Encryption and decryption method, device, equipment and medium for database key manager

Abstract

The present application is applicable to the field of data security technology, and in particular, relates to an encryption and decryption method, device, equipment and medium of a database key manager. When a user creates a data encryption key, the encryption method uses a master white box key to decrypt component ciphertexts to obtain a first component, uses the first component to encrypt the data encryption key to obtain an initial ciphertext, uses the second component to encrypt the initial ciphertext to obtain a final ciphertext, and outputs the final ciphertext in association with the white box key version information. When the decryption method decrypts the target ciphertext obtained by encrypting data with the data encryption key, the master white box key is used to decrypt the component ciphertext of the secondary master key to obtain a first component, uses the second component of the secondary master key to decrypt the target ciphertext to obtain an initial ciphertext, uses the first component to decrypt the initial ciphertext to obtain the data encryption key, and uses the data encryption key to decrypt the target ciphertext to obtain data. The security of the key is improved.

Description

Technical Field

[0001] The present application is applicable to the field of data security technology, and in particular, relates to an encryption and decryption method, device, equipment and medium for a database key manager. Background Art

[0002] With the rapid development of information technology, databases, as core components for storing and managing data, are increasingly widely used in all walks of life. In order to ensure data security, databases usually need to encrypt the stored data. In the process of encrypting data, key management is particularly important. Traditional key management usually stores keys in trusted devices such as hardware security modules (HSM). In some scenarios where hardware is lacking or cost requirements are high, software such as software key managers are usually required to implement key storage and management. When encrypting or decrypting data through software key managers, in order to simplify the operation process, the keys are usually required to be directly read and applied by the software key manager in plain text. This process of using keys in plain text is usually accompanied by the risk of key leakage, thereby causing potential security risks. Therefore, how to improve the security of keys has become an urgent problem to be solved. Summary of the invention

[0003] In view of this, an embodiment of the present application provides an encryption and decryption method, apparatus, device and medium for a database key manager to solve the problem of how to improve the security of the key.

[0004] In a first aspect, an embodiment of the present application provides an encryption method for a database key manager, the encryption method comprising:

[0005] When a user creates a data encryption key, obtaining a master white box key, a secondary master key, and white box key version information stored in a shared library of the database key manager, wherein the secondary master key includes a component ciphertext obtained by encrypting a first component using the master white box key and a second component;

[0006] Decrypting the component ciphertext using the master white-box key to obtain the first component;

[0007] Encrypt the data encryption key using the first component to obtain an initial ciphertext;

[0008] The initial ciphertext is encrypted using the second component to obtain a final ciphertext corresponding to the data encryption key, and the final ciphertext is associated with the white-box key version information and output.

[0009] In a second aspect, an embodiment of the present application provides a decryption method of a database key manager. After obtaining the final ciphertext and white-box key version information by adopting the encryption method of the database key manager described in the first aspect, the decryption method includes:

[0010] When decrypting a target ciphertext obtained by encrypting data with the data encryption key in the final ciphertext, obtaining the final ciphertext and white box key version information associated with the final ciphertext;

[0011] According to the white box key version information associated with the final ciphertext, the secondary master key and the primary white box key are matched from the shared library, and the component ciphertext of the secondary master key is decrypted to obtain the first component;

[0012] Decrypting the target ciphertext using the second component of the secondary master key to obtain the initial ciphertext;

[0013] Decrypting the initial ciphertext using the first component to obtain the data encryption key;

[0014] The target ciphertext is decrypted using the data encryption key to obtain the data.

[0015] In a third aspect, an embodiment of the present application provides an encryption device for a database key manager, the encryption device comprising:

[0016] A first acquisition module is configured to acquire, when a user creates a data encryption key, a master white box key, a secondary master key, and white box key version information stored in a shared library of the database key manager, wherein the secondary master key includes a component ciphertext and a second component obtained by encrypting the first component using the master white box key;

[0017] A first decryption module, configured to decrypt the component ciphertext using the master white-box key to obtain the first component;

[0018] A first encryption module, used to encrypt the data encryption key using the first component to obtain an initial ciphertext;

[0019] The second encryption module is used to encrypt the initial ciphertext using the second component to obtain a final ciphertext corresponding to the data encryption key, and output the final ciphertext in association with the white box key version information.

[0020] In a fourth aspect, an embodiment of the present application provides a decryption device for a database key manager. After obtaining the final ciphertext and white-box key version information by adopting the encryption method of the database key manager as described in the first aspect above, the decryption device includes:

[0021] A sixth acquisition module, configured to acquire the final ciphertext and white box key version information associated with the final ciphertext when decrypting a target ciphertext obtained by encrypting data with the data encryption key in the final ciphertext;

[0022] a fifth decryption module, configured to match the secondary master key and the primary white box key from the shared library according to the white box key version information associated with the final ciphertext, and decrypt the component ciphertext of the secondary master key to obtain the first component;

[0023] a sixth decryption module, configured to decrypt the target ciphertext using the second component of the secondary master key to obtain the initial ciphertext;

[0024] a seventh decryption module, configured to decrypt the initial ciphertext using the first component to obtain the data encryption key;

[0025] An eighth decryption module is used to decrypt the target ciphertext using the data encryption key to obtain the data.

