold, and the key management requests that exceed the preset threshold are ignored.

[0122] In this embodiment, the KMS is used to count the number of key management requests sent by the same request end; when the number exceeds a preset threshold, the number of key management requests sent by the request end is limited to the preset threshold, so that each user can perform service call operations up to the preset threshold, for example: each user can call up to 100 times, 300 times or 500 times per second, etc., which effectively ensures the fairness of each user's call to key service resources and further improves the stability and reliability of the use of the key management service system 100.

[0123] In specific applications, since the demand for exclusive key storage and key calculation services on the user side is one of the core demands of the security of enterprise key management services, and the dedicated KMS provides users with a key management service system with exclusive key storage and key calculation on the user side, based on the above demands, this application embodiment provides a key management service system with exclusive key storage and key calculation on the user side. The system can not only provide users with exclusive key service instances, and ensure that they can only be accessed within the user's virtual private cloud (Virtual Private Cloud, VPC for short), meeting the private network access requirements; at the same time, it can use the user's exclusive password resource pool to achieve isolation and cryptographic isolation of computing resources and storage resources to ensure higher data security.

[0124] For details, please refer to the attached Figure 4 As shown, the key management service system provided by this application embodiment may include:

[0125] Control module: used for users to apply and call operations on the key management service system.

[0126] Specifically, the control module can provide a display interface for calling the shared KMS and / or the dedicated KMS, and the user can input the execution operation on the display interface to generate and obtain the key management request based on the execution operation. Then the key management request is sent to the KMS gateway to implement the call operation of the shared KMS and / or the dedicated KMS through the KMS gateway to implement the key management service operation.

[0127] Among them, the specific implementation of the control module may include at least one of the following: console, command line interface CLI, software development kit SDK or other cloud service interface to call the key management service system, etc. The above console can provide users with all functions of calling the key management service system, and the preset open API interface can be called through CLI and SDK. However, when you are not familiar with the functions implemented by the key management service system, you can use CLI to conduct research or preview operations on the key management service system. In addition, when calling the key management service system through other cloud service interfaces, since the cloud service product may read user data, the data stored on the disk (pre-stored) can be encrypted for the security and reliability of the data.

[0128] KMS Gateway: Communicates with the control module, receives key management requests from the control module, and forwards the key management requests to the shared KMS.

[0129] Shared KMS: Communicates with the KMS gateway to obtain key management requests sent by the KMS gateway. Specifically, the shared KMS may include: a shared key management system, a cryptographic machine (HSM) resource pool, an encryption and decryption service module, and a database. After the key management system in the KMS gateway obtains the key management request, it can call the resources in the cryptographic machine (HSM) resource pool to generate the user master key CMK, and encrypt the user master key and store it in the database.

[0130] If the key management request corresponds to the shared KMS, the data key can be derived from the user master key CMK in the database, and then the data key is called by the encryption and decryption service module to perform data encryption and decryption operations to generate encryption and decryption results, and the generated encryption and decryption results can be returned to the user end. If the key management request does not correspond to the shared KMS, the user master key corresponding to the generated key management request can be returned to the KMS gateway.

[0131] KMS Gateway: Obtain the user master key corresponding to the key management request, identify whether the key management request corresponds to a dedicated KMS based on the user master key, and if the key management request corresponds to a dedicated KMS, determine the dedicated KMS corresponding to the key management request based on the user master key, and then forward the key management request to the dedicated KMS. In some instances, before the KMS gateway forwards the key management request, it can first authenticate the key management request to ensure that the forwarded key management request is a legitimate request.

[0132] Dedicated KMS: Communicates with the KMS gateway to obtain key management requests through the KMS gateway and call the dedicated cryptographic machine resource pool to perform key management operations.

[0133] Specifically, the exclusive KMS may include an exclusive key management system, an exclusive encryption machine instance (exclusive encryption machine resource pool) and an application encryption and decryption service module. When the KMS gateway sends a key management request to the exclusive KMS, it is mainly the exclusive key management system in the exclusive KMS that receives the key management request, and then can call the resources of the exclusive encryption machine instance to generate a user master key, and store the user master key in a dedicated database. The application encryption and decryption service module can call the pre-stored user master key and generate a data key based on the user master key. The data key can be a symmetric key or an asymmetric key, so as to perform data encryption and decryption operations based on the data key, generate data encryption and decryption results, and be able to return the generated encryption and decryption results to the user end, so as to complete the calling operation of the key management service.

[0134] It should be noted that for a dedicated KMS, not only can key management service operations be implemented through the KMS gateway, but users can also access the dedicated KMS through the dedicated gateway in the private network. Generally, when users need to perform key calculations or key storage operations, users can directly send key calculation requests or key storage requests to the dedicated KMS through the dedicated gateway, so that the dedicated KMS can perform key calculations or key storage operations based on the key calculation requests or key storage requests, etc. When users need to perform key management and control operations, they can access the dedicated KMS through the control module and the KMS gateway to implement key management and control operations.

