Key data processing method, device, system, equipment and storage medium

Abstract

The present disclosure provides a processing method of key data, a cryptographic machine cluster comprising hardware cryptographic machines for running at least one cryptographic machine instance; each cryptographic machine instance is configured with the same initial key; obtaining device key ciphertext and domain key ciphertext provided by a target cryptographic machine instance, the device key ciphertext being encrypted by the initial key after creation of a device key, and the domain key ciphertext being encrypted by the device key after creation of a domain key; synchronizing the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; the other cryptographic machine instances are configured to decrypt the synchronized device key ciphertext using the initial key to obtain the device key, and decrypt the synchronized domain key ciphertext to obtain the domain key; in response to receiving a cryptographic operation request from an initiator, sending the cryptographic operation request to any cryptographic machine instance, and processing the cryptographic operation request by the cryptographic machine instance that receives the cryptographic operation request using the domain key held by the cryptographic machine instance.

Description

Technical Field

[0001] This disclosure relates to the field of cloud computing technology, and in particular to methods, apparatus, systems, devices and storage media for processing key data. Background Technology

[0002] Currently, some cloud service providers offer cloud-based encryption services that use certified hardware cryptographic machines as the underlying layer of the service. They create cryptographic machine instances through virtualization technology for users to use, which helps users meet regulatory compliance requirements for data security and protect data privacy in cloud services.

[0003] In cloud computing scenarios, the demands for high availability and scalability increase the design complexity of cloud-based encryption services. For example, cloud-based encryption services often require the configuration of multiple cryptographic machine instances, enabling the arbitrary scheduling of these instances to provide cryptographic computation services in response to user requests. This necessitates that each cryptographic machine instance possess a unified key. Therefore, meeting the high availability and scalability requirements of cloud computing scenarios, along with ensuring reliable key management, becomes a pressing technical challenge. Summary of the Invention

[0004] To overcome the problems existing in related technologies, this disclosure provides a method, apparatus, system, device and storage medium for processing key data.

[0005] According to a first aspect of the embodiments of this specification, a method for processing key data is provided, the method being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster including at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key conforming to a preset key rule for the running cryptographic machine instance; the method includes:

[0006] After identifying the target cryptographic machine instance in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates the domain key.

[0007] The device key ciphertext and domain key ciphertext are synchronized to other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0008] In response to receiving a cryptographic operation request from the initiating end, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using its own domain key.

[0009] According to a second aspect of the embodiments of this specification, a cryptographic service management system is provided. The cryptographic service management system is used to manage a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine. The hardware cryptographic machine is used to run at least one cryptographic machine instance. The hardware cryptographic machine provides a cryptographic machine interface for the management system to call. The cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard. Each cryptographic machine instance has the same domain key.

[0010] The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface;

[0011] The service interface is used to: upon receiving a cryptographic operation request from the initiating end, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using its own domain key.

[0012] According to a third aspect of the embodiments of this specification, a key data processing apparatus is provided. The apparatus is applied to a server, which manages a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, which runs at least one cryptographic machine instance. Each hardware cryptographic machine configures an initial key conforming to a preset key rule for the running cryptographic machine instance. The apparatus includes:

[0013] The acquisition module is used to: after determining the target cryptographic machine instance in the cryptographic machine cluster, acquire the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by the target cryptographic machine instance using the initialization key after creating the device key, and the domain key ciphertext is encrypted by the target cryptographic machine instance using the device key after creating the domain key;

[0014] The synchronization module is used to: synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0015] The request operation module is configured to: in response to receiving a cryptographic operation request from the initiating end, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and have the cryptographic machine instance that receives the cryptographic operation request process the cryptographic operation request using its own domain key.

[0016] According to a fourth aspect of the embodiments of this specification, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method embodiments described in the first aspect above.

[0017] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method embodiments of the first aspect.

[0018] The technical solutions provided in the embodiments of this specification may include the following beneficial effects:

[0019] In this embodiment, after determining the target cryptographic machine instance in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates the domain key. The device key ciphertext and domain key ciphertext are then synchronized to the other cryptographic machine instances. Each hardware cryptographic machine in the cryptographic machine cluster is configured with an initial key conforming to preset key rules for its running cryptographic machine instance. Thus, the initial key is used to protect the device key, and the device key is used to protect the domain key, achieving dual protection of the keys. A secure and unified domain key can be used for cryptographic operations in the cluster, thereby achieving distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements of cloud computing scenarios, as well as the reliability of key management.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this specification and, together with the specification, serve to explain the principles of this disclosure.

[0022] Figure 1A and Figure 1B These are schematic diagrams illustrating a key data processing scenario according to an exemplary embodiment of this specification.

