IM data processing method and system based on BYOK and PQC

Abstract

The invention provides an IM data processing method and system based on BYOK and PQC, and the method is applied to a hardware security module HSM, and comprises the following steps: the HSM firstly obtains a data encryption request initiated by a server, and the data encryption request comprises data which is provided by a client and needs to be encrypted; encrypting the data by using a locally generated data key to obtain a data ciphertext; encrypting the data key by using a master key to obtain a key ciphertext; the master key is generated in advance by using a key material BYOK provided by the client; and finally, returning the data ciphertext and the key ciphertext to the server. According to the data processing method provided by the invention, the user is allowed to autonomously generate the master key, so that the control capability of the user on data security is enhanced; the system can be integrated with an existing IM system and an existing KMS platform, and large-scale application is facilitated; and encryption protection is carried out on the data key and the user data, so that the security of the data is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data encryption method and system based on bring your own key (BYOK) and post-quantum cryptography (PQC). Background Art

[0002] Instant Messaging (IM) has become an indispensable communication tool in modern society, carrying a large amount of user information and privacy data. In order to protect this sensitive information, existing IM systems usually use the Transport Layer Security (TLS) protocol to encrypt data in transit, use symmetric encryption algorithms such as the Advanced Encryption Standard (AES) to encrypt static data, and use the Key Management Service (KMS) to manage keys.

[0003] However, with the development of quantum computing technology, the existing TLS protocol handshake process and the KMS system that relies on the existing public key cryptography system will face the risk of being hacked, and IM data will lose security during transmission and storage.

[0004] In addition, the existing KMS directly encrypts data with the master key and protects the master key by securely storing it in a hardware security module (HSM), thereby protecting the data. Therefore, once the master key is leaked, all data encrypted with the master key will face security threats. Therefore, a more secure key management solution is needed that can minimize the risk of data leakage even if the master key is leaked.

[0005] In addition, existing key management systems usually generate keys on their own. Users cannot select or generate keys on their own, nor can they manage the life cycle of keys, which limits the user's ability to control their own data security. In some scenarios with extremely high data security requirements, such as communications involving commercial secrets or national security, this centralized key management model is difficult to meet user needs. Users need a more autonomous and controllable key management method.

[0006] In order to enhance users' control over keys, reduce the risk of data leakage, and meet the security challenges brought by quantum computing, a more secure and reliable IM data encryption solution is urgently needed.

[0007] It should be noted that the above content is mainly for explaining the technical background, rather than identifying or classifying the prior art. Therefore, unless the prior art document is clearly marked or cited, the content of the background technology section cannot be directly identified as the prior art. Summary of the invention

[0008] To solve the above problems, the present invention proposes an IM data processing method based on BYOK and PQC algorithms.

[0009] According to a first aspect, the present invention provides a data processing method, which is executed by a hardware security module HSM and is characterized in that it comprises the following steps:

[0010] Get the data encryption request initiated by the server, which includes the data to be encrypted provided by the client.

[0011] The data is encrypted using a locally generated data key to obtain data ciphertext.

[0012] The data key is encrypted using a master key to obtain a key ciphertext; the master key is pre-generated using BYOK key material provided by the client.

[0013] The data ciphertext and the key ciphertext are returned to the server.

[0014] In some embodiments, before obtaining the data encryption request initiated by the server, the method further includes:

[0015] The BYOK provided by the client is obtained.

[0016] The master key is generated by using the BYOK and is securely stored.

[0017] In some embodiments, after returning the data ciphertext and the key ciphertext to the server, the method further includes:

[0018] A data decryption request initiated by the server is obtained, which includes the data ciphertext and the key ciphertext.

[0019] The master key is used to decrypt the key ciphertext to obtain the data key.

[0020] The data ciphertext is decrypted using the data key to obtain the data.

[0021] Return the data to the server.

[0022] According to a second aspect, the present invention provides a data processing method, which is executed on a client and is characterized in that it comprises the following steps:

[0023] In response to a user trigger, key material BYOK is generated.

[0024] The BYOK is provided to a hardware security module HSM, so that the HSM generates a master key using the BYOK.

[0025] The data to be encrypted is provided to the server, so that the server initiates a data encryption request containing the data to the HSM, and receives the data ciphertext and key ciphertext returned by the HSM; the data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key.

