Data encryption and decryption method and device in key management system and storage medium

Abstract

The invention discloses a data encryption and decryption method and device in a key management system and a storage medium, and the method comprises the steps: obtaining a key association request of a service side, the key association request comprising an encryption / decryption request of a key and / or a life cycle management request; if the key association request comprises an encryption / decryption request, acquiring corresponding key association information based on the key association request, performing encryption / decryption processing on to-be-processed data of the service side based on the key association information, and returning the encrypted / decrypted data to the service side; and if the key association request comprises a life cycle management request, carrying out life cycle management on the key of the service side based on the key association request. The invention aims to solve the technical problem of low encryption and decryption efficiency caused by encryption and decryption of service side data by an API (Application Program Interface).

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data encryption and decryption method, device and storage medium in a key management system. Background Art

[0002] In order to ensure the security of the business, it is usually necessary to encrypt and decrypt the data and manage it.

[0003] At present, the cloud service platform mainly implements the processing and management of data encryption and decryption in the business-side key management system through the API interface. The operation is complicated, and the encryption and decryption of business-side data provided by the API interface requires remote transmission, and generally can only perform encryption and decryption but not other management processes, which reduces the efficiency of encryption and decryption related processing. In addition, in a large number of microservice scenarios, intensive data encryption and decryption in the key management system will cause a pressure bottleneck of the KMS itself, increase the resource consumption of the KMS, and further affect the efficiency of encryption and decryption. Summary of the invention

[0004] In view of this, the present application provides a data encryption and decryption method, system, device and storage medium in a key management system, aiming to solve the technical problem of low encryption and decryption efficiency caused by implementing encryption and decryption of business-side data through an API interface.

[0005] The embodiment of the present application provides a data encryption and decryption method in a key management system, which is applied to a key management agent in the key management system, wherein the key management agent is respectively connected to a cloud service platform and a business side for communication, and the method includes:

[0006] Obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0007] If the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returning the data after the encryption / decryption processing to the service side;

[0008] If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

[0009] In a possible implementation manner of the present application, the key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key;

[0010] The step of encrypting / decrypting the data to be processed on the service side based on the key association information further includes:

[0011] Determining whether the key is within a validity period;

[0012] If it is not within the validity period, re-apply for the corresponding key from the cloud service platform, and encrypt / decrypt the data to be processed on the business side based on the re-applied key.

[0013] In a possible implementation manner of the present application, if the key association request is a key registration application request, the life cycle management is a working key registration application management;

[0014] The step of obtaining a key association request from the service side includes:

[0015] When the service on the business side is started, read the key registration model file on the business side, and generate a registration application request on the business side based on the key registration model file;

[0016] The step of managing the life cycle of the key of the service side based on the key association request includes:

[0017] Based on the registration application request, obtain a corresponding working key and a corresponding key ID, wherein the working key and the corresponding key ID are generated and fed back by the cloud service platform based on the registration application request;

[0018] Feedback the ID corresponding to the working key to the service side.

[0019] In a possible implementation manner of the present application, if the key association request is a key update request, the life cycle management is update management of the working key;

[0020] The step of managing the life cycle of the key of the service side based on the key association request includes:

[0021] Forwarding the key update request to the cloud service platform, and receiving first information fed back by the cloud service platform, wherein the first information includes information that the update of the original key status corresponding to the key update request has been completed, and the first information also includes a key in a historical state or a key in an activated state, wherein the key in the historical state is only used to decrypt the existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data;

[0022] Based on the activated key in the first information, the new data sent by the service side is encrypted and decrypted.

[0023] In a possible implementation manner of the present application, if the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state;

[0024] The life cycle management is the revocation management of the working key;

[0025] After the step of forwarding the key update request to the cloud service platform and receiving the first information fed back by the cloud service platform, the method further includes:

[0026] Receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, and receiving second information fed back by the cloud service platform, the second information including information for changing the key state to a pending revocation state based on the key revocation request;

[0027] Feeding back the second information to the service side, so that the service side and the cloud service platform can enter into a key state negotiation process;

[0028] During the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information, and feeds back to the key management agent after the processing is completed, then the service side receives third information fed back by the service side, the third information including information that the data encrypted by the key corresponding to the state to be revoked has been processed, and forwards the third information to the cloud service platform, so that the cloud service platform changes the state of the key to be revoked to a disabled state, and the key in the disabled state cannot be used for encryption and decryption of data;

[0029] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

[0030] In a possible implementation manner of the present application, if the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state;

[0031] The life cycle management is the destruction management of the working key;

[0032] After the step of forwarding the third information to the cloud service platform so that the cloud service platform can change the pending revocation state of the key to the deactivated state, the method further comprises:

[0033] receiving a key destruction request from the service side, forwarding the key destruction request to the cloud service platform, and receiving fourth information fed back by the cloud service platform, the fourth information including information that the corresponding key is marked as destroyed based on the key destruction request;

[0034] The fourth information is fed back to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

[0035] The present application also provides a data encryption and decryption method in a key management system, which is applied to a cloud service platform. The cloud service platform is respectively connected to a key management agent and a service side in the key management system in communication. The method includes:

[0036] Receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0037] If the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to a key management agent, so that the key management agent performs encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returns the data after the encryption / decryption processing to the service side; or

[0038] If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

[0039] The present application also provides a data encryption and decryption method in a key management system, which is applied to the business side of the key management system. The business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface that provides an entry for key lifecycle management, and implements online key status negotiation with a cloud service platform based on a key management agent.

[0040] The present application also provides a data encryption and decryption system in a key management system, the data encryption and decryption system in the key management system comprising:

[0041] The business side is used to preset the directory to build in the key registration model file. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent.

[0042] A key management agent is used to obtain a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and is also used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side;

[0043] If the key association request includes a lifecycle management request, further used to manage the lifecycle of the key of the service side based on the key association request;

[0044] A cloud service platform, for receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and for, if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can perform encryption / decryption processing on the pending data of the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; and if the key association request includes a lifecycle management request, for interacting with the key management agent based on the key association request to implement lifecycle management of the key of the business side.

