Key storage mechanism switching method, cluster system, device, medium and product

Abstract

The present invention discloses a switching method, cluster system, device, medium and product of a key preservation mechanism, and relates to the technical field of data security management. When the current key preservation mechanism meets the switching condition of the key preservation mechanism, the first master key corresponding to the current key preservation mechanism is used to unseal the first key to obtain the plain text form of the unsealed first key. There is no need to encrypt the data itself, and the online switching of the key preservation mechanism is achieved by unsealing and encapsulating the master key and the first key under each key preservation mechanism. By unsealing and encapsulating the keys (the master key and the first key of each key preservation mechanism), there is no need to perform repetitive operations of decrypting and encrypting the data itself, which saves switching efficiency. The data of the current encryption business itself is not affected in any way, which improves the storage availability and the flexibility of online switching of different key preservation mechanisms.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a switching method, cluster system, device, medium and product of a key storage mechanism. Background Art

[0002] Enterprise-level storage uses a proprietary key storage mechanism for static data encryption to ensure data security.

[0003] Currently, key management is performed using key storage mechanism A. If key storage mechanism A encounters a failure or other abnormal situation during the key management process and needs to be switched to key storage mechanism B, the existing data, master key and data encryption key encrypted by key storage mechanism A need to be deleted. That is, after the entire key storage mechanism A is completed and deleted, it is switched to the new key management mechanism of key storage mechanism B for reconfiguration. The repetitive operation of obtaining a new master key and a new data encryption key to re-encrypt the data affects the original encryption business, thereby reducing storage availability.

[0004] Therefore, how to reduce the impact on the original encryption business when switching the key storage mechanism to improve the availability of storage is an urgent problem that those skilled in the art need to solve. Summary of the invention

[0005] The purpose of the present invention is to provide a key storage mechanism switching method, cluster system, device, medium and product to solve the problem that the original encryption business is affected by the repetitive operation of key reconfiguration when the key storage mechanism is switched.

[0006] In order to solve the above technical problems, the present invention provides a method for switching a key storage mechanism, comprising:

[0007] Obtain the first master key and the first key corresponding to the current key storage mechanism;

[0008] When the current key storage mechanism meets the switching condition of the key storage mechanism, using the first master key to decrypt the first key;

[0009] Obtain the second master key corresponding to the target key storage mechanism;

[0010] The unsealed first key is encapsulated using the second master key to complete the switching process from the current key storage mechanism to the target key storage mechanism.

[0011] On the one hand, when the first key is a first data encryption key, the first key is decrypted using the first master key, including:

[0012] Decrypting the first data encryption key using the first master key;

[0013] Correspondingly, encapsulating the unsealed first key using the second master key includes:

[0014] The decrypted first data encryption key is encapsulated using the second master key.

[0015] On the other hand, when the first key is a first data encryption key and a first key encryption key, the first key is decrypted by using the first master key, including:

[0016] Using the first master key to decrypt the first key encryption key, wherein the first key encryption key is a key used to encrypt the first data encryption key;

[0017] Correspondingly, encapsulating the unsealed first key using the second master key includes:

[0018] The decrypted first key encryption key is encapsulated using the second master key.

[0019] On the other hand, the process of determining the target key storage mechanism includes:

[0020] Pre-acquire other key storage mechanisms except the current key storage mechanism;

[0021] If there are multiple remaining key storage mechanisms and they include dedicated encryption hardware and a key management server system, the key management server system is used as the target key storage mechanism.

[0022] On the other hand, the process of determining the target key storage mechanism includes:

[0023] Pre-acquire other key storage mechanisms except the current key storage mechanism;

[0024] If the remaining key storage mechanisms are key protection mechanisms of multiple dedicated encryption hardware, the priority level corresponding to each of the remaining key storage mechanisms is determined according to the encryption and decryption rate parameter;

[0025] The key storage mechanism of the dedicated encryption hardware corresponding to the highest priority level is selected as the target key storage mechanism.

[0026] On the other hand, the process of acquiring the target key storage mechanism includes:

[0027] Pre-acquire configuration information of the target key storage mechanism;

[0028] Synchronize with the process of acquiring the configuration information of the current key storage mechanism to acquire the target key storage mechanism;

[0029] Alternatively, when the current key storage mechanism meets the switching condition of the key storage mechanism, the configuration information of the target key storage mechanism is obtained so as to obtain the target key storage mechanism.

[0030] On the other hand, before encapsulating the unsealed first key with the second master key, the method further includes:

[0031] Obtaining the key length of each of the first master key and the second master key;

[0032] If the first master key and the second master key have the same key length, proceeding to the step of encapsulating the unsealed first key with the second master key;

[0033] If the key lengths of the first master key and the second master key are different, and the key length of the first master key is greater than the key length of the second master key, the key length of the second master key is padded according to the key length of the first master key so that the key length of the padded second master key is the same as the key length of the first master key, and the process proceeds to the step of encapsulating the unsealed first key using the second master key.

[0034] On the other hand, padding the key length of the second master key according to the key length of the first master key so that the key length of the padded second master key is the same as the key length of the first master key, including:

[0035] Performing difference processing on the key length of the first master key and the key length of the second master key to obtain the key length to be padded;

[0036] Generate a random code according to the length of the key to be padded;

[0037] The random code and the second master key are concatenated to obtain a padded second master key, so that a key length of the padded second master key is the same as a key length of the first master key.

[0038] On the other hand, before using the second master key to encapsulate the unsealed first key, the method further includes:

[0039] Using the second master key to decrypt the first key to obtain an initially decrypted first key;

[0040] comparing the unsealed first key with the initially unsealed first key;

[0041] If the unsealed first key is the same as the initially unsealed first key, it is determined that the second master key verification is successful, and the process proceeds to the step of encapsulating the unsealed first key using the second master key.

[0042] On the other hand, after the unsealed first key is encapsulated by using the second master key, the method further includes:

[0043] Using key data obtained by encapsulating the first key after decapsulation by the second master key as the initial first key;

[0044] comparing the initial first key with the first key;

[0045] If the initial first key is the same as the first key, it is determined that the second master key verification is successful.

[0046] On the other hand, if the first key is a first data encryption key and a first key encryption key, the switching process from the current key storage mechanism to the target key storage mechanism during a key update period of the key life cycle further includes:

[0047] Updating the second master key to obtain an updated second master key;

[0048] The unsealed first key encryption key is encapsulated using the updated second master key to complete the key update cycle.

[0049] On the other hand, the process of determining whether the current key storage mechanism satisfies the switching condition of the key storage mechanism includes:

[0050] Receiving a key storage mechanism switching instruction issued by a host; wherein the parameters corresponding to the switching instruction at least include the current key storage mechanism, the first master key and the target key storage mechanism;

[0051] If the switching instruction of the key storage mechanism is a valid switching instruction, it is determined that the current key storage mechanism meets the switching condition of the key storage mechanism.

[0052] On the other hand, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0053] When the storage device to which the current key storage mechanism belongs is in a waiting-for-relocation state, the switching instruction of the key storage mechanism is converted from an invalid switching instruction to a valid switching instruction.

[0054] On the other hand, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0055] Obtaining the working status corresponding to the current key storage mechanism;

[0056] If the working state is a fault state or an attack state, the switching instruction of the key storage mechanism is converted into a valid switching instruction.

[0057] On the other hand, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0058] Pre-acquire the current number of experiments and the preset number of experiments of the current key storage mechanism;

[0059] When the current number of experiments reaches a preset number of experiments, the switching instruction of the key storage mechanism is converted into a valid switching instruction.

[0060] On the other hand, after the unsealed first key is encapsulated by using the second master key, the method further includes:

[0061] Deleting and destroying the first master key of the current key storage mechanism;

[0062] Release the storage space of the current key storage mechanism.