[0135] In addition, for the exclusive KMS, before calling the exclusive KMS, you can first configure the access certificate of the exclusive KMS or the exclusive cryptographic machine instance. At this time, the user (or security administrator) can initialize the cluster of cryptographic machine instances, and then create an authorization credential for calling the above-mentioned cryptographic machine instance cluster. The authorization credential can include the user name and login password information, and then the created authorization credential is delivered to the exclusive KMS for storage, so as to perform legitimacy identification operations on the request to access the exclusive KMS.

[0136] In addition, for the exclusive KMS, in order to improve and ensure the applicability, flexibility and reliability of the exclusive KMS, the cryptographic machine in the exclusive KMS can implement extended functional operations through preset interfaces or preset plug-ins. For example, SSL offloading function can be implemented through preset interfaces, etc.

[0137] On the other hand, for exclusive KMS, a cryptographic computing resource pool exclusive to a single tenant is built through the cloud-native serverless capabilities, and the keys are stored in the user's storage medium in an encrypted manner. Specifically, based on the type of exclusive encryption machine resources, exclusive KMS is divided into exclusive KMS Standard Edition and exclusive KMS Basic Edition. Among them, the key storage medium of the exclusive KMS Standard Edition is a cryptographic machine exclusive to the tenant. In this case, the exclusive encryption machine resources are exclusive cryptographic machines; the key storage medium of the exclusive KMS Basic Edition is a user-exclusive database. In this case, the exclusive encryption machine resources are exclusive databases.

[0138] This application embodiment provides a key management system, which implements a technical architecture that is exclusive to the tenant side for cryptographic operations and key storage. It specifically uses cloud-native Serverless capabilities to build a cryptographic operation resource pool exclusive to a single user, and stores user keys exclusively on the user side through a user-side cipher machine to solve the security issues of key operations and storage; a user-exclusive access network channel is built through a user-side private network to ensure user-side network isolation and access security; specifically, the system can support users to use the encryption and decryption services of the KMS exclusive version instance through an exclusive private network to perform application-layer encryption and decryption operations, and provides a user-exclusive network connectivity method (Single Tunnel) to build a user access service network channel, ensuring that the exclusive KMS instance can only be accessed on the user-side private network, and other private networks or other network environments cannot access the exclusive KMS instance, thereby ensuring user-side network isolation and access security, ensuring user exclusivity at the network layer, and providing users with tenant-side network isolation security protection. In addition, without modifying other cloud products, cloud products are supported to access exclusive KMS keys through a shared KMS gateway to achieve the ability to bring your own key (BYOK), and at the same time, a user-determined SLA agreement can be given to ensure the quality and effectiveness of key management services (99.9%). In addition, reverse access supports seamless and secure integration of exclusive KMS with cloud products. This integration method is more secure and meets users' higher compliance requirements, further improving the practicality, flexibility and reliability of the system, which is conducive to market promotion and application.

[0139] Figure 5 A schematic diagram of a key management method provided by an embodiment of the present invention; see attached Figure 5 As shown, this embodiment provides a key management method, the execution subject of the key management method is a key management device, which can be specifically implemented as a KMS gateway, that is, the method can be applied to a key management service KMS gateway, and the KMS gateway is communicatively connected with a shared KMS and at least one exclusive KMS; specifically, the key management method in this embodiment may include:

[0140] Step S501: Obtain a key management request.

[0141] Among them, the key management request refers to the request information that can realize the management operation of key information. The key management requests corresponding to different application scenarios may be different. For example, in the application scenario where the key generation operation needs to be implemented, the key management request is a key generation request; in the application scenario where the key update operation needs to be implemented, the key management request is a key update request; in the application scenario where the key editing operation needs to be implemented, the key management request is a key editing request; in the application scenario where the key deletion operation needs to be implemented, the key management request is a key deletion request.

[0142] In addition, this embodiment does not limit the specific implementation method for obtaining the key management request. In some instances, the key management request may be generated based on the execution operation input by the user to the key management service system. In this case, obtaining the key management request may include: displaying a display interface for interactive operation with the user through a display module in the key management service system, obtaining the execution operation input by the user in the display interface, and generating the key management request based on the execution operation. In other instances, the key management request may be sent by a third device. In this case, the key management service system is connected to the third device in communication, and the third device may generate the key management request, and then the key management service system may actively or passively obtain the key management request through the third device.

[0143] Step S502: Identify through the shared KMS whether the key management request corresponds to a dedicated KMS.