[0045] The present application also provides a data encryption and decryption device in a key management system, which is applied to a key management agent in the key management system, wherein the key management agent is respectively connected to a cloud service platform and a business side for communication, and the device comprises:

[0046] An acquisition module, used to acquire a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0047] a first encryption / decryption module, configured to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side;

[0048] The first lifecycle management module is configured to manage the lifecycle of the key of the service side based on the key association request if the key association request includes a lifecycle management request.

[0049] The present application also provides a data encryption and decryption device in a key management system, which is a physical node device. The data encryption and decryption device in the key management system includes: a memory, a processor, and a program of the data encryption and decryption method in the key management system stored in the memory and executable on the processor. When the program of the data encryption and decryption method in the key management system is executed by the processor, the steps of the data encryption and decryption method in the key management system as described above can be implemented.

[0050] To achieve the above-mentioned purpose, a storage medium is also provided, on which a data encryption and decryption program in a key management system is stored. When the data encryption and decryption program in the key management system is executed by a processor, the steps of any of the above-mentioned data encryption and decryption methods in the key management system are implemented.

[0051] Compared with the related art, in which the API interface is used to implement encryption and decryption of business side data, resulting in low encryption and decryption efficiency, in the present application, a key association request of the business side is obtained, wherein the key association request includes an encryption / decryption request and / or a lifecycle management request of the key; if the key association request includes an encryption / decryption request, corresponding key association information is obtained based on the key association request, encryption / decryption processing is performed on the to-be-processed data of the business side based on the key association information, and the data after the encryption / decryption processing is completed is returned to the business side; if the key association request includes a lifecycle management request, the key of the business side is performed based on the key association request. For the management of the life cycle of the transaction, it can be understood that in the present application, the processing and / or management of encryption and decryption of business-side data is implemented based on the key management agent rather than the API interface. The processing and / or management of encryption and decryption of business-side data is implemented based on the key management agent, and there is no need for remote transmission (because the key management agent is cached locally, and in a large number of microservice scenarios, it can avoid pressure bottlenecks in KMS), which improves the efficiency of encryption and decryption. In addition, the processing of encryption / decryption requests and lifecycle management requests is implemented based on the key management agent rather than the API interface (no additional API interface or other components are required), thereby further improving the efficiency of encryption and decryption related processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a flow chart of a first embodiment of a method for data encryption and decryption in a key management system of the present application;

[0053] Figure 2 This is a detailed flow chart of step S20 in the first embodiment of the data encryption and decryption method in the key management system of this application;

[0054] Figure 3 A schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application;

[0055] Figure 4 A schematic diagram of the interaction between the business side, the key management agent, and the cloud service platform involved in the data encryption and decryption method in the key management system of this application;

[0056] Figure 5 A schematic diagram of generating a master key involved in a data encryption and decryption method in a key management system of the present application;

[0057] Figure 6 A schematic diagram of the registration application management of the working key involved in the data encryption and decryption method in the key management system of this application;

[0058] Figure 7A schematic diagram of the encryption and decryption process involved in the data encryption and decryption method in the key management system of this application;

[0059] Figure 8 A schematic diagram of a specific key query process involved in the data encryption and decryption method in the key management system of this application;

[0060] Fig. 9 A schematic diagram of a specific key update involved in the data encryption and decryption method in the key management system of this application;

[0061] Fig.10 A schematic diagram of a specific key revocation method involved in the data encryption and decryption method in the key management system of this application;

[0062] Fig.11 This is a schematic diagram of the key state transition process involved in the data encryption and decryption method in the key management system of this application. DETAILED DESCRIPTION

[0063] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] The present application embodiment provides a data encryption and decryption method in a key management system. In one embodiment of the data encryption and decryption method in the key management system of the present application, refer to Figure 1 , the method comprising:

[0065] A key management agent is applied to a key management system, wherein the key management agent is respectively connected to a cloud service platform and a business side for communication, and the method includes:

[0066] Step S10, obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0067] Step S20: if the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returning the data after the encryption / decryption processing to the service side;

[0068] Step S30: If the key association request includes a lifecycle management request, manage the lifecycle of the key of the service side based on the key association request.

[0069] First, the basic technical terms involved in this embodiment are explained;

[0070] KMS: Key Manager Service, key management service;

[0071] Master key: a key used to protect working keys;

[0072] Working key: the key used to encrypt business data;

[0073] PBKDF2: Password-Based Key Derivation Function 2, password-based key derivation algorithm;

[0074] API: Application Programming Interface, application programming interface;

[0075] Disk: not cached on disk;

[0076] Access token: An identity tag for applications to access KMS. Applications apply to the KMS service before use. Only those holding the access token are allowed to access the KMS service interface.

[0077] The research and development background of this application can be:

[0078] At present, the cloud service platform mainly implements the processing and management of data encryption and decryption (such as application, cancellation, etc.) in the business-side key management system through API interfaces.

[0079] The current plan will have at least the following situations:

[0080] 1. Providing data encryption and decryption processing and management in the business-side key management system through the API interface is complex to operate. In addition, providing encryption and decryption of business-side data through the API interface requires remote transmission, and generally only encryption and decryption can be performed instead of other management processes, which reduces the efficiency of encryption and decryption related processing. In addition, in a large number of microservice scenarios, intensive data encryption and decryption in the key management system will cause the pressure bottleneck of the KMS itself, increase the resource consumption of the KMS, and further affect the efficiency of encryption and decryption;

[0081] 2. Lack of definition of the key life cycle status, making it difficult to meet users' key management needs;

[0082] 3. When implementing the data encryption and decryption processing and management in the business-side key management system through the API interface, some key management services only support one key for one scenario business, but the actual scenario business may not require only one key;

[0083] 4. The update method required for key risks also needs to be carried out through the API, which will lead to untimely risk management;

[0084] 5. Only the key operation interface is provided through the API. On the one hand, users need to be familiar with the encryption and decryption framework and keys. On the other hand, the business also needs to consider how to store the currently applied keys.