[0063] On the other hand, after completing the switching process from the current key storage mechanism to the target key storage mechanism, the method further includes:

[0064] Performing operation processing on the key life cycle under the target key storage mechanism according to the preset number of experiments;

[0065] When the current number of experiments of the target key storage mechanism reaches the preset number of experiments, obtaining the key operation effects corresponding to the current key storage mechanism and the target key storage mechanism respectively;

[0066] The key operation effects corresponding to the current key preservation mechanism and the target key preservation mechanism are compared to determine the comparison result between the current key preservation mechanism and the target key preservation mechanism, and determine the final key preservation mechanism.

[0067] On the other hand, the switching process from the current key storage mechanism to the target key storage mechanism occurs in any period of the key life cycle of the current key storage mechanism.

[0068] In order to solve the above technical problem, the present invention further provides a cluster system, which includes a plurality of nodes; the cluster system is used to execute the steps of the above-mentioned key storage mechanism switching method to perform key management.

[0069] In order to solve the above technical problems, the present invention further provides a switching device for a key storage mechanism, comprising:

[0070] Memory for storing computer programs;

[0071] A processor is used to implement the steps of the switching method of the key storage mechanism as described when executing the computer program.

[0072] In order to solve the above technical problem, the present invention also provides a non-volatile storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the switching method of the key storage mechanism as described above are implemented.

[0073] In order to solve the above technical problem, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the key storage mechanism switching method when executed by a processor.

[0074] The beneficial effect of the present invention is that, on the one hand, when the current key storage mechanism meets the switching condition of the key storage mechanism, the switching mechanism of the key storage mechanism is triggered, and the first master key corresponding to the current key storage mechanism is used to unseal the first key to obtain the plain text form of the unsealed first key. There is no need to use the unsealed first key to decrypt the data itself under the current key storage mechanism, and the second master key of the target key storage mechanism is directly used to encapsulate the plain text data of the unsealed first key to switch from the current key storage mechanism to the target key storage mechanism. There is no need to encrypt the data itself, and the online switching of the key storage mechanism is realized by unsealing and encapsulating the master key and the first key under each key storage mechanism. On the other hand, through the unsealing and encapsulation between the keys (the master key and the first key of each key storage mechanism), there is no need to reconfigure the encryption of the data based on the new key management mechanism, that is, there is no need to perform repetitive operations of decrypting and encrypting the data itself, saving switching efficiency. At the same time, the data of the current encryption business itself is not affected in any way, improving the storage availability and the flexibility of online switching of different key storage mechanisms.

[0075] Secondly, the setting of the valid flag bit of the effective switching instruction improves the simplicity and operability of determining whether the current key preservation mechanism meets the switching conditions of the key preservation mechanism. When the key preservation mechanism of the corresponding storage device needs to be switched in the relocation state, its invalid switching instruction is converted into a flag bit setting of a valid switching instruction, so as to complete the subsequent switching process of the key preservation mechanism. When the key preservation mechanism in the fault state or attack state needs to be switched, its invalid switching instruction is converted into a flag bit setting of a valid switching instruction, so as to complete the subsequent switching process of the key preservation mechanism and improve the data security under the key preservation mechanism. When the current number of experiments of the current key preservation mechanism reaches the preset number of experiments, the switch is performed, and its invalid switching instruction is converted into a flag bit setting of a valid switching instruction, so as to complete the subsequent switching process of the key preservation mechanism, that is, to complete the experiment of the target key preservation mechanism, improve the experimental processing efficiency under multiple key preservation mechanisms, and make the connection of the switching process without delay. Based on the experimental comparison of the current key preservation mechanism and the target key preservation mechanism, the comparison results of the key operation effects of each are determined to improve the accuracy of the selection under the final key preservation mechanism. The configuration order of the corresponding configuration information in the acquisition process of the target key storage mechanism is to enrich the flexibility of the configuration information of the target key storage mechanism. The switching process of the key storage mechanism in the two-layer key system and the three-layer key system improves the flexibility and diversity of the switching key storage mechanism of different key systems. At the same time, corresponding to the switching process of the key storage mechanism in the three-layer key system, the key encryption key is unsealed and encapsulated by the master key to improve the switching efficiency. When the remaining key storage mechanisms include the key storage mechanism of the dedicated encryption hardware and the key management server system, the key management server system is given priority as the target key storage mechanism to improve the security and scalability of data storage. When the remaining key storage mechanism is the key protection mechanism of multiple dedicated encryption hardware, the key protection mechanism of the dedicated encryption hardware with the highest priority level determined based on the encryption and decryption rate parameter is used as the target key storage mechanism to improve the subsequent encryption and decryption rate. Before the second master key is used to encapsulate the unsealed first key, the second master key is verified, and the key lengths of the first master key and the second master key are compared and verified to improve the accuracy of the second master key. The filling process of the key completion processing is to facilitate the subsequent second master key to encapsulate the unsealed first key, ensure the smooth completion of the encapsulation processing of the second master key of the target key storage mechanism, and realize the switching processing from the current key storage mechanism to the target key storage mechanism.Before the unsealed first key is encapsulated with the second master key, the accuracy of the second master key is indirectly verified by comparing the first key. If the unsealed first key is the same as the initial unsealed first key, the second master key verification is determined to be successful. The second master key is verified by the unsealed first key, which improves the fairness and authority of the verification and ensures the accuracy of the encapsulation of the first key. After the unsealed first key is encapsulated with the second master key, the accuracy of the second master key is indirectly verified by comparing the first key. If the initial first key is the same as the first key, the second master key verification is determined to be successful, and the switching process from the current key storage mechanism to the target key storage mechanism is successfully completed. The switching process from the current key storage mechanism to the target key storage mechanism occurs in any period of the key life cycle of the current key storage mechanism to improve the flexibility of the switching from the current key storage mechanism to the target key storage mechanism. Only one master key needs to be updated. The original master key (current master key) is used to decrypt the key encryption key to obtain the key encryption key in plain text. The new master key (the master key to be replaced) is used to re-encapsulate the key decryption key in plain text. There is no need to re-encapsulate a large number of data encryption keys, thereby improving the efficiency of key updates and reducing the impact of key updates on system availability.

[0076] In addition, the present invention also provides a cluster system, a switching device, a medium and a product of a key storage mechanism, which have the same beneficial effects as the switching method of the key storage mechanism described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0078] Figure 1 A flowchart of a method for switching a key storage mechanism provided by an embodiment of the present invention;

[0079] Figure 2 A schematic diagram of a multiple key storage mechanism in a storage system provided by an embodiment of the present invention;

[0080] Figure 3 A structural diagram of a switching device for a key storage mechanism provided by an embodiment of the present invention;

[0081] Figure 4 A structural diagram of a key storage mechanism switching device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0083] The core of the present invention is to provide a key storage mechanism switching method, cluster system, device, medium and product to solve the problem that the original encryption business is affected by the repetitive operation of key reconfiguration when the key storage mechanism is switched.

[0084] In order to enable those skilled in the art to better understand the solution of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0085] With the rapid development of information technology, data security and privacy protection have become crucial issues. In the field of data storage, static data encryption, as an effective security measure, is gradually gaining widespread attention and application. Static data encryption refers to the encryption of data stored on physical media (such as hard disks, solid-state drives, tapes, etc.) to ensure that the data cannot be read or understood without authorization. By adopting advanced encryption algorithms and key management mechanisms, static data encryption can provide strong security protection for the storage of sensitive data and effectively prevent data leakage and illegal access. In the current context of frequent data leakage incidents, the application of static data encryption technology is particularly important. It can not only protect personal privacy and corporate trade secrets, but also meet the strict requirements of laws and regulations on data security.

[0086] In the current digital age, enterprise-level storage systems carry massive amounts of critical business data, the security and integrity of which are directly related to the stability of business operations, customer trust, and legal compliance. As a cutting-edge data protection technology, static data encryption has far-reaching value in enterprise-level storage.

