Data processing and key management method, data processing apparatus and key management device

Abstract

The present disclosure relates to a data processing and key management method, a data processing device and a key management equipment, the method comprising: obtaining service data provided by a service system, an identifier of the service system, a public key in a key group of the service system, and a version number corresponding to the key group; encrypting the version number through the public key to obtain first encrypted data; sending a key request carrying the first encrypted data and the identifier to the key management equipment; receiving response information returned by the key management equipment according to the key request; in the case that the response information is a data processing key, performing corresponding processing on the service data through the data processing key; wherein the data processing key is returned by the key management equipment in the case that security verification according to the key request is successful, the data processing key is obtained from registration information corresponding to the identifier, and the security verification success indicates that the version number obtained by decrypting the first encrypted data through a private key in the registration information is consistent with a version number in the registration information.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and more specifically, to a data processing method, a data processing apparatus, a key management method, and a key management device. Background Technology

[0002] With the continuous improvement of informatization, data security is receiving increasing attention. In large-scale information systems, when customer security data or some commercially sensitive data are involved, it is necessary to encrypt and store such data, and then decrypt it when needed.

[0003] In traditional technologies, each business system develops its own encryption and decryption services or uses a unified encryption utility class to ensure data security. However, for companies with numerous business systems, storing keys in each system poses a significant risk of data leakage. Summary of the Invention

[0004] One objective of this disclosure is to provide a new technical solution for improving data security.

[0005] According to a first aspect of this disclosure, a data processing method is provided, the method comprising:

[0006] The system obtains business data provided by the business system, the identifier of the business system, the public key in at least one key group of the business system, and the version number corresponding to the at least one key group; wherein the business data is data to be encrypted or data to be decrypted.

[0007] The version number is encrypted using the public key to obtain the first encrypted data;

[0008] Send a key request carrying the first encrypted data and the identifier to the key management device;

[0009] Receive the response information returned by the key management device based on the key request;

[0010] If the response information is a data processing key, the business data is processed accordingly using the data processing key; wherein, the data processing key is returned by the key management device after successful security verification according to the key request, the data processing key is obtained from the registration information corresponding to the identifier, and the successful security verification indicates that the version number obtained by decrypting the first encrypted data using the private key in the registration information is consistent with the version number in the registration information.

[0011] Optionally, before obtaining the business data provided by the business system, the identifier of the business system, the public key in at least one key group of the business system, and the version number corresponding to the at least one key group, the method further includes:

[0012] Obtain the identifier of the business system;

[0013] Based on the identifier of the business system, create at least one key group and a version number corresponding to the at least one key group; wherein, the key group includes a data processing key and a verification key pair, and the verification key pair includes a public key and a private key;

[0014] The identifier of the business system, at least one key group of the business system, and the version number of the corresponding at least one key group are sent to the key management device for registration, and the version number and the public key are configured in the business system.

[0015] Optionally, the method further includes:

[0016] If the response information is an exception indicating a request error, an alarm message corresponding to the exception information will be output.

[0017] Optionally, when the response information is a data processing key, processing the business data accordingly using the data processing key includes:

[0018] When the business data is data to be encrypted, the business data is encrypted using the data processing key to obtain second encrypted data, and the second encrypted data is sent to the database for storage.

[0019] If the business data is data to be decrypted, the business data is decrypted using the data processing key to obtain the first decrypted data.

[0020] Optionally, encrypting the business data using the data processing key to obtain second encrypted data includes:

[0021] The business data is encrypted using the data processing key to obtain the encrypted string corresponding to the business data;

[0022] The encrypted string corresponding to the business data is concatenated with the version number corresponding to the business system key group to obtain the second encrypted data.

[0023] According to a second aspect of this disclosure, a key management method is also provided, the method comprising:

[0024] The system receives a key request sent by a data processing device; wherein the key request carries first encrypted data and the identifier of the business system, and the first encrypted data is data obtained by encrypting the version number of the at least one key group provided by the business system through the public key in at least one key group;

[0025] In response to the key request, obtain the registration information corresponding to the identifier;

[0026] The first encrypted data is decrypted using the private key in the registration information;

[0027] If the version number obtained through decryption matches the version number in the registration information, the data processing key in the registration information is returned to the data processing device as the response information for the key request; wherein, the data processing key is used by the data processing device to process the business data provided by the business system, and the business data is data to be encrypted or data to be decrypted.