[0026] In some embodiments, after providing the data to be encrypted to the server, the method executed on the client further includes:

[0027] A data viewing request is initiated to the server, so that the server initiates a data decryption request including the data ciphertext and the key ciphertext to the HSM, and receives the data returned by the HSM; the data is obtained by the HSM decrypting the data ciphertext using the data key, and the data key is obtained by the HSM decrypting the key ciphertext using the master key.

[0028] Receive the data returned by the server.

[0029] In some embodiments, after generating the BYOK key material and before providing the BYOK key material to the HSM, the method performed on the client further includes:

[0030] Use the PQC algorithm to negotiate a shared key with the Key Management Service (KMS).

[0031] The BYOK material is encrypted using the shared key and sent to the KMS, so that the KMS decrypts the encrypted BYOK material using the shared key and securely transmits the decrypted BYOK material to the HSM.

[0032] According to a third aspect, the present invention provides a data processing method, which is executed by a server and is characterized in that it includes the following steps:

[0033] Receive the data that needs to be encrypted provided by the client;

[0034] A data encryption request is initiated to the HSM, including the data to be encrypted.

[0035] Receive the data ciphertext and key ciphertext returned by the HSM and store them in the database.

[0036] The data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key. The master key is pre-generated by the HSM using the key material BYOK provided by the client and is securely stored.

[0037] In some embodiments, after storing the data ciphertext and the key ciphertext in the database, the method performed by the server further includes:

[0038] In response to a data viewing request received from a client, a data decryption request is initiated to the HSM, which includes the data ciphertext and the key ciphertext obtained from the database.

[0039] The data returned by the HSM is received, where the data is obtained by the HSM decrypting the data ciphertext using the data key, and the data key is obtained by the HSM decrypting the key ciphertext using the master key.

[0040] The data processing method according to any one of the first to third aspects can be applied to instant messaging (IM) services, wherein the server is an IM server and the client is an IM client.

[0041] According to a fourth aspect, the present invention provides a data processing system, comprising:

[0042] The client is used to provide the data that needs to be encrypted to the server.

[0043] The server is used to initiate a data encryption request to the hardware security module HSM according to the data to be encrypted.

[0044] The HSM is used to use a locally generated data key to encrypt the data contained in the data encryption request to obtain a data ciphertext; and to use a master key to encrypt the data key to obtain a key ciphertext; the master key is pre-generated using the key material BYOK provided by the client.

[0045] The server is also used to receive the data ciphertext and the key ciphertext from the HSM.

[0046] According to a fifth aspect, the present invention provides a data processing device, which is integrated in a hardware security module HSM and includes the following functional modules:

[0047] The encryption request acquisition module is configured to obtain a data encryption request initiated by the server, which includes data to be encrypted provided by the client.

[0048] The data encryption module is configured to encrypt the data using a locally generated data key to obtain a data ciphertext.

[0049] The key encryption module is configured to encrypt the data key using a master key to obtain a key ciphertext; the master key is pre-generated using BYOK key material provided by the client.

[0050] The response data returning module is configured to return the data ciphertext and the key ciphertext to the server.

[0051] In some embodiments, the apparatus further comprises:

[0052] A data key generation module is configured to generate a data key.

[0053] The BYOK material acquisition module is configured to acquire the BYOK key material provided by the client.

[0054] The master key generation module is configured to generate a master key according to the BYOK key material provided by the client.

[0055] According to a sixth aspect, the present invention provides a data processing device, which is integrated in a client and includes the following functional modules:

[0056] The BYOK material generation module is configured to generate a BYOK key material in response to a user trigger.

[0057] The BYOK material sending module is configured to provide the BYOK to the hardware security module HSM, so that the HSM generates a master key using the BYOK.

[0058] The data sending module is configured to provide the data to be encrypted to the server, so that the server initiates a data encryption request containing the data to the HSM, and receives the data ciphertext and key ciphertext returned by the HSM; the data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key.

[0059] According to a seventh aspect, the present invention provides a data processing device, which is integrated in a server and includes the following functional modules:

[0060] The data receiving module is configured to receive data that needs to be encrypted provided by the client.