[0087] First, static data encryption can significantly improve the confidentiality of data. By encrypting data stored on physical media such as hard disks and solid-state drives (SSDs), even if the storage device is stolen or lost, attackers cannot directly access and understand the data, thereby effectively preventing the leakage of sensitive information, which is crucial for protecting corporate trade secrets and customer privacy.

[0088] Secondly, static data encryption helps to enhance data integrity. The encryption process is usually accompanied by data integrity verification to ensure that the data has not been tampered with during storage and transmission. This is of great significance for maintaining the authenticity and credibility of enterprise data and meeting industry regulatory requirements.

[0089] In addition, static data encryption can also provide flexible data access control for enterprise-level storage systems. With the cooperation of the key management system, enterprises can implement fine-grained control over data access rights of different users or applications, ensuring that only authorized users can access specific data. This helps prevent internal leaks and misoperations, and improves the company's data security management level.

[0090] In summary, implementing static data encryption in enterprise-level storage can not only significantly improve data confidentiality and integrity protection, but also provide enterprises with more flexible data access control methods. This plays an irreplaceable role in maintaining enterprise data security, ensuring stable business operations, and meeting legal and regulatory requirements.

[0091] Key management plays a vital role in implementing static data encryption in enterprise-level storage systems. The key is the core of encrypting and decrypting data, and its security is directly related to the reliability of the entire encryption system. An effective key management strategy can not only ensure the confidentiality of data, but also improve the flexibility and scalability of the system.

[0092] Key management involves multiple links such as key generation, storage, distribution, update, revocation and destruction. First, the generation of keys should follow the principles of security and randomness to ensure that each key is unique and difficult to predict or crack. Second, the storage of keys needs to be secure, such as hardware security modules (HSM) or key management services (KMS) to prevent unauthorized access or disclosure of keys.

[0093] In terms of key distribution, it should be ensured that only authorized users or systems can obtain the corresponding keys. This is usually achieved through secure communication channels and strict access control mechanisms. At the same time, key update and revocation are also important links in key management. Over time, keys may need to be updated or revoked for various reasons (such as key leakage, algorithm obsolescence, etc.). At this time, there needs to be an efficient and secure way to update or revoke keys and ensure the smooth distribution of new keys.

[0094] Finally, the destruction of keys is also an important part. When keys are no longer needed, they should be destroyed securely to prevent them from being misused or leaked. This usually involves multiple steps such as key deletion and physical destruction.

[0095] When implementing static data encryption in enterprise-level storage, the principle of separating keys from storage systems is adopted for security reasons. Keys should be generated and managed by a dedicated key management system (KMS) or dedicated encryption hardware on the storage system. Keys should be stored in encrypted form and should not appear in plain text in the storage system. Keys can be stored in hardware security modules (HSMs) or cryptographic devices, which have physical protection and tamper-proof functions. Key storage should follow the principle of least privilege, that is, only authorized personnel or systems can access the keys.

[0096] Existing enterprise-level storage keys can be stored using a variety of different key storage mechanisms, such as a dedicated key management system or hardware security module. If the key management service system is used alone, there are the following disadvantages: KMS is a centralized key management system. Once it fails or is attacked, it may cause the entire key management process to be paralyzed, thereby affecting data decryption and access. KMS's dependence is also reflected in its dependence on the network and infrastructure. Any network failure or infrastructure problem may affect the availability and performance of KMS.

[0097] If you use dedicated encryption hardware alone to store keys, there are the following disadvantages: Dedicated encryption hardware usually has a high acquisition cost and requires regular maintenance and updates to ensure its security and performance. Hardware failure or damage may result in the loss or inaccessibility of keys, which in turn affects the decryption and recovery of data. The key management functions of dedicated encryption hardware may be relatively fixed and limited, and cannot meet the ever-changing security needs and policies of the enterprise. Compared with KMS, dedicated encryption hardware may have less flexibility in key rotation, revocation, and auditing.

[0098] When multiple key storage mechanisms are switched during their respective operations, the keys of the current key storage mechanism and the encrypted data can only be deleted, the original data encryption key and master key can be deleted, and then the new key storage mechanism can be switched to reconfigure, resulting in reduced storage availability. The key storage mechanism switching method provided by the present invention can solve the above technical problems.

[0099] Figure 1 A flowchart of a method for switching a key storage mechanism provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0100] S11: Obtain a first master key and a first key corresponding to the current key storage mechanism;

[0101] S12: when the current key storage mechanism meets the switching condition of the key storage mechanism, decrypting the first key by using the first master key;

[0102] S13: Obtain a second master key corresponding to the target key storage mechanism;

[0103] S14: The unsealed first key is encapsulated using the second master key to complete the switching process from the current key storage mechanism to the target key storage mechanism.

[0104] Specifically, the current key storage mechanism can be KMS or dedicated encryption hardware, which is not limited here. The corresponding first master key is the first key of the encryption system, which needs to be generated first, and then the first master key is used to generate the first key. The first key here can be a data encryption key, or a key encryption key and a data encryption key. When the first key is a data encryption key, the corresponding current key storage mechanism is a two-layer key management mechanism. If the first key is a key encryption key and a data encryption key, the corresponding current key storage mechanism is a three-layer key management mechanism.

[0105] The current key preservation mechanism meets the switching conditions of the key preservation mechanism, which can be a switching instruction corresponding to the switching conditions that trigger the key preservation mechanism. The specific time of the triggering can be based on different application scenarios, such as the failure or attack scenario of the current key preservation mechanism, or the storage device corresponding to the current key preservation mechanism is in a relocation state and needs to be temporarily switched. It can also be an experimental state corresponding to multiple key preservation mechanisms to compare and determine which key preservation mechanism to use.

[0106] In some embodiments, the process of determining whether the current key storage mechanism satisfies the switching condition of the key storage mechanism includes:

[0107] Receiving a key storage mechanism switching instruction issued by a host; wherein the parameters corresponding to the switching instruction at least include a current key storage mechanism, a first master key, and a target key storage mechanism;

[0108] If the switching instruction of the key storage mechanism is a valid switching instruction, it is determined that the current key storage mechanism meets the switching condition of the key storage mechanism.

[0109] Specifically, a switching instruction of the key storage mechanism sent by the host is received. It can be understood that the host refers to the user-side host, the data read and written by the host is plain text data, and the host cannot perceive the encryption and decryption operations of the data. Figure 2 A schematic diagram of a plurality of key storage mechanisms in a storage system provided by an embodiment of the present invention, such as Figure 2As shown, key management supports both a dedicated key management service system and dedicated encryption hardware on the storage system, allowing enterprise-level storage to switch key preservation mechanisms without affecting existing encryption services. The storage system, that is, the storage array, is responsible for completing encryption and decryption operations on user data. The dedicated encryption hardware is built into the storage system and is responsible for key management, that is, key generation, destruction, and preservation, etc., when the key management service system is not in use. Similarly, the key management service system is responsible for key generation, destruction, and preservation, etc., when the dedicated encryption hardware built into the storage system is not in use.

[0110] The switching instruction at least includes the current key storage mechanism, the first master key currently in use, and the target key storage mechanism. The processing of the switching instruction requires that the switching instruction of the corresponding key storage mechanism is a valid switching instruction, which can be triggered by setting the valid flag bit, that is, determining that the current key storage mechanism meets the switching conditions of the key storage mechanism.

