Key data processing method, device, system and equipment and storage medium

Abstract

The invention provides a key data processing method, and a cipher machine cluster comprises a hardware cipher machine which is used for operating at least one cipher machine instance; each cipher machine instance is configured with the same initial key; a device key ciphertext and a domain key ciphertext provided by the target cipher machine instance are obtained, the device key ciphertext is encrypted by using the initialization key after the device key is created, and the domain key ciphertext is encrypted by using the device key after the domain key is created; synchronizing the device key ciphertext and the domain key ciphertext to other cipher machine instances; other cryptographic machine instances are used for decrypting the synchronized equipment key ciphertext by the initial key to obtain the equipment key and decrypting the synchronized domain key ciphertext to obtain the domain key; and in response to the received cryptographic operation request of the initiating end, sending the cryptographic operation request to any cryptographic machine instance, and processing the cryptographic operation request by the cryptographic machine instance receiving the cryptographic operation request by using the own domain key.

Description

Technical Field

[0001] The present disclosure relates to the field of cloud computing technology, and in particular to a method, device, system, equipment and storage medium for processing key data. Background Art

[0002] At present, some cloud service providers provide encryption services in the cloud. They use tested and certified hardware cryptographic machines as the service underlying layer and create cryptographic machine instances through virtualization technology for users to use. This can help users meet regulatory compliance requirements for data security and protect the privacy of cloud service data.

[0003] In cloud computing scenarios, the need for high availability and scalability makes cloud encryption services more complex to design. For example, in cloud encryption services, it is hoped that multiple cryptographic machine instances can be configured, and cryptographic machine instances can be arbitrarily scheduled to provide cryptographic operation services when facing user cryptographic operation requests. In this way, each cryptographic machine instance needs to hold a unified key. Therefore, how to meet the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management, has become a technical problem that needs to be solved urgently. Summary of the invention

[0004] To overcome the problems existing in the related art, the present disclosure provides a method, apparatus, system, device and storage medium for processing key data.

[0005] According to a first aspect of an embodiment of this specification, a method for processing key data is provided, the method being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method comprising:

[0006] After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates the domain key;

[0007] Synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key they hold to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0008] In response to receiving a cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

[0009] According to a second aspect of the embodiments of this specification, there is provided a cryptographic service management system, the cryptographic service management system is used to manage a cryptographic machine cluster, the cryptographic machine cluster includes at least one hardware cryptographic machine, the hardware cryptographic machine is used to run at least one cryptographic machine instance, the hardware cryptographic machine provides a cryptographic machine interface for the management system to call, the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; each cryptographic machine instance has the same domain key;

[0010] The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine;

[0011] The service interface is used to: after receiving a cryptographic operation request from the initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0012] According to a third aspect of the embodiments of this specification, a key data processing device is provided, the device is applied to a server, the server is used to manage a cryptographic machine cluster, the cryptographic machine cluster includes at least one hardware cryptographic machine, the hardware cryptographic machine is used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the device includes:

[0013] an acquisition module, configured to: after determining a target cryptographic machine instance in the cryptographic machine cluster, acquire a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates a device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates a domain key;

[0014] A synchronization module, used to: synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key they hold to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0015] The request operation module is used to: in response to receiving a cryptographic operation request from an initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request uses its own domain key to process the cryptographic operation request.

[0016] According to a fourth aspect of an embodiment of this specification, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method embodiment described in the first aspect are implemented.

[0017] According to a fifth aspect of the embodiments of this specification, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method embodiments described in the first aspect.

[0018] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0019] In the embodiments of this specification, after determining the target cryptographic machine instance in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained, the device key ciphertext is encrypted by the target cryptographic machine instance using the initialization key after creating the device key, and the domain key ciphertext is encrypted by the target cryptographic machine instance using the device key after creating the domain key; the device key ciphertext and domain key ciphertext are synchronized to the other cryptographic machine instances. Each of the hardware cryptographic machines in the cryptographic machine cluster configures an initial key that complies with the preset key rules for the running cryptographic machine instance, so that the initial key is used to protect the device key, and the device key is used to protect the domain key, thereby realizing double protection of the key. A secure and unified domain key can be used for cryptographic operations in the cluster, thereby realizing distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the disclosure.

[0022] Figure 1A and Figure 1B They are schematic diagrams of a key data processing scenario shown in this specification according to an exemplary embodiment.

[0023] Figure 2The flowchart of a method for processing key data is shown in the present specification according to an exemplary embodiment.

[0024] Figure 3 It is a hardware structure diagram of a computer device where a key data processing device is located according to an exemplary embodiment shown in this specification.

[0025] Figure 4 It is a block diagram of a key data processing device shown in this specification according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this specification. Instead, they are merely examples of devices and methods consistent with some aspects of this specification as detailed in the appended claims.