[0023] Figure 2This is a flowchart illustrating a key data processing method according to an exemplary embodiment of this specification.

[0024] Figure 3 This is a hardware structure diagram of a computer device containing a key data processing apparatus, as illustrated in this specification according to an exemplary embodiment.

[0025] Figure 4 This is a block diagram illustrating a key data processing apparatus according to an exemplary embodiment of this specification. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0027] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0028] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0029] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points shall be provided for users to choose to authorize or refuse.

[0030] Cloud HSM (Cloud Data Encryption Service) uses certified hardware cryptographic machines as its underlying layer. Through virtualization technology, it creates cryptographic machine instances for users to utilize, helping them meet regulatory compliance requirements for data security and protecting data privacy in cloud services. With Cloud HSM, users can securely and reliably manage keys and use various encryption algorithms to reliably encrypt and decrypt data.

[0031] A hardware security module (HSM) is a hardware device that can provide users with functions such as key management or cryptographic operations, either independently or in conjunction with the hardware security module.

[0032] Cloud HSM refers to a cloud-based encryption solution that uses a tested and certified hardware cryptographic machine as the underlying service layer. Through virtualization technology, it helps customers meet regulatory compliance requirements for data security and protect the privacy of data in cloud services.

[0033] By adopting a cloud cryptographic machine solution, multiple cryptographic machine instances (also known as cloud cryptographic machine instances, etc.) can be created in a cluster. A cryptographic machine instance refers to a resource virtualized using the hardware encryption module of a cryptographic machine. Cryptographic machine instances have the same compliance as hardware encryption modules, can implement all functions of encryption services, and have the ability to perform encryption and decryption operations on data.

[0034] Key Management Service (KMS): A one-stop key management and data encryption service platform that provides simple, reliable, secure, and compliant data encryption protection capabilities. Specifically, KMS typically provides a system or service for key hosting and management, and offers cryptographic computation capabilities for the hosted keys. Ensuring the security and compliance of encryption keys is a core capability of KMS. National and industry regulations stipulate corresponding laws and standards requiring the use of hardware cryptographic machines that meet security level requirements for key protection and storage.

[0035] like Figure 1A The diagram shown is a schematic representation of a key data processing scenario according to an exemplary embodiment of this specification. Figure 1A It includes a cryptographic machine cluster, a KMS system, and an initiating end; among them, the server that manages the cryptographic machine cluster takes the KMS system as an example. The cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance. Figure 1ATaking hardware cryptographic machines 1 to 3 as examples, each hardware cryptographic machine runs two instances. The KMS system is used to manage the cryptographic machine cluster; the initiating end can use the cryptographic operation functions of the cryptographic machine cluster through the KMS system. Figure 1A The following are three cloud product examples.

[0036] After a cryptographic machine instance is created by the hardware cryptographic machine, it needs to be initialized before it can provide cryptographic operations. In some related technologies, hardware cryptographic machine manufacturers provide management tools, which require manual installation on the machine. The hardware cryptographic machine is then connected through the management tool, and the instance is manually initialized, keys are synchronized, and server-side authentication is configured. All these operations are manual, complex, and error-prone, making them unsuitable for large-scale deployments. In these cases, synchronization and other processes are performed by the hardware cryptographic machine itself, making it dependent on the hardware cryptographic machine manufacturer.

[0037] In public cloud scenarios, hardware cryptographic machines are configured by the cloud service provider, and users do not have a specific need for hardware cryptographic machine manufacturers. However, in private or hybrid cloud scenarios, some users specify particular hardware cryptographic machine manufacturers. Therefore, the KMS system, as a management platform, needs to be able to connect to hardware cryptographic machines from different manufacturers. However, the interfaces of hardware cryptographic machines from different manufacturers are inconsistent, and the management and usage methods also differ slightly. This results in high costs for the server-side to adapt to new cloud cryptographic machine manufacturers, and stability is difficult to guarantee. Each time a cryptographic machine manufacturer is connected, the cryptographic operation interfaces from the operations and maintenance side to the data plane must be re-adapted.

[0038] Therefore, it is necessary to improve the server-side to support the access of cloud cryptographic machines from multiple vendors, and to automate the operation and maintenance and use of cloud cryptographic machines from different vendors.

[0039] like Figure 1B The diagram shown is a schematic diagram of another cryptographic service scenario according to an exemplary embodiment of this specification. The hardware cryptographic machines in the diagram are hardware cryptographic machines 1 to 3 as examples, and each hardware cryptographic machine is assumed to run two cryptographic machine instances. In actual applications, the number of hardware cryptographic machines and the number of cryptographic machine instances running in each hardware cryptographic machine can be flexibly configured as needed, and this embodiment does not limit this.

[0040] Among them, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard.