[0111] In addition, the processing process of its instructions, for example, the key storage mechanism currently in use is A, the new key storage mechanism is B, the master key in use is Master_Key_A, the data encryption key Data_Encryption_Key in use, there are multiple Data Encryption Keys in the system, one for each storage pool or each volume according to the configuration. These data encryption keys have been wrapped by Master_Key_A and recorded as Data_Encryption_Key_Wrapped_by_Master_Key_A. The storage system receives the issued command and obtains the above parameters, including A, B, and Master_Key_A. The storage system checks whether Master_key_A is the same as the master key in use in the system. If they are not the same, an error message is prompted and the process ends. The storage system applies to B for a new master key, Master_key_B. If the application fails, an error message is prompted and the process ends. The storage system uses Master_Key_A to unseal all Data_Encryption_Key_Wrapped_by_Master_Key_A in the system to obtain Data_Encryption_Key. The storage system uses Master_Key_B to encrypt and wrap Data_Encryption_Key to obtain Data_Encryption_Key_Wrapped_by_Master_Key_B. The storage system destroys Master_Key_A. Command feedback: After the storage system completes the key management mode switch, it will feedback the execution result to the user. The feedback result carries the following parameters: Execution result: success or failure; error message (optional), when the execution result is failure, the error message is filled; the key management mode currently used, A or B.

[0112] Therefore, the setting of its effective flag bit can be switched based on a certain scenario trigger, which is not limited here.

[0113] The setting of the valid flag bit of the valid switching instruction provided in this embodiment improves the simplicity and operability of determining whether the current key storage mechanism satisfies the switching condition of the key storage mechanism.

[0114] In some embodiments, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0115] When the storage device to which the current key storage mechanism belongs is in a waiting-for-relocation state, the switching instruction of the key storage mechanism is converted from an invalid switching instruction to a valid switching instruction.

[0116] Specifically, when the storage device to which the current key storage mechanism belongs is in a state to be relocated, the current key storage mechanism needs to be temporarily disabled. Corresponding to the key storage during the relocation process, it needs to be switched to the target key storage mechanism, so the switching instruction of the key storage mechanism needs to be switched from an invalid switching instruction to a valid switching instruction. When the storage device relocation is completed, the target key storage mechanism needs to be switched to the current key storage mechanism.

[0117] In the migration state provided in this embodiment, if the key storage mechanism of the corresponding storage device needs to be switched, the flag bit of the invalid switching instruction is converted into a valid switching instruction to complete the subsequent key storage mechanism switching process.

[0118] In some embodiments, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0119] Get the working status of the current key storage mechanism;

[0120] If the working state is a fault state or an attack state, the switching instruction of the key storage mechanism is converted into a valid switching instruction.

[0121] Specifically, if the working state of the current key storage mechanism is a fault state or an attack state, it means that the current key storage mechanism is abnormal and needs to be switched to other key storage mechanisms for key management, so the switching instruction is converted into a valid switching instruction.

[0122] If the key preservation mechanism in the fault state or attack state provided in this embodiment needs to be switched, the invalid switching instruction is converted into a flag setting of a valid switching instruction to facilitate the subsequent switching processing of the key preservation mechanism and improve the data security under the key preservation mechanism.

[0123] In some embodiments, after the key storage mechanism in the above-mentioned fault state or attack state is replaced, after the unsealed first key is encapsulated with the second master key, the following is further included:

[0124] Deleting and destroying the first master key of the current key storage mechanism;

[0125] Release the storage space of the current key storage mechanism.

[0126] Specifically, the first master key of the current key storage mechanism is deleted and destroyed to release storage space, thereby saving storage space and releasing resources.

[0127] Taking the switching scenario from using the key management service system to using dedicated encryption hardware as an example, the user initiates the key management mode switching process and specifies the new key management mode as using dedicated encryption hardware to manage keys; the storage controller applies for a new master key from the dedicated encryption hardware; the storage controller uses the original master key to unseal the data encryption key and obtains the unseal data encryption key; the storage controller uses the newly applied master key to re-encapsulate the data encryption key; the storage controller deletes the original master key stored on the key management service system; the storage controller responds to the user that the key management mode switching is completed. Similarly, the switching scenario of switching from using dedicated encryption hardware to the key management service system is the same as the above switching scenario, which will not be repeated here.

[0128] In some embodiments, determining that the switching instruction of the key storage mechanism is a valid switching instruction includes:

[0129] Pre-acquire the current number of experiments and the preset number of experiments of the current key preservation mechanism;

[0130] When the current number of experiments reaches the preset number of experiments, the switching instruction of the key preservation mechanism is converted into a valid switching instruction.

[0131] Specifically, in the actual application process of the key preservation mechanism, experiments can be carried out corresponding to multiple key preservation mechanisms. The experimental process here is not limited, and it mainly corresponds to the quality inspection of key management of different key preservation mechanisms, or corresponds to the performance inspection of the storage system, etc., to obtain the current number of experiments and the preset number of experiments of the current key preservation mechanism. If the current number of experiments reaches the preset number of experiments, the switching instruction will be converted into a valid switching instruction.

[0132] When the current number of experiments of the current key preservation mechanism provided in this embodiment reaches the preset number of experiments, the mechanism is switched, and its invalid switching instruction is converted into a flag setting of a valid switching instruction, so as to complete the subsequent switching processing of the key preservation mechanism, that is, complete the experiment of the target key preservation mechanism, improve the experimental processing efficiency under multiple key preservation mechanisms, and make the switching process connected without delay.

[0133] In some embodiments, considering the experimental process of the target key storage mechanism, after completing the switching process from the current key storage mechanism to the target key storage mechanism, the method further includes:

[0134] Running the key life cycle under the target key preservation mechanism according to a preset number of experiments;

[0135] When the current number of experiments of the target key storage mechanism reaches the preset number of experiments, the key operation effects corresponding to the current key storage mechanism and the target key storage mechanism are obtained;

[0136] The key operation effects corresponding to the current key preservation mechanism and the target key preservation mechanism are compared to determine the comparison result of the current key preservation mechanism and the target key preservation mechanism, and determine the final key preservation mechanism.

[0137] Specifically, after the experiments of the current key preservation mechanism and the target key preservation mechanism are completed, it is necessary to obtain the key operation effect corresponding to each key preservation mechanism, that is, the quality detection effect, and compare them. If the key operation effect of the current key preservation mechanism and the target key preservation mechanism are the same, you can choose any one, or select the final key preservation mechanism based on other factors. If the key operation effect of the current key preservation mechanism is better than the key operation effect of the target key preservation mechanism, the current key preservation mechanism is selected as the final key preservation mechanism. If the key operation effect of the target key preservation mechanism is better than the key operation effect of the current key preservation mechanism, the target key preservation mechanism is selected as the final key preservation mechanism.

[0138] This embodiment provides an experimental comparison based on the current key storage mechanism and the target key storage mechanism to determine the comparison results of the respective key operation effects and improve the accuracy of the selection under the final key storage mechanism.

[0139] In step S12, when the current key storage mechanism meets the switching condition of the key storage mechanism, the first master key is used to unseal the first key. The unseal process here takes into account that during the switching process, the original master key (first master key) is used to unseal the first key to obtain the unsealed plaintext first key.

[0140] In step S13, the second master key corresponding to the target key storage mechanism is obtained. The generation process of the second master key here is the same as the generation process of the first master key corresponding to the current key storage mechanism, that is, the user initiates a master key generation request and sends the request to the storage controller. The storage controller requests a new key from the respective key storage mechanism. The respective key storage mechanisms generate a key and return the key as their respective master key to the storage controller. The storage controller caches the returned master key in the secure memory. The acquisition step here and the above-mentioned step S12 can be executed sequentially or simultaneously with step S11, which is not limited here. Considering the configuration information of the current key storage mechanism and the target key storage mechanism, it can be the configuration work completed before switching the key storage mechanism, or it can be the configuration of the target key storage mechanism when the switching conditions are met. The two methods are not limited.

[0141] In some embodiments, the process of obtaining the target key storage mechanism includes:

[0142] Obtain the configuration information of the target key storage mechanism in advance;

[0143] Synchronize with the process of obtaining the configuration information of the current key storage mechanism to obtain the target key storage mechanism;

[0144] Alternatively, when the current key storage mechanism meets the switching condition of the key storage mechanism, the configuration information of the target key storage mechanism is obtained so as to obtain the target key storage mechanism.