[0028] Optionally, before receiving the key request sent by the data processing device, the method further includes:

[0029] The system receives registration information sent by the data processing device; wherein the registration information includes the identifier of the business system, at least one key group of the business system and a version number corresponding to the at least one key group, the key group includes a data processing key and a verification key pair, the verification key pair includes a public key and a private key, the identifier of the business system is obtained by the data processing device, and the at least one key group and the version number corresponding to the at least one key group are created by the data processing device based on the identifier of the business system;

[0030] Save the registration information.

[0031] Optionally, the method further includes:

[0032] If the version number obtained through decryption is inconsistent with the version number in the registration information, the exception information indicating an abnormal request will be returned to the data processing device as the response information for the key request.

[0033] According to a third aspect of this disclosure, a data processing apparatus is also provided, including a memory and a processor, the memory being used to store a computer program, and the processor being used to execute the method as described in the first aspect of this disclosure under the control of the computer program.

[0034] According to a fourth aspect of this disclosure, a key management device is also provided, including a memory and a processor, the memory being used to store a computer program, and the processor being used to execute the method as described in the second aspect of this disclosure under the control of the computer program.

[0035] One beneficial effect of this disclosure is that, in the data processing method of this disclosure, a data processing key is obtained by verifying the identity information of the business system, and then the data processing key is used to encrypt and decrypt the data provided by the business system. Compared with the prior art, the data processing method of this disclosure can effectively improve data security. Furthermore, in the data processing method of this disclosure, by creating multiple version numbers for the business system, the data processing key can be changed periodically, thereby effectively reducing the risk of data leakage.

[0036] Other features and advantages of the embodiments of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0037] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the present disclosure and, together with their description, serve to explain the principles of the embodiments of the present disclosure.

[0038] Figure 1 It is a schematic diagram of the composition structure of a system capable of applying data processing according to some embodiments;

[0039] Figure 2 This is a flowchart illustrating a data processing method according to some embodiments;

[0040] Figure 3 This is a schematic diagram of the structure of a data processing apparatus according to some embodiments;

[0041] Figure 4 This is a flowchart illustrating a key management method according to some embodiments;

[0042] Figure 5 This is a schematic diagram of the structure of a key management device according to some embodiments;

[0043] Figure 6 This is a schematic diagram of the interaction flow of a data processing method according to some embodiments. Detailed Implementation

[0044] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps set forth in these embodiments do not limit the scope of the invention.

[0045] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0046] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and equipment should be considered part of the specification.

[0047] In all the examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values.

[0048] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0049] <Hardware Configuration>

[0050] Figure 1 This is a schematic diagram of the structural composition of a system capable of applying data processing according to some embodiments. For example... Figure 1 As shown, the system 1000 includes a data processing device 1100, a key management device 1200, and a network 1300. The system can be applied to data processing scenarios.

[0051] The data processing device 1100 can be a portable computer, desktop computer, tablet computer, etc. For example... Figure 1 As shown, the data processing device 1100 may include a processor 1110, a memory 1120, an interface device 1130, a communication device 1140, a display device 1150, an input device 1160, a speaker 1170, a microphone 1180, etc. The processor 1110 may be a central processing unit (CPU), a microprocessor (MCU), etc. The memory 1120 may include, for example, ROM (Read-Only Memory), RAM (Random Access Memory), or non-volatile memory such as a hard disk. The interface device 1130 may include, for example, a USB interface, a headphone jack, etc. The communication device 1140 may be capable of wired or wireless communication. The display device 1150 may be, for example, a liquid crystal display (LCD), a touch screen, etc. The input device 1160 may include, for example, a touch screen, a keyboard, etc. Users can input / output voice information through the speaker 1170 and the microphone 1180.

[0052] The key management device 1200 can be, for example, a blade proxy server. The key management device 1200 can be, for example, a blade proxy server. Figure 1As shown, the device includes a processor 1210, a memory 1220, an interface device 1230, a communication device 1240, a display device 1250, and an input device 1260. The processor 1210 may be, for example, a central processing unit (CPU) or a microprocessor (MCU). The memory 1220 may include, for example, ROM (Read-Only Memory), RAM (Random Access Memory), or non-volatile memory such as a hard disk. The interface device 1230 may include, for example, a USB interface or a serial interface. The communication device 1240 may be capable of wired or wireless communication. The display device 1250 may be, for example, a liquid crystal display (LCD). The input device 1260 may include, for example, a touchscreen or a keyboard.