[0027] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. The singular forms "a", "the" and "the" used in this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0028] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0029] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] Cloud HSM (Cloud Data Encryption Service), an encryption service on the cloud, uses a certified hardware cryptographic machine as the underlying service. It creates cryptographic machine instances through virtualization technology for users to use, which can help users meet regulatory compliance requirements for data security and protect the privacy of cloud service data. With the help of cloud encryption services, users can manage keys securely and reliably, and can also use a variety of encryption algorithms to perform reliable encryption and decryption operations on data.

[0031] A hardware security module (HSM) is a hardware device that can independently or concurrently provide users with key management or cryptographic operations and other functions.

[0032] Cloud HSM refers to an encryption solution on the cloud that uses a tested and certified hardware HSM as the underlying service. Through virtualization technology, it helps customers meet regulatory compliance requirements for data security and protect the privacy of cloud service data.

[0033] With the cloud cryptographic machine solution, multiple cryptographic machine instances (also called cloud cryptographic machine instances, etc.) can be created in the cluster. Cryptographic machine instances refer to resources virtualized using the hardware encryption module of the cryptographic machine. Cryptographic machine instances have the same compliance as hardware encryption modules, can implement all functions of encryption services, and have the ability to encrypt and decrypt data.

[0034] Key Management Service (KMS): A one-stop key management and data encryption service platform that provides simple, reliable, secure, and compliant data encryption protection capabilities. Specifically, KMS can usually provide a system or service for key hosting and management, and provide cryptographic computing capabilities for the managed keys. Ensuring the security and compliance of encryption keys is the core capability of KMS. The country and the industry have specified corresponding laws and regulations, requiring the use of hardware cryptographic machines that meet security level requirements to protect and store keys.

[0035] like Figure 1A FIG. 1 is a schematic diagram of a key data processing scenario according to an exemplary embodiment of the present specification. Figure 1A The system includes a cryptographic machine cluster, a KMS system, and an initiator. The server that manages the cryptographic machine cluster takes the KMS system as an example. The cryptographic machine cluster includes at least one hardware cryptographic machine, which is used to run at least one cryptographic machine instance. Figure 1AIn the example, hardware cryptographic machines 1 to 3 are used, and two cryptographic machine instances are run in each hardware cryptographic machine. The KMS system is used to manage the cryptographic machine cluster; the initiator can use the cryptographic operation function of the cryptographic machine cluster through the KMS system. Figure 1A Three cloud product instances are taken as examples.

[0036] After the cryptographic machine instance is created by the hardware cryptographic machine, it needs to be initialized before cryptographic operations can be provided. In some related technologies, the hardware cryptographic machine manufacturer provides a management tool, which needs to be manually installed on the machine, and then the hardware cryptographic machine is connected in the management tool to manually initialize the cryptographic machine instance, synchronize the key and configure the authentication configuration on the service side. All operations are manual operations, the process is complex and prone to errors, and it is not suitable for large-scale deployment. The synchronization process is performed by the hardware cryptographic machine and depends on the hardware cryptographic machine manufacturer.

[0037] In the public cloud scenario, the hardware cryptographic machine is configured by the cloud service provider, and users have no demand for a specific hardware cryptographic machine manufacturer. In the private cloud or hybrid cloud scenario, some users will specify a specific hardware cryptographic machine manufacturer. Based on this, the KMS system, as a management platform, needs to have the ability to access hardware cryptographic machines from different manufacturers. However, the interfaces of hardware cryptographic machines from different cryptographic machine manufacturers are inconsistent, and the management and usage methods of the cryptographic machines are slightly different, resulting in high costs for the server to adapt to new cloud cryptographic machine manufacturers, and stability is difficult to guarantee. Every time a cryptographic machine manufacturer is connected, the cryptographic operation interface from the operation and maintenance side to the data plane must be re-adapted.

[0038] Based on this, it is necessary to improve the server so that it can support the access of cloud cryptographic machines from multiple vendors and can automate the operation and maintenance and use of cloud cryptographic machines from different vendors.

[0039] like Figure 1B As shown, it is a schematic diagram of another scenario of cryptographic service shown in this specification according to an exemplary embodiment. In the figure, the hardware cryptographic machines take hardware cryptographic machines 1 to hardware cryptographic machines 3 as examples, and each hardware cryptographic machine takes two cryptographic machine instances running as an example. In actual applications, the number of hardware cryptographic machines and the number of cryptographic machine instances running in each hardware cryptographic machine can be flexibly configured as needed, and this embodiment does not limit this.

[0040] Among them, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard.

[0041] The key mentioned in this embodiment includes information that can be used to encrypt and decrypt data. The key type can include multiple types, such as symmetric key, asymmetric key, hybrid key, one-way hash function or digital signature, etc., which is not limited in this embodiment.