[0144] Since the KMS gateway can forward key management requests in various application scenarios, for example, it can forward key management requests corresponding to the shared KMS, or it can forward key management requests corresponding to the dedicated KMS. Therefore, after obtaining the key management request, in order to accurately forward the key management request, the key management request can be analyzed and processed to identify whether the key management request corresponds to the dedicated KMS. When the key management request corresponds to a dedicated KMS, the key management operation corresponding to the key management request needs to be implemented in the dedicated KMS. Therefore, the KMS gateway can send the key management request to the dedicated KMS.

[0145] In some instances, identifying whether a key management request corresponds to a dedicated KMS through a shared KMS may include: sending the key management request to the shared KMS; obtaining a user master key corresponding to the key management request through the shared KMS; and identifying whether the key management request corresponds to a dedicated KMS based on the user master key.

[0146] In some instances, identifying whether a key management request corresponds to a dedicated KMS based on a user master key may include: obtaining key metadata in the user master key; determining whether the key management request corresponds to a dedicated KMS based on the key metadata, and when the key management request corresponds to a dedicated KMS, determining the dedicated KMS corresponding to the key management request based on the key metadata.

[0147] The specific implementation process of identifying whether a key management request corresponds to a dedicated KMS by sharing the KMS in this embodiment is the same as that described above. Figure 2-Figure 4The specific implementation process of the corresponding system to identify whether a key management request corresponds to an exclusive KMS through a shared KMS is similar. Please refer to the above statements for details and will not be repeated here.

[0148] Step S503: When the key management request corresponds to a dedicated KMS, the key management request is forwarded to the corresponding dedicated KMS.

[0149] For a dedicated KMS, each dedicated KMS is configured with a corresponding dedicated cryptographic machine resource pool. The dedicated cryptographic machine resource pools corresponding to different dedicated KMSs are independent of each other. The dedicated cryptographic machine resource pool includes various resource information for implementing key management operations. Specifically, the dedicated cryptographic machine resource pool can be stored in the dedicated KMS. Therefore, after the dedicated KMS receives the key management request sent by the KMS gateway, in order to use the key resources dedicated to the user to implement key management operations, the dedicated cryptographic machine resource pool corresponding to the dedicated KMS can be called, and the dedicated cryptographic machine resource pool can be used to perform key management operations, for example: data keys for encrypting and decrypting data can be created through resources in the dedicated cryptographic machine resource pool, data keys for encrypting and decrypting data can be updated, data keys for encrypting and decrypting data can be deleted, and so on.

[0150] In the key management method provided in this embodiment, when the key management request corresponds to the exclusive KMS, the KMS gateway can directly forward the key management request to the exclusive KMS. Since the access operation of the above-mentioned exclusive KMS is implemented through the KMS gateway, there is no need to specifically configure the SDK for accessing the exclusive encryption machine resource pool. This not only reduces the user's software maintenance cost, but also facilitates the user to access the exclusive KMS. In addition, after the exclusive KMS obtains the key management request, the corresponding key management operation is performed through the exclusive encryption machine resource pool corresponding to the exclusive KMS, thereby effectively realizing the ability to provide the user with an exclusive exclusive encryption machine resource pool (i.e., service instance). When the exclusive encryption machine resource pool is used for key management operations, it can ensure that the entire calculation and storage operations of the key management operation are implemented in the exclusive KMS, i.e., the implementation process of key management is exclusive, which effectively improves the security and compliance of key storage and key operations, further improves the security and reliability of the use of this method, and is conducive to meeting the usage needs of different users.

[0151] Figure 6 A flowchart of another key management method provided by an embodiment of the present invention; based on the above embodiment, refer to the attached Figure 6 As shown, after obtaining the key management request, the method in this embodiment may further include:

[0152] Step S601: Determine the request type corresponding to the key management request and the network where the request is located.

[0153] Specifically, for key management requests, key management requests can be divided into two categories according to the request type: (1) preset control requests, which may include at least one of the following: key generation request, key update request, key editing request, key deletion request and other requests related to the key generation cycle. (2) key operation request or key storage request. A key operation request refers to a request to operate on data based on a data key, and a key storage request is used to implement a key storage operation.

[0154] For the exclusive KMS, there are two access methods. Method one is that users access the exclusive KMS through the KMS gateway, and method two is that users access the exclusive KMS through the exclusive gateway of the private network. Since the security level or security requirement corresponding to the key calculation request or key storage request is higher than the security level or security requirement corresponding to the preset control request, the key calculation request or key storage request can be configured to be implemented only through the above-mentioned access method two, while the preset control request can be implemented through the above-mentioned access method one.

[0155] Based on the above description, it can be known that for the KMS gateway, after the KMS gateway receives the key management request, in order to improve the security and reliability of the key management operation, the request type corresponding to the key management request and the network where the request is located can be determined, wherein the request type may include: preset control request, or key operation request / key storage request, and the request type can be obtained by analyzing and identifying the preset field, keyword or request type identifier of the key management request. The network where the request is located can include a legal network for the exclusive KMS and an illegal network for the exclusive KMS, and the network where the request is located can be obtained by analyzing and identifying the transmission port information and / or preset field corresponding to the key management request.