[0041] The key mentioned in this embodiment includes information that can be used to encrypt and decrypt data. The type of key can include various types, such as symmetric keys, asymmetric keys, hybrid keys, one-way hash functions, or digital signatures, etc., and this embodiment does not limit this type.

[0042] The server in this embodiment can run on a computer device, which includes, but is not limited to, a single server, a server group consisting of multiple servers, or a cloud based on cloud computing consisting of a large number of hosts.

[0043] The diagram illustrates a KMS system as an example of a server-side application, providing an interface service. This service includes one or more service nodes, which can be programs running on computing instances, used to access the interface service. Specifically, each service node is configured with one or more service interfaces, which support the same interface standard as the cryptographic machine interface. The service nodes communicate with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through these service interfaces.

[0044] In this embodiment, each cryptographic machine instance has the same domain key; the service interface is used to: upon receiving a cryptographic operation request from the initiating end, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein, the cryptographic machine instance is used to process the cryptographic operation request using its own domain key.

[0045] Optionally, distributed scheduling can be implemented across multiple service nodes, enabling distributed processing on the server side. Different service interfaces are used to initiate different operation requests to the cipher machine instance; for example, each service interface can initiate an atomic operation to the hardware cipher machine / cipher machine instance. Therefore, the one or more service interfaces configured in each service node can be understood as the deployment of an SDK (Software Development Kit) layer, through which the cipher machine's interfaces are called. In this way, through interface encapsulation, the differences in cipher machine interfaces from different vendors can be shielded without modifying the upper-layer service code.

[0046] In practical applications, the interface standard can be configured as needed, for example, based on the standards supported by the various cryptographic device manufacturers that need to be connected. For example, for cryptographic operations, the interface standard could include PKCS#11 (Public Key Cryptography Standards#11). The PKCS#11 standard defines a class of interfaces that allow software applications to communicate with various cryptographic devices and perform cryptographic services such as secure key management, digital signatures, and encryption and decryption operations.

[0047] In this way, the cryptographic machine interfaces of each hardware cryptographic machine in the cryptographic machine cluster support the same interface standard, and the service interface of the KMS system also supports the standard. The server can access hardware cryptographic machines from different manufacturers and call the cryptographic machine interface through the service interface to perform operation and maintenance on the cryptographic machine instance or use the cryptographic operation service provided by the cryptographic machine instance.

[0048] For example, the server can run one or more tasks, which can execute a processing flow. During execution, this flow can call one or more service interfaces. The called service interfaces then generate corresponding call requests to the cryptographic machine interface, thereby automatically completing the maintenance task. Alternatively, the server can obtain the cryptographic operation request from the initiating end, parse the request, and call the corresponding service interface. The called service interface then generates a call request to the cryptographic machine interface, enabling the called cryptographic machine instance to perform the cryptographic operation.

[0049] In some cases, for cryptographic machines from any manufacturer, the use of the cryptographic machine can be uniformly divided into two stages: the first stage is key initialization, and the second stage is the KMS system providing services to the outside world, creating keys for users and using the keys to perform encryption and decryption operations.

[0050] Optionally, the key initialization process in the first phase requires operation on a specific cryptographic machine instance, such as initializing a specific cryptographic machine instance and using a specific cryptographic machine instance for key initialization; while the server can use any cryptographic machine instance to provide cryptographic operation services when providing services to the outside world, without needing to specify a specific cryptographic machine instance.

[0051] Each service node has an SDK layer deployed, which divides all operations of the cloud cryptographic machine into two types: stateful management interfaces and stateless management interfaces. The call parameters of the stateful management interfaces include information about the cryptographic machine instance being called, while the call parameters of the stateless management interfaces do not include information about the cryptographic machine instance being called.

[0052] Optionally, stateful management interfaces may include device management and domain key management, while stateless management interfaces may include session key management and cryptographic operations.

[0053] As an example, the service interface of the device management type may include any of the following: a service interface for obtaining cryptographic machine information, a service interface for managing cryptographic machine users, a service interface for initializing cryptographic machine, an interface for managing cryptographic machine certificates, or a service interface for managing cryptographic machine device keys.

[0054] The service interface for domain key management can include any of the following: a service interface for creating domain keys; or a service interface for exporting / importing domain keys.

[0055] Service interfaces for session key management may include service interfaces for creating session keys, and / or service interfaces for wrapping / unwrapping session keys.

[0056] The service interface for cryptographic operations may include any of the following: a service interface for symmetric encryption and decryption, a service interface for generating random numbers, or a service interface for asymmetric encryption and decryption; wherein, the service interface for asymmetric encryption and decryption may include a service interface for encryption / decryption, and / or a service interface for signing / verifying signatures.

