A secure and universally applicable database key management system under hybrid cloud

Abstract

This invention discloses a secure and universal database key management system for hybrid cloud environments, specifically relating to the field of database encryption technology. It includes: a security API module, a control center module, a key generation module, a KMS service module, a key storage module, and a log management module. The security API module serves as the interface between the system and external systems, providing access permissions to the TeleDB database and generating keys. It also provides access to the TeleDB management platform and handles the installation and uninstallation of transparent encryption plugins. The API uses a self-developed symmetric encryption algorithm for encryption. The control center module coordinates and manages the various modules. The key management system in this invention uses a self-developed symmetric encryption algorithm for end-to-end security encryption, ensuring the absolute security of key information such as APIs, databases, and logs.

Description

Technical Field

[0001] This invention relates to the field of database encryption technology, and more specifically, to a secure and universal database key management system for hybrid cloud environments. Background Technology

[0002] As the group company's "cloud transformation and digital transformation" strategy deepens and the underlying technology move away from IOE (IBM, Oracle, and EMC) is implemented, replacing foreign commercial databases with technologies such as open-source, independently developed databases has become a trend, leading to increasingly higher requirements for database security and stable operation. Currently, regarding database security issues, the academic community has proposed some new cryptography-based technologies. In hybrid cloud scenarios, cryptography is needed to encrypt data from different users to ensure communication security. The question of how to protect data security from theft, tampering, or destruction is receiving increasing attention.

[0003] In existing technology, application CN107609420A discloses a database encryption system, including a permission management module, a key management module, an SQL parsing and reconstruction module, and an encryption / decryption module. This system combines internal and external encryption. The permission management module sets user permission checks and restrictions, measuring user permissions based on user security levels. The key management module manages the encrypted database, used for setting, saving, and retrieving keys. The SQL parsing and reconstruction module enables the exchange of plaintext and ciphertext data within the database. Users need to exchange and call the key management module and the encryption / decryption module when obtaining the decryption key. This invention ensures system security and has advantages such as stability and practicality. Although this system can store important information in the database in a closed manner, requiring users to be approved by the system before querying or retrieving information, and only users with plaintext approval can access the database, it cannot guarantee data security during encryption and cannot make the underlying data encryption transparent to users. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a secure and universal database key management system for hybrid cloud environments to address the problems mentioned in the background section.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a secure and universal database key management system for hybrid cloud environments, comprising: a security API module, a control center module, a key generation module, a KMS service module, a key storage module, and a log management module;

[0006] The security API module is the interface between the system and the outside world. It is used to provide access permissions to the TeleDB database and generate keys. It is also used to install and uninstall transparent encryption plugins for the TeleDB management platform. The API uses a symmetric encryption algorithm for encryption.

[0007] The control center module is used to coordinate and manage the various modules;

[0008] The key generation module generates a security key based on the security key generation request;

[0009] The KMS service module operates based on the request to generate a security key;

[0010] The key storage module caches and stores the security key;

[0011] The log management module is responsible for recording all interaction information between users and this key management system, and between this system and the KMS service.

[0012] Furthermore, before uninstalling the TeleDB database transparent plugin, it checks whether the current TeleDB database has encrypted table data. If so, it indicates that the encryption of the table data failed and reminds the user to decrypt the table data first. Otherwise, uninstalling the transparent encryption plugin will cause an error. After installing the TeleDB database transparent encryption plugin, wait for the plugin to send an installation success message.

[0013] Furthermore, the content encrypted using a symmetric encryption algorithm by the secure API module includes:

[0014] First, a symmetric key is generated using a secure random number generator; then, the same key is used for encryption and decryption using a symmetric encryption algorithm.

[0015] Securely distribute the generated symmetric key to both communicating parties;

[0016] The transmitted data is encrypted using a symmetric key, where the transmitted data and the key are input into a symmetric encryption algorithm to generate ciphertext data;

[0017] The encrypted ciphertext data is sent to the recipient via API;

[0018] The receiver uses the same key to decrypt the received key data.