[0053] Network 1300 can be a wireless network or a wired network, and can be a local area network (LAN) or a wide area network (WAN). Figure 1 In the system 1000 shown, the data processing device 1100 and the key management device 1200 can communicate via the network 1300.

[0054] Figure 1 The system 1000 shown is merely illustrative and is by no means intended to limit the invention, its application, or its uses.

[0055] Those skilled in the art should understand that, although in Figure 1 The present invention illustrates multiple devices for the data processing apparatus 1100, the key management device 1200, and the network 1300. However, the present invention may relate only to some of these devices; for example, the data processing apparatus 1100 may only involve the processor 1110 and the memory 1120, or the key management device 1200 may only involve the processor 1210 and the memory 1220, etc. Those skilled in the art can design instructions based on the disclosed scheme of the present invention. How the instructions control the processor to operate is well known in the art and will not be described in detail here.

[0056] The overall concept of this invention is to provide a novel data processing technical solution. A data processing device sends a key request to a key management device, which then returns response information based on the key request. The data processing device then processes the business data accordingly based on the received response information. Compared to existing technologies, the data processing method disclosed herein can effectively improve data security.

[0057] <Method Example 1>

[0058] Figure 2 This is a flowchart illustrating a data processing method according to some embodiments.

[0059] like Figure 2 As shown, the implementing entity of this embodiment is a data processing device, and the data processing method of this embodiment may include the following steps S2100 to S2500:

[0060] Step S2100: Obtain the business data provided by the business system, the identifier of the business system, the public key in at least one key group of the business system, and the version number corresponding to at least one key group.

[0061] In this embodiment, the data processing device acquires information from each business system to verify the identity of the business system. Simultaneously, the data processing device creates different key sets and corresponding version numbers for each key set to improve data security by changing the key sets of the business systems.

[0062] A business system refers to the business processes required for an enterprise to achieve its positioning, the roles played by each partner, and the methods and content of cooperation and transactions among stakeholders.

[0063] In some examples, business data may include at least one of data to be encrypted and data to be decrypted.

[0064] Data to be encrypted refers to data that needs to be encrypted. The basic process of data encryption is to process the original plaintext file or data according to a certain algorithm, making it an unreadable piece of code, usually called "ciphertext". The original content can only be displayed after the corresponding key is entered. In this way, the purpose of protecting the data from being stolen or read by unauthorized persons is achieved.

[0065] In some examples, the data to be encrypted may be, for example, fields or files containing sensitive information.

[0066] Data to be decrypted refers to data that needs to be decrypted. The reverse process of encryption is decryption, which is the process of converting encoded information back into its original form.

[0067] In some examples, the data to be decrypted may be, for example, a field or file containing ciphertext.

[0068] A key set refers to the collection of keys used to process business data. A key is a parameter input into algorithms that convert plaintext to ciphertext or vice versa. Keys are divided into symmetric keys and asymmetric keys. Symmetric key encryption, also known as private key encryption or shared key encryption, requires both the sender and receiver to use the same key to encrypt and decrypt plaintext. Symmetric key encryption algorithms mainly include DES, 3DES, IDEA, RC5, and RC6. Asymmetric key encryption systems, also known as public-key encryption, require different keys to perform encryption and decryption operations. One key is publicly released (the public key), and the other is kept secret by the user (the private key). The sender uses the public key to encrypt the information, while the receiver uses the private key to decrypt it.

[0069] In some examples, the data processing device can create multiple key groups and corresponding version numbers for each key group in batches. For instance, based on the identifier of the business system, the data processing device creates one key group and its corresponding version number at a time, and uses the data processing key in that key group to process the business data. When the same business data needs to be processed again, the data processing device creates another key group and its corresponding version number, and uses the data processing key in the newly created key group to process the business data, and so on.

[0070] In some examples, the data processing device can create multiple key groups and version numbers for each key group at once. For instance, the data processing device creates multiple key groups and version numbers for each key group based on the identifier of the business system. The data processing device uses the data processing key in any one of the key groups to process the business data. When the same business data needs to be processed again, the data processing device uses the data processing key in any one of the key groups to process the business data again.