[0026] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the encryption method of the database key manager as described in the first aspect or the decryption method of the database key manager as described in the second aspect is implemented.

[0027] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the encryption method of the database key manager as described in the first aspect, or the decryption method of the database key manager as described in the second aspect is implemented.

[0028] Compared with the prior art, the embodiments of the present application have the following beneficial effects: when a user creates a data encryption key, the present application obtains the primary white box key, the secondary master key and the white box key version information stored in the shared library of the database key manager, uses the primary white box key to decrypt the component ciphertext to obtain the first component, uses the first component to encrypt the data encryption key to obtain the initial ciphertext, uses the second component to encrypt the initial ciphertext to obtain the final ciphertext of the corresponding data encryption key, and associates the final ciphertext with the white box key version information and outputs it. When decrypting the target ciphertext obtained by encrypting the data with the data encryption key in the final ciphertext, the secondary master key and the primary white box key are matched from the shared library according to the white box key version information associated with the final ciphertext, the component ciphertext of the secondary master key is decrypted to obtain the first component, the second component of the secondary master key is used to decrypt the target ciphertext to obtain the initial ciphertext, the first component is used to decrypt the initial ciphertext to obtain the data encryption key, and the target ciphertext is decrypted using the data encryption key to obtain the data. Among them, the database key manager uses a three-level key management system to divide the keys into primary white box keys, secondary master keys and data encryption keys. The primary white box key is used to encrypt the first component of the secondary master key, the secondary master key is used to encrypt the data encryption key, and the data encryption key is used to encrypt data. Among them, by using white-boxed primary white box keys and secondary master keys, the primary white box keys and secondary master keys do not appear in plain text when stored or encrypted and decrypted while ensuring normal key creation, encryption and decryption operations, thereby avoiding the risk of being leaked and improving the security of the primary white box keys and secondary master keys. Moreover, since the secondary master key is composed of the component ciphertext and the second component, different secondary master keys are distinguished from each other, and users can freely create multiple different secondary master keys, which improves the flexibility of secondary master key creation while also improving the security of secondary master keys. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0030] Figure 1 This is a schematic diagram of an application environment of an encryption method of a database key manager and a decryption method of a database key manager provided in the first embodiment of the present application;

[0031] Figure 2 It is a flowchart of an encryption method of a database key manager provided in Embodiment 2 of the present application;

[0032] Figure 3This is a schematic diagram of the overall structure of a master white box key, a secondary master key and a data encryption key in a database key manager provided in Embodiment 2 of the present application;

[0033] Figure 4 It is a flowchart of an encryption method of a database key manager provided in Embodiment 3 of the present application;

[0034] Figure 5 It is a flowchart of an encryption method of a database key manager provided in Embodiment 4 of the present application;

[0035] Figure 6 It is a flowchart of an encryption method of a database key manager provided in Embodiment 5 of the present application;

[0036] Figure 7 It is a flowchart of an encryption method of a database key manager provided in Example 6 of the present application;

[0037] Figure 8 It is a flowchart of a decryption method of a database key manager provided in Embodiment 7 of the present application;

[0038] Fig. 9 It is a structural schematic diagram of an encryption device of a database key manager provided in Embodiment 8 of the present application;

[0039] Fig.10 It is a structural schematic diagram of a decryption device of a database key manager provided in Embodiment 9 of the present application;

[0040] Fig.11 It is a structural diagram of a computer device provided in Example 10 of the present application. DETAILED DESCRIPTION

[0041] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0042] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0043] It should also be understood that the term “and / or” used in the specification and appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0044] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0045] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0046] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0047] It should be understood that the size of the serial numbers of the steps in the following embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0048] In order to illustrate the technical solution of the present application, a specific embodiment is provided below for illustration.

[0049] The first embodiment of the present application provides an encryption method for a database key manager and a decryption method for a database key manager, which can be applied in the following aspects: Figure 1In the application environment, the server communicates with the client, the server provides the key publishing and creation functions of the database key manager, and the client obtains the database key manager and its primary and secondary keys from the server, so as to realize the work of using the database key manager to encrypt and decrypt data. The client includes but is not limited to PDAs, desktop computers, notebook computers, ultra-mobile personal computers (UMPC), netbooks, cloud computing devices, personal digital assistants (PDA) and other devices. The computer device corresponding to the server can be implemented by an independent server or a server cluster composed of multiple servers.

[0050] See also Figure 2 , is a flow chart of an encryption method of a database key manager provided in Embodiment 2 of the present application, the encryption method is applied to Figure 1 In the client, the server provides the client with a database key manager and a shared library for storing keys, etc., so that the created data encryption key can be output when the client user creates the data encryption key. Figure 2 As shown, the encryption method may include the following steps:

[0051] Step S201, when a user creates a data encryption key, obtain the master white box key, the secondary master key and the white box key version information stored in the shared library of the database key manager.