[0019] After decryption, the recipient processes the data for use in the application.

[0020] Furthermore, after receiving the key generation request sent by the TeleDB database, the security API module forwards the key generation request to the control center module. The control center module adaptively selects the corresponding key generation method according to the current cloud scenario; if it is a public cloud scenario, it selects the KMS service to generate the third-party key for the TeleDB database; if it is a private cloud scenario, it generates the security key itself.

[0021] Furthermore, the coordination process of the control center module includes the following:

[0022] The control center module receives requests from the security API module and performs verification and permission checks based on the requests;

[0023] The control center module determines the request based on the system environment information and forwards it to the corresponding module. The corresponding module then executes the requested operation and generates the result.

[0024] The control center module securely returns the results to the secure API module;

[0025] Meanwhile, the control center module periodically sends heartbeat packets to the TeleDB management platform to maintain the connection and monitors the connection status with the TeleDB management platform;

[0026] The control center module is connected to the location system and supports location awareness.

[0027] Furthermore, the content of the security key generated by the key generation module according to the security key generation request includes:

[0028] Specifically, the key generation module accepts a key generation request, detects that the key generation request comes from a private cloud scenario, and obtains instance information from the TeleDB database information;

[0029] Use the instance information of the TeleDB database as the salt value;

[0030] Use the key sent by the TeleDB database as the password for the key generator;

[0031] Generate security keys using Bouncy Castle;

[0032] The generated security key is stored in the key storage module.

[0033] Furthermore, the security key generated using Bouncy Castle includes the following:

[0034] The Bouncy Castle library is introduced, and a key generation algorithm is selected; the key generation algorithm includes either a symmetric key algorithm or an asymmetric key algorithm.

[0035] Initialize the key generator;

[0036] Set the length of the generated key according to security requirements;

[0037] Invoke the key generator's algorithm to generate a secure key;

[0038] The generated security key is transmitted to the recipient or the key storage module.

[0039] Furthermore, the operation process of the KMS service module includes the following:

[0040] The KMS service module receives the key generation request from the control center module and checks whether the key already exists based on the capability information.

[0041] If it does not exist, the KMS service module sends a request to the KMS service to generate a master key CMK;

[0042] The KMS service generates a master key request and returns the UUID of the master key.

[0043] Using the obtained master key UUID, the KMS service module sends a request to the KMS service to generate a data key DEK;

[0044] The KMS service responds to the request to generate a data key and returns the DEK, the corresponding KEY identifier, and the CMKUUID.

[0045] The KMS service module returns the obtained KEY, CMKUUID, and DEK mapping relationship to the control center module.

[0046] Furthermore, the operation of the key storage module includes the following:

[0047] The key storage module is responsible for caching and storing the security keys returned by the key generation module or the KMS service module;

[0048] Accept the control center's request to obtain a key and provide the security key;

[0049] The key storage module receives the security key, first stores it in the cache, then stores it on the corresponding SET instance node in ZooKeeper, and finally saves it in the TeleDB database.

[0050] Furthermore, the records include the number of requests to the KMS service, the returned results, the requested API, the request time, the number of user requests, the returned results, the requested API, and the request time, which are saved locally and stored in the TeleDB database.

[0051] The technical effects and advantages of this invention are as follows:

[0052] 1. Compared with existing key management systems, this invention solves the key management problem in cloud scenarios, while also being compatible with and supporting key management in hybrid cloud scenarios of public and private clouds; it supports the installation and uninstallation of transparent encryption plugins for TeleDB database instances, and supports key management in transparent data encryption. Through the transparent encryption plugin of TeleDB database, data can be encrypted when it is written to disk, which can ensure data security, and users are unaware of the encryption of the underlying data.

[0053] 2. Compared with existing key management methods, the key management system in this invention uses a self-developed symmetric encryption algorithm for end-to-end security encryption, ensuring the absolute security of key information such as APIs, databases, and logs; the key management system is deployed using automated scripts, supporting single-machine and master-slave configurations, and supporting high availability of services.