[0071] In some examples, the key set of a business system may include at least one of a symmetric key and an asymmetric key.

[0072] A public key is the non-secret half of a key pair used with a private key algorithm. Public keys are typically used to encrypt session keys, verify digital signatures, or encrypt data that can be decrypted using the corresponding private key.

[0073] The version number is used to identify the key group, and each key group has a unique version number. Based on the version number, the data processing device can clearly identify the corresponding key group.

[0074] In some examples, the version number may consist of at least one of numbers and letters, or it may consist of other custom content, which is not limited here.

[0075] Before step S2100 obtains the business data provided by the business system, the identifier of the business system, the public key in at least one key group of the business system, and the version number corresponding to at least one key group, the following steps S2001 to S2003 may be further included:

[0076] Step S2001: Obtain the identifier of the business system.

[0077] In this embodiment, the data processing device creates information about the business system based on the identifier of the business system.

[0078] An identifier is a mark used for identification.

[0079] In some examples, the identifier of a business system can be, for example, a name, a number, a logo, or other content used to identify the business system, without limitation here.

[0080] In some examples, business systems can provide identifiers to data processing devices.

[0081] Step S2002: Based on the identifier of the business system, create at least one key group and the corresponding version number of the at least one key group for the business system.

[0082] In this embodiment, the data processing device creates information about the business system for subsequent authentication of the business system.

[0083] In some examples, the key set may include a data processing key and an authentication key pair.

[0084] A data processing key is a key used for data processing.

[0085] In some examples, the data processing key is the key used for data encryption and decryption.

[0086] A verification key pair is a key used to verify information.

[0087] In some examples, the verification key pair may include, for example, a public key and a private key.

[0088] Step S2003: Send the identifier of the business system, at least one key group of the business system and the version number of the corresponding key group to the key management device for registration, and configure the version number and public key in the business system.

[0089] In this embodiment, the data processing device sends information from the business systems to the key management device for unified registration, thereby facilitating unified management of keys for each business system, reducing the risk of data leakage, and improving data security. The data processing device also configures verification information in each business system so that the business system can request keys from the key management device.

[0090] The key management device is used to register and store information from various business systems, as well as to verify the identity of those requesting keys. Based on the verification results, it then sends a response to the data processing device to solve the key management problem caused by the large-scale application of cryptographic technology in distributed enterprise application environments.

[0091] In some examples, the key management device may be, for example, a server.

[0092] Step S2200: Encrypt the version number using the public key to obtain the first encrypted data.

[0093] In this embodiment, the data processing device encrypts the version number for subsequent authentication.

[0094] A public key and a private key are a key pair (i.e., a public key and a private key) obtained through an algorithm. One of them is made public and is called the public key; the other is kept secret and is called the private key. When using this key pair, if data is encrypted with one key, it must be decrypted with the other key.

[0095] Common asymmetric encryption algorithms include RSA, Elgamal, knapsack algorithm, Rabin, DH, and ECC elliptic curve cryptography.

[0096] In some examples, such as using the RSA algorithm to obtain a key pair, the version number can be encrypted using the public key in that key pair.

[0097] The first encrypted data refers to the encrypted version number.

[0098] Step S2300: Send a key request carrying the first encrypted data and identifier to the key management device.

[0099] In this embodiment, the data processing device sends a key request carrying verification information to the key management device, so that the key management device can verify the identity of the business system. The key management device obtains the private key corresponding to the public key in the first encrypted data based on the identifier, and then uses the private key to decrypt the first encrypted data.

[0100] A key request is used to request a key from the key management device to process business data.

[0101] Step S2400: Receive the response information returned by the key management device based on the key request.

[0102] In this embodiment, the data processing device obtains the response information sent by the key management device.

[0103] Response information refers to the information sent by the key management device to the data processing device based on the decryption result of the first encrypted data using the private key.

[0104] In some examples, the response information may be, for example, a data processing key. The response information is the data processing key when the version number obtained after decrypting the first encrypted data with the private key matches the version number registered by the key management device.

[0105] In some examples, the response information may also be an exception message indicating that the request was not successful. For instance, if the version number obtained after decrypting the first encrypted data with the private key does not match the version number registered with the key management device, the response information will be an exception message indicating that the request was not successful.