[0156] After obtaining the network where the request is located, a legitimacy identification operation can be performed on the network where the request is located, specifically including: obtaining a preset network list for identifying the network where the request is located, the preset network list including standard network identifiers of multiple legal networks; when there is a standard network identifier that matches the network where the request is located in the preset network list, it is determined that the network where the request is located is a legal network; when there is no standard network identifier that matches the network where the request is located in the preset network list, it is determined that the network where the request is located is an illegal network.

[0157] Step S602: If the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS.

[0158] Step S603: When the request type is a preset key operation request or a key storage request, or the network where the request is located is an illegal network, it is prohibited to send the key management request to the dedicated KMS.

[0159] After obtaining the request type corresponding to the key management request and the network where the request is located, since different types of key management requests and different networks have different corresponding forwarding strategies, in order to ensure the security and reliability of key management operations, when the request type is a preset control request and the network where the request is located is a preset legal network, it means that the key management request at this time is a legal request for the exclusive KMS. Therefore, the KMS gateway can directly forward the key management request, that is, allow the key management request to be sent to the exclusive KMS. Correspondingly, when the request type is a preset key operation request or key storage request, or the network where the request is located is an illegal network, it means that the key management request at this time is an illegal request for the exclusive KMS. Therefore, the KMS gateway will not forward the key management request, that is, it is prohibited to send the key management request to the exclusive KMS.

[0160] In this embodiment, after the KMS gateway obtains the key management request, the KMS gateway implements a legitimacy identification operation on the key management request. When the key management request is determined to be a legitimate request, the key management request will be forwarded to the exclusive KMS. When the key management request is determined to be an illegal request, the key management request will not be forwarded to the exclusive KMS, thereby realizing the forwarding operation of key management requests that are only safe for the exclusive KMS, effectively avoiding the occurrence of illegal access operations, and further improving the security and reliability of the use of the system.

[0161] Figure 7 A flowchart of another key management method provided by an embodiment of the present invention; based on any of the above embodiments, refer to the attached Figure 7 As shown, the method in this embodiment may further include:

[0162] Step S701: within a preset time period, count the number of key management requests sent by the same request end.

[0163] Step S702: When the number exceeds a preset threshold, the number of key management requests sent by the requesting end is limited to the preset threshold.

[0164] Specifically, when multiple users use the key management service system, within a preset time period (for example, 5 minutes, 10 minutes, 20 minutes, or 30 minutes), a user may make multiple key management requests to the key management service system. In this way, the key management service system may receive several key management requests sent by multiple users within a preset time period. Since the resources corresponding to the key management service system are fixed and limited, in order to ensure the fairness of each user in calling resources, the key management service system can pre-configure a preset threshold for limiting the flow of each user. In some instances, the preset thresholds corresponding to all users may be the same. In other instances, the preset thresholds corresponding to different types of users may be different. For example, the preset threshold corresponding to ordinary users is the first threshold, and the preset threshold corresponding to member users is the second threshold, wherein the second threshold is higher than the first threshold.

[0165] After configuring the preset threshold for the key management service system, in the process of key management based on the key management service system, since all key management requests obtained by the key management service system need to pass through the KMS gateway, the KMS gateway can count the number of key management requests sent by the same request end within a preset time period. For example, the KMS gateway can count the number of key management requests sent by request end A within a preset 30 minutes as C1, the number of key management requests sent by request end B as C2, the number of key management requests sent by request end C as C3, and so on.

[0166] After obtaining the number of key management requests sent by the same request end, the number can be analyzed and compared with the preset threshold. When the number is less than or equal to the preset threshold, it means that the request end is calling the key management service within the specified limit. At this time, there is no need to perform any restrictions or current limiting operations on the key management service calling operation of the request end; when the number is greater than the preset threshold, it means that the request end has exceeded the specified service calling limit. In order to ensure the fairness of the key management service system resource calls and to ensure the normal and stable operation of the key management service, the key management service calling operation of the above request end can be restricted or current limited. Specifically, the number of key management requests sent by the request end is limited to the preset threshold, and the key management requests that exceed the preset threshold are ignored.

[0167] In this embodiment, the KMS gateway counts the number of key management requests sent by the same request end; when the number exceeds a preset threshold, the number of key management requests sent by the request end is limited to the preset threshold, so that each user can perform service call operations up to the preset threshold, for example: each user can call up to 100 times, 300 times or 500 times per second, etc., which effectively ensures the fairness of each user's call to key service resources and further improves the stability and reliability of the use of the key management service system.

[0168] Figure 8 A schematic diagram of a key management method provided by another embodiment of the present invention; Figure 8 As shown, this embodiment provides a key management method, and the execution subject of the key management method can be a key management device, which can be specifically implemented as a dedicated key management service KMS, that is, the method can be applied to a dedicated key management service KMS, and the dedicated KMS gateway is communicatively connected to the KMS gateway; specifically, the key management method in this embodiment may include:

[0169] Step S801: Receive a key management request sent by a KMS gateway.