[0042] The server of this embodiment may be run on a computer device, wherein the computer device includes but is not limited to a single server, a server group consisting of multiple servers, or a cloud consisting of a large number of hosts based on cloud computing.

[0043] In the figure, the service end takes the KMS system as an example, and provides an interface service, which includes one or more service nodes. The service node can be a program running on a computing instance, which is used to provide interface services. Specifically, the service node is configured with one or more service interfaces, which also support the same interface standards as the cryptographic machine interface. The service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0044] In this embodiment, each cryptographic machine instance has the same domain key; the service interface is used to: after receiving a cryptographic operation request from the initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0045] Optionally, distributed scheduling can be performed under multiple service nodes, so that the server can implement distributed processing. Different service interfaces are used to initiate different operation requests to the cryptographic machine instance. For example, each service interface is used to initiate an atomic operation to the hardware cryptographic machine / cryptographic machine instance. Therefore, one or more service interfaces configured in each service node can be understood as a layer of SDK (Software Development Kit) deployed in the service node, and the interface of the cryptographic machine is called through the service interface. In this way, through the encapsulation of the interface, the differences in the cryptographic machine interfaces of different manufacturers can be shielded without modifying the upper-level service code.

[0046] The interface standard can be configured as needed in actual applications, for example, it can be determined according to the standards supported by the manufacturers of the cryptographic machines to be connected. As an example, for cryptographic operations, the interface standard may include PKCS#11 (Public Key Cryptography Standards#11, cryptographic standard interface). The PKCS#11 standard defines a class of interfaces that allow software applications to communicate with various cryptographic devices and perform cryptographic services such as secure key management, digital signatures, and encryption and decryption operations.

[0047] In this way, the cryptographic machine interfaces of each hardware cryptographic machine in the cryptographic machine cluster support the same interface standard, and the service interface of the KMS system also supports this standard. The server can access hardware cryptographic machines from different manufacturers and call the cryptographic machine interface through the service interface to operate and maintain the cryptographic machine instance or use the cryptographic operation services provided by the cryptographic machine instance.

[0048] For example, one or more tasks can be run in the server, and the task can execute a processing flow. During the execution of the processing flow, one or more service interfaces can be called, and the called service interface can generate a call request to the cryptographic machine interface accordingly, so as to automatically complete the operation and maintenance task. Alternatively, the server can obtain the cryptographic operation request from the initiator, parse the cryptographic operation request, and call the corresponding service interface. The called service interface can generate a call request to the cryptographic machine interface accordingly, so that the called cryptographic machine instance can complete the cryptographic operation.

[0049] In some examples, for any manufacturer's cryptographic machine, the use of the cryptographic machine can be uniformly divided into two stages: the first stage is key initialization, and the second stage is the KMS system providing external services, creating keys for users, and using keys for encryption and decryption operations.

[0050] Optionally, during the key initialization process of the first phase, a specific cryptographic machine instance needs to be operated, such as initializing a specific cryptographic machine instance and using a specific cryptographic machine instance to initialize the key; while in the process of the server providing external services, any cryptographic machine instance can be used to provide cryptographic operation services without specifying a specific cryptographic machine instance.

[0051] An SDK layer is deployed on each service node, which divides all operations of the cloud cryptographic machine into: stateful management interface and stateless management interface; wherein, the calling parameters of the stateful management interface include the information of the called cryptographic machine instance; the calling parameters of the stateless management interface do not include the information of the called cryptographic machine instance.

[0052] Optionally, the types of stateful management interfaces may include device management and domain key management, and the types of stateless management interfaces may include session key management and cryptographic operations.

[0053] As an example, the device management type service interface may include any of the following: a service interface for obtaining cryptographic machine information, a service interface for performing cryptographic machine user management, a service interface for cryptographic machine initialization, an interface for cryptographic machine certificate management, or a service interface for cryptographic machine device key management.

[0054] The service interface of the domain key management type may include any one of the following: a service interface for creating a domain key; a service interface for exporting / importing a domain key.

[0055] The service interface of the session key management type may include a service interface for creating a session key and / or a service interface for wrapping / unwrapping a session key.

[0056] The service interface of the cryptographic operation type may include any of the following: a service interface for symmetric encryption and decryption, a service interface for generating random numbers, or a service interface for asymmetric encryption and decryption; among which, the service interface for asymmetric encryption and decryption may include a service interface for encryption / decryption, and / or a service interface for signing / signature verification.

[0057] Among them, the stateful management interface can be used to realize the automation of cryptographic machine operation and maintenance, while the stateless management interface can be used to process the cryptographic operation request of the initiator to the cryptographic machine instance.