[0085] In the present application, since the processing and / or management of data encryption and decryption in the business-side key management system is implemented based on the key management agent rather than the API interface, the processing and / or management of data encryption and decryption in the business-side key management system is implemented based on the key management agent, and there is no need for remote transmission (because the key management agent is cached locally, in a large number of microservice scenarios, it can avoid pressure bottlenecks in KMS), thereby improving the encryption and decryption efficiency. In addition, the processing of encryption / decryption requests and lifecycle management requests is implemented based on the key management agent rather than the API interface (no additional API interface or other components are required), thereby further improving the efficiency of encryption and decryption related processing.

[0086] Furthermore, in this application, the lifecycle management of keys is implemented to meet the user's key management needs;

[0087] Furthermore, in the present application, the number of keys can be multiple and is associated with the number of business scenarios on the business side, that is, one business scenario can apply for multiple keys, thereby meeting the business scenario's demand for keys.

[0088] Furthermore, in the present application, the revoked keys and protected data can be securely decoupled in real time (and can be negotiated to achieve timely risk management), which not only ensures the security and availability of the keys, but also ensures the security and availability of the protected data. In addition, during the corresponding process, it can also be ensured that the protected data will not be interrupted.

[0089] Furthermore, in this application, the corresponding encryption, decryption and authentication methods are all implemented through the key management agent (KMS-Agent), and the business side is completely unaware of it. Users do not need to be familiar with the encryption and decryption framework and keys, and do not consider how to store the currently applied keys.

[0090] In this embodiment, the data encryption and decryption method in the key management system is applied to the data encryption and decryption device in the key management system. The data encryption and decryption device in the key management system belongs to the data encryption and decryption equipment in the key management system. The data encryption and decryption equipment in the key management system can be the key management agent (KMS-Agent) in the key management system, wherein the key management system also includes a cloud service platform (KMS-server cluster) and a business side (KMS-Console), and the key management agent is communicated with the cloud service platform and the business side respectively.

[0091] like Figure 4As shown, the business side (microservice applications 1, 2, 3, N, etc.) can interact with the cloud service platform through the key management agent to achieve encryption and decryption of its business data / or key lifecycle management.

[0092] As an example, a key lifecycle management interface is provided on the business side (KMS-Console), which can make key management more convenient (users trigger key management requests, such as encryption and decryption requests, on this interface). In addition, the business side also has a customized key maintenance interface, on which corresponding maintenance requests can be triggered. That is, when a specific key is at risk, the original risky key can be negotiated and replaced in a very short time to avoid the risk of leakage of old keys.

[0093] In this embodiment, KMS (Key Management Service) is provided at the cloud service platform (KMS-server cluster), that is, when the cloud service platform receives a lifecycle management request generated by the business side based on its lifecycle management interface, the management requirements matching its lifecycle management request are implemented through the cloud service platform.

[0094] In addition, in this embodiment, a master key is also generated at the cloud service platform, such as Figure 5 As shown, the master key can be generated specifically by using preset multiple categories (three categories) of key materials (the composition of the key materials can be determined based on security and implementation conditions) and salt values ​​generated corresponding to strong random numbers as inputs to a (secure key derivation algorithm), wherein the key derivation algorithm can be a PBKDF2 algorithm, and then obtaining the master key.

[0095] As an example, a cloud service platform uses multiple nodes to form a cluster for key services, that is, after it is started, multiple nodes jointly provide key management services.

[0096] As an example, if there are cluster nodes in the cloud service platform, the key material for generating the master key must be synchronized to each cluster node. The cluster nodes use the same key material to keep the master keys of each cluster node consistent.

[0097] As an example, the master key generated by the cloud service platform is stored in the memory, and the master key is never written to the disk;

[0098] As an example, the key management agent is the middleman between the cloud service platform and the business side (all requests from the business side to the cloud service platform can be forwarded by the key management agent).

[0099] As an example, overall, the key management agent also acts as an intermediary between the cloud service platform and the business side to implement periodic management and / or encryption and decryption processing of keys.

[0100] As an example, the key management agent can automatically scan and load the key registration model file placed at a specified location by the business side, and then interact with the cloud service platform to implement key registration.

[0101] As an example, the key management agent encrypts and decrypts data input by the business side without the business side having to worry about how to obtain the key and where to store it, thereby achieving encryption and decryption processing of the business data.

[0102] As an example, the key management agent is also encapsulated into the authentication method of the cloud platform service, so that the business side is completely unaware, but the use of the corresponding keys is safe.

[0103] The specific steps are as follows:

[0104] Step S10, obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0105] As an example, a user triggers a key association request through a management interface of a service side, and the service side sends the key association request to a key management agent, that is, the key management agent receives the key association request from the service side.

[0106] As an example, the key association request includes an encryption request or a decryption request of a key;

[0107] As an example, the data encryption and decryption method in the key management system can be applied to the encryption and decryption process involved in the microservice business scenario.

[0108] As an example, the key association request also includes a lifecycle management request;

[0109] As an example, a lifecycle management request may be a request for registration, query, update, revocation, and destruction of a (working) key.

[0110] As an example, the life cycle management of a key includes the state transition process of the key, such as Fig.11 As shown (register and apply first, then query, update, revoke and destroy, etc.).

[0111] Step S20: if the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returning the data after the encryption / decryption processing to the service side;

[0112] As an example, if the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request;

[0113] As an example, the key association information may include a working key;

[0114] As an example, based on the working key, the data to be processed on the service side is encrypted, and the encrypted data is returned to the service side;

[0115] As an example, based on the working key, the data to be processed on the business side is decrypted, and the decrypted data is returned to the business side.