[0145] Specifically, the configuration information of the target key storage mechanism may be obtained in advance, and synchronized with the acquisition process of the current key storage mechanism in step S11 to obtain the target key storage mechanism. Alternatively, when the switching condition is met and the target key switching mechanism needs to be switched, the configuration information of the target key storage mechanism is obtained to complete the acquisition process of the target key storage mechanism.

[0146] This embodiment provides a configuration sequence of corresponding configuration information during the acquisition process of the target key storage mechanism to enrich the flexibility of configuration of the configuration information of the target key storage mechanism.

[0147] In step S14, the second master key is used to encapsulate the unsealed first key. The encapsulation process here is the same as the conventional encapsulation process of the first key, or it can be different. It is not limited here and can be set according to actual conditions. At this point, the key management corresponding to the target key storage mechanism has been completely switched.

[0148] The embodiment of the present invention provides a method for switching a key storage mechanism, which obtains a first master key and a first key corresponding to the current key storage mechanism; when the current key storage mechanism meets the switching condition of the key storage mechanism, the first master key is used to unseal the first key; the second master key corresponding to the target key storage mechanism is obtained; the unsealed first key is encapsulated using the second master key to complete the switching process from the current key storage mechanism to the target key storage mechanism. On the one hand, when the current key storage mechanism meets the switching condition of the key storage mechanism, the switching mechanism of the key storage mechanism is triggered, and the first master key corresponding to the current key storage mechanism is used to unseal the first key to obtain the plain text form of the unsealed first key. There is no need to use the unsealed first key to decrypt the data itself under the current key storage mechanism, and the second master key of the target key storage mechanism is directly used to encapsulate the plain text data of the unsealed first key to switch from the current key storage mechanism to the target key storage mechanism. There is no need to encrypt the data itself, and the online switching of the key storage mechanism is realized by unsealing and encapsulating the master key and the first key under each key storage mechanism. On the other hand, by unsealing and encapsulating the keys (the master key and the first key of each key storage mechanism), there is no need to reconfigure the encryption of the data based on the new key management mechanism, that is, there is no need to perform repeated operations of decrypting and encrypting the data itself, which saves switching efficiency. At the same time, the data of the current encrypted business itself is not affected in any way, which improves storage availability and the flexibility of online switching of different key storage mechanisms.

[0149] In some embodiments, when the first key is a first data encryption key, the first key is decrypted using the first master key, including:

[0150] Decrypting the first data encryption key using the first master key;

[0151] Correspondingly, the unsealed first key is encapsulated using the second master key, including:

[0152] The decrypted first data encryption key is encapsulated using the second master key.

[0153] It should be noted that when the first key is the first data encryption key, it means that the current key storage mechanism includes two layers of key systems, one is the master key and the other is the data encryption key. Regarding the data encryption key generation scenario, the corresponding generation process in each key storage mechanism is the same. Taking the key storage mechanism of the key management service system as an example, since the security requirements of the data encryption key are lower than the master key, the number of keys stored in the key storage mechanism is limited, so the data encryption key is generally generated by the hardware random generator on the storage controller and then encapsulated with the master key.

[0154] The generation steps include: the user initiates the data encryption key generation scenario; the storage controller uses a hardware random number generator to generate a random number that meets the security requirements as the data encryption key; the storage controller uses the master key to encapsulate the data encryption key and saves the encapsulated data encryption key in the configuration library.

[0155] The first data encryption key is unsealed using the first master key, and then the unsealed first data encryption key is encapsulated using the second master key. The master keys here come from different key storage mechanisms, and there is no need to encrypt and decrypt the corresponding data itself, or reconfigure operations.

[0156] In some other embodiments, when the first key is a first data encryption key and a first key encryption key, the first key is decrypted using the first master key, including:

[0157] Decrypting a first key encryption key using a first master key; wherein the first key encryption key is a key used to encrypt a first data encryption key;

[0158] Correspondingly, the unsealed first key is encapsulated using the second master key, including:

[0159] The unsealed first key encryption key is encapsulated using the second master key.

[0160] Specifically, if the first key is the first data encryption key and the first key encryption key, the corresponding current key storage mechanism is a three-layer key system, including a data encryption key, a key encryption key and a master key. The master key is usually used as a seed for generating a key encryption key and a data encryption key. The key encryption key is used to encrypt the data encryption key to increase security. Even if the data encryption key is intercepted, the data encryption key cannot be decrypted without the key encryption key.

[0161] In this embodiment, a three-layer key system is considered, and the corresponding switching process is to unseal the first key encryption key only by the first master key, and to encapsulate the unseal first key by the second master key. Considering that there are many data encryption keys, it takes a long time to unseal or encapsulate the data encryption key by the master key, so a three-layer key system is adopted to directly unseal or encapsulate the key encryption key corresponding to the master key, thereby reducing the switching time.

[0162] The switching process of the key storage mechanism in the two-layer key system and the three-layer key system provided in this embodiment improves the flexibility and diversity of the switching key storage mechanism of different key systems. At the same time, corresponding to the switching process of the key storage mechanism in the three-layer key system, the master key is used to unseal and encapsulate the key encryption key, thereby improving the switching efficiency.

[0163] In some embodiments, the process of determining the target key storage mechanism includes:

[0164] Pre-acquire the remaining key storage mechanisms except the current key storage mechanism;

[0165] If there are multiple remaining key storage mechanisms, and they include dedicated encryption hardware and a key management server system, the key management server system is used as the target key storage mechanism.

[0166] Specifically, when there are multiple key storage mechanisms other than the current key storage mechanism, it is necessary to check the types of the remaining key storage mechanisms. For example, when there are key storage mechanisms of dedicated encryption hardware and key storage mechanisms of software such as key management server systems, priority should be given to key management server systems to improve the security of data storage.

[0167] Compared with dedicated encryption hardware, the key management server system has the corresponding integration, which not only corresponds to the data storage of the storage system, but also corresponds to the storage of other data of the server.

[0168] This embodiment provides that when other key storage mechanisms include a key storage mechanism of dedicated encryption hardware and a key management server system, the key management server system is given priority as a target key storage mechanism to improve the security and scalability of data storage.

[0169] In some embodiments, the process of determining the target key storage mechanism includes:

[0170] Pre-acquire the remaining key storage mechanisms except the current key storage mechanism;

[0171] If the other key storage mechanisms are key protection mechanisms of multiple dedicated encryption hardware, the priority level corresponding to each of the other key storage mechanisms is determined according to the encryption and decryption rate parameter;

[0172] The key storage mechanism of the dedicated encryption hardware corresponding to the highest priority level is selected as the target key storage mechanism.

[0173] Specifically, dedicated encryption hardware refers to physical devices designed specifically for performing encryption and decryption operations, usually using technologies such as Application Specific Integrated Circuit (ASIC) or Field-Programmable Gate Array (FPGA) to ensure processing speed and security. It can be a Universal Serial Bus (USB) dongle, full disk encryptor, network security module, password card or smart card, etc., without limitation here.

[0174] When the remaining key storage mechanisms are key protection mechanisms of multiple dedicated encryption hardware, the key storage mechanism to be selected needs to determine the corresponding priority level according to the encryption and decryption rate parameter. The priority level parameter here can be determined by sorting according to the size of the encryption and decryption rate parameter, or can be determined according to other parameter factors. The key storage mechanism of the dedicated encryption hardware with the highest priority level is selected as the target key storage mechanism.

[0175] This embodiment provides that when the remaining key storage mechanisms are key protection mechanisms of multiple dedicated encryption hardware, the key protection mechanism of dedicated encryption hardware with the highest priority level determined based on the encryption and decryption rate parameters is used as the target key storage mechanism to improve the subsequent encryption and decryption rates.

[0176] Considering the verification process corresponding to the master key during the switching process of different key storage mechanisms, it can be performed before the unsealed first key is encapsulated with the second master key, or after the unsealed first key is encapsulated with the second master key.