[0106] Step S2500: If the response information is a data processing key, process the business data accordingly using the data processing key.

[0107] In this embodiment, the data processing device uses the acquired data processing key to process the business data.

[0108] When the version number obtained by the key management device decrypting the first encrypted data using the private key in the registration information matches the version number in the registration information, the security verification is successful. If the key management device successfully performs security verification based on the key request, it returns a data processing key to the data processing device. The data processing key is obtained from the registration information corresponding to the key management device's identifier.

[0109] When the version number obtained by the key management device after decrypting the first encrypted data using the private key in the registration information does not match the version number in the registration information, it indicates that the security verification has failed. If the key management device fails to perform security verification based on the key request, it returns an exception message indicating an abnormal request to the data processing device, and the data processing device outputs an alarm message corresponding to the exception message.

[0110] In some examples, when the data processing device processes the same business data again, it can obtain a new data processing key by changing the key group and the version number of the key group in the business system. Then, the business data can be processed accordingly using the new data processing key, which can effectively reduce the risk of data leakage.

[0111] In step S2500, if the response information is a data processing key, the business data is processed accordingly using the data processing key, which may further include the following steps S2510 to S2520:

[0112] In step S2510, when the business data is data to be encrypted, the business data is encrypted using a data processing key to obtain second encrypted data, and the second encrypted data is sent to the database for storage.

[0113] In this embodiment, the data processing device uses a data processing key to encrypt the business data.

[0114] In some examples, the data processing key can be, for example, a key in a symmetric encryption technique.

[0115] Symmetric encryption, also known as single-key encryption, refers to encryption methods that use a single-key cryptosystem, where the same key can be used for both encryption and decryption. Commonly used symmetric encryption algorithms include: DES, 3DES, TDEA, Blowfish, RC2, RC4, RC5, IDEA, and Skipjack.

[0116] In some examples, the data processing key is stored directly in the memory of the data processing device to prevent it from being printed by the business system and thus prevent data processing key leakage.

[0117] The second type of encrypted data refers to encrypted business data.

[0118] A database is a "repository for organizing, storing, and managing data according to a data structure." It is a large collection of organized, shareable, and centrally managed data that is stored permanently in a computer.

[0119] In step S2510, the business data is encrypted using the data processing key to obtain the second encrypted data. This step may further include the following steps S2511 to S2512:

[0120] Step S2511: Encrypt the business data using the data processing key to obtain the encrypted string corresponding to the business data.

[0121] In this embodiment, the data processing device uses a data processing key to encrypt the business data, thereby obtaining the encrypted ciphertext of the business data.

[0122] An encrypted string refers to the ciphertext obtained by encrypting business data. Ciphertext is a message obtained by encrypting plaintext.

[0123] In some examples, the encrypted string may consist of numbers or letters, or other custom content, which is not limited here.

[0124] Step S2512: Concatenate the encrypted string corresponding to the business data with the version number corresponding to the business system key group to obtain the second encrypted data.

[0125] In this embodiment, the data processing device combines the version number with the encrypted ciphertext of the business data to facilitate subsequent decryption.

[0126] In some examples, the data processing device appends the version number corresponding to the business system key group to the encrypted string corresponding to the business data. For example, the second encrypted data is the encrypted string & version number.

[0127] In some examples, the data processing device appends the version number corresponding to the business system key group to the encrypted string corresponding to the business data. For example, the second encrypted data is the version number followed by the encrypted string.

[0128] Step S2520: If the business data is data to be decrypted, the business data is decrypted using the data processing key to obtain the first decrypted data.

[0129] In this embodiment, the data processing device uses a data processing key to decrypt the business data.

[0130] The first decrypted data refers to the decrypted business data.

[0131] In some examples, the data processing device uses a data processing key to decrypt the second encrypted data to obtain the first decrypted data. Specifically, the data processing device identifies the version number in the second encrypted data, obtains the data processing key corresponding to the business system based on the version number, and uses the data processing key to decrypt the business data to obtain the first decrypted data.

[0132] The data processing method of this embodiment obtains a data processing key by verifying the identity information of the business system, and then uses the data processing key to encrypt and decrypt the data provided by the business system. Compared with the prior art, the data processing method of this embodiment can effectively improve data security. Furthermore, by creating multiple version numbers for the business system, the data processing key can be changed periodically, thereby effectively reducing the risk of data leakage.