[0116] As an example, the key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key;

[0117] As an example, when the working key is in the cloud service platform, it is securely maintained based on the master key generated in the cloud service platform.

[0118] Reference Figure 2 The step of encrypting / decrypting the data to be processed on the service side based on the key association information further includes:

[0119] Step S21, determining whether the key is within the validity period;

[0120] Step S22: If the key is not within the validity period, re-apply for the corresponding key from the cloud service platform, and encrypt / decrypt the data to be processed on the business side based on the re-applied key.

[0121] In this embodiment, the key is specifically described as a working key.

[0122] In this embodiment, it is determined whether the working key is within the validity period. If the working key is within the validity period, encryption / decryption processing is performed on the data to be processed on the business side based on the working key, and the data after the encryption / decryption processing is completed is returned to the business side; if it is not within the validity period, a corresponding working key is re-applied to the cloud service platform, and encryption / decryption processing is performed on the data to be processed on the business side based on the re-applied working key, and the data after the encryption / decryption processing is completed is returned to the business side;

[0123] It should be emphasized that the key-associated information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally. When the working key is used in the key management agent to encrypt and decrypt business data, the corresponding working key will not be exposed to the business side.

[0124] In this embodiment, the specific steps of encryption and decryption involved above are as follows: Figure 7 As shown:

[0125] 1. The user passes the plain text and key ID information to KMS-Agent to call KMS-Agent for encryption;

[0126] 2. The KMS-Agent obtains the current key in the memory. The KMS-Agent first confirms whether the cache time of the key has expired. If it has expired, it will flow to the following step 3, otherwise it will flow to step 9;

[0127] 3. If the cache is expired (no current key exists), a key query request (carrying access token and key model information) is sent to the interface of the security gateway;

[0128] 4. The key query request needs to be verified at the security gateway;

[0129] 5. After verification, the security gateway forwards the key query request to the KMS-Server;

[0130] 6. KMS-Server completes the key query based on the key query request;

[0131] 7. KMS-Server returns the key ID and key to the security gateway;

[0132] 8. The security gateway returns the key ID and key to KMS-Agent;

[0133] 9. KMS-Agent uses the returned key to encrypt the plaintext data and returns it to the business side;

[0134] In the above process, the business side will obtain the encrypted ciphertext and key ID for storage, but the key itself will not be exposed to the business side, nor will it be stored on the business side, making the key safe and reliable.

[0135] In this embodiment, it should be noted that, during the encryption / decryption process, the parameters passed by the business side to the key management agent are different. In the case of encryption, what is passed to the key management agent is the plaintext of the data to be encrypted and the target key ID, wherein the target key ID includes the registration key ID and / or the available key ID; in the case of decryption, what is passed to the key management agent is the ciphertext of the data to be decrypted and the available key ID, wherein the registration key ID corresponds to a service scenario, and one registration key ID includes multiple available key IDs, but only one available key ID is in an activated state.

[0136] In this embodiment, the available key ID is the available working key ID.

[0137] Step S30: If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

[0138] In this embodiment, if the key association request includes a lifecycle management request, based on the key association request, interaction is performed with the cloud service platform to implement lifecycle management of the key on the business side.

[0139] As an example, based on a specific lifecycle management request, interaction is performed with a cloud service platform to implement specific lifecycle management of the key on the business side.

[0140] As an example, a lifecycle management request may be a request for registration, query, update, revocation, and destruction of a (working) key.

[0141] Wherein, if the key association request is a key registration application request, the life cycle management is a working key registration application management;

[0142] The step of obtaining a key association request from the service side includes:

[0143] Step S11, when the service on the business side is started, reading the key registration model file on the business side, and generating a registration application request on the business side based on the key registration model file;

[0144] The step of managing the life cycle of the key of the service side based on the key association request includes:

[0145] Step S31, based on the registration application request, obtaining a corresponding working key and a corresponding key ID, wherein the working key and the corresponding key ID are generated and fed back by the cloud service platform based on the registration application request;

[0146] Step S32: Feedback the ID corresponding to the working key to the service side.

[0147] In this embodiment, it should be noted that after the business side service is started, KMS-Agent will scan and parse the key registration model file (or key model file, the key registration model file is set in the preset directory on the business side) provided by the business, KMS-Agent parses the key registration related information in the key registration model file, and then based on the key registration related information, carries a legal access token to the cloud service platform to apply for a key (registration application request). It should be noted that if KMS-Agent needs to access the cloud service platform, it needs to be authenticated through a unified security gateway and obtain a legal access token before access (the business application has applied for the access token of the corresponding service account of the cloud service platform for this tenant during deployment, and the permission of the access token of the service account is: limited to access by this tenant to the KMS-Server).

[0148] After the authenticated registration application request is sent to the KMS-Server (cloud service platform), the KMS-Server generates the required working key for the application and returns it. In the above process, the working key is protected by the master key.

[0149] KMS-Agent receives the requested (working) key and temporarily puts it into the cache. If the (working) key is not used within the specified time, it will be discarded from the cache.

[0150] As an example, the business side provides a key registration model file according to the preset key registration model. It should be noted that one key registration model file can register multiple (working) keys, which means that an application or a scenario (microservice scenario) can apply for multiple keys according to its needs.

[0151] As an example, there may be other registration methods (not just the above-mentioned modeled key registration method). For example, the business side may also choose to use the native API for key registration, without specific limitation.

[0152] As an example, the key registration model file is shown in Table 1 (the key registration model file includes business registration information and key specification information), where the business registration information indicates that the business application using the key needs to be registered to the KMS-Server. The key specification information mainly confirms the number of bits of the key, the algorithm used, the parameters required by the encryption algorithm, the display information of the key, etc.

[0153] Table 1

[0154]

[0155] In this embodiment, there may be multiple keys, and the number of the keys is associated with the number of business scenarios on the business side. Specifically, the number of keys can be specified in the key registration model file.