[0061] The encryption request sending module is configured to initiate a data encryption request to the HSM, including the data to be encrypted.

[0062] The ciphertext receiving module is configured to receive the data ciphertext and key ciphertext returned by the HSM and store them in the database.

[0063] The data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key. The master key is pre-generated by the HSM using the key material BYOK provided by the client and is securely stored.

[0064] The data processing method provided by the present invention allows users to independently generate master keys, thereby enhancing users' ability to control data security; it can be integrated with existing IM systems and KMS platforms, has strong compatibility, and is convenient for large-scale application; and both data keys and user data are encrypted for protection, thereby enhancing data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0066] Figure 1 A schematic diagram of multi-party interaction of a data processing method provided by an embodiment of the present invention;

[0067] Figure 2 A schematic diagram of a specific method for a client to transmit BYOK to an HSM according to an embodiment of the present invention;

[0068] Figure 3 A schematic diagram of a data processing system provided by an embodiment of the present invention;

[0069] Figure 4 A schematic diagram of the structure of a data processing device integrated in an HSM provided by an embodiment of the present invention;

[0070] Figure 5 A schematic diagram of the structure of a data processing device integrated in a client provided by an embodiment of the present invention;

[0071] Figure 6 A schematic diagram of the structure of a data processing device integrated in a server provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0072] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions of this specification will be described below in conjunction with the accompanying drawings.

[0073] The present invention provides a data processing method based on the combination of Bring Your Own Key (BYOK) and Post-Quantum Cryptography (PQC).

[0074] It should be understood that bringing your own key is a security model that allows users to generate and manage keys themselves, rather than relying on keys provided by third-party service providers. This model enhances the user's control over the key, avoids full trust in third-party platforms, and improves data security.

[0075] PQC is a cryptographic algorithm designed to resist quantum computer attacks, such as lattice-based cryptography, code-based cryptography, multivariate cryptography, etc.

[0076] Instant messaging is a communication method that allows users to send and receive text, voice, video and other messages in real time. Common IM software includes WeChat, QQ, Telegram, etc., which carry a large amount of user information and privacy data. The solution provided by the present invention is based on the protection of the entire life cycle of IM data, but the application of the solution is not limited to this. It can also be used in scenarios such as cloud storage services that require users to be able to control their sensitive information stored in the cloud while providing long-term data security protection; or in scenarios such as enterprise collaboration platforms and Internet of Vehicles systems that frequently exchange data and require dual protection during data transmission and storage.

[0077] Next, taking IM data protection as an example, the implementation method of the method is explained in detail. Figure 1 A flow chart of an IM data processing method in an embodiment is shown. In this embodiment, the IM data processing method is jointly completed by the following parties: an IM client, an IM server, a hardware security module (HSM) and a key management service (KMS).

[0078] It should be understood that HSM is a physical device specifically used for secure storage and management of keys, which can effectively prevent keys from being stolen or tampered with, and provide physical security for key storage. Exemplarily, the HSM can be Thales LunaHSM or Gemalto SafeNet HSM.

[0079] In order to facilitate key management, the IM data processing method generally uses KMS to coordinate the entire data encryption process, which includes key access control, rotation, and communication between HSM and the client and server. Exemplarily, the KMS can be AWS KMS, Google Cloud KMS, and Azure Key Vault. It should be understood that the functions implemented by KMS can also be integrated in other participants (such as HSM) without using a dedicated KMS service.

[0080] The different implementation stages involved in the IM data processing method mainly include BYOK key import, data encryption, and data decryption. The following introduces the specific implementation steps of each stage.

[0081] When the method is run for the first time or the BYOK key needs to be updated, the BYOK key import phase begins, including Figure 1 The following steps are shown in:

[0082] S11. The user generates BYOK key material on the IM client.

[0083] Here, BYOK can be a high-strength random string, and the user can select the length and type of BYOK according to security requirements. The user can use his own encryption software or a strong random number generator to generate BYOK.

[0084] S12. The client sends BYOK to the HSM.

[0085] Here, in order to prevent BYOK from being leaked during transmission, BYOK can be encrypted using a shared key during transmission. The shared key is negotiated between the IM client and KMS using the Kyber algorithm based on PQC. The specific process is as follows: Figure 2 As shown, including:

[0086] S121. The IM client generates a temporary key pair based on the Kyber algorithm and sends the temporary public key to the KMS.