[0058] As an example, one or more tasks can be configured in the server, and the task can be a program for executing a specific process. For example, the task can be an initialization task, including a cryptographic machine instance initialization task, a key initialization task, a key synchronization task, and so on. When a cryptographic machine instance is created in the cryptographic machine cluster, the KMS system can start the initialization task of the cryptographic machine instance. For example, taking the creation of the target cryptographic machine instance as an example, the KMS system can obtain the information of the target cryptographic machine instance, and start the cryptographic machine instance initialization task based on the information of the target cryptographic machine instance. The task can execute the following process during operation:

[0059] After logging in to the target cryptographic machine instance using the factory default verification data configured by the hardware cryptographic machine for the cryptographic machine instance, change the password of the target cryptographic machine instance and log in again, and obtain the API token (Application Programming Interface token, a token used for application authentication and authorization) returned by the target cryptographic machine instance.

[0060] After obtaining the API token, the service interface for initializing the cryptographic machine can be called, so that the service interface for initializing the cryptographic machine calls the cryptographic machine interface to initialize the target cryptographic machine instance.

[0061] Assuming that the target cipher machine instance is the first cipher machine instance created in the cipher machine cluster, the key initialization task will also be started. The key initialization task can execute the following process during operation:

[0062] Calling a service interface for managing the encryption machine device key, so that the interface calls the encryption machine interface, requests the target encryption machine instance to create a device key, and then returns the device key ciphertext, wherein the device key ciphertext is encrypted by the target encryption machine using the initial key;

[0063] The service interface for creating a domain key is called so that the interface calls the cryptographic machine interface to request the target cryptographic machine instance to create a domain key.

[0064] The service interface for exporting / importing domain keys is called so that the interface calls the cryptographic machine interface, requests the target cryptographic machine instance to return the domain key ciphertext, and then returns the domain key ciphertext, which is encrypted by the device key after the target cryptographic machine instance creates the domain key.

[0065] In this way, the server can obtain the device key ciphertext and domain key ciphertext.

[0066] Subsequently, other cryptographic machine instances will also be created, and the server can similarly start the cryptographic machine instance initialization task, and the execution process can be seen in the above embodiment. Since other subsequent cryptographic machine instances need to synchronize keys, a key synchronization task can also be started. The key synchronization task can execute the following process during operation:

[0067] Calling a service interface for encryption machine device key management, so that the interface calls the cipher machine interface to request the transmission of the device key ciphertext to the other cipher machine instance;

[0068] The service interface for exporting / importing the domain key is called so that the interface calls the cryptographic machine interface to request the transmission of the domain key ciphertext to the other cryptographic machine instance.

[0069] In this way, the server can synchronize the device key ciphertext and domain key ciphertext to other cipher machine instances. Other cipher machine instances use their own initial keys to decrypt the synchronized device key ciphertext to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key. Thus, each cipher machine instance in the cluster holds the same device key and domain key.

[0070] In some examples, the device key and / or domain key may also be updated according to a set period. For example, the server automatically triggers the update using a set rule, and the set rule may be configured as needed, such as a set time period.

[0071] When the update is triggered, one of the cryptographic machine instances is selected in the cryptographic machine cluster to create a new device key and domain key; in this way, an update task can be created, and the update task can use the selected cryptographic machine instance as the aforementioned target cryptographic machine instance to start the aforementioned key initialization task. The execution process of the task is as described above, so that the cryptographic machine instance generates a new device key and / or domain key, and returns the device key ciphertext and / or domain key ciphertext to the KMS system.

[0072] The server can synchronize the new device key ciphertext and / or domain key ciphertext to other cryptographic machine instances in the cluster. The synchronization process can be seen in the above embodiment. After synchronization, other cryptographic machine instances can use the new device key ciphertext and / or domain key ciphertext to obtain new device keys and / or domain keys to replace the old device keys and / or domain keys they already hold.

[0073] In the second stage, the server uses the service interface of each service node to provide services to the outside world, create keys for users, and use keys to perform key operations. For example, the KMS system includes a gateway, which can be configured with one or more API servers facing the initiator. Optionally, the API server can be a program running in the computing instance, which is used to accept the cryptographic operation request of the initiator. The cryptographic operation request can be of various types, such as user key creation, encryption and decryption, signing or signature verification, etc.

[0074] For example, when the gateway receives a cryptographic operation request from the initiator, it can request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0075] After an API Server in the gateway receives a cryptographic operation request, it is dispatched to any interface service node, which runs the cryptographic operation task. The task can call the service interface, which can be a stateless service interface. The called service interface initiates a request to the cryptographic machine interface of any hardware cryptographic machine, requesting the cryptographic machine instance to perform cryptographic operations.

[0076] As an example, a cryptographic operation request includes a user key creation request, which can call a service interface for creating a session key, and the service interface calls the cryptographic machine interface of any hardware cryptographic machine in the cluster, requests any cryptographic machine instance to create a user key, and after obtaining the user key ciphertext returned by the cryptographic machine instance, the initiator's identifier and the user key ciphertext are stored in the database. The user key ciphertext is encrypted by the requested cryptographic machine instance using the domain key it holds.