[0133] <Equipment Example 1>

[0134] Figure 3 This is a schematic diagram of the structure of a data processing apparatus according to some embodiments.

[0135] In this embodiment, a data processing device 3000 is also provided, such as... Figure 3 As shown, it includes a processor 3100 and a memory 3200. The memory 3200 is used to store an executable computer program, and the processor 3100 is used to execute the data processing method as described in the above embodiments under the control of the computer program.

[0136] In this embodiment, the data processing device 3000 may further include other devices or modules, such as... Figure 1 The data processing device 1100 shown is also described. The data processing device 1100 can also have various physical forms, such as a tablet computer, a handheld computer, a desktop computer, etc.

[0137] Those skilled in the art will understand that the data processing device 3000 can be implemented in various ways. For example, the data processing device 3000 can be implemented by configuring the processor with instructions. For example, instructions can be stored in ROM, and when the device is started, the instructions can be read from ROM into the programmable device to implement the data processing device 3000. For example, the data processing device 3000 can be embedded in a dedicated device (e.g., an ASIC), the data processing device 3000 can be divided into independent units, or they can be combined together. The data processing device 3000 can be implemented by one of the various implementation methods described above, or by a combination of two or more of the various implementation methods described above.

[0138] <Method Example 2>

[0139] Figure 4 This is a flowchart illustrating a key management method according to some embodiments.

[0140] like Figure 4 As shown, the implementation subject of this embodiment is a key management device, and the key management method of this embodiment may include the following steps S4100 to S4400:

[0141] Step S4100: Receive a key request sent by the data processing device.

[0142] In this embodiment, the key management device receives a key request carrying verification information, and then verifies the identity of the business system.

[0143] In some examples, the data processing device may be a terminal device, which may include distributed components for providing data processing programs; and the data processing device may provide utility classes for verifying the identity of the business system and encrypting / decrypting business data.

[0144] In some examples, the key management device can be a server, which is used to register and store information of various business systems, verify the identity of the requesting key, and then send response information back to the data processing device based on the verification result.

[0145] In some examples, the key request carries initial encrypted data and the identifier of the business system.

[0146] The first encrypted data is data obtained by encrypting the version number corresponding to at least one key group provided by the business system using the public key from at least one key group provided by the business system. For example, the first encrypted data is the encrypted version number.

[0147] A business system is identified by a tag that can be used to identify the business system. For example, a business system's logo can be used as its identifier.

[0148] Before step S4100 receives the key request sent by the data processing device, steps S4110 to S4120 are also included:

[0149] Step S4110: Receive registration information sent by the data processing device.

[0150] In this embodiment, the key management device registers information from each business system to facilitate subsequent identity verification.

[0151] In some examples, the registration information may include at least one of the following: the identifier of the business system, at least one set of keys for the business system, and the version number of the corresponding key set.

[0152] The identifier of the business system is obtained by the data processing device and is used to identify the business system.

[0153] At least one key set and its corresponding version number are created by the data processing device based on the identifier of the business system. A key set refers to a collection of keys used to process business data. The version number identifies the key set; each key set has a unique version number.

[0154] In some examples, the key set may include a data processing key and an authentication key pair, the authentication key pair including a public key and a private key.

[0155] A data processing key is a key used for data processing.

[0156] In some examples, the data processing key is the key used for data encryption and decryption.

[0157] A verification key pair is a key used to verify information.

[0158] In some examples, the verification key pair may include, for example, a public key and a private key.

[0159] Step S4120: Save the registration information.

[0160] In this embodiment, the key management device saves the information of each business system after registration.

[0161] Step S4200: In response to the key request, obtain the registration information corresponding to the identifier.

[0162] In this embodiment, after receiving the key request sent by the data processing device, the key management device needs to find the registration information of the corresponding business system in order to facilitate subsequent identity verification.

[0163] In some examples, the key management device obtains the registration information corresponding to the identifier of the business system.

[0164] Step S4300: Decrypt the first encrypted data using the private key in the registration information.

[0165] In this embodiment, the key management device verifies the information of the business system based on the private key corresponding to the public key in the registration information.

[0166] In some examples, the key management device obtains the private key from the registration information corresponding to the identifier, and uses the private key to decrypt the first encrypted data to obtain the decrypted version number.