[0054] 3. Compared with existing key management methods, the key management system of the present invention adopts a multi-level storage method: local caching is used to quickly and efficiently obtain keys, ZooKeeper cluster stores keys to improve the high availability of key acquisition service, and database stores keys for recording and fallback purposes;

[0055] 4. The key management system in this invention is not only compatible with transparent encryption key management for database instances, but also with key management in other scenarios. As long as the API of this system is adapted, it can be accessed by this key management system, which is convenient to view and highly portable. The key management system in this invention supports providing keys based on Bouncy Castle, which has excellent security and superior performance characteristics. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the database key management system in Example 1;

[0057] Figure 2 Here is a basic flowchart of the key acquisition process in Example 2;

[0058] Figure 3 This is a schematic diagram of an electronic device according to Embodiment 3;

[0059] Figure 4 This is a schematic diagram of a computer-readable storage medium according to Embodiment 4. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0061] Furthermore, the accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor methods and / or microcontroller methods.

[0062] It should be understood that although terms such as "first," "second," etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are used merely to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, a first unit may be referred to as a second unit, and a similar second unit may be referred to as a first unit. The term "and / or" as used herein includes any and all combinations of one or more of the associated items listed.

[0063] Example 1

[0064] Please see Figure 1 As shown in the figure, this embodiment discloses a secure and universal database key management system for hybrid cloud environments, including: a security API module, a control center module, a key generation module, a KMS service module, a key storage module, and a log management module; the above modules are connected via wired and / or wireless means to realize data transmission between them;

[0065] The security API module serves as the interface between the system and external systems. It provides access permissions to the TeleDB database and generates keys. It also enables the installation and uninstallation of transparent encryption plugins for the TeleDB management platform. The security API module uses a self-developed symmetric encryption algorithm to ensure data security.

[0066] It should also be noted that the security API module supports various other platforms to connect to this key management system through the security API module. As long as the interface protocol requirements of the security API module are met, the secure key access function of this key management system can be used.

[0067] It should also be noted that before uninstalling the TeleDB database transparent plugin, check whether the current TeleDB database has encrypted table data. If it does, it means that the encryption of the table data failed and reminds the user to decrypt the table data first. Otherwise, uninstalling the transparent encryption plugin will cause an error. After installing the TeleDB database transparent encryption plugin, wait for the plugin to send an installation success message to ensure that the communication link is normal.

[0068] It should be noted that the content encrypted using the self-developed symmetric encryption algorithm in the security API module includes:

[0069] First, a symmetric key is generated using a secure random number generator; then, the same key is used for encryption and decryption using a symmetric encryption algorithm.

[0070] Securely distribute the generated symmetric key to both communicating parties;

[0071] The transmitted data is encrypted using a symmetric key, where the transmitted data and the key are input into a symmetric encryption algorithm to generate ciphertext data;

[0072] The encrypted ciphertext data is sent to the recipient via API;

[0073] The receiver uses the same key to decrypt the received key data.

[0074] After decryption, the recipient processes the data for use in the application.

[0075] It should be noted that after receiving the key generation request from the TeleDB database, the security API module forwards the key generation request to the control center module. The control center module adaptively selects the corresponding key generation method according to the current cloud scenario; if it is a public cloud scenario, it selects the KMS service to generate the third-party key for the TeleDB database; if it is a private cloud scenario, it generates the security key itself.

[0076] To further explain, a symmetric encryption algorithm is used to encrypt the data key and critical information to avoid security issues caused by key data leakage; and keepalived is bound to both the primary and backup nodes, providing services through VIP to ensure that the backup node continues to provide services even if the primary node fails.

[0077] The control center module is used to coordinate and manage the various modules to ensure effective communication between the system and external platforms.

