Key rotation data encryption system and application method

Abstract

A key rotation data encryption system belongs to the technical field of internet encryption and comprises a connection key management unit, a key generation and management unit and a key storage application software unit, the key generation and management unit is also provided with a key version control subunit, an automatic key rotation and key management subunit, an old key security processing subunit and a key rotation backup and recovery mechanism subunit; the application method of the key rotation data encryption system comprises five steps. According to the method, the key leakage risk is reduced, repeated attacks can be prevented, the compliance requirement is met, the encryption strength is improved, the situation that equipment is stolen or broken can be handled, through local key rotation, especially in a distributed system or a client environment, the overall safety of the system can be improved, data protection is enhanced, the key rotation problem is solved, and the security of the equipment is improved. In addition, the key reading and analyzing speed is improved, and technical support is provided for internet security.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a key rotation data encryption system and an application method. Background Art

[0002] Key management refers to the handling of related issues in the entire process from key generation to final destruction, including system initialization and key generation, storage, backup / recovery, loading, distribution, protection, update, control, loss, revocation and destruction. Key management is particularly important in confidentiality systems because keys are the most vulnerable link in confidentiality systems, and key distribution and storage directly affect the overall security of the system.

[0003] Traditional key management systems generally adopt a static key management method, that is, once the key is generated and distributed, it will be used for a long time. Although this method is simple, it brings some defects as follows and has high security risks: if the key is leaked, the attacker can access the encrypted data for a long time; it is difficult to prevent replay attacks: the key is not changed regularly, which can be easily intercepted and used multiple times by attackers; it is difficult to comply with regulations: many modern security standards (such as the PCI-DSS Payment Card Industry Data Security Standard) require regular key updates to reduce the risk of leakage, which has an adverse impact on the application of the system. The key rotation mechanism refers to the automatic replacement of encryption keys after a fixed period of time, thereby improving the security of the system. The current key rotation (key rotation is a security measure that enhances the security of the system by regularly replacing encryption keys) technology is generally divided into the following categories: (1) Timed key rotation: Specifically, some systems will automatically replace the key after a preset time interval, such as every 24 The advantage of this method is that it can effectively reduce the risk of key leakage. The disadvantage is that there is a management burden, and improper rotation frequency may lead to performance problems. (2) Random key rotation: Random key rotation updates the key based on the trigger conditions of the system or event (such as reaching a certain number of accesses). The advantage is that the predictable rotation frequency can increase security. The disadvantage is that it is difficult to monitor and debug, and it has a large demand on system resources. (3) Key classification and hierarchical management: In key hierarchical management, the top-level key is used to protect the lower-level keys. For example, the master key manages multiple sub-keys, and the master key is rotated regularly to ensure that all lower-level keys are also protected. The advantage is that only the top-level key needs to be updated during key rotation, which reduces the operational burden. The disadvantage is that the implementation is more complicated, and the leakage of the lower-level keys still brings risks. In summary, due to the defects of local key rotation, the existing methods for implementing local key rotation technology have the following shortcomings: (1) Key synchronization problem: It is difficult to ensure the synchronization of key rotation in a distributed system; (2) Storage dependency: Local key storage depends on device security. If the device is hacked, the key may be leaked; (3) Insufficient automation: Most existing rotation mechanisms require administrators to perform manual operations or periodic configurations, and lack intelligent automated rotation management. For example, in the existing technology, some encryption libraries and security frameworks provide basic key rotation functions, such as AWS (Amazon) KMS (Key Management Service): Amazon's key management service provides periodic key rotation functions, but does not support fully localized rotation; HashiCorp Vault (Key Management Software): It supports key lifecycle management and rotation, but needs to rely on centralized key storage services. Summary of the invention

[0004] In order to overcome the key rotation mechanism of the existing key management system, due to technical limitations, there are disadvantages as described in the background technology. The present invention provides a key rotation data encryption system and application method that reduces the risk of key leakage, prevents repeated attacks, meets compliance requirements, improves encryption strength, and can cope with device theft or hacking under the joint action of relevant units and processes. Through local key rotation, especially in a distributed system or client environment, the overall security of the system can be improved and data protection can be enhanced, the key rotation problem is solved, and the key reading and parsing speed is improved, which provides strong technical support for Internet security.