[0167] A private key is the secret half of a key pair used with a public-key algorithm. A public key and a private key are a key pair (i.e., a public key and a private key) obtained through an algorithm. One of these is made public and called the public key; the other is kept secret and called the private key. When using this key pair, if data is encrypted with one key, it must be decrypted with the other key.

[0168] In some examples, the first encrypted data is the encrypted version number.

[0169] Decryption is the reverse process of encryption.

[0170] In step S4400, if the version number obtained by decryption matches the version number in the registration information, the data processing key in the registration information is returned to the data processing device as the response information for the key request.

[0171] In this embodiment, the key management device responds based on the decryption result and feeds back the response information to the data processing device.

[0172] If the version number obtained after decryption matches the version number in the registration information, the security verification is successful.

[0173] In some examples, if the version number obtained after decryption does not match the version number in the registration information, it indicates that the security verification has failed. The key management device returns the exception information indicating the request error to the data processing device as the response information for the key request.

[0174] The response information represents the information sent by the key management device to the data processing device.

[0175] In some examples, the response information may include at least one of a data processing key and an exception message indicating that the request was not made.

[0176] The data processing key is used by the data processing device to process business data provided by the business system.

[0177] In some examples, the business data can be at least one of the data to be encrypted and the data to be decrypted.

[0178] The key management method in this embodiment reduces repetitive code development and improves R&D efficiency by uniformly managing the keys of various business systems. At the same time, verifying the identity information of the business systems to obtain data processing keys can effectively reduce the risk of data leakage and thus improve data security.

[0179] <Equipment Example 2>

[0180] Figure 5 This is a schematic diagram of a key management device according to some embodiments.

[0181] In this embodiment, a key management device 5000 is also provided, including a processor 5100 and a memory 5200. The memory 5200 is used to store an executable computer program, and the processor 5100 is used to execute the key management method as described in the above embodiment under the control of the computer program.

[0182] In this embodiment, the key management device 5000 may also include other devices or modules, such as... Figure 1 The key management device 1200 shown is shown.

[0183] In this embodiment, the key management device 1200 is not limited to a physical implementation; the key management device 1200 can be a blade server, a cloud server, a server cluster, etc.

[0184] Those skilled in the art will understand that the key management device 1200 can be implemented in various ways. For example, the key management device 1200 can be implemented by configuring a processor with instructions. For example, the instructions can be stored in ROM, and when the device is started, the instructions can be read from ROM into a programmable device to implement the key management device 1200. For example, the key management device 1200 can be embedded in a special-purpose device (e.g., an ASIC). The key management device 1200 can be divided into independent units, or they can be combined together. The key management device 1200 can be implemented by one of the various implementation methods described above, or by a combination of two or more of the various implementation methods described above.

[0185] Figure 6 This is a schematic diagram of the interaction flow of a data processing method according to some embodiments.

[0186] like Figure 6 As shown, the data processing method in this embodiment includes steps S6001 to S6014:

[0187] Step S6001: The data processing device obtains the identifier of the business system.

[0188] In some examples, the business system and the data processing device can be housed in the same electronic device; for example, the business system runs on the electronic device, and the data processing device is installed as a plug-in on the electronic device.

[0189] In some examples, business systems and data processing devices may also be located in different electronic devices.

[0190] In step S6002, the data processing device creates a key group and a corresponding version number for the business system based on the identifier of the business system.

[0191] In step S6003, the data processing device sends the identifier of the business system, the key group of the business system, and the version number of the corresponding key group to the key management device.

[0192] Step S6004: The key management device registers and saves the identifier of the business system, the key group of the business system, and the version number of the corresponding key group.

[0193] In step S6005, the data processing device sends the version number and public key to the business system.

[0194] Step S6006: The business system configures the version number and public key.

[0195] Step S6007: The business system sends business data to the data processing device.

[0196] In step S6008, the data processing device obtains the identifier of the business system, the public key in the key group of the business system, and the version number corresponding to the key group based on the business data sent by the business system.

[0197] In step S6009, the data processing device encrypts the version number using the public key to obtain the first encrypted data.

[0198] In step S6010, the data processing device sends a key request carrying the first encrypted data and identifier to the key management device.

[0199] In step S6011, the key management device responds to the key request sent by the data processing device and obtains the registration information corresponding to the identifier.

[0200] In step S6012, the key management device decrypts the first encrypted data using the private key in the registration information.