[0057] Among them, the stateful management interface can be used to automate the operation and maintenance of the cryptographic machine, while the stateless management interface can be used to handle cryptographic operation requests from the initiating end to the cryptographic machine instance.

[0058] As an example, one or more tasks can be configured on the server side. Each task can be a program used to execute a specific process. For instance, a task could be an initialization task, including a cryptographic machine instance initialization task, a key initialization task, a key synchronization task, and so on. When a cryptographic machine instance is created in the cluster, the KMS system can initiate the initialization task for that instance. For example, taking the creation of a target cryptographic machine instance as an example, the KMS system can obtain information about the target instance and initiate the initialization task based on that information. This task can execute the following process during its execution:

[0059] After logging into the target cryptographic machine instance using the factory default authentication data configured on the hardware cryptographic machine instance, change the password of the target cryptographic machine instance and log in again, and obtain the API token (Application Programming Interface token, a token used for application authentication and authorization) returned by the target cryptographic machine instance.

[0060] After obtaining the API token, you can call the service interface used for cipher machine initialization, which will then call the cipher machine interface to initialize the target cipher machine instance.

[0061] Assuming the target cryptographic machine instance is the first cryptographic machine instance created in the cryptographic machine cluster, a key initialization task will also be initiated. During the execution of this key initialization task, the following process can be performed:

[0062] Call the service interface for cryptographic machine device key management, so that the interface calls the cryptographic machine interface, requests the target cryptographic machine instance to create a device key and then returns the device key ciphertext, where the device key ciphertext is encrypted by the target cryptographic machine using the initial key;

[0063] Call the service interface used to create a domain key, so that the interface calls the cryptographic machine interface and requests the target cryptographic machine instance to create a domain key.

[0064] Call the service interface used to export / import domain keys, so that the interface calls the cryptographic machine interface, requests the target cryptographic machine instance to return the domain key ciphertext, and then returns the domain key ciphertext. The domain key ciphertext is encrypted by the target cryptographic machine instance using the device key after creating the domain key.

[0065] In this way, the server can obtain the device key ciphertext and the domain key ciphertext.

[0066] Subsequently, other cryptographic machine instances will also be created. The server can similarly initiate a cryptographic machine instance initialization task, and the execution flow is shown in the above embodiment. Since subsequent cryptographic machine instances require key synchronization, a key synchronization task can also be initiated. This key synchronization task can execute the following process during its execution:

[0067] Call the service interface used for encryption machine device key management, so that the interface calls the cryptographic machine interface to request the transmission of the device key ciphertext to the other cryptographic machine instance;

[0068] Call the service interface for exporting / importing domain keys so that the interface calls the cryptographic machine interface to request the transmission of the domain key ciphertext to the other cryptographic machine instance.

[0069] In this way, the server can synchronize the device key ciphertext and domain key ciphertext to other cryptographic machine instances. Other cryptographic machine instances use their own initial key to decrypt the synchronized device key ciphertext to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key. Thus, all cryptographic machine instances in the cluster hold the same device key and domain key.

[0070] In some cases, device keys and / or domain keys can also be updated at set intervals. For example, the server can automatically trigger updates using set rules, which can be configured as needed, such as a set time period.

[0071] When an update is triggered, one of the cryptographic machine instances in the cryptographic machine cluster is selected to create a new device key and domain key. Thus, an update task can be created, which can use the selected cryptographic machine instance as the target cryptographic machine instance to start the aforementioned key initialization task. The execution process of this task is as described above. In this way, the cryptographic machine instance generates a new device key and / or domain key and returns the device key ciphertext and / or domain key ciphertext to the KMS system.

[0072] The server can synchronize the new device key ciphertext and / or domain key ciphertext to other cryptographic machine instances in the cluster, as described in the above embodiment. After synchronization, other cryptographic machine instances can use the new device key ciphertext and / or domain key ciphertext to obtain new device keys and / or domain keys, replacing the old device keys and / or domain keys they already possess.

[0073] In the second phase, the server provides services to the outside world through the service interfaces of each service node, creating keys for users and performing key operations using those keys. For example, the KMS system includes a gateway, which can be configured with one or more API servers facing the initiator. Optionally, this API server can be a program running in a computing instance, used to handle cryptographic operation requests from the initiator. Cryptographic operation requests can be of various types, such as user key creation, encryption / decryption, signing, or signature verification.

[0074] For example, when a gateway receives a cryptographic operation request from the initiator, it can request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein, the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0075] After receiving a cryptographic operation request, an API Server in the gateway dispatches it to any interface service node. The interface service node then runs the cryptographic operation task. This task can call a service interface, which can be a stateless service interface. The called service interface then sends a request to the cryptographic interface of any hardware cryptographic machine, requesting the cryptographic machine instance to perform cryptographic operations.