[0052] In the embodiment of the present application, the database key manager may refer to a tool for storing and managing database keys, and may perform operations such as key generation and storage, key update and rotation, and key distribution and access control. The database key manager manages the keys using a three-level key management system. The three-level key management system may refer to a key management system with different levels, which mainly includes three levels of keys: a master white box key, a sub-master key, and a data encryption key. The master white box key may refer to the highest level white box key, and the sub-master key may refer to the second highest level hybrid key, which includes a component ciphertext and a second component obtained by encrypting the first component using the master white box key, and the second component. A component may refer to a string of random numbers in plain text form, a component ciphertext may refer to a first component in ciphertext form obtained by encrypting the first component using a master white box key, a second component may refer to a white box key obtained by converting the random number into a white box key, a data encryption key may refer to a key in plain text form for encrypting and decrypting specific data, and in the three-level key management system, it may include a master white box key, multiple sub-master keys and data encryption keys, the master white box key may be used to encrypt and decrypt the sub-master key for protection, each sub-master key may be used to encrypt and decrypt the data encryption key for protection, and each data encryption key may be used to encrypt and decrypt specific data for protection.

[0053] The shared library may refer to a white box encryption library generated based on a primary white box key, a secondary master key and a white box algorithm, the shared library includes the primary white box key, the secondary master key, the white box key version information, and the algorithm logic required for the primary white box key and the secondary master key to perform encryption and decryption operations, the white box key version information may refer to the unique identification number (Identity document, ID) and version number corresponding to the primary white box key and the secondary master key. Specifically, when a user creates a data encryption key, the key management tool of the database key manager calls the interface of the shared library to obtain the primary white box key, the secondary master key and the white box key version information.

[0054] Step S202: decrypt the component ciphertext using the master white-box key to obtain a first component.

[0055] Step S203: Use the first component to encrypt the data encryption key to obtain an initial ciphertext.

[0056] Step S204: Use the second component to encrypt the initial ciphertext to obtain a final ciphertext corresponding to the data encryption key, and associate the final ciphertext with the white-box key version information and output them.

[0057] In an embodiment of the present application, the initial ciphertext may refer to the data encryption key in ciphertext form obtained by encrypting the data encryption key using the first component and the encryption algorithm, and the final ciphertext may refer to the data encryption key in ciphertext form obtained by encrypting the initial ciphertext using the second component and the encryption algorithm.

[0058] Specifically, first, the interface of the shared library is called through the database key management tool, and the component ciphertext is decrypted using the master white box key to obtain the first component. Then, the data encryption key is encrypted using the preset symmetric encryption algorithm and the first component to obtain the initial ciphertext. For example, the symmetric encryption algorithm can be an AES algorithm, an SM4 algorithm, a DES algorithm, etc. Finally, the interface of the shared library is called through the database key management tool, and the initial ciphertext is encrypted using the second component of the secondary master key to obtain the final ciphertext of the corresponding data encryption key. The final ciphertext obtained is associated with the version information of the master white box key and the secondary master key obtained for encrypting the data encryption key and output.

[0059] See also Figure 3 , is a schematic diagram of the overall structure of a master white box key, a secondary master key and a data encryption key in a database key manager provided in Embodiment 2 of the present application, such as Figure 3 As shown, the database key manager uses a three-level key management system, which includes a master white box key, a sub-master key and a data encryption key, wherein the master white box key, as the highest level key, encrypts the first component to obtain the component ciphertext, each sub-master key, as the second highest level key, encrypts the data encryption key to obtain the corresponding final ciphertext, and each data encryption key encrypts specific data.

[0060] The encryption and decryption methods of the database key manager are applied to the client. The server provides the client database key manager with the created master white box key and the second component of the secondary master key. The client can create the first component of the secondary master key according to specific needs, wherein the first component is a string of random numbers in plain text form. The user can generate one or more first components on the local client through the database key management tool before encryption and decryption according to specific needs, and obtain the component ciphertext after encryption with the master white box key, and store the component ciphertext in the file of the shared library.

[0061] When encrypting a data encryption key created by a user, this encryption method uses the master white box key to decrypt the component ciphertext to obtain the first component, uses the first component of the sub-master key to encrypt the data encryption key to obtain the initial ciphertext, uses the second component of the sub-master key to encrypt the initial ciphertext to obtain the final ciphertext of the data encryption key, and outputs the final ciphertext in association with the version information of the white box key.

[0062] When decrypting the ciphertext obtained by encrypting data with the data encryption key in the final ciphertext, the decryption method matches the secondary master key and the primary white box key according to the white box key version information associated with the final ciphertext, decrypts the component ciphertext of the secondary master key to obtain the first component, uses the second component of the secondary master key to decrypt the target ciphertext to obtain the initial ciphertext, uses the first component to decrypt the initial ciphertext to obtain the data encryption key, and uses the data encryption key to decrypt the ciphertext to obtain the data.

[0063] In an embodiment of the present application, when a user creates a data encryption key, the master white box key, the secondary master key, and the white box key version information stored in the shared library of the database key manager are obtained, the component ciphertexts are decrypted using the master white box key to obtain the first component, the data encryption key is encrypted using the first component to obtain the initial ciphertext, the initial ciphertext is encrypted using the second component to obtain the final ciphertext of the corresponding data encryption key, and the final ciphertext and the white box key version information are associated and output. Among them, the database key manager uses a three-level key management system to divide the keys into primary white box keys, secondary master keys and data encryption keys. The primary white box key is used to encrypt the first component of the secondary master key, the secondary master key is used to encrypt the data encryption key, and the data encryption key is used to encrypt data. Among them, by using white-boxed primary white box keys and secondary master keys, the primary white box keys and secondary master keys do not appear in plain text when stored or encrypted and decrypted while ensuring normal key creation, encryption and decryption operations, thereby avoiding the risk of being leaked and improving the security of the primary white box keys and secondary master keys. Moreover, since the secondary master key is composed of the component ciphertext and the second component, different secondary master keys are distinguished from each other, and users can freely create multiple different secondary master keys, which improves the flexibility of secondary master key creation while also improving the security of secondary master keys.