[0201] In step S6013, the key management device returns response information to the data processing device based on the decryption result.

[0202] In step S6014, if the response information is a data processing key, the data processing device processes the business data accordingly using the data processing key.

[0203] In this embodiment, unified management of keys for various business systems can reduce repetitive code development and improve R&D efficiency; at the same time, verifying the identity information of business systems to obtain data processing keys can effectively reduce the risk of data leakage and thus improve data security.

[0204] This invention can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.

[0205] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0206] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0207] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0208] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0209] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0210] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0211] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions. It will be known to those skilled in the art that implementation in hardware, implementation in software, and implementation using a combination of software and hardware are equivalent.

[0212] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, and are not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein. The scope of the invention is defined by the appended claims.

Claims

1. A data processing method, characterized in that, include: Obtain the identifier of the business system; Based on the identifier of the business system, create at least one key group and a version number corresponding to the at least one key group; wherein, the key group includes a data processing key and a verification key pair, and the verification key pair includes a public key and a private key; The identifier of the business system, at least one key group of the business system, and the version number corresponding to the at least one key group are sent to the key management device for registration, and the version number and the public key are configured in the business system. The system obtains business data provided by the business system, the identifier of the business system, the public key in at least one key group of the business system, and the version number corresponding to the at least one key group; wherein the business data is data to be encrypted or data to be decrypted. The version number is encrypted using the public key to obtain the first encrypted data; Send a key request carrying the first encrypted data and the identifier to the key management device; Receive the response information returned by the key management device based on the key request; If the response information is a data processing key, the business data is processed accordingly using the data processing key; wherein, the data processing key is returned by the key management device after successful security verification according to the key request, the data processing key is obtained from the registration information corresponding to the identifier, and the successful security verification indicates that the version number obtained by decrypting the first encrypted data using the private key in the registration information is consistent with the version number in the registration information.

2. The method according to claim 1, characterized in that, The method further includes: If the response information is an exception indicating a request error, an alarm message corresponding to the exception information will be output.

3. The method according to claim 1, characterized in that, When the response information is a data processing key, the process of processing the business data using the data processing key includes: When the business data is data to be encrypted, the business data is encrypted using the data processing key to obtain second encrypted data, and the second encrypted data is sent to the database for storage. If the business data is data to be decrypted, the business data is decrypted using the data processing key to obtain the first decrypted data.

4. The method according to claim 3, characterized in that, The step of encrypting the business data using the data processing key to obtain second encrypted data includes: The business data is encrypted using the data processing key to obtain the encrypted string corresponding to the business data; The encrypted string corresponding to the business data is concatenated with the version number corresponding to the business system key group to obtain the second encrypted data.

5. A key management method, characterized in that, include: The system receives registration information sent by a data processing device; wherein the registration information includes the identifier of the business system, at least one key group of the business system and a version number corresponding to the at least one key group, the key group includes a data processing key and a verification key pair, the verification key pair includes a public key and a private key, the identifier of the business system is obtained by the data processing device, and the at least one key group and the version number corresponding to the at least one key group are created by the data processing device based on the identifier of the business system. Save the registration information; The system receives a key request sent by the data processing device; wherein the key request carries first encrypted data and the identifier of the business system, and the first encrypted data is data obtained by encrypting the version number of the at least one key group provided by the business system through the public key in at least one key group provided by the business system. In response to the key request, obtain the registration information corresponding to the identifier; The first encrypted data is decrypted using the private key in the registration information; If the version number obtained through decryption matches the version number in the registration information, the data processing key in the registration information is returned to the data processing device as the response information for the key request; wherein, the data processing key is used by the data processing device to process the business data provided by the business system, and the business data is data to be encrypted or data to be decrypted.

6. The method according to claim 5, characterized in that, Also includes: If the version number obtained through decryption is inconsistent with the version number in the registration information, the exception information indicating an abnormal request will be returned to the data processing device as the response information for the key request.

7. A data processing apparatus, characterized in that, It includes a memory and a processor, the memory being used to store a computer program, and the processor being used to execute the method as described in any one of claims 1-4 under the control of the computer program.

8. A key management device, characterized in that, It includes a memory and a processor, the memory being used to store a computer program, and the processor being used to execute the method as described in any one of claims 5-6 under the control of the computer program.

Images