[0170] Step S802: Based on the key management request, call the dedicated cryptographic machine resource pool corresponding to the dedicated KMS.

[0171] Step S803: Use the dedicated cryptographic machine resource pool to perform key management operations.

[0172] In some examples, the dedicated KMS communication is connected to a dedicated gateway of a dedicated network; the method in this embodiment may also include:

[0173] Step S901: obtaining a data encryption and decryption request through a proprietary gateway;

[0174] Step S902: Based on the data encryption and decryption request, call the dedicated cryptographic machine resource pool to generate a data key corresponding to the data encryption and decryption request;

[0175] Step S903: Encrypt and decrypt data based on the data key.

[0176] In some other examples, the method in this embodiment may further include:

[0177] Step S1001: Acquire the credential configuration information corresponding to the dedicated KMS input by the user.

[0178] Step S1002: Generate an authorization certificate corresponding to the dedicated KMS based on the certificate configuration information.

[0179] Step S1003: Save the authorization certificate to identify the legitimacy of the data encryption and decryption request or the key management request.

[0180] In some other examples, before the dedicated KMS receives the key management request, the method in this embodiment may further include:

[0181] Step S1101: Obtain the configuration information of the exclusive cryptographic machine resource pool input by the user.

[0182] Step S1102: Generate a dedicated cryptographic machine resource pool based on the configuration information.

[0183] Specifically, the implementation process, implementation principle and implementation effect of the above method steps in this embodiment are the same as those in the above Figure 2-Figure 3 The implementation process, implementation principle and implementation effect of the method steps implemented by the key management service system in the embodiment shown are similar. For the parts not described in detail in this embodiment, please refer to the description of Figure 2-Figure 4 Description of the illustrated embodiment.

[0184] Fig. 9 A schematic diagram of the structure of a key management service gateway provided by an embodiment of the present invention; Fig. 9 As shown, this embodiment provides a key management service gateway, which is connected to a shared KMS and at least one dedicated KMS in communication; specifically, the KMS gateway is used to perform the above Figure 5 The key management method shown, the KMS gateway may include:

[0185] A first acquisition module 11, used to acquire a key management request;

[0186] A first identification module 12, used to identify whether the key management request corresponds to a dedicated KMS through the shared KMS;

[0187] The first processing module 13 is configured to forward the key management request to the corresponding dedicated KMS when the key management request corresponds to a dedicated KMS.

[0188] In some instances, the first processing module 13 in this embodiment is used to perform the following steps: after obtaining a key management request, determining the request type corresponding to the key management request and the network where the request is located; when the request type is a preset control request and the network where the request is located is a preset legal network, allowing the key management request to be sent to the exclusive KMS; when the request type is a preset key operation request or a key storage request, or the network where the request is located is an illegal network, prohibiting the key management request from being sent to the exclusive KMS.

[0189] In some instances, the first processing module 13 in this embodiment is used to perform the following steps: obtain a preset network list for identifying the network where the request is located, the preset network list including multiple standard network identifiers of legal networks; when there is a standard network identifier matching the network where the request is located in the preset network list, it is determined that the network where the request is located is a legal network; when there is no standard network identifier matching the network where the request is located in the preset network list, it is determined that the network where the request is located is an illegal network.

[0190] In some instances, when the first identification module 12 identifies whether a key management request corresponds to an exclusive KMS through a shared KMS, the first identification module 12 is used to perform the following steps: sending the key management request to the shared KMS; obtaining a user master key corresponding to the key management request through the shared KMS; and identifying whether the key management request corresponds to an exclusive KMS based on the user master key.

[0191] In some instances, when the first identification module 12 identifies whether a key management request corresponds to a dedicated KMS based on the user master key, the first identification module 12 is used to execute: obtaining key metadata in the user master key; based on the key metadata, determining whether the key management request corresponds to a dedicated KMS, and when the key management request corresponds to a dedicated KMS, determining the dedicated KMS corresponding to the key management request based on the key metadata.

[0192] In some instances, the first processing module 13 in this embodiment is used to perform the following steps: within a preset time period, counting the number of key management requests sent by the same request end; when the number exceeds a preset threshold, limiting the number of key management requests sent by the request end to the preset threshold.

[0193] Fig. 9 The key management service gateway shown can perform Figure 5-Figure 7 For the method of the embodiment shown in the figure, the part not described in detail in this embodiment can be referred to Figure 5-Figure 7 The implementation process and technical effects of this technical solution refer to Figure 5-Figure 7 The description in the illustrated embodiment will not be repeated here.