[0076] As an example, a cryptographic operation request includes a user key creation request. This request can invoke a service interface for creating session keys. This service interface then calls the cryptographic machine interface of any hardware cryptographic machine in the cluster to request the creation of a user key from any cryptographic machine instance. After receiving the ciphertext of the user key returned by the cryptographic machine instance, the identifier of the initiating end and the ciphertext of the user key are stored in the database. The ciphertext of the user key is encrypted by the requested cryptographic machine instance using its own domain key.

[0077] As an example, a cryptographic operation request includes a user key creation request, and may also include a user key usage request, which carries user data. The interface service node can obtain this user key creation request, query the database for the ciphertext of the user key corresponding to the initiator's identifier, and use the user data and the ciphertext to call the service interface used for session key wrapping / unwrapping. This interface can call the cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster, thereby requesting any cryptographic machine instance to process the request. The requested cryptographic machine instance returns the cryptographic operation result, which is then returned to the initiator by the KMS system. Specifically, the cryptographic operation result is obtained by the requested cryptographic machine instance using its own domain key to decrypt the ciphertext of the user key to obtain the user key, and then using the decrypted user key to perform cryptographic operations on the user data.

[0078] As can be seen from the above embodiments, the service interface implemented in the KMS system in this specification allows access to hardware cryptographic machines from different manufacturers through interaction between the service interface domain hardware cryptographic machine and cryptographic machine instances. Different manufacturers have different cryptographic machines, and the KMS system helps users shield the differences between the underlying hardware cryptographic machines from different manufacturers.

[0079] In the embodiments described in this specification, the high availability and scalability requirements in cloud computing scenarios lead to high design complexity for cloud-based encryption services. For example, cloud-based encryption services may require configuring multiple cryptographic machine instances, allowing for arbitrary scheduling of these instances to provide cryptographic computation services in response to user requests. This necessitates that each cryptographic machine instance hold a unified key. Therefore, how to meet the high availability and scalability requirements, as well as the reliability of key management, in cloud computing scenarios is a key challenge. Therefore, as... Figure 2 The diagram illustrates a key data processing method according to an exemplary embodiment. This method can be applied to a server-side application, which manages a cryptographic machine cluster. The cluster includes at least one hardware cryptographic machine, which runs at least one cryptographic machine instance. Each hardware cryptographic machine configures an initial key conforming to a preset key rule for each running cryptographic machine instance. The method may include the following steps:

[0080] Step 202: After determining the target cryptographic machine instance in the cryptographic machine cluster, obtain the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates the domain key.

[0081] Step 204: Synchronize the device key ciphertext and domain key ciphertext to the other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key.

[0082] Step 206: In response to receiving the cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using its own domain key.

[0083] In practical applications, the key data processing method of this embodiment can be applied to the server side, for example... Figure 1A or Figure 1B In scenarios such as KMS systems, for example, a KMS system can be used to access a hardware cryptographic machine from one vendor, and the KMS system can be adapted to the cryptographic machine interface of a vendor's hardware cryptographic machine. Alternatively, as in the aforementioned embodiments, it can be used to access hardware cryptographic machines from multiple vendors, configuring service nodes to implement one or more service interfaces, and interacting with the cryptographic machine interface of the hardware cryptographic machine through these service interfaces.

[0084] The initial key can be a key that conforms to preset key rules, such as the factory key configured for the hardware cryptographic machine instance. This factory key is typically stored in the trusted execution environment of the hardware cryptographic machine and is used to create and protect the keys required by the hardware cryptographic machine during subsequent operation. Each hardware cryptographic machine in the cryptographic machine cluster is configured with the same initial key for its running instances, and this initial key is stored internally within the cryptographic machine instance. The cryptographic machine cluster can consist of hardware cryptographic machines from the same manufacturer, thus ensuring that multiple instances running within multiple hardware cryptographic machines use a unified initial key.

[0085] An initial key is used to create and protect device keys, while the device keys are used to protect domain keys. Considering the high availability requirements of cloud computing scenarios, cryptographic machine instances may be dynamically created and shut down. The hardware cryptographic machine used by user A can be subsequently made available to other users through initialization. Therefore, different device keys are generated after the initial key is used to initialize the cryptographic machine instance. The device key of the cryptographic machine instance is created after each initialization, meaning it is different after each initialization. This ensures that different users can use different device keys. Then, the device keys are used to create and protect domain keys, achieving dual key protection and unifying the domain keys under a single user. For example, the initial key can be used to create device keys, and the device keys are used to create domain keys. The domain keys can be used for verification using the device keys. In this way, a secure and unified domain key can be used for cryptographic operations in the cluster, enabling distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements of cloud computing scenarios, as well as the reliability of key management.