[0064] See also Figure 4 , is a flow chart of an encryption method of a database key manager provided in Embodiment 3 of the present application. Figure 4 As shown, in the above step S201, the initial ciphertext is encrypted using the second component to obtain the final ciphertext corresponding to the data encryption key, and after the final ciphertext and the white box key version information are associated and output, the encryption method may further include the following steps:

[0065] Step S401, when encrypting target data provided by a user, obtain a target ciphertext corresponding to a data encryption key to be used and white box key version information associated with the target ciphertext.

[0066] In the embodiment of the present application, the target data may refer to specific data in plain text form, for example, user information stored in a database, or document data, image data, and video data stored outside the database. The data encryption key to be used may refer to a key in plain text form for encrypting the target data, the target ciphertext may refer to the final ciphertext corresponding to the data encryption key to be used, and the white box key version information associated with the target ciphertext may refer to the ID and version number of the primary white box key and the secondary primary key for encrypting the data encryption key to be used.

[0067] Specifically, the target ciphertext and the white box key version information of the associated target ciphertext corresponding to the data encryption key to be used provided by the user can be directly obtained, or a random number of a specific length can be created as the data encryption key to be used according to the key management tool, and the data encryption key to be used can be encrypted according to the encryption method in steps S201 to S204 to obtain the target ciphertext and the white box key version information of the associated target ciphertext corresponding to the data encryption key to be used.

[0068] Step S402: According to the white box key version information associated with the target ciphertext, the corresponding target secondary master key and the primary white box key are matched from the shared library, and the component ciphertext of the target secondary master key is decrypted to obtain the target first component.

[0069] In an embodiment of the present application, the target secondary master key may refer to the secondary master key matched in the shared library according to the white box key version information of the associated target ciphertext, and the target first component may refer to the random number in plain text obtained by decrypting the component ciphertext of the target secondary master key.

[0070] Specifically, first, according to the ID and version number of the secondary master key associated with the target ciphertext, the corresponding target secondary master key is matched from the shared library, and then, by calling the interface of the shared library, the component ciphertext of the target secondary master key is decrypted using the master white box key to obtain the target first component.

[0071] Step S403: decrypt the target ciphertext using the second component of the target secondary master key to obtain the target initial ciphertext.

[0072] Step S404: decrypt the target initial ciphertext using the target first component to obtain a data encryption key to be used.

[0073] In the embodiment of the present application, the target initial ciphertext may refer to the initial ciphertext obtained by decrypting the target ciphertext.

[0074] Specifically, first, by calling the interface of the shared library, the target ciphertext is decrypted using the second component of the target secondary master key to obtain the target initial ciphertext, and then, the symmetric encryption algorithm used by the target first component in step S401 to encrypt the data encryption key to be used is obtained, and the target initial ciphertext is decrypted using the obtained symmetric encryption algorithm and the target first component to obtain the data encryption key to be used.

[0075] Step S405: encrypt the target data using the data encryption key to be used to obtain the ciphertext corresponding to the target data.

[0076] In the embodiment of the present application, the ciphertext corresponding to the target data may refer to the target data in ciphertext form. The target data may be encrypted according to the obtained data encryption key to be used and a preset encryption algorithm to obtain the ciphertext corresponding to the target data.

[0077] In the embodiment of the present application, when encrypting the target data provided by the user, according to the white box key version information associated with the target ciphertext, the corresponding target secondary master key and the master white box key are matched from the shared library, the component ciphertext of the target secondary master key is decrypted to obtain the target first component, the target ciphertext is decrypted using the second component of the target secondary master key to obtain the target initial ciphertext, the target initial ciphertext is decrypted using the target first component to obtain the data encryption key to be used, and the target data is encrypted using the data encryption key to be used to obtain the ciphertext corresponding to the target data. Among them, in the process of decrypting the target ciphertext corresponding to the data encryption key to be used by the master white box key and the target secondary master key to obtain the data encryption key to be used, since the second component of the master white box key and the target secondary master key is a white box key, it does not appear in the form of plain text in this decryption process, avoiding the risk of being attacked and leaked, and since the first component of the target secondary master key is a random number, different target secondary master keys are distinguished from each other, thereby improving the security of the target secondary master key, reducing the risk of the target ciphertext being cracked, and further improving the security of encrypting the target data.

[0078] See also Figure 5 , is a flow chart of an encryption method of a database key manager provided in Embodiment 4 of the present application. Figure 5 As shown, before obtaining the master white box key and the secondary master key stored in the shared library of the database key manager in the above step S201, the encryption method may further include the following steps:

[0079] Step S501: Obtain a first original key, a second original key and a first component.

[0080] Step S502: obtain a master white-box key according to a preset white-box key generation algorithm and a first original key, and obtain a second component according to a preset white-box key generation algorithm and a second original key.

[0081] In an embodiment of the present application, the first original key may refer to a random number used to convert a white box key into a primary white box key, the second original key may refer to a random number used to convert a white box key into a second component of a secondary master key, and the preset white box key generation algorithm may refer to a pre-set standard cryptographic algorithm.