[0177] In some embodiments, before the unsealed first key is encapsulated with the second master key, the method further includes:

[0178] Obtaining the key lengths of the first master key and the second master key;

[0179] If the key lengths of the first master key and the second master key are the same, proceeding to the step of encapsulating the unsealed first key with the second master key;

[0180] If the key lengths of the first master key and the second master key are different, and the key length of the first master key is greater than the key length of the second master key, the key length of the second master key is padded according to the key length of the first master key so that the padded key length of the second master key is the same as the key length of the first master key, and the step of encapsulating the unsealed first key with the second master key is entered.

[0181] Specifically, the verification process of the second master key based on the target key storage mechanism is compared with the first master key. The comparison method here uses the key length of each master key. Randomness can also be used to evaluate the quality of the second master key, which is not limited here. Taking the key lengths of each master key as an example, if they are the same, the second master key is directly used to encapsulate the unsealed first key. If they are not the same, and the key length of the first master key is greater than the key length of the second master key, it is necessary to pad the key length of the second master key based on the key length of the first master key so that the key lengths of the two master keys are the same.

[0182] If the key length of the first master key is smaller than the key length of the second master key, it is necessary to re-acquire a new second master key based on the target key storage mechanism for determination.

[0183] This embodiment provides that before the second master key is used to encapsulate the unsealed first key, the second master key is verified, and the key lengths of the first master key and the second master key are compared and verified to improve the accuracy of the second master key.

[0184] The key padding process here may be performed by generating a random code. In some embodiments, the key length of the second master key is padded according to the key length of the first master key so that the key length of the padded second master key is the same as the key length of the first master key, including:

[0185] Performing difference processing on the key length of the first master key and the key length of the second master key to obtain the key length to be padded;

[0186] Generate a random code according to the length of the key to be completed;

[0187] The random code and the second master key are concatenated to obtain a padded second master key, so that the key length of the padded second master key is the same as the key length of the first master key.

[0188] Specifically, the key completion process generates a random code based on the length of the key to be completed, and the random code is pieced together with the second master key. The pieced together process can add a random code at the end, or fill the random code with 0 bytes, or set a specific random code corresponding to other algorithms, and the PKCS#5 Padding algorithm can be used for filling, etc.

[0189] After the completed second master key is obtained, the key length of the second master key is the same as the key length of the first master key.

[0190] The filling process of the key completion processing provided in this embodiment is to facilitate the subsequent second master key to encapsulate the unsealed first key, ensure the smooth completion of the encapsulation processing of the second master key of the target key storage mechanism, so as to realize the switching processing from the current key storage mechanism to the target key storage mechanism.

[0191] In some embodiments, before the second master key is used to encapsulate the unsealed first key, the method further includes:

[0192] Using the second master key to decrypt the first key to obtain the initially decrypted first key;

[0193] comparing the unsealed first key with the initially unsealed first key;

[0194] If the unsealed first key is the same as the initially unsealed first key, it is determined that the second master key verification is successful, and the process proceeds to the step of encapsulating the unsealed first key using the second master key.

[0195] Specifically, in the above embodiment, the accuracy of the second master key is verified by directly comparing the first master key with the second master key. In this embodiment, the accuracy of the second master key is indirectly verified based on the comparison method of the first key. The first key is unsealed using the second master key to obtain the first key in plain text after the initial unsealing, and the first key after the first key is unsealed using the first master key is compared with the first key after the initial unsealing. The comparison process here can be a comparison between key lengths, or a comparison based on special bytes of the first key, etc., which is not limited here. If the unsealed first key is the same as the first key after the initial unsealing, it is determined that the second master key verification is successful, and the unsealed first key can be encapsulated using the second master key.

[0196] This embodiment provides that before the unsealed first key is encapsulated with the second master key, the accuracy of the second master key is indirectly verified by comparing the first key. If the unsealed first key is the same as the first key after initial unsealing, it is determined that the second master key verification is successful. The second master key is verified by the unsealed first key, which improves the fairness and authority of the verification and ensures the accuracy of the encapsulation of the first key.

[0197] In some embodiments, after the unsealed first key is encapsulated using the second master key, the method further includes:

[0198] Using key data obtained by encapsulating the first key after decapsulation by the second master key as the initial first key;

[0199] comparing the initial first key with the first key;

[0200] If the initial first key is the same as the first key, it is determined that the second master key verification is successful.

[0201] Specifically, considering the verification before the second master key is encapsulated, the accuracy of the second master key can also be indirectly verified by comparing the encapsulated first key obtained by encapsulating the first key with the master key of the respective key storage mechanism after the second master key is encapsulated.

[0202] The key data encapsulated by the second master key against the unsealed first key (the first key in plain text) is used as the initial first key, and the initial first key is compared with the first key. The comparison process here can be a comparison between key lengths, or a comparison based on special bytes of the first key, etc., which is not limited here.

[0203] This embodiment provides that after the unsealed first key is encapsulated with the second master key, the accuracy of the second master key is indirectly verified by comparing with the first key. If the initial first key is the same as the first key, it is determined that the second master key verification is successful, and the switching process from the current key storage mechanism to the target key storage mechanism is successfully completed.

[0204] In some embodiments, the switching process from the current key storage mechanism to the target key storage mechanism occurs at any period of the key life cycle of the current key storage mechanism.

[0205] It should be noted that the switching process of the key storage mechanism can occur in any period of the key life cycle of the current key storage mechanism, such as data encryption scenario, data decryption scenario, key update scenario, etc.

[0206] In the data encryption scenario, the encryption under different key storage mechanisms is the same. Before encrypting the data, the storage controller has completed the configuration of the master key and the data encryption key. It should be noted that the first key can be a data encryption key, or a general term for a data encryption key and a key encryption key. Therefore, if it is only a data encryption key, the key system of the key storage mechanism is a two-layer system. If it is a data encryption key and a key encryption key, the key system of the key storage mechanism is a three-layer system. Regardless of the key system, before the corresponding data encryption scenario occurs, the storage controller has completed various types of key configuration work.

[0207] Taking the two-layer key system of the data encryption scenario using the key management service system as an example, the host writes plaintext data to the storage controller; the storage controller queries the configuration library for the encapsulated data encryption key that should be used by the host for this write; the storage controller uses the master key to unseal the encapsulated data encryption key to obtain the data encryption key; the storage controller uses the data encryption key to complete the data encryption operation; and the storage controller writes the encrypted ciphertext to the hard disk.

[0208] Taking the three-layer key system of the data encryption scenario using the key management service system as an example, the host writes plaintext data to the storage controller; the storage controller queries the configuration library for the encapsulated data encryption key that should be used for this host write; the storage controller uses the key encryption key to decapsulate the encapsulated data encryption key to obtain the data encryption key; the storage controller uses the key encryption key to complete the data encryption operation; and the storage controller writes the encrypted ciphertext to the hard disk.

[0209] In the data decryption scenario, the decryption corresponding to different key storage mechanisms is the same. Taking the two-layer key system of the data encryption scenario using the key management service system as an example, the host sends a read data instruction to the storage controller; the storage controller queries the configuration library for the encapsulated data encryption key that the host should use for this read; the storage controller uses the master key to unseal the encapsulated data encryption key to obtain the data encryption key; the storage controller reads the encrypted data from the hard disk and uses the data encryption key obtained in the previous step to complete the data decryption operation; the storage controller sends the decrypted plaintext to the host.

[0210] Taking the three-layer key system of the data encryption scenario using the key management service system as an example, the data decryption scenario when using the key management service system; the host sends a read data instruction to the storage controller; the storage controller queries the configuration library for the encapsulated data encryption key that should be used for this host read; the storage controller uses the key encryption key to decapsulate the encapsulated data encryption key to obtain the data encryption key; the storage controller reads the encrypted data from the hard disk and uses the data encryption key obtained in the previous step to complete the data decryption operation; the storage controller sends the decrypted plaintext to the host.