[0005] The technical solution adopted by the present invention to solve its technical problem is: A key rotation data encryption system includes a cloud-based connection key management, key generation and management, and key storage application software units. The connection key management unit also has a hierarchical key architecture subunit, and the key generation and management unit also has a key version control subunit, an automated key rotation and key management subunit, an old key security processing subunit, and a key rotation backup and recovery mechanism subunit; the hierarchical key architecture subunit can realize the separate management of the master key and the data key, and the key version control subunit has key version management and multi-version key decryption support functions. In the key version management application, a new key is generated in each key rotation cycle and a version number is assigned. In the multi-version key decryption application, when decrypting, the key version control subunit selects the corresponding key according to the key version number of the data to ensure the continuity and compatibility of data decryption; the automated key rotation and key management subunit has automated key rotation and integrated application Chinese key management functions. In the use, the key rotation frequency can be set and the automatic rotation process can be realized in the system. In the integrated application of Chinese key management, the key is generated by the KSP key management system; the security processing subunit of the old key has a key elimination mechanism and a function of destroying expired keys. In the key elimination mechanism application, the validity period and abandonment period of the key can be set. After the expiration, the encryption permission of the old key is automatically disabled, but the decryption permission is still retained. In the destruction of expired keys, when all data are updated to the new key, the old key is completely destroyed from the storage to prevent it from being maliciously restored and used; the key rotation backup and recovery mechanism subunit has the backup and snapshot functions before rotating the key and the rotation rollback mechanism function. In the backup and snapshot application before rotation, a backup or snapshot of the key and data can be created before a large-scale key rotation operation, so as to quickly restore to a stable state when a problem occurs. In the rotation rollback mechanism application, when the rotation fails or the new key cannot decrypt the data normally, the system can quickly switch back to the old key to maintain business continuity.

[0006] Furthermore, the hierarchical key architecture subunit adopts a hierarchical key architecture, in which a master key is used to derive or encrypt a data key, and data encryption uses a data key instead of a master key, thereby ensuring that all data does not need to be decrypted during rotation.

[0007] Furthermore, in the key version management, specifically, key version information is recorded during encryption to identify which key version is used to encrypt the data; in multi-version key decryption, the old version key can be set to be used only for decryption to ensure that new data always uses the latest key version.

[0008] Furthermore, in the automated key rotation, the key rotation frequency is to automatically trigger the rotation periodically or after a specific event.

[0009] Furthermore, in the centralized key management, the key ciphertext is passed to the encryption component to uniformly manage the storage, rotation, and destruction of the key through the Keystore, thereby ensuring the security of the rotation process, reducing manual intervention, and improving rotation efficiency.

[0010] An application method of a key rotation data encryption system comprises the following steps: step A: generating an RSA key pair through a key generation and management unit initialization, obtaining the local MAC, IP, system version and authentication token to send an HTTP request, returning the TOKEN after the KSP key management platform successfully authenticates, starting the execution rotation task scheduler, and ensuring the continuity of key generation and rotation; step B: obtaining the key ciphertext encrypted by the RSA public key through the TOKEN issued by the KSP key management platform by connecting to the key management unit, creating a keystore file to store the key label, key version, key expiration time and key ciphertext information associated with the key after decryption with a private key, and completing the registration rotation timing task; step C: after storing the data of step B through the key storage unit, the task scheduler regularly checks the key expiration time after completion, and after expiration, the task scheduler repeats step B to order the key to the KSP key management platform, and rotates and updates the key ciphertext information, key version and expiration time in the keystore through the key label, thereby ensuring the key security; step D: Data encryption is performed through the key generation and management unit. Specifically, the TOKEN, RSA public key, key label, and key length are sent via HTTP connection to obtain the key from the KSP key management platform. After the KSP key management platform verifies the TOKEN, the label and version are matched to the key for data encryption. The key corresponding to the key label is generated according to the key length, and the ciphertext is returned after the key is encrypted with the public key to generate an RSA key pair; Step E: Decrypt the data, extract the key version identifier from the ciphertext, and decrypt the data by matching the label with the version key.

[0011] Furthermore, in step A, the local MAC, IP, system version and authentication token are issued by the KSP key management platform page.

[0012] Furthermore, in step C, after the key storage time expires, step C can be repeated to perform the rotation task, and an order can be placed again to obtain the key from the KSP key management platform, and step D can be repeated again to store the key, version, and expiration time in the keystore, and this key rotation is completed.

[0013] Furthermore, in the step D, when encrypting data, the data is encrypted by matching the label and version to the key to generate a ciphertext.