[0082] Specifically, first, three random numbers are generated by a random number generator as the first original key, the second original key and the first component respectively; then, through the white box cryptography technology of static white box or dynamic white box, the preset white box key generation algorithm and the first original key are merged and confused to obtain the main white box key; the preset white box key generation algorithm and the second original key are merged and confused to obtain the second component.

[0083] Step S503: Use the master white-box key to encrypt the first component to obtain component ciphertext.

[0084] Step S504: Obtain a secondary master key according to the component ciphertext and the second component.

[0085] Specifically, in the process of obtaining the secondary master key, first, a shared library is generated based on the obfuscated generated main white box key, the second component and the preset white box key generation algorithm, and then, by calling the interface of the shared library, the first component is encrypted using the main white box key to obtain the component ciphertext, and finally, the component ciphertext and the second component are combined to obtain the secondary master key.

[0086] Step S505 : Map the master white box key and the secondary master key with the constructed white box key version information and store them in a shared library of the database key manager.

[0087] Specifically, first, the ID and version number of the master white box key and the secondary master key can be set respectively according to the key management tool, and then, by establishing a mapping table, a mapping relationship is formed between the master white box key and its ID and version number, and a mapping relationship is formed between the secondary master key and its ID and version number, and the mapping relationship is written into the established mapping table, and the mapping table is stored in the shared library of the database key manager.

[0088] In the embodiment of the present application, a master white box key is obtained according to a preset white box key generation algorithm and a first original key, a second component is obtained according to a preset white box key generation algorithm and a second original key, the first component is encrypted using the master white box key to obtain a component ciphertext, a sub-master key is obtained according to the component ciphertext and the second component, and the master white box key and the sub-master key are mapped and stored with the constructed white box key version information in a shared library of a database key manager. By using the white-boxed master white box key and the sub-master key, the master white box key and the sub-master key do not appear in plain text when they are stored or encrypted and decrypted while ensuring normal key creation, encryption and decryption operations, thereby avoiding the risk of being leaked and improving the security of the master white box key and the sub-master key. Moreover, since the sub-master key is composed of the component ciphertext and the second component, different sub-master keys are distinguished from each other, and users can freely create multiple different sub-master keys, thereby improving the flexibility of sub-master key creation and the security of sub-master keys.

[0089] See also Figure 6 , is a flowchart of an encryption method of a key manager of a search database provided in Embodiment 5 of the present application. Figure 6 As shown, after obtaining the master white-box key according to the preset white-box key generation algorithm and the first original key in the above step S502, the encryption method may further include the following steps:

[0090] Step S601: Update the master white box key to obtain an updated master white box key.

[0091] Step S602: Use the updated master white-box key to encrypt the first component to obtain an updated component ciphertext.

[0092] Step S603: Obtain an updated secondary master key according to the updated component ciphertext and the second component.

[0093] Step S604: Map and store the updated master white box key, the updated secondary master key and the constructed updated white box key version information into the shared library of the database key manager.

[0094] For example, if after the master white box key is obtained by using the dynamic white box technology, the master white box key is rotated and updated, first, a new first original key can be generated by a random number generator as the updated first original key, and then, the preset white box key generation algorithm and the updated first original key are merged and confused by the dynamic white box technology to obtain the updated master white box key. Finally, based on the updated master white box key, the version information of the secondary master key and the white box key is updated. For details, please refer to the contents of steps S502 to S505.

[0095] In the embodiments of the present application, the main white box key is updated to obtain an updated main white box key, and the version information of the secondary master key and the white box key is updated based on the updated main white box key. When the main white box key needs to be updated, the main white box key can be rotated and updated based on the dynamic white box technology. There is no need for complex modification or reconstruction, and the rotation update of the main white box key can be completed quickly, thereby improving the convenience of the rotation update of the main white box key.

[0096] See also Figure 7 , is a flow chart of an encryption method of a database key manager provided in Example 6 of the present application. Figure 7 As shown, after obtaining the secondary master key according to the component ciphertext and the second component in the above step S504, the encryption method may further include the following steps:

[0097] Step S701, updating the second component to obtain an updated second component, and updating the first component to obtain an updated first component.

[0098] Step S702: Use the master white-box key to encrypt the updated first component to obtain an updated component ciphertext.

[0099] Step S703, obtaining an updated secondary master key according to the updated component ciphertext and the updated second component, mapping and storing the updated secondary master key and the constructed updated white box key version information into the shared library of the database key manager.

[0100] Specifically, after obtaining the secondary master key, when the secondary master key is rotated and updated, first, the second component is updated to obtain an updated second component. For details, please refer to the content of updating the main white box key in step S601. Then, a new random number can be regenerated through a random number generator as the updated first component. Finally, based on the updated first component and the updated second component, the secondary master key is updated. For details, please refer to the content in steps S503 to S505, or the content in steps S602 to S604.

[0101] In the embodiment of the present application, the second component is updated to obtain an updated second component, the first component is updated to obtain an updated first component, and based on the updated first component and the updated second component, the version information of the secondary master key and the white box key is updated. When the secondary master key needs to be updated, the secondary master key can be rotated and updated based on the dynamic white box technology. There is no need for complex modification or reconstruction, and the rotation update of the secondary master key can be completed quickly, thereby improving the convenience of the rotation update of the secondary master key.