[0211] In the key update scenario, the update method corresponding to different key storage mechanisms is the same. Taking the two-layer key system of the data encryption scenario using the key management service system as an example, the user initiates the key update process; the storage controller applies for a new key from the key management service system; the key management service system returns the key to the storage controller, that is, the new master key; the storage controller uses the original master key to decrypt the data encryption key, and uses the new master key to re-encapsulate the data encryption key.

[0212] Taking the three-layer key system of the data encryption scenario using the key management service system as an example, the user initiates the key update process; the storage controller applies for a new key from the key management service system; the key management service system returns the key to the storage controller, that is, the new master key; the storage controller uses the original master key to decrypt the key encryption key, obtains the plaintext key encryption key, and uses the new master key to re-encapsulate the plaintext key encryption key; the storage controller responds to the user that the key update has been completed.

[0213] The switching process from the current key storage mechanism to the target key storage mechanism provided in this embodiment occurs in any period of the key life cycle of the current key storage mechanism, so as to improve the flexibility of switching from the current key storage mechanism to the target key storage mechanism.

[0214] In some embodiments, if the first key is a first data encryption key and a first key encryption key, the switching process from the current key storage mechanism to the target key storage mechanism during a key update period of the key life cycle further includes:

[0215] Updating the second master key to obtain an updated second master key;

[0216] The unsealed first key encryption key is encapsulated using the updated second master key to complete the key update cycle.

[0217] Specifically, when the first key is the first data encryption key and the first key encryption key, and the switching process occurs during the key update cycle, the second master key needs to be updated to obtain the updated second master key, and the unsealed first key encryption key is encapsulated using the updated second master key to complete the key update cycle. It should be noted that the update of the second master key here can be updated at a certain time interval after the switching process occurs, mainly considering the switching process from the current key storage mechanism to the target key storage mechanism, which actually replaces the master key. On this basis, a key update process has been completed; it can also be strictly determined according to the key update cycle, even if the corresponding update time is reached after the switching process occurs, it is not limited here.

[0218] Considering the conventional key update process, the keys corresponding to each layer can be replaced. If the master key is replaced, it is necessary to regenerate the master key and use the new master key to re-encapsulate all data encryption keys, resulting in a longer key replacement process. If the data encryption key is replaced, all new data encryption keys need to be used to re-encrypt the data, resulting in increased replacement costs.

[0219] In this embodiment, the update method of encapsulating the key encryption key with the second master key, on the one hand, pre-introduces the key encryption key in the key management mechanism, and the key encryption key is used to encrypt the data encryption key, and there is no need for conventional key replacement for the replacement of the data encryption key, thereby reducing the replacement cost. There is also no need to use the new master key to re-encapsulate all the data encryption keys when the master key is replaced, resulting in a long key replacement process. On the other hand, the key replacement mainly corresponds to the update of the master key. The new master key (the master key to be replaced) only needs to encapsulate the key encryption key to complete the key replacement process, and there is no need to re-encrypt and encapsulate all the data encryption keys. The present invention only needs to update one master key, use the original master key (the current master key) to decapsulate the key encryption key to obtain the key encryption key in plain text, and use the new master key (the master key to be replaced) to re-encapsulate the key decryption key in plain text, without re-encapsulating a large number of data encryption keys, thereby improving the key update efficiency and reducing the impact of the key update on the system availability.

[0220] Furthermore, the present invention also provides a cluster system, which includes a plurality of nodes; the cluster system is used to execute the steps of the switching method of the key storage mechanism to perform key management.

[0221] For an introduction to a cluster system provided by the present invention, please refer to the above method embodiment, which will not be described in detail herein. The present invention has the same beneficial effects as the above key storage mechanism switching method.

[0222] The above describes in detail various embodiments corresponding to the key storage mechanism switching method. On this basis, the present invention also discloses a key storage mechanism switching device corresponding to the above method. Figure 3 A structural diagram of a switching device for a key storage mechanism provided by an embodiment of the present invention. Figure 3 As shown, the switching device of the key preservation mechanism includes:

[0223] A first acquisition module 11 is used to acquire a first master key and a first key corresponding to a current key storage mechanism;

[0224] A first utilizing module 12, configured to use a first master key to decrypt the first key when the current key storage mechanism satisfies a switching condition of the key storage mechanism;

[0225] A second acquisition module 13, used to acquire a second master key corresponding to the target key storage mechanism;

[0226] The second utilizing module 14 is used to utilize the second master key to encapsulate the unsealed first key, so as to complete the switching process from the current key storage mechanism to the target key storage mechanism.

[0227] Since the embodiments of the device part correspond to the above embodiments, please refer to the description of the embodiments of the method part for the embodiments of the device part, and will not be repeated here.

[0228] For an introduction to a switching device for a key storage mechanism provided by the present invention, please refer to the above method embodiment, which will not be described in detail herein. It has the same beneficial effects as the above switching method for the key storage mechanism.

[0229] Figure 4 A structural diagram of a switching device for a key storage mechanism provided by an embodiment of the present invention, such as Figure 4 As shown, the device comprises:

[0230] A memory 21, used for storing computer programs;

[0231] The processor 22 is used to implement the steps of the method for switching the key storage mechanism when executing the computer program.

[0232] The key storage mechanism switching device provided in this embodiment may include but is not limited to a tablet computer, a laptop computer, or a desktop computer.

[0233] Among them, the processor 22 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 22 can be implemented in at least one hardware form of a digital signal processor (DSP), an FPGA, and a programmable logic array. The processor 22 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 22 may be integrated with a graphics processing unit (GPU), and the GPU is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 22 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0234] The memory 21 may include one or more non-volatile storage media, which may be non-transitory. The memory 21 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 21 is at least used to store the following computer program 211, wherein, after the computer program is loaded and executed by the processor 22, the relevant steps of the switching method of the key preservation mechanism disclosed in any of the aforementioned embodiments can be implemented. In addition, the resources stored in the memory 21 may also include an operating system 212 and data 213, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 212 may include Windows, Unix, Linux, etc. The data 213 may include, but is not limited to, data involved in the switching method of the key preservation mechanism, etc.

[0235] In some embodiments, the switching device of the key storage mechanism may also include a display screen 23 , an input and output interface 24 , a communication interface 25 , a power supply 26 , and a communication bus 27 .

[0236] Those skilled in the art can understand that Figure 4 The structure shown in the figure does not constitute a limitation on the switching device of the key storage mechanism, and may include more or fewer components than those shown in the figure.

[0237] The processor 22 implements the key storage mechanism switching method provided in any of the above embodiments by calling the instructions stored in the memory 21.

[0238] For an introduction to a switching device for a key storage mechanism provided by the present invention, please refer to the above method embodiment, which will not be described in detail herein. It has the same beneficial effects as the above key storage mechanism switching method.

[0239] Furthermore, the present invention also provides a non-volatile storage medium, on which a computer program is stored, and when the computer program is executed by the processor 22, the steps of the switching method of the key storage mechanism as described above are implemented.

[0240] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and executes all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0241] For an introduction to a non-volatile storage medium provided by the present invention, please refer to the above method embodiment, which will not be described in detail herein. It has the same beneficial effects as the switching method of the above key storage mechanism.

[0242] Furthermore, the present invention also provides a computer program product, including a computer program / instruction, which implements the steps of the key storage mechanism switching method when executed by a processor.

[0243] For an introduction to a computer program product provided by the present invention, please refer to the above method embodiment, which will not be described in detail herein. It has the same beneficial effects as the above-mentioned key storage mechanism switching method.