[0086] In step 202, the device key and domain key can be created by selecting a target cryptographic machine instance from the cryptographic machine cluster. This step can be triggered in various ways.

[0087] After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance includes:

[0088] After the cryptographic machine instance is created for the first time in the cryptographic machine cluster, the newly created cryptographic machine instance is determined as the target cryptographic machine instance, and the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained.

[0089] The step of synchronizing the device key ciphertext and domain key ciphertext to the other cryptographic machine instances includes:

[0090] After creating other cryptographic machine instances in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext are synchronized to the other cryptographic machine instances.

[0091] In this way, key initialization can be performed after the first cryptographic machine instance in the cluster starts. Subsequent cryptographic machine instances can synchronously obtain the existing device key ciphertext and domain key ciphertext without needing to create them again.

[0092] Therefore, the first cryptographic machine instance started in the cluster can be used to create device keys and domain keys, while subsequent cryptographic machine instances do not need to create them. The KMS system ensures the consistency of device keys and domain keys in the cluster through synchronization.

[0093] Optionally, in other examples, after the set update cycle arrives, the device key ciphertext and domain key ciphertext provided by the target cipher machine instance can be obtained after the target cipher machine instance is identified in the cipher machine cluster.

[0094] In other examples, keys can be updated as needed. For instance, after a set update cycle is reached, once a target cryptographic machine instance is identified in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by that instance are obtained. The KMS system can then synchronize the updated device key ciphertext and domain key ciphertext to other cryptographic machine instances in the cluster. This allows for periodic key updates, effectively preventing cryptographic attacks and further enhancing security.

[0095] In other examples, only the domain key can be updated. For instance, after a set update cycle is reached, the target cryptographic machine instance is identified in the cryptographic machine cluster, and the ciphertext of the domain key provided by the target cryptographic machine instance is obtained. The KMS system can then synchronize the updated domain key ciphertext to other cryptographic machine instances in the cluster.

[0096] For example, the method may further include:

[0097] After the set period is reached, a first cryptographic machine instance is determined in the cryptographic machine cluster, and the updated domain key ciphertext of the first cryptographic machine instance is obtained. The first cryptographic machine instance is used to create a new domain key to replace the domain key it already holds. The updated domain key ciphertext is obtained by encrypting the new domain key using the device key.

[0098] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that the other cryptographic machine instances can use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace their own existing domain key.

[0099] In this embodiment, the domain key can be updated in the above manner when the set period arrives, which can effectively prevent password attacks and ensure the security of users' password operations.

[0100] During the external service process of a KMS system, it may encounter a large number of cryptographic operation requests from initiating parties. These requests include the creation of user keys, which are information to be protected. One approach is to store these user keys in a hardware cryptographic machine within the cluster. However, this method consumes significant storage resources of the hardware cryptographic machine. Therefore, in some examples, cryptographic operation requests include user key creation requests. Sending the cryptographic operation request to any cryptographic machine instance in the cluster, and having the receiving cryptographic machine instance process the request using its own domain key, can include:

[0101] Send the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtain the user key ciphertext created by the cryptographic machine instance that received the user key creation request using its own domain key;

[0102] The identifier of the initiating end and the encrypted user key are stored in the database.

[0103] In this embodiment, the cryptographic machine instance protects the user key using the domain key before providing the encrypted user key to the server. Thus, the hardware cryptographic machine does not store the domain key, saving its storage resources. The domain key protection within the cryptographic machine instance ensures the security of the user key. The server then stores the initiator's identifier and the encrypted user key in its database for subsequent use by the initiator.

[0104] In some examples, when the domain key is updated, after the updated domain key ciphertext is synchronized to other cryptographic machine instances, the method may further include:

[0105] Obtain the ciphertext of each user key stored in the database, and provide the ciphertext of each user key to one or more cryptographic machine instances in the cryptographic machine cluster;

[0106] After obtaining the updated ciphertext of each user key returned by the one or more cryptographic machine instances, it is stored in the database; wherein, the updated ciphertext of each user key is obtained by decrypting the ciphertext of the user key with the domain key already held by the one or more cryptographic machine instances, and then encrypting the user key with the updated domain key.

[0107] This involves selecting one or more cryptographic machine instances within the cryptographic machine cluster to update the ciphertext of each user key stored in the database. For example, a single cryptographic machine instance can perform the update of all user key ciphertexts, or a distributed process can be used, utilizing multiple cryptographic machine instances to perform the update, with each instance updating one or more keys. This ensures the security of user keys.