[0014] Compared with the prior art, the beneficial effects of the present invention are: under the joint action of relevant units and processes, the present invention solves the key rotation problem and improves the key reading and parsing speed. Specifically, regular rotation of keys can limit the use cycle of keys and reduce potential losses after key exposure. After rotating keys, old keys will become invalid, thereby preventing repeated attacks; compliance requirements are met, and the security of data in transmission and storage can be ensured; regular replacement of keys can improve the strength of encryption, making it difficult for attackers to obtain information through brute force cracking; in a local environment, if the device is invaded, the key may be leaked, and key rotation can effectively reduce the potential threats brought by such physical or software attacks. By rotating local keys, the overall security of the system can be improved and data protection can be enhanced, especially in distributed systems or client environments. The advantages are more obvious. In summary, the present invention has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0016] Figure 1 It is a schematic block diagram of the architecture of a key rotation data encryption system of the present invention.

[0017] Figure 2 The present invention is a flowchart of an application method of a key rotation data encryption system. DETAILED DESCRIPTION

[0018] Figure 1As shown in , a key rotation data encryption system includes a cloud-based connection key management, key generation and management, and key storage application software units. The connection key management unit also has a hierarchical key architecture subunit, and the key generation and management unit also has a key version control subunit, an automated key rotation and key management subunit, an old key security processing subunit, and a key rotation backup and recovery mechanism subunit; the hierarchical key architecture subunit can realize the separate management of the master key and the data key. Specifically, the hierarchical key architecture subunit adopts a hierarchical key architecture, and the master key is used to derive or encrypt the data key. Data encryption uses the data key instead of the master key to ensure that all data does not need to be decrypted when the key is rotated. The key version control subunit has key version management and multi-version key decryption support functions. Specifically, the key version information is recorded during encryption to identify which key version the data is encrypted with. In the key version management application, a new key is generated for each key rotation cycle and a version number is assigned. In the multi-version key decryption application, when decrypting, the system selects the corresponding key according to the key version number of the data to ensure the continuity and compatibility of data decryption. The old version key can be set to be used only for decryption to ensure that the new data always uses the latest key version. The automated key rotation and key management subunit has the functions of automated key rotation and integrated Chinese key management. In the automated key rotation application, the key rotation frequency can be set and the automated rotation process can be implemented in the system. In the automated key rotation, the key rotation frequency is automatically triggered periodically or after a specific event. In the integrated Chinese key management application, the key is generated by the KSP (key management system) key management system, and the key ciphertext is passed to the encryption component to uniformly manage the storage, rotation, and destruction of the key through the Keystore (key container file), thereby ensuring the security of the rotation process, reducing manual intervention, and improving rotation efficiency. The security processing subunit of the old key has a key elimination mechanism and a function of destroying expired keys. When the key elimination mechanism is applied, the validity period and abandonment period of the key can be set. After the expiration, the encryption permission of the old key is automatically disabled, but the decryption permission is still retained. When destroying expired keys, when all data is updated to the new key, the old key is completely destroyed from the storage to prevent it from being maliciously restored and used; the key rotation backup and recovery mechanism subunit has a backup and snapshot function before rotation and a rotation rollback mechanism function. When the backup and snapshot before rotation are applied, a backup or snapshot of the key and data can be created before a large-scale key rotation operation so as to quickly restore to a stable state when a problem occurs. When the rotation rollback mechanism is applied, when a rotation fails or the new key cannot decrypt the data normally, the system can quickly switch back to the old key to maintain business continuity.