[0194] In one possible design, Fig. 9 The structure of the key management service gateway shown can be implemented as an electronic device, which can be integrated into a client, a mobile phone, a tablet computer, a desktop computer, etc. Fig.10 As shown, the electronic device may include: a first processor 21 and a first memory 22. The first memory 22 is used to store the corresponding electronic device to execute the above Figure 5-Figure 7The program of the key management method provided in the illustrated embodiment, the first processor 21 is configured to execute the program stored in the first memory 22 .

[0195] The program includes one or more computer instructions, wherein when one or more computer instructions are executed by the first processor 21, the following steps can be implemented: obtaining a key management request; identifying whether the key management request corresponds to an exclusive KMS through the shared KMS; when the key management request corresponds to an exclusive KMS, forwarding the key management request to the corresponding exclusive KMS.

[0196] Furthermore, the first processor 21 is also used to execute the aforementioned Figure 5-Figure 7 All or part of the steps in the illustrated embodiments.

[0197] The structure of the electronic device may further include a first communication interface 23 for the electronic device to communicate with other devices or a communication network.

[0198] In addition, an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by electronic devices, which includes instructions for executing the above Figure 5-Figure 7 The procedures involved in the key management method in the method embodiment shown.

[0199] In addition, an embodiment of the present invention provides a computer program product, including: a computer program, when the computer program is executed by a processor of an electronic device, the processor executes Figure 5-Figure 7 The key management method in the method embodiment is shown.

[0200] Fig.11 A structural diagram of a dedicated key management service device provided by an embodiment of the present invention; Fig.11 As shown, this embodiment provides a dedicated key management service device, which is connected to the key management service KMS gateway in communication. Specifically, the dedicated key management service device is used to perform the above Figure 8 The key management method shown, the dedicated key management service device may include:

[0201] The second acquisition module 31 is used to receive a key management request sent by the KMS gateway;

[0202] The second calling module 32 is used to call the exclusive cryptographic machine resource pool corresponding to the exclusive KMS based on the key management request;

[0203] The second processing module 33 is used to perform key management operations using a dedicated cryptographic machine resource pool.

[0204] In some examples, the dedicated KMS communication is connected to a dedicated gateway of a dedicated network; the second acquisition module 31, the second calling module 32 and the second processing module 33 in this embodiment are respectively used to perform the following steps:

[0205] A second acquisition module 31, used to obtain a data encryption and decryption request through a proprietary gateway;

[0206] The second calling module 32 is used to call the dedicated cryptographic machine resource pool to generate a data key corresponding to the data encryption and decryption request based on the data encryption and decryption request;

[0207] The second processing module 33 is used to perform encryption and decryption operations on the data based on the data key.

[0208] In some examples, the second acquisition module 31 and the second processing module 33 in this embodiment are respectively used to perform the following steps:

[0209] The second acquisition module 31 is used to acquire the credential configuration information corresponding to the dedicated KMS input by the user;

[0210] The second processing module 33 is used to generate an authorization certificate corresponding to the exclusive KMS based on the certificate configuration information; save the authorization certificate to identify the legitimacy of the data encryption and decryption request or the key management request.

[0211] In some examples, before the dedicated KMS receives the key management request, the second acquisition module 31 and the second processing module 33 in this embodiment are respectively used to perform the following steps:

[0212] The second acquisition module 31 is used to obtain the configuration information of the exclusive cryptographic machine resource pool input by the user;

[0213] The second processing module 33 is used to generate a dedicated cryptographic machine resource pool based on the configuration information.

[0214] Fig.11 The device shown can perform Figure 8 For the method of the embodiment shown in the figure, the part not described in detail in this embodiment can be referred to Figure 8 The implementation process and technical effects of this technical solution refer to Figure 8 The description in the illustrated embodiment will not be repeated here.

[0215] In one possible design, Fig.11 The structure of the dedicated key management service device shown can be implemented as an electronic device, which can be a mobile phone, a tablet computer, a server, or other devices. Fig.12 As shown, the electronic device may include: a second processor 41 and a second memory 42. The second memory 42 is used to store the corresponding electronic device executing the above Figure 8 The program of the key management method in the illustrated embodiment, the second processor 41 is configured to execute the program stored in the second memory 42.

[0216] The program includes one or more computer instructions, wherein when one or more computer instructions are executed by the second processor 41, the following steps can be implemented: receiving a key management request sent by the KMS gateway; calling an exclusive cryptographic machine resource pool corresponding to the exclusive KMS based on the key management request; and performing key management operations using the exclusive cryptographic machine resource pool.

[0217] Furthermore, the second processor 41 is also used to execute the aforementioned Figure 8 All or part of the steps in the illustrated embodiments.

[0218] The structure of the electronic device may further include a second communication interface 43 for the electronic device to communicate with other devices or a communication network.

[0219] In addition, an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by electronic devices, which includes instructions for executing the above Figure 8 The procedures involved in the key management method in the method embodiment shown.