[0078] Specifically, the coordination process of the control center module includes the following:

[0079] The control center module receives requests from the security API module and performs verification and permission checks based on the requests;

[0080] The control center module determines the request based on the system environment information and forwards it to the corresponding module. The corresponding module then executes the requested operation and generates the result.

[0081] The control center module securely returns the results to the secure API module;

[0082] Meanwhile, the control center module periodically sends heartbeat packets to the TeleDB management platform to maintain the connection and monitors the connection status with the TeleDB management platform;

[0083] The control center module is connected to the location system and supports location awareness.

[0084] It should be noted that the control center module is responsible for processing and forwarding requests received by the security API, and forwarding the requests to the corresponding modules according to the system environment information. After obtaining the results, the requests are returned to the security API module. The control center module is also responsible for periodically sending heartbeat packets to the TeleDB management platform and connecting with the location system to ensure the stability, security and maintainability of the system.

[0085] The key generation module generates a security key based on the security key generation request;

[0086] The key generation module generates the following security key content based on the security key generation request:

[0087] Specifically, the key generation module accepts a key generation request, detects that the key generation request comes from a private cloud scenario, and obtains instance information from the TeleDB database information;

[0088] Use the instance information of the TeleDB database as the salt value;

[0089] Use the key sent by the TeleDB database as the password for the key generator;

[0090] Generate security keys using Bouncy Castle;

[0091] The generated security key is stored in the key storage module.

[0092] It should be noted that the key generation module is used in private cloud scenarios to generate a security key based on TeleDB database information after receiving a key generation request from the control center; the open-source BouncyCastle is used to generate security keys for cryptography and security-related operations; the instance information of the TeleDB database is used as the salt, and the key sent by the TeleDB database is used as the key deriver's cipher to generate a fixed-length security key; the key generation process utilizes the salt, the key deriver's cipher, and a professional cryptography library to ensure the security and randomness of the generated key.

[0093] To further clarify, the security key generated using Bouncy Castle includes the following:

[0094] Import the Bouncy Castle library and select a key generation algorithm; the key generation algorithm includes symmetric key algorithms (such as AES) or asymmetric key algorithms (such as RSA);

[0095] Initialize the key generator;

[0096] Set the length of the generated key according to security requirements;

[0097] Invoke the key generator's algorithm to generate a secure key;

[0098] The generated security key is transmitted to the recipient or the key storage module.

[0099] It should be noted that, based on Bouncy Castle (an open-source Java cryptography library), the instance information of the TeleDB database is used as the salt value. The key sent by the TeleDB database transparent encryption plugin is used to generate a security key with an exponentiation. The security key is encrypted by the set symmetric encryption algorithm and then returned to the TeleDB database. It can be used as a third-party key for the TeleDB database in private cloud scenarios. The number of iterations and the length of the generated key are flexibly configurable.

[0100] Bouncy Castle, as the core algorithm of the key management system, boasts superior security and performance, playing a crucial role, particularly in key generation. The Bouncy Castle core employs advanced encryption techniques and mathematical algorithms to ensure the generated keys are extremely secure, difficult to crack or guess. Its security is built upon complex mathematical operations and cryptographic principles, preventing common attack methods such as brute-force attacks and weak key attacks. Bouncy Castle generates keys with strong uniqueness, ensuring that each generated key is unique. By employing high-quality random number generation algorithms and complex key derivation processes, it guarantees key uniqueness and unpredictability, thereby enhancing the overall security of the system. Furthermore, the Bouncy Castle algorithm core is highly flexible and customizable. It allows for customization of the key generation process according to the specific needs of the application, selecting key lengths, algorithms, and parameters suitable for specific application scenarios to meet different security requirements.

[0101] The KMS service module runs based on the request to generate a security key;

[0102] The operation of the KMS service module includes the following steps:

[0103] The KMS service module receives the key generation request from the control center module and checks whether the key already exists based on the capability information.

[0104] If it does not exist, the KMS service module sends a request to the KMS service to generate a master key CMK;

[0105] The KMS service generates a master key request and returns the UUID of the master key.