[0156] In this embodiment, if there are multiple business scenarios on the business side (the number of business scenarios is determined based on the functions of the business data), there will be multiple corresponding keys. For example, one key can be applied for each sensitive data in the enterprise, and one key can be applied for each critical data in the enterprise, and so on.

[0157] The registration application management of the above working key (business key registration steps) is as follows: Figure 6 As shown (where KMS-Agent is integrated into this (business) microservice, and the key model file is configured in the specified directory):

[0158] 1. Start (business) microservices and KMS-Agent;

[0159] 2. KMS-Agent loads the key model file, obtains key registration information such as key specifications and key-related services, and generates a registration application request accordingly;

[0160] 3. Obtain the access token for accessing the cloud service platform (KMS service), and then send the registration application request to the security gateway of the cloud service platform (KMS service) through a secure channel with the legal access token and key registration information;

[0161] 4. The security gateway confirms the legitimacy of the access token and whether it has the right to access the cloud service platform (KMS service);

[0162] 5. After the access token is verified to be valid, the security gateway transfers the registration application request to the cloud service platform (KMS cluster or KMS-Server).

[0163] 6. KMS-Server receives the registration request from the business microservice, generates the data (work) key through a strong random algorithm based on the key specification and key-related business, and encrypts the data (work) key with the master key and persists it to KMS-Server;

[0164] 7. KMS-Server returns the data (working) key and key ID to the security gateway.

[0165] 8. Send the key and key ID to KMS-Agent via the security gateway.

[0166] 9. KMS-Agent receives the key and key ID, etc., and places them in the current memory for subsequent encryption / decryption of business data.

[0167] Compared with the related art, in which the API interface is used to implement encryption and decryption of business-side data, resulting in low encryption and decryption efficiency, in the present application, a key association request of the business side is obtained, wherein the key association request includes an encryption / decryption request and / or a lifecycle management request of the key; if the key association request includes an encryption / decryption request, corresponding key association information is obtained based on the key association request, encryption / decryption processing is performed on the to-be-processed data of the business side based on the key association information, and the data after the encryption / decryption processing is completed is returned to the business side; if the key association request includes a lifecycle management request, the key of the business side is processed based on the key association request. As for the management of the life cycle, it can be understood that in the present application, the processing and / or management of data encryption and decryption on the business side is implemented based on the key management agent rather than the API interface. The processing and / or management of data encryption and decryption on the business side is implemented based on the key management agent, and there is no need for remote transmission (because the key management agent is cached locally, and in a large number of microservice scenarios, it can avoid pressure bottlenecks in KMS), which improves the efficiency of encryption and decryption. In addition, the processing of encryption / decryption requests and life cycle management requests is implemented based on the key management agent rather than the API interface (no additional API interface or other components are required), thereby further improving the efficiency of encryption and decryption related processing.

[0168] Further, based on the first embodiment of the present application, another embodiment of the present application is provided. In this embodiment, if the key association request is a key query request, the life cycle management is query management of the working key;

[0169] The step of managing the life cycle of the key of the service side based on the key association request includes:

[0170] Step S33, forwarding the key query request to the cloud service platform, and receiving the key ID of the working key fed back by the cloud service platform based on the key query request;

[0171] Step S34: Feedback the key ID of the working key to the service side.

[0172] In this embodiment, the specific key query process is as follows: Figure 8 As shown:

[0173] 1. The business side (system security administrator) triggers a key query request or a key information viewing request in its management interface (it should be noted that what is viewed is the key ID, status and part of the registration information instead of the actual key); that is, the key ID of the working key instead of the working key is fed back to the business side.

[0174] 2. KMS-Agent forwards the key query request to the cloud service platform's security gateway based on the access token;

[0175] 3. The cloud service platform's security gateway verifies the legitimacy of the access token;

[0176] 4. After the legitimacy of the access token is verified, the key query request is forwarded to the KMS-Server;

[0177] 5. KMS-Server prepares the corresponding key ID and registration information based on the key query request;

[0178] 6. Return the key ID and registration information to the security gateway;

[0179] 7. The key ID and registration information are returned to KMS-Agent through the security gateway;

[0180] 8. KMS-Agent sends the key ID and registration information back to KMS-Console to complete the key query.

[0181] Wherein, if the key association request is a key update request, the life cycle management is the update management of the working key;

[0182] The step of managing the life cycle of the key of the service side based on the key association request includes:

[0183] Step S34: forward the key update request to the cloud service platform, and receive first information fed back by the cloud service platform, wherein the first information includes information that the key update request corresponds to the original key status update has been completed, and the first information also includes a key in a historical state or a key in an activated state, wherein the key in the historical state is only used to decrypt the existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data;

[0184] Step S35: encrypt and decrypt new data sent by the service side based on the activated key in the first information.

[0185] Among them, the key in the historical state is only used to decrypt the existing data and can no longer encrypt new data. After receiving the update request, the cloud service platform updates the original key state corresponding to the key update request.

[0186] In this embodiment, the specific key update process is as follows: Fig. 9 As shown:

[0187] 1. The business side (system security administrator) triggers a key update request in its management interface (the user first selects the key to be updated in the interface provided by KMS-Console to trigger the key update request);

[0188] 2. KMS-Agent forwards the key update request to the cloud service platform's security gateway based on the access token;

[0189] 3. The cloud service platform's security gateway verifies the legitimacy of the access token;

[0190] 4. After the legitimacy of the access token is verified, the key update request is forwarded to the KMS-Server;

[0191] 5. Based on the key update request, KMS-Server updates the original key to the historical state and generates a new key;

[0192] 6. KMS-Server returns the key update success status to the security gateway;

[0193] 7. The key update success status is returned to KMS-Agent through the security gateway;

[0194] 8. KMS-Agent sends the key update success status back to KMS-Console to complete the key update.