[0077] As an example, a cryptographic operation request includes a user key creation request, and the cryptographic operation request may also include a user key use request, which carries user data; the interface service node can obtain the user key creation request, query the user key ciphertext corresponding to the initiator's identifier in the database, and use the user data and the user key ciphertext to call the service interface for session key wrap / unwrap, which can call the cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster, thereby requesting any cryptographic machine instance to process. The requested cryptographic machine instance returns the cryptographic operation result and is returned to the initiator by the KMS system. The cryptographic operation result is obtained by the requested cryptographic machine instance using its own domain key to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform cryptographic operation on the user data.

[0078] As can be seen from the above embodiments, the service interface is implemented in the KMS system in the embodiments of this specification. Through the service interface domain hardware cryptographic machine and cryptographic machine instance interaction, hardware cryptographic machines of different manufacturers can be connected. Different manufacturers have different cryptographic machines, and the KMS system helps users shield the differences between the underlying hardware cryptographic machines of different manufacturers.

[0079] In the embodiments of this specification, considering the high availability and scalability requirements in cloud computing scenarios, cloud encryption services have a high design complexity. For example, in cloud encryption services, it is hoped that multiple cryptographic machine instances can be configured, and when faced with user cryptographic operation requests, the cryptographic machine instances can be arbitrarily scheduled to provide cryptographic operation services. In this way, each cryptographic machine instance is required to hold a unified key. Therefore, how to meet the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management. Therefore, Figure 2 As shown, a method for processing key data according to an exemplary embodiment of the present specification is shown. The method can be applied to a server, and the server is used to manage a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method may include the following steps:

[0080] Step 202, after determining the target cryptographic machine instance in the cryptographic machine cluster, obtain the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates the domain key;

[0081] Step 204, synchronize the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances; wherein the other cryptographic machine instances are used to use the initial key they hold to decrypt the synchronized device key ciphertext to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key.

[0082] Step 206, in response to receiving the cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

[0083] In practical applications, the key data processing method of this embodiment can be applied to the server, for example Figure 1A or Figure 1B In the KMS system in the scenarios such as the above, the KMS system can be used to access the hardware cryptographic machine of a manufacturer, and the KMS system can adapt to the cryptographic machine interface of the hardware cryptographic machine of a manufacturer. It can also be used to access the hardware cryptographic machines of multiple manufacturers, configure the service node to implement one or more service interfaces, and interact with the cryptographic machine interface of the hardware cryptographic machine through the service interface, as in the above embodiment.

[0084] The initial key may be a key that complies with preset key rules, such as a factory key configured by a hardware cryptographic machine for a cryptographic machine instance. The factory key is usually stored in the trusted execution environment of the hardware cryptographic machine and is used to create and protect the keys required by the hardware cryptographic machine in the subsequent operation process. Each of the hardware cryptographic machines in the cryptographic machine cluster configures the same initial key for the running cryptographic machine instance, and the initial key is stored inside the cryptographic machine instance. The cryptographic machine cluster may be a hardware cryptographic machine from the same manufacturer, so that when there are multiple hardware cryptographic machines, multiple cryptographic machine instances running in multiple hardware cryptographic machines use a unified initial key.

[0085] The initial key is used to create and protect the device key, while the device key is used to protect the domain key. Considering the high availability requirements in cloud computing scenarios, the cryptographic machine instance may be dynamically created and closed. The hardware cryptographic machine used by user A can be provided to other users through initialization later. Therefore, different device keys are generated after the cryptographic machine instance is initialized through the initial key. The device key of the cryptographic machine instance is created after each initialization, that is, it will be different after each initialization. In this way, different device keys can be implemented when different users use it. After that, the device key is used to create and protect the domain key, realizing dual protection of the key and unification of the domain key under one user. For example, the initial key can be used to create the device key, and the device key is used to create the domain key. The domain key can be verified by the device key when it is used. In this way, a secure and unified domain key can be used in the cluster for cryptographic operations, so that distributed cryptographic operations can be implemented through multiple cryptographic machine instances, meeting the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management.

[0086] In step 202, the device key and the domain key may be created by selecting a target cryptographic machine instance from the cryptographic machine cluster. There may be multiple ways to trigger this step.

[0087] After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes:

[0088] After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining the cryptographic machine instance created for the first time as a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance;

[0089] The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0090] After the cryptographic machine cluster creates other cryptographic machine instances, the device key ciphertext and the domain key ciphertext are synchronized to the other cryptographic machine instances.

[0091] In this way, after the first cryptographic machine instance in the cluster is started, the key can be initialized. Other cryptographic machine instances started later can synchronize the existing device key ciphertext and domain key ciphertext without having to create them again.