[0106] Using the obtained master key UUID, the KMS service module sends a request to the KMS service to generate a data key DEK;

[0107] The KMS service responds to the request to generate a data key and returns the DEK, the corresponding KEY identifier, and the CMKUUID.

[0108] The KMS service module returns the obtained KEY, CMKUUID, and DEK mapping relationship to the control center module.

[0109] It should be noted that, in public cloud scenarios, after receiving a key generation request from the control center, the KMS service module checks whether a key exists for the current KEY based on the instance information. If not, it first sends a request to the KMS service to generate a master key CMK, obtains the master key UUID, and then sends a request to the KMS service to generate a data key DEK. This results in a one-to-one correspondence between KEY, CMKUUID, and DEK. This module ensures that, in public cloud scenarios, the KMS service module can generate or retrieve the correspondence associated with KEY, CMKUUID, and DEK based on instance information, thereby ensuring the secure generation and use of keys.

[0110] To further explain, in the public cloud scenario, when this system receives a request to generate a key from TeleDB data transmission, it first sends a request to the self-developed KMS service to generate a master key CMK, generates a data key DEK based on the generated master key CMKUUID, encrypts the data key DEK and stores it in the key storage module, and then returns the key to the control center.

[0111] The key storage module caches and stores the security key;

[0112] The operation of the key storage module includes the following:

[0113] The key storage module is responsible for caching and storing the security keys returned by the key generation module or the KMS service module;

[0114] Accept the control center's request to obtain a key and provide the security key;

[0115] The key storage module receives the security key, first stores the security key in the cache, then stores it on the corresponding SET instance node in ZooKeeper, and finally saves it in the TeleDB database;

[0116] It should be noted that the key storage module uses a two-level cache, namely local cache and ZooKeeper storage, to improve the availability and efficiency of the system. When a request to retrieve the data key from the TeleDB database is received, it first retrieves it from the local cache. If the key is not found in the local cache, it retrieves it from the node path of the corresponding instance in ZooKeeper. Finally, it retrieves it from the TeleDB database of the system. The system will also back up an encrypted copy of the data key locally as a security backup to prevent the availability of TeleDB from being affected by KMS service or system downtime.

[0117] The log management module is responsible for recording all interactions between users and this key management system, as well as between this system and the KMS service;

[0118] It should be noted that the records include the number of requests to the KMS service, the returned results, the requested API, and the request time; the number of user requests, the returned results, the requested API, and the request time; and are stored locally and in the TeleDB database.

[0119] Furthermore, this system tracks the number of user requests, including the number of requests from the transparent encryption plugin of the user's TeleDB database instance to this system, and the number of requests initiated by this system to the KMS service, etc., for user traceability and as a basis for billing; this system periodically sends heartbeat packets to the TeleDB management platform to ensure that operations and maintenance personnel can monitor the status of this key management system.

[0120] Example 2

[0121] Please see Figure 3 As shown, this embodiment provides an electronic device, including: a processor and a memory, wherein the memory stores a computer program that can be called by the processor;

[0122] The processor executes a secure and universal database key management system for hybrid cloud environments, as described in Embodiment 1, by calling a computer program stored in the memory.

[0123] Example 3

[0124] Please see Figure 4 As shown, this embodiment provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform a secure and universal database key management system for hybrid cloud environments as described in Embodiment 1.