[0087] S122. KMS executes Kyber.Encap on the temporary public key to generate a shared key and ciphertext, returns the ciphertext to the IM client, and securely stores the shared key.

[0088] To make the transmission more secure, you can also use Dilithium to sign the temporary public key generated by the IM client. When KMS receives the temporary public key, it verifies the signature to confirm each other's identities.

[0089] S123. The IM client receives the ciphertext and executes Kyber.Decap to recover the shared key.

[0090] S124. Encrypt the BYOK material using the shared key and AEAD, send the encrypted BYOK material to the KMS, and then securely delete the local BYOK material and the shared key.

[0091] Among them, AEAD is an encryption mode that combines encryption and authentication functions, which can effectively prevent attackers from viewing or tampering with data without being discovered.

[0092] S125. KMS decrypts the BYOK material using the shared key and AEAD.

[0093] S126. The KMS securely transmits the decrypted BYOK material to the HSM, and then securely deletes the shared key and the decrypted BYOK material.

[0094] At this point, the HSM has securely received the BYOK materials sent by the client.

[0095] Back to Figure 1 , S13, HSM uses BYOK materials to generate a master key and securely stores the master key. Generate a master key identifier Key ID corresponding to the master key and return it to KMS, which sends the Key ID to the server.

[0096] At this point, the master key is securely stored in the HSM, and the BYOK key import phase is over. Next, we enter the data encryption phase, including Figure 1 The following steps are shown in:

[0097] S20. The IM client uploads the data input by the user to the IM server.

[0098] The data may be IM chat records, pictures, voice, video, etc.

[0099] Exemplarily, the IM client may initiate a data upload request to the IM server in response to an operation initiated by a user to upload chat records to the cloud.

[0100] S21. After receiving the data, the IM server initiates a data encryption request to the KMS, which includes the data and the Key ID.

[0101] S22. KMS forwards the data encryption request to HSM.

[0102] S23. After receiving the data encryption request, the HSM generates a data key based on the quantum random number generated by the QRNG, uses the data key to encrypt the data to obtain a data ciphertext; and uses the master key to encrypt the data key to obtain a key ciphertext, and securely deletes the data key.

[0103] Among them, QRNG is a device or service that generates true random numbers based on the principles of quantum physics. The quantum random numbers generated by QRNG have higher unpredictability. Generating keys based on quantum random numbers can improve the security of the keys. QRNG can be integrated into the HSM or provided as an independent cloud service.

[0104] The data key can also be generated based on ordinary pseudo-random numbers, or by other key generation methods.

[0105] S24. The HSM returns the data ciphertext and the key ciphertext to the KMS.

[0106] S25. KMS generates a key ID for the key ciphertext and stores the key ciphertext and the key ID in association. It should be understood that the key ID actually uniquely identifies the data key corresponding to the key ciphertext.

[0107] S26. KMS returns the key ID, data ciphertext and key ciphertext to the IM server.

[0108] S27. The IM server associates the data ciphertext, the key ciphertext and the key ID and stores them in a database.

[0109] At this point, the user data and its encryption key (i.e., data key) are encrypted and stored securely, and the data encryption phase is completed. Next, the data decryption phase begins, including Figure 1 The following steps are shown in:

[0110] S30: The IM client initiates a data viewing request to the IM server.

[0111] Exemplarily, in response to a user-initiated operation of viewing cloud chat records, the IM client initiates a data viewing request to the IM server.

[0112] S31. The IM server initiates a data decryption request to the KMS according to the received data viewing request. The data decryption request includes the data ciphertext downloaded from the database, the key ciphertext and the key ID.

[0113] S32. After receiving the data decryption request, the KMS forwards it to the HSM.

[0114] S33. After receiving the data decryption request, the HMS uses the master key to decrypt the key ciphertext to obtain the data key.

[0115] Specifically, the HMS first searches locally for the master key associated with the key ciphertext in the data decryption request, and then uses the master key to decrypt the key ciphertext.

[0116] S34. The HSM decrypts the data ciphertext using the data key to obtain the data.

[0117] S35. HSM returns the data to KMS.