[0092] Therefore, the first cryptographic machine instance started in the cluster can be used to create device keys and domain keys, while the subsequently started cryptographic machine instances do not need to be created. The KMS system ensures the unification of device keys and domain keys in the cluster through synchronization.

[0093] Optionally, in other examples, after the set update period arrives, after the target cryptographic machine instance is determined in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained.

[0094] In other examples, the key can be updated as needed. For example, after the set update cycle is reached, after the target cryptographic machine instance is determined in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained. Afterwards, the KMS system can synchronize the updated device key ciphertext and domain key ciphertext to other cryptographic machine instances in the cluster. In this way, the key update can be triggered regularly, which can effectively prevent cryptographic attacks and further ensure security.

[0095] In other examples, only the domain key may be updated. For example, after the set update period arrives, after the target cryptographic machine instance is determined in the cryptographic machine cluster, the domain key ciphertext provided by the target cryptographic machine instance is obtained. Afterwards, the KMS system may synchronize the updated domain key ciphertext to other cryptographic machine instances in the cluster.

[0096] For example, the method may further include:

[0097] After the set period arrives, determine the first cryptographic machine instance in the cryptographic machine cluster, obtain the domain key ciphertext updated by the first cryptographic machine instance, the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key;

[0098] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already have.

[0099] In this embodiment, when the set period arrives, the domain key can be updated in the above manner, which can effectively prevent password attacks and ensure the security of the user's password operation.

[0100] In the process of providing external services, the KMS system may face a large number of cryptographic operation requests from the initiator. The cryptographic operation request from the initiator includes the creation of user keys. As the information to be protected, one idea is to store the user keys in the hardware cryptographic machine in the cluster. However, this method will cause the consumption of storage resources of the hardware cryptographic machine. Based on this, in some examples, the cryptographic operation request includes a user key creation request, and the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request uses its own domain key to process the cryptographic operation request, which may include:

[0101] Sending the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtaining the user key ciphertext created by the cryptographic machine instance that receives the user key creation request using the domain key held by itself;

[0102] The identifier of the initiator and the user key ciphertext are stored in a database.

[0103] In this embodiment, the cryptographic machine instance uses the domain key to protect the user key and then provides the user key ciphertext to the server. In this way, the hardware cryptographic machine does not store the domain key and does not consume the storage resources of the hardware cryptographic machine. The protection of the domain key in the cryptographic machine instance can ensure the security of the user key. The server stores the initiator's identifier and the user key ciphertext in the database for subsequent use by the initiator.

[0104] In some examples, when the domain key is updated, after the updated domain key ciphertext is synchronized to other cryptographic machine instances, the method may further include:

[0105] Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster;

[0106] After obtaining the updated ciphertexts of each user key returned by the one or more cryptographic machine instances, the ciphertexts are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts with the domain keys already held by the one or more cryptographic machine instances themselves to obtain the user key, and then encrypting the user key with the updated domain key.

[0107] Among them, one or more cipher machine instances can be selected in the cipher machine cluster to update the ciphertext of each user key stored in the database. For example, one cipher machine instance can execute the update of all user key ciphertexts, or distributed processing can be performed using multiple cipher machine instances to execute the update, and each cipher machine instance can update one or more. In this way, the security of user keys can be guaranteed.

[0108] In some examples, the cryptographic operation request includes a user key use request, the user key use request carries user data, and the sending of the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, wherein the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using a domain key held by itself, includes:

[0109] Querying a user key ciphertext corresponding to the identifier of the initiator from a database;

[0110] Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster;

[0111] Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

[0112] In this embodiment, since the user key is not stored in the cryptographic machine, after receiving the user key use request, the KMS can query the user key ciphertext corresponding to the initiator's identifier from the database, and then use the user data and the user key ciphertext to request any cryptographic machine instance in the cryptographic machine cluster to process the user key use request. Therefore, the requested cryptographic machine instance can perform cryptographic operations and return cryptographic operation results. In this way, the user's key operation needs are met without consuming the storage resources of the hardware cryptographic machine.

[0113] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0114] The service end includes at least one service node, the method is applied in the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0115] In this embodiment, the server can Figure 1B In the embodiment, by configuring a service interface in the service node, the interface standard supported by the service interface is the same as the interface standard supported by the cryptographic machine interface, thereby shielding the difference between the interfaces of different hardware cryptographic machines.