[0108] In some examples, the cryptographic operation request includes a user key usage request carrying user data. Sending the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and having the receiving cryptographic machine instance process the cryptographic operation request using its own domain key, includes:

[0109] Retrieve the ciphertext of the user key corresponding to the identifier of the initiating party from the database;

[0110] Send the ciphertext of the user key and the user key usage request to any cryptographic machine instance in the cryptographic machine cluster;

[0111] Obtain the cryptographic operation result and return it to the initiating end; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that received the user key usage request decrypting the ciphertext of the user key using its own domain key to obtain the user key, and then using the decrypted user key to perform cryptographic operations on the user data.

[0112] In this embodiment, since the cryptographic machine does not store the user key, after receiving a user key usage request, KMS can query the database for the ciphertext of the user key corresponding to the initiator's identifier. Then, using the user data and the ciphertext of the user key, it requests any cryptographic machine instance in the cryptographic machine cluster to process the user key usage request. Therefore, the requested cryptographic machine instance can perform cryptographic operations and return the results. In this way, the user's key operation needs are met without consuming the storage resources of the hardware cryptographic machine.

[0113] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0114] The server includes at least one service node, the method is applied to the service node, the service interface configured on the service node supports the interface standard, and the service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface.

[0115] In this embodiment, the server can be as follows: Figure 1B In the described embodiment, by configuring a service interface in the service node, the service interface supports the same interface standard as the cryptographic machine interface, thereby achieving the effect of masking the differences in interfaces between different hardware cryptographic machines. For details, please refer to the foregoing embodiments, which will not be repeated here.

[0116] In some examples, the service interface includes: a stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information about the cipher machine instance being called; the calling parameters of the stateless class management interface do not include information about the cipher machine instance being called.

[0117] The step of obtaining the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance includes:

[0118] Obtain information about the target cryptographic machine instance, use the information about the target cryptographic machine instance to call the stateful class management interface, and after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located based on the information about the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine;

[0119] After the target hardware cryptographic machine's interface is invoked, obtain the device key ciphertext and domain key ciphertext obtained and returned from the target cryptographic machine instance;

[0120] And / or,

[0121] The step of synchronizing the device key ciphertext and domain key ciphertext to the other cryptographic machine instances includes:

[0122] The system obtains information about the other cryptographic machine instances, uses this information to call the stateful class management interface, and then, based on the information about the other cryptographic machine instances, the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instances are located. Finally, it calls the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instances.

[0123] And / or,

[0124] The request to any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes:

[0125] The stateless class management interface calls the cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster, so that the called hardware cryptographic machine can schedule any cryptographic machine instance to process the cryptographic operation request.

[0126] Based on the above classification of service interfaces, the operation and maintenance of the cryptographic machine can be carried out using stateful management interfaces, while user cryptographic operation requests can be handled using stateless management interfaces, thereby achieving effective management of the cryptographic machine.

[0127] As can be seen from the above embodiments, a secure and unified domain key can be used for cryptographic operations in the cluster, thereby achieving distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements of cloud computing scenarios, as well as the reliability of key management.

[0128] This embodiment also defines the management plane interface and data plane interface standard for the KMS system's operation and maintenance of cryptographic machines, which has the following two advantages: the cloud cryptographic machine has automated operation and maintenance capabilities, and the data plane is unified with the PKCS11 interface. Based on this standard, the KMS system can connect to cloud cryptographic machines that conform to this standard at a lower cost, realizing automated operation and maintenance and use. The traditional cloud cryptographic machine initialization steps are automated, and the data plane usage process is unified, eliminating the need for extensive repetitive work from different cryptographic machine manufacturers.

[0129] Corresponding to the embodiments of the aforementioned key data processing method, this specification also provides embodiments of a key data processing apparatus and the computer equipment on which it is applied.

[0130] The embodiments of the key data processing device described in this specification can be applied to computer devices, such as servers or terminal devices. The device embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by its processor reading the corresponding computer program instructions from non-volatile memory into memory and executing them. From a hardware perspective, such as... Figure 3 The diagram shown is a hardware structure diagram of a computer device containing the key data processing apparatus described in this specification. (Except for...) Figure 3 In addition to the processor 310, memory 330, network interface 320, and non-volatile memory 340 shown, the computer device where the key data processing device 331 is located in the embodiment may also include other hardware depending on the actual function of the computer device, which will not be described in detail here.

[0131] like Figure 4 As shown, Figure 4 This is a block diagram illustrating a key data processing apparatus according to an exemplary embodiment. The apparatus is applied to a server, which manages a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, which runs at least one cryptographic machine instance. Each hardware cryptographic machine configures an initial key conforming to a preset key rule for the running cryptographic machine instance. The apparatus includes:

[0132] The acquisition module 41 is used to: after determining the target cryptographic machine instance in the cryptographic machine cluster, acquire the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by the target cryptographic machine instance using the initialization key after creating the device key, and the domain key ciphertext is encrypted by the target cryptographic machine instance using the device key after creating the domain key;

[0133] Synchronization module 42 is used to: synchronize the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key;

[0134] The request operation module 43 is configured to: in response to receiving a cryptographic operation request from the initiating end, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and have the cryptographic machine instance that receives the cryptographic operation request process the cryptographic operation request using its own domain key.