[0125] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired network. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0126] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0127] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0128] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only one method, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0131] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0133] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure and universal database key management system for hybrid cloud environments, characterized in that, include: Security API module, control The system includes a control center module, a key generation module, a KMS service module, a key storage module, and a log management module. The security API module is the interface between the system and the outside world. It is used to provide access permissions to the TeleDB database and generate keys. It is also used to install and uninstall transparent encryption plugins for the TeleDB management platform. The API uses a symmetric encryption algorithm for encryption. After receiving a key generation request from the TeleDB database, the security API module forwards the key generation request to the control center module. The control center module adaptively selects the corresponding key generation method according to the current cloud scenario. In a public cloud scenario, select the KMS service to generate a third-party key for the TeleDB database; in a private cloud scenario, generate a security key yourself. The control center module is used to coordinate and manage the various modules; The key generation module generates a security key according to the security key generation request, including: The key generation module accepts key generation requests and detects that the key generation request comes from a private cloud scenario, and obtains instance information from the TeleDB database information; Use the instance information of the TeleDB database as the salt value; Use the key sent by the TeleDB database as the password for the key generator; Generate security keys using Bouncy Castle; Store the generated security key in the key storage module; The security key generated using Bouncy Castle includes the following: The Bouncy Castle library is introduced, and a key generation algorithm is selected; the key generation algorithm includes either a symmetric key algorithm or an asymmetric key algorithm. Initialize the key generator; Set the length of the generated key according to security requirements; Invoke the key generator's algorithm to generate a secure key; The generated security key is transmitted to the recipient or the key storage module; The KMS service module operates based on the request to generate a security key; the operation process of the KMS service module includes the following: The KMS service module receives the key generation request from the control center module and checks whether the key already exists based on the capability information. If it does not exist, the KMS service module sends a request to the KMS service to generate a master key CMK; The KMS service generates a master key request and returns the UUID of the master key. Using the obtained master key UUID, the KMS service module sends a request to the KMS service to generate a data key DEK; The KMS service responds to the request to generate a data key and returns the DEK, the corresponding KEY identifier, and the CMKUUID. The KMS service module returns the obtained KEY, CMKUUID, and DEK mapping relationship to the control center module. The key storage module caches and stores the security key; the operation of the key storage module includes the following: The key storage module is responsible for caching and storing the security keys returned by the key generation module or the KMS service module; Accept the control center's request to obtain a key and provide the security key; The key storage module receives the security key, first stores the security key in the cache, then stores it on the corresponding SET instance node in ZooKeeper, and finally saves it in the TeleDB database; The log management module is responsible for recording all interaction information between users and this key management system, and between this system and the KMS service.

2. The secure and universal database key management system under a hybrid cloud environment according to claim 1, characterized in that, Before uninstalling the TeleDB database transparent plugin, check if the current TeleDB database has encrypted table data. If it does, it means that the encryption of the table data failed and reminds the user to decrypt the table data first. Otherwise, uninstalling the transparent encryption plugin will cause an error. After installing the TeleDB database transparent encryption plugin, wait for the plugin to send an installation success message.

3. The secure and universal database key management system for hybrid cloud environments according to claim 2, characterized in that, The content encrypted using the symmetric encryption algorithm by the security API module includes: First, a symmetric key is generated using a secure random number generator; then, the same key is used for encryption and decryption using a symmetric encryption algorithm. Securely distribute the generated symmetric key to both communicating parties; The transmitted data is encrypted using a symmetric key, where the transmitted data and the key are input into a symmetric encryption algorithm to generate ciphertext data; The encrypted ciphertext data is sent to the recipient via API; The receiver uses the same key to decrypt the received key data. After decryption, the recipient processes the data for use in the application.

4. A secure and universal database key management system for hybrid cloud environments according to claim 3, characterized in that, The coordination process of the control center module includes the following: The control center module receives requests from the security API module and performs verification and permission checks based on the requests; The control center module determines the request based on the system environment information and forwards it to the corresponding module. The corresponding module then executes the requested operation and generates the result. The control center module securely returns the results to the secure API module; Meanwhile, the control center module periodically sends heartbeat packets to the TeleDB management platform to maintain the connection and monitors the connection status with the TeleDB management platform; The control center module is connected to the location system and supports location awareness.

5. A secure and universal database key management system for hybrid cloud environments according to claim 4, characterized in that, The records include the number of requests to the KMS service, the returned results, the requested API, the request time, the number of user requests, the returned results, the requested API, and the request time, and are saved locally and stored in the TeleDB database.

Images