[0244] The above is a detailed introduction to the switching method, cluster system, device, medium and product of a key preservation mechanism provided by the present invention. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

[0245] It should also be noted that, in this specification, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A method for switching a key storage mechanism, characterized in that: include: Obtaining a first master key and a first key corresponding to a current key storage mechanism; wherein the key storage mechanism is a two-layer or three-layer key system; When the current key storage mechanism meets the switching condition of the key storage mechanism, the first master key is used to unseal the first key; the switching condition is triggered by at least one of the following methods: based on the failure scenario or attack scenario of the current key storage mechanism; the storage device to which the current key storage mechanism belongs is in a state to be relocated; comparison of experimental states of multiple key storage mechanisms; Obtain the second master key corresponding to the target key storage mechanism; The unsealed first key is encapsulated using the second master key to complete the online switching process from the current key storage mechanism to the target key storage mechanism; the type of the key storage mechanism is a key management server system or dedicated encryption hardware.

2. The method for switching the key storage mechanism according to claim 1, characterized in that: When the first key is a first data encryption key, the first key is decrypted using the first master key, including: Decrypting the first data encryption key using the first master key; Correspondingly, encapsulating the unsealed first key using the second master key includes: The decrypted first data encryption key is encapsulated using the second master key.

3. The method for switching the key storage mechanism according to claim 1, characterized in that: When the first key is a first data encryption key and a first key encryption key, the first key is decrypted by using the first master key, including: Using the first master key to decrypt the first key encryption key, wherein the first key encryption key is a key used to encrypt the first data encryption key; Correspondingly, encapsulating the unsealed first key using the second master key includes: The decrypted first key encryption key is encapsulated using the second master key.

4. The method for switching the key storage mechanism according to claim 2 or 3, characterized in that: The process of determining the target key storage mechanism includes: Pre-acquire other key storage mechanisms except the current key storage mechanism; If there are multiple remaining key storage mechanisms and they include dedicated encryption hardware and a key management server system, the key management server system is used as the target key storage mechanism.

5. The method for switching the key storage mechanism according to claim 2 or 3, characterized in that: The process of determining the target key storage mechanism includes: Pre-acquire other key storage mechanisms except the current key storage mechanism; If the remaining key storage mechanisms are key protection mechanisms of multiple dedicated encryption hardware, the priority level corresponding to each of the remaining key storage mechanisms is determined according to the encryption and decryption rate parameter; The key storage mechanism of the dedicated encryption hardware corresponding to the highest priority level is selected as the target key storage mechanism.

6. The method for switching the key storage mechanism according to claim 2 or 3, characterized in that: The process of obtaining the target key storage mechanism includes: Pre-acquire configuration information of the target key storage mechanism; Synchronize with the process of acquiring the configuration information of the current key storage mechanism to acquire the target key storage mechanism; Alternatively, when the current key storage mechanism meets the switching condition of the key storage mechanism, the configuration information of the target key storage mechanism is obtained so as to obtain the target key storage mechanism.

7. The method for switching the key storage mechanism according to claim 1, characterized in that: Before encapsulating the unsealed first key with the second master key, the method further includes: Obtaining the key length of each of the first master key and the second master key; If the first master key and the second master key have the same key length, proceeding to the step of encapsulating the unsealed first key with the second master key; If the key lengths of the first master key and the second master key are different, and the key length of the first master key is greater than the key length of the second master key, the key length of the second master key is padded according to the key length of the first master key so that the key length of the padded second master key is the same as the key length of the first master key, and the process proceeds to the step of encapsulating the unsealed first key using the second master key.

8. The method for switching the key storage mechanism according to claim 7, characterized in that: The key length of the second master key is padded according to the key length of the first master key so that the key length of the padded second master key is the same as the key length of the first master key, including: Performing difference processing on the key length of the first master key and the key length of the second master key to obtain the key length to be padded; Generate a random code according to the length of the key to be padded; The random code and the second master key are concatenated to obtain a padded second master key, so that a key length of the padded second master key is the same as a key length of the first master key.

9. The method for switching the key storage mechanism according to claim 1, characterized in that: Before using the second master key to encapsulate the unsealed first key, the method further includes: Using the second master key to decrypt the first key to obtain an initially decrypted first key; comparing the unsealed first key with the initially unsealed first key; If the unsealed first key is the same as the initially unsealed first key, it is determined that the second master key verification is successful, and the process proceeds to the step of encapsulating the unsealed first key using the second master key.

10. The method for switching the key storage mechanism according to claim 1, characterized in that: After the unsealed first key is encapsulated by using the second master key, the method further includes: Using key data obtained by encapsulating the first key after decapsulation by the second master key as the initial first key; comparing the initial first key with the first key; If the initial first key is the same as the first key, it is determined that the second master key verification is successful.

11. The method for switching a key storage mechanism according to claim 1, characterized in that: If the first key is a first data encryption key and a first key encryption key, the switching process from the current key storage mechanism to the target key storage mechanism during a key update period of a key life cycle further includes: Updating the second master key to obtain an updated second master key; The unsealed first key encryption key is encapsulated using the updated second master key to complete the key update cycle.

12. The method for switching the key storage mechanism according to claim 1, characterized in that: The process of determining whether the current key storage mechanism satisfies the switching condition of the key storage mechanism includes: Receiving a key storage mechanism switching instruction issued by a host; wherein the parameters corresponding to the switching instruction at least include the current key storage mechanism, the first master key and the target key storage mechanism; If the switching instruction of the key storage mechanism is a valid switching instruction, it is determined that the current key storage mechanism meets the switching condition of the key storage mechanism.

13. The method for switching the key storage mechanism according to claim 12, characterized in that: Determining that the switching instruction of the key storage mechanism is a valid switching instruction includes: When the storage device to which the current key storage mechanism belongs is in a waiting-for-relocation state, the switching instruction of the key storage mechanism is converted from an invalid switching instruction to a valid switching instruction.

14. The method for switching the key storage mechanism according to claim 12, characterized in that: Determining that the switching instruction of the key storage mechanism is a valid switching instruction includes: Obtaining the working status corresponding to the current key storage mechanism; If the working state is a fault state or an attack state, the switching instruction of the key storage mechanism is converted into a valid switching instruction.

15. The method for switching the key storage mechanism according to claim 12, characterized in that: Determining that the switching instruction of the key storage mechanism is a valid switching instruction includes: Pre-acquire the current number of experiments and the preset number of experiments of the current key storage mechanism; When the current number of experiments reaches a preset number of experiments, the switching instruction of the key storage mechanism is converted into a valid switching instruction.

16. The method for switching the key storage mechanism according to claim 14, characterized in that: After the unsealed first key is encapsulated by using the second master key, the method further includes: Deleting and destroying the first master key of the current key storage mechanism; Release the storage space of the current key storage mechanism.

17. The method for switching the key storage mechanism according to claim 15, characterized in that: After completing the switching process from the current key storage mechanism to the target key storage mechanism, the method further includes: Performing operation processing on the key life cycle under the target key storage mechanism according to the preset number of experiments; When the current number of experiments of the target key storage mechanism reaches the preset number of experiments, obtaining the key operation effects corresponding to the current key storage mechanism and the target key storage mechanism respectively; The key operation effects corresponding to the current key preservation mechanism and the target key preservation mechanism are compared to determine the comparison result between the current key preservation mechanism and the target key preservation mechanism, and determine the final key preservation mechanism.

18. The method for switching a key storage mechanism according to claim 1, characterized in that: The switching process from the current key storage mechanism to the target key storage mechanism occurs in any period of the key life cycle of the current key storage mechanism.

19. A cluster system, characterized in that: The cluster system includes a plurality of nodes; the cluster system is used to execute the steps of the key storage mechanism switching method described in any one of claims 1 to 18 to perform key management.

20. A switching device for a key storage mechanism, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for switching the key storage mechanism as described in any one of claims 1 to 18 when executing the computer program.

21. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for switching the key storage mechanism as described in any one of claims 1 to 18 are implemented.

22. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the method for switching the key storage mechanism described in any one of claims 1 to 18 are implemented.

Images