[0195] Among them, the key in the historical state is only used to decrypt the existing data and can no longer encrypt new data. After receiving the update request, the cloud service platform updates the original key state corresponding to the key update request.

[0196] That is, after the key is updated, the old key is set to the historical state. KMS-Server will regenerate a new key for the business microservice and set it to the active state (the key in the active state is used to encrypt and decrypt subsequent new data). That is, after the KMS-Agent key cache on the business side expires, a new key will be obtained to encrypt and decrypt data in the subsequent key management system of the business microservice.

[0197] In this embodiment, periodic management of key registration, query and update can be implemented.

[0198] Further, based on the above-mentioned embodiment of the present application, another embodiment of the present application is provided. In this embodiment, if the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state;

[0199] The life cycle management is the revocation management of the working key;

[0200] After the step of forwarding the key update request to the cloud service platform and receiving the first information fed back by the cloud service platform, the method further includes:

[0201] Step S36, receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, and receiving second information fed back by the cloud service platform, wherein the second information includes information on changing the key status to a pending revocation status based on the key revocation request;

[0202] Step S37, during the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information and feeds back to the key management agent after the processing is completed, then third information fed back by the service side is received, the third information including information that the data encrypted by the key corresponding to the state to be revoked has been processed, and the third information is forwarded to the cloud service platform so that the cloud service platform can change the state of the key to be revoked to the deactivated state, and the key in the deactivated state cannot be used for encryption and decryption of data;

[0203] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

[0204] In this embodiment, the specific key revocation process is as follows: Fig.10 As shown:

[0205] 1. The business side (system security administrator) triggers a key revocation request in its management interface (the user first selects the historical key to be revoked in the interface provided by KMS-Console to trigger the key revocation request);

[0206] 2. KMS-Agent forwards the key revocation request to the cloud service platform's security gateway based on the key ID information corresponding to the access token and the historical key;

[0207] 3. The cloud service platform's security gateway verifies the legitimacy of the access token;

[0208] 4. After the legitimacy of the access token is verified, the key revocation request is forwarded to the KMS-Server;

[0209] 5. Based on the key revocation request, KMS-Server updates the original key to being revoked;

[0210] 6. KMS-Server returns the current status of the key to the security gateway;

[0211] 7. Return the current status of the key to KMS-Agent through the security gateway;

[0212] 8. KMS-Agent sends the current status of the key to KMS-Consol;

[0213] 9. KMS-Consol sends a key revocation negotiation request to the business application (client) on the business side;

[0214] 10. The business application (client) on the business side processes the relevant data protected by the current key;

[0215] 11. After processing the relevant data protected by the current key, the business application (client) on the business side sends the instruction to agree to revoke the key (negotiation result) to KMS-Consol;

[0216] 12. KMS-Consol sends the negotiation results to KMS-Agent;

[0217] 13. KMS-Agent forwards the negotiation result to the security gateway of the cloud service platform based on the access token;

[0218] 14. The cloud service platform's security gateway verifies the legitimacy of the access token;

[0219] 15. After the legitimacy of the access token is verified, the negotiation result is forwarded to the KMS-Server;

[0220] 16. Based on the negotiation result, KMS-Server forwards the revocation success information to KMS-Agent through the security gateway;

[0221] 17. KMS-Agent sends the successful revocation information back to KMS-Console

[0222] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

[0223] Wherein, if the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state;

[0224] The life cycle management is the destruction management of the working key;

[0225] After the step of forwarding the third information to the cloud service platform so that the cloud service platform changes the state of the key to be revoked to a deactivated state, the method further comprises:

[0226] Step S38, receiving a key destruction request from the service side, forwarding the key destruction request to the cloud service platform, and receiving fourth information fed back by the cloud service platform, wherein the fourth information includes information that the corresponding key is marked as destroyed based on the key destruction request;

[0227] Step S39: Feedback the fourth information to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

[0228] It should be noted that a key in a deactivated (revoked) state means that the key will no longer be used, and the user can decide whether the key should be destroyed.

[0229] When it is necessary to destroy the key, the user first selects the key in the revoked (disabled) state in the interface provided by KMS-Console, and triggers the key destruction logic (it should be noted that only the key in the revoked (disabled) state can be destroyed, and the keys in other states cannot be directly destroyed). Then KMS-Agent forwards the key destruction request to the cloud service platform, where (all requests sent to KMS-Server must undergo security authentication). After the authentication is passed, KMS-Server receives the key destruction request, marks the key as destroyed, updates the key status to destroyed, and returns it to KMS-Console.

[0230] When KMS-Console receives a response indicating that the key has been destroyed, it clears the key information in KMS-Console, and other services can no longer obtain the key.

[0231] In this embodiment, it should be noted that the above-mentioned destruction strategy is soft destruction, which marks the key as destroyed. The real destruction needs to be evaluated by the management process before the key is cleared from the library.

[0232] Further, based on the above embodiments of the present application, another embodiment of the present application is provided. In this embodiment, the method is applied to a cloud service platform, and the cloud service platform is respectively connected to the key management agent and the service side in the key management system in communication. The method includes:

[0233] Receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0234] If the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to a key management agent, so that the key management agent performs encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returns the data after the encryption / decryption processing to the service side; or

[0235] If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

[0236] The data encryption and decryption method in the key management system also includes:

[0237] If it is detected that the key management function is activated, a master key is generated using a preset key generation algorithm based on a preset type of key material and a preset strong random number;

[0238] The working keys in the cloud service platform are securely maintained based on the master key.

[0239] The specific implementation of the data encryption and decryption method in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0240] Furthermore, based on the above-mentioned embodiments in the present application, another embodiment of the present application is provided. In this embodiment, the business side is applied to the key management system, and the business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent.

[0241] The specific implementation of the data encryption and decryption method in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0242] Further, based on the above embodiment of the present application, another embodiment of the present application is provided. In this embodiment, a data encryption and decryption system in the key management system is provided, and the system includes:

[0243] The business side is used to preset the directory to build in the key registration model file. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent.