[0116] In some examples, the service interface includes: a stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information of the called cryptographic machine instance; the calling parameters of the stateless class management interface do not include information of the called cryptographic machine instance;

[0117] The obtaining of the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes:

[0118] Obtain information of a target cryptographic machine instance, and call the stateful class management interface using the information of the target cryptographic machine instance; after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located according to the information of the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine;

[0119] Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware ciphertext machine instance after the ciphertext machine interface is called;

[0120] and / or,

[0121] The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0122] Obtain information of the other cryptographic machine instance, and call the stateful class management interface using the information of the other cryptographic machine instance; after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located according to the information of the other cryptographic machine instance, call the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instance;

[0123] and / or,

[0124] The requesting any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes:

[0125] The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

[0126] Through the above classification of service interfaces, the operation and maintenance of the cryptographic machine can be carried out using a stateful management interface, and the user's cryptographic operation requests can be carried out using a stateless management interface, thereby achieving effective management of the cryptographic machine.

[0127] It can be seen from the above embodiments that a secure and unified domain key can be used for cryptographic operations in the cluster, thereby realizing distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management.

[0128] This embodiment also defines the management plane interface of the KMS system to operate and maintain the cryptographic machine and the data plane interface standard for providing services, which has the following two advantages: the cloud cryptographic machine has automated operation and maintenance capabilities, and the data plane is unified as the PKCS11 interface. Based on this standard, the KMS system can access the cloud cryptographic machine that meets this standard at a lower cost to achieve automated operation and maintenance and use. The traditional cloud cryptographic machine initialization steps are automated, and the data plane usage process is unified, so different cryptographic machine manufacturers no longer need to do a lot of repetitive work.

[0129] Corresponding to the embodiments of the aforementioned key data processing method, this specification also provides embodiments of a key data processing device and a computer device to which it is applied.

[0130] The embodiments of the key data processing device of this specification can be applied to computer devices, such as servers or terminal devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, if Figure 3 The figure is a hardware structure diagram of the computer device where the key data processing device of this manual is located, except Figure 3 In addition to the processor 310, memory 330, network interface 320, and non-volatile memory 340 shown, the computer device where the key data processing device 331 is located in the embodiment may also include other hardware according to the actual function of the computer device, which will not be described in detail.

[0131] like Figure 4 As shown, Figure 4 This is a block diagram of a key data processing device according to an exemplary embodiment of the present specification, wherein the device is applied to a server, and the server is used to manage a cryptographic machine cluster, wherein the cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the device includes:

[0132] The acquisition module 41 is used to: after determining the target cryptographic machine instance in the cryptographic machine cluster, acquire the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates the domain key;

[0133] The synchronization module 42 is used to synchronize the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key held by themselves to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0134] The request operation module 43 is used to: in response to receiving a cryptographic operation request from the initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request uses the domain key it holds to process the cryptographic operation request.

[0135] In some examples, the acquisition module 41 is further used to:

[0136] After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining the cryptographic machine instance created for the first time as a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance;

[0137] The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0138] After the cryptographic machine cluster creates other cryptographic machine instances, the device key ciphertext and the domain key ciphertext are synchronized to the other cryptographic machine instances.

[0139] In some examples, the cryptographic operation request includes a user key creation request, and the request operation module 43 is further used to:

[0140] Sending the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtaining the user key ciphertext created by the cryptographic machine instance that receives the user key creation request using the domain key held by itself;

[0141] The identifier of the initiator and the user key ciphertext are stored in a database.

[0142] In some examples, the cryptographic operation request includes a user key use request, and the request operation module 43 is further used to:

[0143] Querying a user key ciphertext corresponding to the identifier of the initiator from a database;

[0144] Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster;

[0145] Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

[0146] In some examples, the apparatus further includes an updating module configured to:

[0147] After the set period arrives, determine the first cryptographic machine instance in the cryptographic machine cluster, obtain the domain key ciphertext updated by the first cryptographic machine instance, the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key;

[0148] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already have.

[0149] In some examples, the update module is further used to:

[0150] Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster;

[0151] After obtaining the updated ciphertexts of each user key returned by the one or more cryptographic machine instances, the ciphertexts are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts with the domain keys already held by the one or more cryptographic machine instances themselves to obtain the user key, and then encrypting the user key with the updated domain key.

[0152] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0153] The service end includes at least one service node, the device is applied in the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0154] In some examples, the service interface includes: a stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information of the called cryptographic machine instance; the calling parameters of the stateless class management interface do not include information of the called cryptographic machine instance;

[0155] The acquisition module 41 is further used for:

[0156] Obtain information of a target cryptographic machine instance, and call the stateful class management interface using the information of the target cryptographic machine instance; after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located according to the information of the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine;

[0157] Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware ciphertext machine instance after the ciphertext machine interface is called;

[0158] and / or,

[0159] The acquisition module 41 is further used for:

[0160] Obtain information of the other cryptographic machine instance, and call the stateful class management interface using the information of the other cryptographic machine instance; after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located according to the information of the other cryptographic machine instance, call the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instance;

[0161] and / or,

[0162] The request operation module is further used for:

[0163] The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

[0164] The implementation process of the functions and effects of each module in the above-mentioned key data processing device is specifically described in the implementation process of the corresponding steps in the above-mentioned key data processing method, which will not be repeated here.