[0118] S36. KMS returns the data to the IM server.

[0119] S37: The IM server returns the data to the IM client for the user to view.

[0120] The above is a specific implementation of the data processing method provided by the present invention. Compared with the prior art, the method has the following beneficial effects:

[0121] 1. Allow users to independently manage and control their own keys, enhancing their ability to control data security.

[0122] 2. During the data encryption process, both the data key and the user data are encrypted and protected. Even if the master key is leaked, the data will not be directly exposed, thus enhancing data security.

[0123] 3. The use of PQC algorithm can effectively resist potential quantum computing attacks and ensure the long-term security of data.

[0124] 4. Providing centralized key management services through KMS not only simplifies the key management process, but also can be integrated with the existing IM system and KMS platform.

[0125] The present invention also provides a data processing system 300, the schematic diagram of which is as follows Figure 3 As shown, the system includes the following parts:

[0126] The client 301 is used to provide the data to be encrypted to the server.

[0127] The server 302 is used to initiate a data encryption request to the hardware security module HSM according to the data to be encrypted.

[0128] The hardware security module 303 is used to use a locally generated data key to encrypt the data contained in the data encryption request to obtain a data ciphertext; and to use a master key to encrypt the data key to obtain a key ciphertext; the master key is pre-generated using the key material BYOK provided by the client.

[0129] The server is also used to receive the data ciphertext and the key ciphertext from the HSM.

[0130] In some embodiments, the system further includes a key management service 304 responsible for coordinating the entire data encryption process, which includes key management, communication between the HSM and the client and the server.

[0131] In some embodiments, the system further includes a quantum random number generator 305 responsible for providing quantum random numbers for generating data keys.

[0132] In some embodiments, the client and the server communicate using a KEMTLS protocol supporting a PQC algorithm. To enhance the security of data during transmission, the client and the server use a negotiated session key to encrypt and decrypt the transmitted data.

[0133] In some embodiments, the data processing system is an IM system, the client is an IM client, and the server is an IM server. In addition to the above-mentioned data processing functions, the IM system can also include functions that all existing IM systems have, such as user management, friend management, message push, etc.

[0134] It should be noted that the above system can execute the data processing method provided by the present invention. In addition, the functions of each part of the system can also refer to the above introduction to the method, which will not be repeated here.

[0135] The present invention provides a data processing device 400, which is integrated into a hardware security module HSM. Figure 4 As shown, it includes the following functional modules:

[0136] The encryption request acquisition module 401 is configured to acquire a data encryption request initiated by the server, which includes data to be encrypted provided by the client.

[0137] The data encryption module 402 is configured to encrypt the data using a locally generated data key to obtain a data ciphertext.

[0138] The key encryption module 403 is configured to encrypt the data key using a master key to obtain a key ciphertext; the master key is pre-generated using BYOK key material provided by the client.

[0139] The response data returning module 404 is configured to return the data ciphertext and the key ciphertext to the server.

[0140] In some embodiments, the apparatus further comprises:

[0141] The data key generation module 405 is configured to generate a data key.

[0142] The BYOK material acquisition module 406 is configured to acquire the BYOK key material provided by the client.

[0143] The master key generation module 407 is configured to generate a master key according to the BYOK key material provided by the client.

[0144] The present invention provides a data processing device 500, which is integrated in a client. The schematic diagram of the device is shown in FIG. Figure 5 As shown, it includes the following functional modules:

[0145] The BYOK material generation module 501 is configured to generate a BYOK key material in response to a user trigger.

[0146] The BYOK material sending module 502 is configured to provide the BYOK to the hardware security module HSM, so that the HSM generates a master key using the BYOK.

[0147] The data sending module 503 is configured to provide the data to be encrypted to the server, so that the server initiates a data encryption request containing the data to the HSM, and receives the data ciphertext and key ciphertext returned by the HSM; the data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key.

[0148] The present invention provides a data processing device 600, which is integrated in a server. Figure 6 As shown, it includes the following functional modules:

[0149] The data receiving module 601 is configured to receive data that needs to be encrypted provided by the client.

[0150] The encryption request sending module 602 is configured to initiate a data encryption request to the HSM, including the data to be encrypted.