[0244] A key management agent is used to obtain a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and is also used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side;

[0245] If the key association request includes a lifecycle management request, further used to manage the lifecycle of the key of the service side based on the key association request;

[0246] A cloud service platform, for receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and for, if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can perform encryption / decryption processing on the pending data of the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; and if the key association request includes a lifecycle management request, for interacting with the key management agent based on the key association request to implement lifecycle management of the key of the business side.

[0247] The specific implementation of the data encryption and decryption system in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0248] Reference Figure 3 , Figure 3 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0249] like Figure 3 As shown, the data encryption and decryption device in the key management system may include: a processor 1001 , a memory 1005 , and a communication bus 1002 . The communication bus 1002 is used to realize the connection and communication between the processor 1001 and the memory 1005 .

[0250] Optionally, the data encryption and decryption device in the key management system may also include a user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, a WiFi module, etc. The user interface may include a display screen (Display), an input submodule such as a keyboard (Keyboard), and the optional user interface may also include a standard wired interface and a wireless interface. The network interface may include a standard wired interface and a wireless interface (such as a WI-FI interface).

[0251] Those skilled in the art will understand that Figure 3 The structure of the data encryption and decryption device in the key management system shown in the figure does not constitute a limitation on the data encryption and decryption device in the key management system, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0252] like Figure 3As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, and a data encryption and decryption program in the key management system. The operating system is a program that manages and controls the hardware and software resources of the data encryption and decryption device in the key management system, and supports the operation of the data encryption and decryption program and other software and / or programs in the key management system. The network communication module is used to realize the communication between the cameras inside the memory 1005, and the communication with other hardware and software in the device.

[0253] exist Figure 3 In the data encryption and decryption device in the key management system shown, the processor 1001 is used to execute the data encryption and decryption program in the key management system stored in the memory 1005 to implement the steps of the data encryption and decryption method in the key management system described in any one of the above items.

[0254] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0255] The present application also provides a data encryption and decryption device in a key management system, which is applied to a key management agent in the key management system, wherein the key management agent is respectively connected to a cloud service platform and a business side for communication, and the device comprises:

[0256] An acquisition module, used to acquire a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0257] a first encryption / decryption module, configured to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side;

[0258] The first lifecycle management module is configured to manage the lifecycle of the key of the service side based on the key association request if the key association request includes a lifecycle management request.

[0259] In a possible implementation manner of the present application, the key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key;

[0260] The first encryption / decryption module is used to implement:

[0261] Determining whether the key is within a validity period;

[0262] If it is not within the validity period, re-apply for the corresponding key from the cloud service platform, and encrypt / decrypt the data to be processed on the business side based on the re-applied key.

[0263] In a possible implementation manner of the present application, if the key association request is a key registration application request, the life cycle management is a working key registration application management;

[0264] The acquisition module is used to implement:

[0265] When the service on the business side is started, read the key registration model file on the business side, and generate a registration application request on the business side based on the key registration model file;

[0266] The first life cycle management module is used to implement:

[0267] Based on the registration application request, obtain a corresponding working key and a corresponding key ID, wherein the working key and the corresponding key ID are generated and fed back by the cloud service platform based on the registration application request;

[0268] Feedback the ID corresponding to the working key to the service side.

[0269] In a possible implementation manner of the present application, if the key association request is a key update request, the life cycle management is update management of the working key;

[0270] The first life cycle management module is used to implement:

[0271] Forwarding the key update request to the cloud service platform, and receiving first information fed back by the cloud service platform, wherein the first information includes information that the update of the original key status corresponding to the key update request has been completed, and the first information also includes a key in a historical state or a key in an activated state, wherein the key in the historical state is only used to decrypt the existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data;

[0272] Based on the activated key in the first information, the new data sent by the service side is encrypted and decrypted.

[0273] In a possible implementation manner of the present application, if the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state;

[0274] The life cycle management is the revocation management of the working key;

[0275] The first life cycle management module is used to implement:

[0276] Receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, and receiving second information fed back by the cloud service platform, the second information including information for changing the key state to a pending revocation state based on the key revocation request;

[0277] Feeding back the second information to the service side, so that the service side and the cloud service platform can enter into a key state negotiation process;

[0278] During the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information, and feeds back to the key management agent after the processing is completed, then the service side receives third information fed back by the service side, the third information including information that the data encrypted by the key corresponding to the state to be revoked has been processed, and forwards the third information to the cloud service platform, so that the cloud service platform changes the state of the key to be revoked to a disabled state, and the key in the disabled state cannot be used for encryption and decryption of data;

[0279] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

[0280] In a possible implementation manner of the present application, if the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state;

[0281] The life cycle management is the destruction management of the working key;

[0282] The first life cycle management module is used to implement:

[0283] receiving a key destruction request from the service side, forwarding the key destruction request to the cloud service platform, and receiving fourth information fed back by the cloud service platform, the fourth information including information that the corresponding key is marked as destroyed based on the key destruction request;

[0284] The fourth information is fed back to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

[0285] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0286] The present application also provides a data encryption and decryption device in a key management system, which is applied to a cloud service platform. The cloud service platform is respectively connected to a key management agent and a service side in the key management system in communication. The device includes:

[0287] A receiving module, configured to receive a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request;

[0288] a second encryption / decryption module, configured to, if the key association request includes an encryption / decryption request, determine corresponding key association information based on the key association request, send the key association information to a key management agent, so that the key management agent performs encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side; or

[0289] The second lifecycle management module is configured to manage the lifecycle of the key of the service side based on the key association request if the key association request includes a lifecycle management request.

[0290] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0291] The present application also provides a data encryption and decryption device in a key management system, which is applied to the business side of the key management system. The business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface that provides an entry for key lifecycle management, and implements online key status negotiation with a cloud service platform based on a key management agent.