[0019] Figure 2As shown in, an application method of a key rotation data encryption system includes the following steps: Step A: Generate an RSA (asymmetric encryption algorithm) key pair through the key generation and management unit initialization, obtain the local MAC (hardware address), IP (network address), system version and authentication token to send an HTTP request, and the KSP (key management system) key management platform returns TOKEN (identity token) after successful authentication, and starts the execution rotation task scheduler to ensure the continuity of key generation and rotation. The local MAC hardware address), IP (network address), system version and authentication token are issued by the KSP (key management system) key management platform page. Step B: By connecting to the key management unit, the key ciphertext encrypted by the RSA (asymmetric encryption algorithm) public key is obtained through the TOKEN (identity token) issued by the KSP (key management system) key management platform, and the key label, key version, key expiration time, and key ciphertext information associated with the key are created by using the private key to decrypt the key, and the registration rotation timing task is completed; Step C: The data in step B is stored through the key storage component unit. After completion, the task scheduler regularly checks the key expiration time. After expiration, the task scheduler repeats step B to place an order for the key to the KSP (key management system) key management platform, and the key ciphertext information, key version, and expiration time are rotated and updated in the keystore (key container file) through the key label, ensuring the security of the key. After the key storage time expires, step C can be repeated to execute the rotation task, and the order can be placed again to obtain the key from the KSP (key management system) key management platform, and step D can be repeated again to store the key, version, and expiration time in the keystore (key container file). This key rotation is completed. Step D: Data encryption is performed through the key generation and management unit. Specifically, the TOKEN (identity token), RSA (asymmetric encryption algorithm) public key, key label, and key length are sent through the HTTP connection to obtain the key from the KSP (key management system) key management platform. After the KSP (key management system) key management platform verifies the TOKEN (identity token), the label and version are matched to the key for data encryption. The key corresponding to the key label is generated by the key length, and the ciphertext is returned after the key is encrypted with the public key. When the RSA (asymmetric encryption algorithm) key pair is generated to encrypt data, the data is encrypted by matching the label and version to the key to generate the ciphertext. Step E: Decrypt the data, extract the key version identifier from the ciphertext, and decrypt the data by matching the label and version with the key.

[0020] Figure 1 , 2As shown, the key rotation technology adopted by the present invention has significant advantages when encrypting data, especially in terms of improving security, compliance and management efficiency: (1) Enhance data security and reduce the risk of key exposure: By regularly replacing encryption keys, even if a key is leaked or cracked, the impact is limited to data within a specific time period, and will not endanger the data security of the entire system. (2) Reduce the risk of old keys: Over time, old keys may no longer be safe due to the improvement of attack methods. Key rotation ensures that new and stronger keys are used regularly to protect data, thereby reducing the risks caused by old keys. (3) Support data life cycle management and long-term data storage: For long-term stored data, key rotation provides a more secure encryption method, extending the security life of data storage. Even if the data is stored for a long time, security can still be guaranteed. (4) Protect historical data: Through key rotation, it can be ensured that even if historical data is obtained by an attacker, the data will be effectively protected by re-encryption after the old key expires. (5) Improve key management efficiency and automate key management: Key rotation operations are performed through an automated key management system, reducing manual intervention and improving operational efficiency. At the same time, it also reduces the risk of human error and makes key management more standardized. (6) Support for distributed applications: Key rotation technology can be flexibly applied in a distributed environment. By synchronizing the key status of each node, the consistency of encryption and decryption can be maintained. (6) Flexibility in responding to security incidents and rapid response to key leakage: Once a key leakage is detected, key rotation technology allows for the rapid generation and distribution of new keys to replace old keys, ensuring the continuity of data security and reducing potential damage. (7) Rotation rollback mechanism: Key rotation systems usually support rolling back to old keys, facilitating rapid switching in the event of rotation failures or new key problems, and maintaining the normal operation of the system. (8) Support for multi-version keys and compatibility, multi-version key management: Each time a new key is generated through rotation, the system retains the old key for historical data decryption. Through version management, it can support access to both new and old data at the same time, without the need to decrypt and re-encrypt all data at once. (9) Compatibility and continuity: Rotation technology supports the upgrade and replacement of encryption algorithms. While rotating keys, it is compatible with multiple algorithms, allowing the system to flexibly keep pace with encryption standards and new technologies. In summary, the present invention reduces the risk of key leakage, prevents repeated attacks, meets compliance requirements, improves encryption strength, and can cope with device theft or hacking. Through local key rotation, especially in a distributed system or client environment, it can improve the overall security of the system and enhance data protection, solve the key rotation problem, and increase the speed of key reading and parsing, providing strong technical support for Internet security.

[0021] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the appended claims rather than the above description, and it is intended that all changes that fall within the meaning and scope of the equivalent elements of the claims are included in the present invention.