[0102] See also Figure 8, is a flowchart of a decryption method of a database key manager provided in Embodiment 7 of the present application. The decryption method is applied to Figure 1 The server provides the client with a database key manager and a shared library for storing keys, etc., so that when the client user decrypts the ciphertext obtained by encrypting the data with the data encryption key in the final ciphertext, the decrypted data is output, and the final ciphertext and white box key version information are obtained by using the encryption method of any one of the above embodiments 2 to 6. Figure 8 As shown, the decryption method may include the following steps:

[0103] Step S801, when decrypting the ciphertext obtained by encrypting data with the data encryption key in the final ciphertext, the final ciphertext and the white box key version information associated with the final ciphertext are obtained.

[0104] Step S802: According to the white box key version information associated with the final ciphertext, the secondary master key and the primary white box key are matched from the shared library, and the component ciphertext of the secondary master key is decrypted to obtain the first component.

[0105] Step S803: decrypt the target ciphertext using the second component of the secondary master key to obtain an initial ciphertext.

[0106] Step S804: decrypt the initial ciphertext using the first component to obtain a data encryption key.

[0107] Step S805: decrypt the ciphertext using the data encryption key to obtain data.

[0108] In the embodiment of the present application, data may refer to specific data in ciphertext form, and ciphertext may refer to data in ciphertext form obtained by encrypting data with a data encryption key.

[0109] Specifically, in the process of decrypting the ciphertext obtained by encrypting the data with the data encryption key in the final ciphertext, first, according to the obtained final ciphertext and the white box version information associated with the final ciphertext, the secondary master key and the primary white box key are matched from the shared library, and the final ciphertext is decrypted according to the obtained secondary master key and the primary white box key to obtain the data encryption key. Specifically, please refer to the contents of steps S401 to S404. Then, the ciphertext is decrypted according to the data encryption key and the preset decryption algorithm to obtain the data.

[0110] In the embodiment of the present application, when decrypting the ciphertext obtained by encrypting the data with the data encryption key in the final ciphertext, the sub-master key and the main white-box key are matched from the shared library according to the white-box key version information associated with the final ciphertext, the component ciphertext of the sub-master key is decrypted to obtain the first component, the target ciphertext is decrypted using the second component of the sub-master key to obtain the initial ciphertext, the initial ciphertext is decrypted using the first component to obtain the data encryption key, and the ciphertext is decrypted using the data encryption key to obtain the data. In the process of decrypting the final ciphertext corresponding to the data encryption key by the main white-box key and the sub-master key to obtain the data encryption key, since the second components of the main white-box key and the sub-master key are white-box keys, they do not appear in the form of plain text in this decryption process, thus avoiding the risk of being leaked by attacks, and since the first component of the sub-master key is a random number, different sub-master keys are distinguished from each other, thus improving the security of the sub-master key, reducing the risk of the final ciphertext being cracked, and further improving the security of the data obtained by decrypting the ciphertext.

[0111] The encryption method of the database key manager corresponding to the above embodiment, Fig. 9 The structure block diagram of the encryption device of the database key manager provided in the eighth embodiment of the present application is shown. The encryption device is applied to Figure 1 In the client, the server provides the client with a created database key manager and a shared library for storing keys, etc., so as to output the created data encryption key when the client user creates the data encryption key. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0112] See also Fig. 9 , the encryption device comprises:

[0113] A first acquisition module 91 is used to acquire a master white box key, a secondary master key and white box key version information stored in a shared library of the database key manager when a user creates a data encryption key, wherein the secondary master key includes a component ciphertext and a second component obtained by encrypting the first component using the master white box key;

[0114] A first decryption module 92, configured to decrypt the component ciphertext using the master white-box key to obtain the first component;

[0115] A first encryption module 93, configured to encrypt the data encryption key using the first component to obtain an initial ciphertext;

[0116] The second encryption module 94 is used to encrypt the initial ciphertext using the second component to obtain a final ciphertext corresponding to the data encryption key, and associate the final ciphertext with the white box key version information and output it.

[0117] Optionally, the encryption device further includes:

[0118] A second acquisition module is used to acquire a target ciphertext corresponding to a data encryption key to be used and white box key version information associated with the target ciphertext when encrypting target data provided by a user;

[0119] A second decryption module is configured to match the corresponding target secondary master key and the primary white box key from the shared library according to the white box key version information associated with the target ciphertext, decrypt the component ciphertext of the target secondary master key, and obtain a target first component;

[0120] A third decryption module, configured to decrypt the target ciphertext using the second component of the target secondary master key to obtain a target initial ciphertext;

[0121] a fourth decryption module, configured to decrypt the target initial ciphertext using the target first component to obtain the data encryption key to be used;

[0122] The third encryption module is used to encrypt the target data using the data encryption key to be used to obtain a ciphertext corresponding to the target data.

[0123] Optionally, the encryption device further includes:

[0124] A third acquisition module, used to acquire the first original key, the second original key and the first component;

[0125] a fourth acquisition module, configured to obtain the master white box key according to a preset white box key generation algorithm and the first original key, and obtain the second component according to the preset white box key generation algorithm and the second original key;

[0126] a fourth encryption module, configured to encrypt the first component using the master white-box key to obtain the component ciphertext;

[0127] a fifth acquisition module, configured to obtain the secondary master key according to the component ciphertext and the second component;

[0128] The first storage module is used to map and store the master white box key, the sub-master key and the constructed white box key version information into a shared library of the database key manager.