[0292] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0293] The present application also provides a data encryption and decryption system in a key management system, the data encryption and decryption system in the key management system comprising:

[0294] The business side is used to preset the directory to build in the key registration model file. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent.

[0295] A key management agent is used to obtain a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and is also used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing to the service side;

[0296] If the key association request includes a lifecycle management request, further used to manage the lifecycle of the key of the service side based on the key association request;

[0297] A cloud service platform, for receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and for, if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can perform encryption / decryption processing on the pending data of the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; and if the key association request includes a lifecycle management request, for interacting with the key management agent based on the key association request to implement lifecycle management of the key of the business side.

[0298] The specific implementation of the data encryption and decryption system in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0299] An embodiment of the present application provides a storage medium, and the storage medium stores one or more programs, and the one or more programs can also be executed by one or more processors to implement the steps of the data encryption and decryption method in the key management system described in any one of the above items.

[0300] The specific implementation of the storage medium of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0301] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the data encryption and decryption method in the above-mentioned key management system.

[0302] The specific implementation of the computer program product of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0303] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0304] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0305] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus hardware platform, or by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM) and includes several instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0306] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data encryption and decryption method in a key management system, characterized in that: Applied to a key management agent, the key management agent is respectively connected to a cloud service platform and a business side for communication, the method comprising: Obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; If the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returning the data after the encryption / decryption processing to the service side; If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

2. The data encryption and decryption method in the key management system according to claim 1, characterized in that: The key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key; The step of encrypting / decrypting the data to be processed on the service side based on the key association information further includes: Determining whether the key is within a validity period; If it is not within the validity period, re-apply for the corresponding key from the cloud service platform, and encrypt / decrypt the data to be processed on the business side based on the re-applied key.

3. The data encryption and decryption method in the key management system according to claim 1, characterized in that: If the key association request is a key registration application request, the life cycle management is a working key registration application management; The step of obtaining a key association request from the service side also includes: When the service on the business side is started, read the key registration model file on the business side, and generate a registration application request on the business side based on the key registration model file; The step of managing the life cycle of the key of the service side based on the key association request includes: Based on the registration application request, obtain a corresponding working key and a corresponding key ID, wherein the working key and the corresponding key ID are generated and fed back by the cloud service platform based on the registration application request; Feedback the ID corresponding to the working key to the service side.

4. The data encryption and decryption method in the key management system according to claim 1, characterized in that: If the key association request is a key update request, the life cycle management is update management of the working key; The step of managing the life cycle of the key of the service side based on the key association request includes: Forwarding the key update request to the cloud service platform, and receiving first information fed back by the cloud service platform, wherein the first information includes information that the key update request corresponds to the original key status update has been completed, and the first information also includes a key in a historical state or a key in an activated state, wherein the key in the historical state is only used to decrypt the existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data; Based on the activated key in the first information, the new data sent by the service side is encrypted and decrypted.

5. The data encryption and decryption method in the key management system according to claim 4, characterized in that: If the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state; The life cycle management is the revocation management of the working key; After the step of forwarding the key update request to the cloud service platform and receiving the first information fed back by the cloud service platform, the method further includes: Receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, and receiving second information fed back by the cloud service platform, the second information including information for changing the key state to a pending revocation state based on the key revocation request; Feeding back the second information to the service side, so that the service side and the cloud service platform can enter into a key state negotiation process; During the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information, and feeds back to the key management agent after the processing is completed, then the service side receives third information fed back by the service side, the third information including information that the data encrypted by the key corresponding to the state to be revoked has been processed, and forwards the third information to the cloud service platform, so that the cloud service platform changes the state of the key to be revoked to a disabled state, and the key in the disabled state cannot be used for encryption and decryption of data; If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

6. The data encryption and decryption method in the key management system according to claim 5, characterized in that: If the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state; The life cycle management is the destruction management of the working key; After the step of forwarding the third information to the cloud service platform so that the cloud service platform can change the pending revocation state of the key to the deactivated state, the method further comprises: receiving a key destruction request from the service side, forwarding the key destruction request to the cloud service platform, and receiving fourth information fed back by the cloud service platform, the fourth information including information that the corresponding key is marked as destroyed based on the key destruction request; The fourth information is fed back to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

7. A data encryption and decryption method in a key management system, characterized in that: Applied to a cloud service platform, the cloud service platform is respectively connected to a key management agent and a service side in a key management system, and the method includes: Receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; If the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to a key management agent, so that the key management agent performs encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returns the data after the encryption / decryption processing to the service side; or If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

8. A method for encryption and decryption, applied to the business side of a key management system, wherein the business side has a built-in key registration model file in a preset directory, the business side includes a key maintenance interface that provides an entry for key lifecycle management, and implements online key status negotiation with a cloud service platform based on a key management agent.

9. A data encryption and decryption system in a key management system, characterized in that: The data encryption and decryption system in the key management system includes: The business side is used to preset the directory to build in the key registration model file. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent; A key management agent, used to obtain a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; further used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing is completed to the service side; if the key association request includes a lifecycle management request, further used to perform lifecycle management on the key of the service side based on the key association request; A cloud service platform, for receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and for, if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can perform encryption / decryption processing on the pending data of the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; and if the key association request includes a lifecycle management request, for interacting with the key management agent based on the key association request to implement lifecycle management of the key of the business side.

10. A data encryption and decryption device in a key management system, characterized in that: The invention comprises a memory, a processor and a data encryption and decryption program in a key management system which is stored in the memory and can be run on the processor. When the processor executes the data encryption and decryption program in the key management system, the steps of the data encryption and decryption method in the key management system described in any one of claims 1 to 7 are implemented.

11. A storage medium, characterized in that: The storage medium stores a data encryption and decryption program in a key management system, and when the data encryption and decryption program in the key management system is executed by a processor, the steps of the data encryption and decryption method in the key management system according to any one of claims 1 to 7 are implemented.

Images