[0022] In addition, it should be understood that although the present specification is described according to the implementation mode, the implementation mode does not only include an independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in the embodiments can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A key rotation data encryption system, characterized in that: It includes a cloud-based connection key management, key generation and management, and key storage application software unit, wherein the connection key management unit also has a hierarchical key architecture subunit, and the key generation and management unit also has a key version control subunit, an automated key rotation and key management subunit, an old key security processing subunit, and a key rotation backup and recovery mechanism subunit; The hierarchical key architecture subunit can realize the separate management of the master key and the data key. The key version control subunit has the functions of key version management and multi-version key decryption support. In the key version management application, a new key is generated in each key rotation cycle and a version number is assigned. In the multi-version key decryption application, when decrypting, the key version control subunit selects the corresponding key according to the key version number of the data to ensure the continuity and compatibility of data decryption; the automatic key rotation and key management subunit has the functions of automatic key rotation and integrated application Chinese key management. In the automatic key rotation application, the key rotation frequency can be set and the automatic rotation process can be realized in the system. In the integrated application Chinese key management application, the key is generated by the KSP key management system; the secure processing of the old key The subunit has a key elimination mechanism and a function of destroying expired keys. In the application of the key elimination mechanism, the validity period and abandonment period of the key can be set. After the expiration, the encryption permission of the old key is automatically disabled, but the decryption permission is still retained. In the destruction of expired keys, when all data are updated to the new key, the old key is completely destroyed from the storage to prevent malicious recovery and utilization; the key rotation backup and recovery mechanism subunit has a backup and snapshot function before rotating the key, and a rotation rollback mechanism function. In the application of the backup and snapshot before rotation, a backup or snapshot of the key and data can be created before a large-scale key rotation operation, so as to quickly restore to a stable state when a problem occurs. In the application of the rotation rollback mechanism, when a rotation fails or the new key cannot decrypt the data normally, the system can quickly switch back to the old key to maintain business continuity.

2. A key rotation data encryption system according to claim 1, characterized in that: The hierarchical key architecture subunit adopts a hierarchical key architecture, where the master key is used to derive or encrypt the data key. Data encryption uses the data key instead of the master key, ensuring that all data does not need to be decrypted during rotation.

3. A key rotation data encryption system according to claim 1, characterized in that: In key version management, specifically, key version information is recorded during encryption to identify which key version the data is encrypted with; in multi-version key decryption, the old version key can be set to be used only for decryption to ensure that new data always uses the latest key version.

4. A key rotation data encryption system according to claim 1, characterized in that: In automated key rotation, key rotation is triggered automatically at regular intervals or after specific events.

5. A key rotation data encryption system device according to claim 1, characterized in that: In centralized key management, the key ciphertext is passed to the encryption component, which uniformly manages the storage, rotation, and destruction of the key through Keystore, ensuring the security of the rotation process, reducing manual intervention, and improving rotation efficiency.

6. The application method of a key rotation data encryption system according to any one of claims 1 to 5, characterized in that: The method comprises the following steps: Step A: Initialize and generate an RSA key pair through a key generation and management unit, obtain the local MAC, IP, system version and authentication token to send an HTTP request, and return the TOKEN after the KSP key management platform successfully authenticates, and start the execution rotation task scheduler, which can ensure the continuity of key generation and rotation; Step B: By connecting to the key management unit, the key ciphertext encrypted by the RSA public key is obtained through the TOKEN issued by the KSP key management platform, and the key ciphertext is created after decryption with the private key. The key label, key version, key expiration time and key ciphertext information associated with the key are stored in the keystore file, and the registration rotation timing task is completed; Step C: After the data of step B is stored in the key storage unit, the task scheduler regularly checks the key expiration time after completion. After the expiration, the task scheduler repeats step B to order the key to the KSP key management platform, and the key ciphertext information, key version and expiration time are rotated and updated in the keystore through the key label, so as to ensure the key security; Step D: Data is encrypted through the key generation and management unit. Specifically, the TOKEN, RSA public key, key label, and key length are sent via HTTP connection to obtain the key from the KSP key management platform. After the KSP key management platform verifies the TOKEN, the label and version are matched to the key for data encryption. The key corresponding to the key label is generated according to the key length, and the key is encrypted with the public key and the ciphertext is returned to generate an RSA key pair. Step E: Decrypt the data, extract the key version identifier from the ciphertext, and decrypt the data by matching the tag with the version key.

7. The application method of a key rotation data encryption system according to claim 6, characterized in that: In step A, the local MAC, IP, system version and authentication token are issued by the KSP key management platform page.

8. The application method of a key rotation data encryption system according to claim 6, characterized in that: In step C, after the key storage time expires, you can repeat step C to perform the rotation task, place an order again to obtain the key from the KSP key management platform, and repeat step D again to store the key, version, and expiration time in the keystore. This key rotation is completed.

9. The application method of a key rotation data encryption system according to claim 6, characterized in that: In step D, when encrypting data, the data is encrypted by matching the label and version to the key to generate ciphertext.

Images