[0220] In addition, an embodiment of the present invention provides a computer program product, including: a computer program, when the computer program is executed by a processor of an electronic device, the processor executes Figure 8 The key management method in the method embodiment is shown.

[0221] Fig.13 A schematic diagram of a key management method provided by another embodiment of the present invention; Fig.13 As shown, this embodiment provides a key management method, the execution subject of the key management method is a key management device, which can be specifically implemented as a shared key management service KMS, that is, the method can be applied to a shared key management service KMS, wherein the shared KMS communication is connected with a KMS gateway; specifically, the key management method in this embodiment may include:

[0222] Step S1301: Obtain a key management request through the KMS gateway.

[0223] Step S1302: Determine the user master key corresponding to the key management request.

[0224] Step S1303: Send the user master key to the KMS gateway, so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

[0225] When a user has a key management requirement, in order to accurately implement the key management operation, all key management requests need to be sent to the shared KMS for processing. Specifically, a key management request can be sent to the shared KMS through the KMS gateway, so that the shared KMS obtains the key management request through the KMS gateway. After the shared KMS obtains the key management request, the shared cryptographic machine resource pool can be called to establish a customer master key (Customer Master Key, referred to as CMK) corresponding to the key management request. The customer master key is a key encryption key, which is mainly used to encrypt and protect data encryption keys. After establishing the customer master key corresponding to the key management request, in order to facilitate the user to call, view and use the customer master key, the customer master key can be stored in the shared database in the shared KMS, and the customer master key can be sent to the KMS gateway, so that the KMS gateway can identify whether the key management request corresponds to a dedicated KMS based on the customer master key. Specifically, after the KMS gateway obtains the customer master key, the customer master key can be analyzed and processed to identify whether the key management request corresponds to a dedicated KMS.

[0226] The specific implementation process of identifying whether a key management request corresponds to a dedicated KMS by sharing the KMS in this embodiment is the same as that described above. Figure 2-Figure 4 The specific implementation process of the corresponding system to identify whether a key management request corresponds to an exclusive KMS through a shared KMS is similar. Please refer to the above statements for details and will not be repeated here.

[0227] Fig.14 A schematic diagram of the structure of a shared key management service device provided by an embodiment of the present invention; Fig.14 As shown, this embodiment provides a shared key management service device. When implemented specifically, the shared key management service device is implemented as a shared KMS, and the shared key management service device is connected to a key management service KMS gateway. Specifically, the dedicated key management service device is used to perform the above Fig.13 The key management method shown, the dedicated key management service device may include:

[0228] The third acquisition module 51 is used to obtain a key management request through the KMS gateway;

[0229] A third determination module 52, configured to determine a user master key corresponding to the key management request;

[0230] The third processing module 53 is used to send the user master key to the KMS gateway, so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

[0231] Fig.14 The device shown can perform Fig.13 For the method of the embodiment shown in the figure, the part not described in detail in this embodiment can be referred to Fig.13 The implementation process and technical effects of this technical solution refer to Fig.13 The description in the illustrated embodiment will not be repeated here.

[0232] In one possible design, Fig.14 The structure of the shared key management service device shown can be implemented as an electronic device, which can be a mobile phone, a tablet computer, a server, or other devices. Fig.15 As shown, the electronic device may include: a third processor 61 and a third memory 62. The third memory 62 is used to store the corresponding electronic device executing the above Fig.13 The third processor 61 is configured to execute the program of the key management method in the illustrated embodiment and is stored in the third memory 62 .

[0233] The program includes one or more computer instructions, wherein when one or more computer instructions are executed by the third processor 61, the following steps can be implemented: obtaining a key management request through a KMS gateway; determining a user master key corresponding to the key management request; and sending the user master key to the KMS gateway so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

[0234] Furthermore, the third processor 61 is also used to execute the aforementioned Fig.13 All or part of the steps in the illustrated embodiments.

[0235] The structure of the electronic device may further include a third communication interface 63 for the electronic device to communicate with other devices or a communication network.

[0236] In addition, an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by electronic devices, which includes instructions for executing the above Fig.13 The procedures involved in the key management method in the method embodiment shown.

[0237] In addition, an embodiment of the present invention provides a computer program product, including: a computer program, when the computer program is executed by a processor of an electronic device, the processor executes Fig.13 The key management method in the method embodiment is shown.