[0151] The ciphertext receiving module 603 is configured to receive the data ciphertext and key ciphertext returned by the HSM and store them in the database.

[0152] The data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key. The master key is pre-generated by the HSM using the key material BYOK provided by the client and is securely stored.

[0153] It should be noted that the above device can execute the data processing method provided by the present invention. In addition, the functions of each module can also refer to the above introduction to the method, which will not be repeated here.

[0154] In the description of the embodiments of the present application, words such as "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a concrete way.

[0155] In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "plurality" means two or more.

[0156] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprises", "has" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0157] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data processing method, the method being executed by a hardware security module HSM, characterized in that: The following steps are involved: Get the data encryption request initiated by the server, which includes the data to be encrypted provided by the client; Encrypt the data using a locally generated data key to obtain data ciphertext; Encrypt the data key using the master key to obtain a key ciphertext; The master key is pre-generated using the key material BYOK provided by the client; The data ciphertext and the key ciphertext are returned to the server.

2. The method according to claim 1, characterized in that Before obtaining the data encryption request initiated by the server, the method further includes: Obtain the BYOK provided by the client; The master key is generated by using the BYOK and is securely stored.

3. The method according to claim 1, characterized in that After returning the data ciphertext and the key ciphertext to the server, the method further includes: Obtaining a data decryption request initiated by the server, which includes the data ciphertext and the key ciphertext; Decrypt the key ciphertext using the master key to obtain the data key; Decrypt the data ciphertext using the data key to obtain the data; Return the data to the server.

4. A data processing method, which is executed on a client, characterized in that: The following steps are involved: In response to a user trigger, generate key material BYOK; Providing the BYOK to a hardware security module HSM, so that the HSM generates a master key using the BYOK; The data to be encrypted is provided to the server, so that the server initiates a data encryption request containing the data to the HSM, and receives the data ciphertext and key ciphertext returned by the HSM; the data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key.

5. The method according to claim 4, characterized in that After providing the data to be encrypted to the server, the method further includes: Initiate a data viewing request to the server, so that the server initiates a data decryption request including the data ciphertext and the key ciphertext to the HSM, and receives the data returned by the HSM; the data is obtained by the HSM decrypting the data ciphertext using the data key, and the data key is obtained by the HSM decrypting the key ciphertext using the master key; Receive the data returned by the server.

6. The method according to claim 4, characterized in that After generating the BYOK key material and before providing the BYOK key material to the HSM, the method further includes: Negotiate a shared key with the key management service KMS using the PQC algorithm; The BYOK material is encrypted using the shared key and sent to the KMS, so that the KMS decrypts the encrypted BYOK material using the shared key and securely transmits the decrypted BYOK material to the HSM.

7. A data processing method, the method being executed by a server, characterized in that: The following steps are involved: Receive the data that needs to be encrypted provided by the client; Initiate a data encryption request to the HSM, including the data to be encrypted; Receive the data ciphertext and key ciphertext returned by the HSM and store them in the database; The data ciphertext is obtained by the HSM encrypting the data using a locally generated data key, and the key ciphertext is obtained by the HSM encrypting the data key using a master key. The master key is pre-generated by the HSM using the key material BYOK provided by the client and is securely stored.

8. The method according to claim 7, characterized in that After storing the data ciphertext and the key ciphertext in the database, the method further includes: In response to a data viewing request received from a client, initiating a data decryption request to the HSM, which includes the data ciphertext and the key ciphertext obtained from the database; The data returned by the HSM is received, where the data is obtained by the HSM decrypting the data ciphertext using the data key, and the data key is obtained by the HSM decrypting the key ciphertext using the master key.

9. The method according to any one of claims 1 to 8, characterized in that: The method is applied to instant messaging (IM) services, the server is an IM server, and the client is an IM client.

10. A data processing system comprising: The client is used to provide the data that needs to be encrypted to the server; The server is used to initiate a data encryption request to the hardware security module HSM according to the data to be encrypted; The HSM is used to encrypt the data contained in the data encryption request using a locally generated data key to obtain a data ciphertext; and to encrypt the data key using a master key to obtain a key ciphertext; The master key is pre-generated using the key material BYOK provided by the client; The server is also used to receive the data ciphertext and the key ciphertext from the HSM.

Images