[0129] Optionally, the encryption device further includes:

[0130] A first updating module, configured to update the master white box key to obtain an updated master white box key;

[0131] A second updating module, configured to encrypt the first component using the updated master white-box key to obtain an updated component ciphertext;

[0132] A third updating module, configured to obtain an updated secondary master key according to the updated component ciphertext and the second component;

[0133] The second storage module is used to map and store the updated master white box key, the updated secondary master key and the constructed updated white box key version information into the shared library of the database key manager.

[0134] Optionally, the encryption device further includes:

[0135] a fourth updating module, configured to update the second component to obtain an updated second component, and to update the first component to obtain an updated first component;

[0136] a fifth updating module, configured to encrypt the updated first component using the master white-box key to obtain an updated component ciphertext;

[0137] The third storage module is used to obtain an updated secondary master key according to the updated component ciphertext and the updated second component, and map and store the updated secondary master key and the constructed updated white box key version information into the shared library of the database key manager.

[0138] It should be noted that the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0139] Corresponding to the online query method in the above embodiment, Fig.10 The structure block diagram of the decryption device of the database key manager provided in the ninth embodiment of the present application is shown. The decryption device is applied to Figure 1 The server provides the client with a database key manager and a shared library for storing keys, etc., so that when the client user decrypts the ciphertext obtained by encrypting the data with the data encryption key in the final ciphertext, the decrypted data can be output. For ease of explanation, only the parts related to the embodiments of the present application are shown.

[0140] See also Fig.10 After the final ciphertext and white-box key version information are obtained by using the encryption method of any one of the above-mentioned embodiments 2 to 6, the decryption device includes:

[0141] A sixth acquisition module 1001 is used to acquire the final ciphertext and white box key version information associated with the final ciphertext when decrypting the ciphertext obtained by encrypting data with the data encryption key in the final ciphertext;

[0142] a fifth decryption module 1002, configured to match the secondary master key and the primary white box key from the shared library according to the white box key version information associated with the final ciphertext, and decrypt the component ciphertext of the secondary master key to obtain the first component;

[0143] A sixth decryption module 1003, configured to decrypt the target ciphertext using the second component of the secondary master key to obtain the initial ciphertext;

[0144] A seventh decryption module 1004, configured to decrypt the initial ciphertext using the first component to obtain the data encryption key;

[0145] The eighth decryption module 1005 is used to decrypt the ciphertext using the data encryption key to obtain the data.

[0146] It should be noted that the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0147] Fig.11 This is a schematic diagram of the structure of a computer device provided in Example 10 of the present application. Fig.11 As shown, the computer device of this embodiment includes: at least one processor ( Fig.11 Only one is shown), a memory, and a computer program stored in the memory and executable on at least one processor, which implements the steps in any of the above-mentioned encryption methods of the database key manager or the above-mentioned decryption methods of the database key manager when the processor executes the computer program.

[0148] The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that Fig.11 This is merely an example of a computer device and does not constitute a limitation on the computer device. The computer device may include more or fewer components than those shown in the figure, or a combination of certain components, or different components. For example, it may also include a network interface, a display screen, and an input device.

[0149] The processor may be a CPU, or other general-purpose processors, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0150] The memory includes a readable storage medium, an internal memory, etc., wherein the internal memory may be the memory of a computer device, and the internal memory provides an environment for the operation of an operating system and computer-readable instructions in the readable storage medium. The readable storage medium may be a hard disk of a computer device, and in other embodiments may also be an external storage device of a computer device, for example, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on a computer device. Further, the memory may also include both an internal storage unit of a computer device and an external storage device. The memory is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as program codes of computer programs, etc. The memory may also be used to temporarily store data that has been output or is to be output.

[0151] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the above-mentioned method embodiment, which will not be repeated here. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiment when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying computer program code, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0152] The present application implements all or part of the processes in the above-mentioned embodiment method, and may also be completed through a computer program product. When the computer program product runs on a computer device, the computer device can implement the steps in the above-mentioned method embodiment when executing the computer program product.

[0153] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0154] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0155] In the embodiments provided in the present application, it should be understood that the disclosed devices / computer equipment and methods can be implemented in other ways. For example, the device / computer equipment embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0156] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0157] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An encryption method for a database key manager, characterized in that: The encryption method comprises: When a user creates a data encryption key, obtaining a master white box key, a secondary master key, and white box key version information stored in a shared library of the database key manager, wherein the secondary master key includes a component ciphertext obtained by encrypting a first component using the master white box key and a second component; Decrypting the component ciphertext using the master white-box key to obtain the first component; Encrypt the data encryption key using the first component to obtain an initial ciphertext; Encrypt the initial ciphertext using the second component to obtain a final ciphertext corresponding to the data encryption key, and associate the final ciphertext with the white-box key version information and output it; Before acquiring the master white box key, the secondary master key and the white box key version information stored in the shared library of the database key manager, the method further includes: Obtaining a first original key, a second original key, and the first component; According to a preset white-box key generation algorithm and the first original key, the master white-box key is obtained, and according to the preset white-box key generation algorithm and the second original key, the second component is obtained; Encrypting the first component using the master white-box key to obtain the component ciphertext; Obtaining the secondary master key according to the component ciphertext and the second component; The master white box key and the sub-master key are mapped with the constructed white box key version information and stored in a shared library of the database key manager.