[0238] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0239] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on such an understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a computer product, and the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0240] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to produce a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0241] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable device to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0242] These computer program instructions may also be loaded onto a computer or other programmable device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0243] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0244] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0245] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0246] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A key management service system, characterized in that: include: A key management service KMS gateway and at least one dedicated KMS in communication with the KMS gateway; wherein, The KMS gateway is used to obtain a key management request, and when the key management request corresponds to a dedicated KMS, forward the key management request to the dedicated KMS; The dedicated KMS is used to receive the key management request, call the dedicated cryptographic machine resource pool corresponding to the dedicated KMS based on the key management request, and use the dedicated cryptographic machine resource pool to perform key management operations; After the KMS gateway obtains the key management request, the KMS gateway is further used to: determine the request type corresponding to the key management request and the network where the request is located; when the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS; when the request type is a preset key operation request or a key storage request, or the network where the request is located is an illegal network, the key management request is prohibited from being sent to the dedicated KMS; The system also includes a shared KMS that is communicatively connected to the KMS gateway; The KMS gateway is further configured to send the key management request to the shared KMS after obtaining the key management request; The shared KMS is used to receive the key management request, determine the user master key corresponding to the key management request, and send the user master key to the KMS gateway; The KMS gateway is used to obtain the user master key and identify whether the key management request corresponds to a dedicated KMS based on the user master key.

2. The system according to claim 1, characterized in that The dedicated KMS is connected to a dedicated gateway of a dedicated network, and the dedicated KMS is also used for: Obtaining a data encryption and decryption request through the proprietary gateway; Based on the data encryption and decryption request, calling the dedicated cryptographic machine resource pool to generate a data key corresponding to the data encryption and decryption request; The data encryption and decryption operations are performed based on the data key.

3. The system according to claim 2, characterized in that The KMS gateway is specifically used for: Obtaining key metadata from the user master key; Based on the key metadata, determine whether the key management request corresponds to a dedicated KMS, and if the key management request corresponds to a dedicated KMS, determine the dedicated KMS corresponding to the key management request based on the key metadata.

4. The system according to claim 2, characterized in that Before the dedicated KMS obtains the data encryption and decryption request through the dedicated gateway, or before the dedicated KMS receives the key management request, the dedicated KMS is further used to: Obtaining credential configuration information corresponding to the dedicated KMS input by the user; Based on the credential configuration information, generate an authorization credential corresponding to the dedicated KMS; The authorization certificate is saved to identify the legitimacy of the data encryption and decryption request or the key management request.

5. The system according to claim 2, characterized in that Before the dedicated KMS obtains the data encryption and decryption request through the dedicated gateway, or before the dedicated KMS receives the key management request, the dedicated KMS is further used to: Obtaining configuration information of the exclusive cryptographic machine resource pool input by the user; Based on the configuration information, the exclusive cryptographic machine resource pool is generated.

6. A key management method, characterized in that: Applied to a key management service KMS gateway, the KMS gateway is communicatively connected to a shared KMS and at least one dedicated KMS; the method comprises: Get key management request; Identifying, by the shared KMS, whether the key management request corresponds to a dedicated KMS; When the key management request corresponds to a dedicated KMS, forwarding the key management request to the corresponding dedicated KMS; After obtaining the key management request, the method further includes: Determining a request type corresponding to the key management request and a network where the request is located; If the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS; When the request type is a preset key operation request or a key storage request, or the network where the request is located is an illegal network, it is prohibited to send the key management request to the dedicated KMS; Identifying, by the shared KMS, whether the key management request corresponds to a dedicated KMS, including: Sending the key management request to the shared KMS; Acquire, through the shared KMS, a user master key corresponding to the key management request; Based on the user master key, it is identified whether the key management request corresponds to a dedicated KMS.

7. A key management method, characterized in that: Applied to a shared key management service KMS, wherein the shared KMS communication is connected to a KMS gateway; the method comprises: Obtain a key management request through a KMS gateway, wherein the KMS gateway is used to determine the request type corresponding to the key management request and the network where the request is located; when the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS; when the request type is a preset key operation request or key storage request, or the network where the request is located is an illegal network, the key management request is prohibited from being sent to the dedicated KMS; Determining a user master key corresponding to the key management request; The user master key is sent to the KMS gateway, so that the KMS gateway identifies whether the key management request corresponds to a dedicated KMS based on the user master key.

8. A key management service gateway, characterized in that: The key management service KMS gateway is communicatively connected to a shared KMS and at least one dedicated KMS; the KMS gateway includes: A first acquisition module, used to acquire a key management request; A first identification module, configured to identify, through the shared KMS, whether the key management request corresponds to a dedicated KMS; A first processing module, configured to forward the key management request to a corresponding dedicated KMS when the key management request corresponds to the dedicated KMS; The first processing module is further used to determine the request type corresponding to the key management request and the network where the request is located after obtaining the key management request; when the request type is a preset control request and the network where the request is located is a preset legal network, the key management request is allowed to be sent to the dedicated KMS; when the request type is a preset key operation request or a key storage request, or when the network where the request is located is an illegal network, the key management request is prohibited from being sent to the dedicated KMS; The first identification module is further used to send the key management request to the shared KMS; obtain the user master key corresponding to the key management request through the shared KMS; and identify whether the key management request corresponds to an exclusive KMS based on the user master key.

Images