[0165] Correspondingly, an embodiment of the present specification also provides a computer program product, including a computer program, which implements the steps of the aforementioned key data processing method embodiment when executed by a processor.

[0166] Correspondingly, an embodiment of the present specification also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of an embodiment of a method for processing key data when executing the program.

[0167] Correspondingly, an embodiment of the present specification also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the embodiment of the method for processing key data are implemented.

[0168] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

[0169] The above embodiments can be applied to one or more computer devices, where the computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. The hardware of the computer device includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0170] The computer device may be any electronic product that can perform human-computer interaction with a user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television (IPTV), a smart wearable device, etc.

[0171] The computer device may also include a network device and / or a user device, wherein the network device includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud consisting of a large number of hosts or network servers based on cloud computing.

[0172] The network where the computer device is located includes but is not limited to the Internet, a wide area network, a metropolitan area network, a local area network, a virtual private network (VPN), etc.

[0173] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0174] The step division of the above methods is only for clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the protection scope of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the protection scope of this application.

[0175] The description of "specific examples" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0176] Those skilled in the art will readily appreciate other embodiments of the specification after considering the specification and practicing the invention claimed herein. The specification is intended to cover any variations, uses or adaptations of the specification that follow the general principles of the specification and include common knowledge or customary techniques in the art that are not claimed in the specification. The specification and examples are to be considered exemplary only, and the true scope and spirit of the specification are indicated by the following claims.

[0177] It should be understood that the present description is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0178] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for processing key data, the method being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method comprises: After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates the domain key; Synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key they hold to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; In response to receiving a cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

2. The method according to claim 1, wherein after determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance comprises: After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining the cryptographic machine instance created for the first time as a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance; The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes: After the cryptographic machine cluster creates other cryptographic machine instances, the device key ciphertext and the domain key ciphertext are synchronized to the other cryptographic machine instances.

3. According to the method of claim 1, the cryptographic operation request includes a user key creation request, and the sending of the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance receiving the cryptographic operation request processes the cryptographic operation request using the domain key held by itself, comprises: Sending the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtaining the user key ciphertext created by the cryptographic machine instance that receives the user key creation request using the domain key held by itself; The identifier of the initiator and the ciphertext of the user key are stored in a database.

4. The method according to claim 3, wherein the cryptographic operation request comprises a user key use request, the user key use request carries user data, and the step of sending the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance receiving the cryptographic operation request processes the cryptographic operation request using the domain key held by itself, comprises: Querying a user key ciphertext corresponding to the identifier of the initiator from a database; Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster; Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

5. The method according to claim 4, further comprising: After the set period arrives, determine the first cryptographic machine instance in the cryptographic machine cluster, and obtain the domain key ciphertext updated by the first cryptographic machine instance; wherein the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key; The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already have.

6. The method according to claim 5, after synchronizing the updated domain key ciphertext to other cryptographic machine instances, the method further comprises: Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster; After obtaining the updated ciphertexts of each user key returned by the one or more cryptographic machine instances, the ciphertexts are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts with the domain keys already held by the one or more cryptographic machine instances themselves to obtain the user key, and then encrypting the user key with the updated domain key.

7. The method according to any one of claims 1 to 6, wherein the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; The service end includes at least one service node, the method is applied in the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

8. The method according to claim 7, wherein the service interface comprises: A stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information of the called cryptographic machine instance; The calling parameters of the stateless class management interface do not include the information of the called cryptographic machine instance; The obtaining of the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes: Obtain information of a target cryptographic machine instance, and call the stateful class management interface using the information of the target cryptographic machine instance; after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located according to the information of the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine; Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware ciphertext machine instance after the ciphertext machine interface is called; and / or, The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes: Obtain information of the other cryptographic machine instance, and call the stateful class management interface using the information of the other cryptographic machine instance; after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located according to the information of the other cryptographic machine instance, call the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instance; and / or, The requesting any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes: The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

9. A cryptographic service management system, the cryptographic service management system is used to manage a cryptographic machine cluster, the cryptographic machine cluster includes at least one hardware cryptographic machine, the hardware cryptographic machine is used to run at least one cryptographic machine instance, the hardware cryptographic machine provides a cryptographic machine interface for the management system to call, the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; each cryptographic machine instance has the same domain key; The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine; in, The service interface is used to: after receiving a cryptographic operation request from an initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using a domain key held by itself.

10. A device for processing key data, the device being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the device comprises: an acquisition module, configured to: after determining a target cryptographic machine instance in the cryptographic machine cluster, acquire a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates a device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates a domain key; A synchronization module, used to: synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key they hold to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; The request operation module is used to: in response to receiving a cryptographic operation request from an initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

Images