2. The encryption method of the database key manager according to claim 1, characterized in that: After encrypting the initial ciphertext using the second component to obtain a final ciphertext corresponding to the data encryption key, and associating the final ciphertext with the white-box key version information and outputting the same, the method further includes: When encrypting target data provided by a user, obtaining a target ciphertext corresponding to a data encryption key to be used and white box key version information associated with the target ciphertext; According to the white box key version information associated with the target ciphertext, the corresponding target secondary master key and the primary white box key are matched from the shared library, and the component ciphertext of the target secondary master key is decrypted to obtain the target first component; Decrypting the target ciphertext using the second component of the target secondary master key to obtain a target initial ciphertext; Decrypting the target initial ciphertext using the target first component to obtain the data encryption key to be used; The target data is encrypted using the data encryption key to obtain a ciphertext corresponding to the target data.

3. The encryption method of the database key manager according to claim 1, characterized in that: After obtaining the master white box key according to the preset white box key generation algorithm and the first original key, the method further includes: Updating the master white box key to obtain an updated master white box key; Encrypting the first component using the updated master white-box key to obtain an updated component ciphertext; Obtaining an updated secondary master key according to the updated component ciphertext and the second component; The updated master white box key, the updated secondary master key and the constructed updated white box key version information are mapped and stored in a shared library of the database key manager.

4. The encryption method of the database key manager according to claim 1, characterized in that: After obtaining the secondary master key according to the component ciphertext and the second component, the method further includes: updating the second component to obtain an updated second component, and updating the first component to obtain an updated first component; Encrypting the updated first component using the master white-box key to obtain an updated component ciphertext; An updated secondary master key is obtained according to the updated component ciphertext and the updated second component, and the updated secondary master key and the constructed updated white box key version information are mapped and stored in the shared library of the database key manager.

5. A decryption method for a database key manager, characterized in that: After obtaining the final ciphertext and white-box key version information using the encryption method according to any one of claims 1 to 4, the decryption method comprises: When decrypting the ciphertext corresponding to the target data obtained by encrypting the target data with the data encryption key in the final ciphertext, obtaining the final ciphertext and white box key version information associated with the final ciphertext; According to the white box key version information associated with the final ciphertext, the secondary master key and the primary white box key are matched from the shared library, and the component ciphertext of the secondary master key is decrypted to obtain the first component; Decrypting the final ciphertext using the second component of the secondary master key to obtain the initial ciphertext; Decrypting the initial ciphertext using the first component to obtain the data encryption key; The ciphertext corresponding to the target data is decrypted using the data encryption key to obtain the target data.

6. An encryption device for a database key manager, characterized in that: The encryption device comprises: A first acquisition module is configured to acquire, when a user creates a data encryption key, a master white box key, a secondary master key, and white box key version information stored in a shared library of the database key manager, wherein the secondary master key includes a component ciphertext and a second component obtained by encrypting the first component using the master white box key; A first decryption module, configured to decrypt the component ciphertext using the master white-box key to obtain the first component; A first encryption module, used to encrypt the data encryption key using the first component to obtain an initial ciphertext; A second encryption module, configured to encrypt the initial ciphertext using the second component to obtain a final ciphertext corresponding to the data encryption key, and associate the final ciphertext with the white box key version information and output the result; A third acquisition module, used to acquire the first original key, the second original key and the first component; a fourth acquisition module, configured to obtain the master white box key according to a preset white box key generation algorithm and the first original key, and obtain the second component according to the preset white box key generation algorithm and the second original key; a fourth encryption module, configured to encrypt the first component using the master white-box key to obtain the component ciphertext; a fifth acquisition module, configured to obtain the secondary master key according to the component ciphertext and the second component; The first storage module is used to map and store the master white box key, the sub-master key and the constructed white box key version information into a shared library of the database key manager.

7. A decryption device for a database key manager, characterized in that: After obtaining the final ciphertext and white-box key version information using the encryption method according to any one of claims 1 to 4, the decryption device comprises: A sixth acquisition module, configured to acquire the final ciphertext and white box key version information associated with the final ciphertext when decrypting the ciphertext corresponding to the target data obtained by encrypting the target data with the data encryption key in the final ciphertext; a fifth decryption module, configured to match the secondary master key and the primary white box key from the shared library according to the white box key version information associated with the final ciphertext, and decrypt the component ciphertext of the secondary master key to obtain the first component; a sixth decryption module, configured to decrypt the final ciphertext using the second component of the secondary master key to obtain the initial ciphertext; a seventh decryption module, configured to decrypt the initial ciphertext using the first component to obtain the data encryption key; An eighth decryption module is used to use the data encryption key to decrypt the ciphertext corresponding to the target data to obtain the target data.

8. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the encryption method of the database key manager as described in any one of claims 1 to 4 or the decryption method of the database key manager as described in claim 5 is implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the encryption method of the database key manager according to any one of claims 1 to 4 or the decryption method of the database key manager according to claim 5 is implemented.

Images