[0135] In some examples, the acquisition module 41 is also used for:

[0136] After the cryptographic machine instance is created for the first time in the cryptographic machine cluster, the newly created cryptographic machine instance is determined as the target cryptographic machine instance, and the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained.

[0137] The step of synchronizing the device key ciphertext and domain key ciphertext to the other cryptographic machine instances includes:

[0138] After creating other cryptographic machine instances in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext are synchronized to the other cryptographic machine instances.

[0139] In some examples, the cryptographic operation request includes a user key creation request, and the request operation module 43 is further configured to:

[0140] Send the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtain the user key ciphertext created by the cryptographic machine instance that received the user key creation request using its own domain key;

[0141] The identifier of the initiating end and the encrypted user key are stored in the database.

[0142] In some examples, the cryptographic operation request includes a user key usage request, and the request operation module 43 is further configured to:

[0143] Retrieve the ciphertext of the user key corresponding to the identifier of the initiating party from the database;

[0144] Send the ciphertext of the user key and the user key usage request to any cryptographic machine instance in the cryptographic machine cluster;

[0145] Obtain the cryptographic operation result and return it to the initiating end; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that received the user key usage request decrypting the ciphertext of the user key using its own domain key to obtain the user key, and then using the decrypted user key to perform cryptographic operations on the user data.

[0146] In some examples, the device further includes an update module for:

[0147] After the set period is reached, a first cryptographic machine instance is determined in the cryptographic machine cluster, and the updated domain key ciphertext of the first cryptographic machine instance is obtained. The first cryptographic machine instance is used to create a new domain key to replace the domain key it already holds. The updated domain key ciphertext is obtained by encrypting the new domain key using the device key.

[0148] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that the other cryptographic machine instances can use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace their own existing domain key.

[0149] In some examples, the update module is also used for:

[0150] Obtain the ciphertext of each user key stored in the database, and provide the ciphertext of each user key to one or more cryptographic machine instances in the cryptographic machine cluster;

[0151] After obtaining the updated ciphertext of each user key returned by the one or more cryptographic machine instances, it is stored in the database; wherein, the updated ciphertext of each user key is obtained by decrypting the ciphertext of the user key with the domain key already held by the one or more cryptographic machine instances, and then encrypting the user key with the updated domain key.

[0152] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0153] The server includes at least one service node, the device is applied to the service node, the service interface configured on the service node supports the interface standard, and the service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface.

[0154] In some examples, the service interface includes: a stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information about the cipher machine instance being called; the calling parameters of the stateless class management interface do not include information about the cipher machine instance being called.

[0155] The acquisition module 41 is further configured to:

[0156] Obtain information about the target cryptographic machine instance, use the information about the target cryptographic machine instance to call the stateful class management interface, and after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located based on the information about the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine;

[0157] After the target hardware cryptographic machine's interface is invoked, obtain the device key ciphertext and domain key ciphertext obtained and returned from the target cryptographic machine instance;

[0158] And / or,

[0159] The acquisition module 41 is further configured to:

[0160] The system obtains information about the other cryptographic machine instances, uses this information to call the stateful class management interface, and then, based on the information about the other cryptographic machine instances, the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instances are located. Finally, it calls the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instances.

[0161] And / or,

[0162] The request calculation module is also used for:

[0163] The stateless class management interface calls the cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster, so that the called hardware cryptographic machine can schedule any cryptographic machine instance to process the cryptographic operation request.

[0164] The specific implementation process of the functions and roles of each module in the above-mentioned key data processing device can be found in the implementation process of the corresponding steps in the above-mentioned key data processing method, and will not be repeated here.

[0165] Accordingly, this specification also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the aforementioned key data processing method embodiment.

[0166] Accordingly, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of an embodiment of a key data processing method.

[0167] Accordingly, embodiments of this specification also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of an embodiment of a key data processing method.

[0168] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this specification according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0169] The above embodiments can be applied to one or more computer devices. The computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. The hardware of the computer device includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0170] The computer device can be any electronic product that can interact with the user, such as a personal computer, tablet computer, smartphone, personal digital assistant (PDA), game console, interactive network television (IPTV), smart wearable device, etc.

[0171] The computer equipment may also include network equipment and / or user equipment. The network equipment includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of hosts or network servers.

[0172] The network in which the computer device is located includes, but is not limited to, the Internet, wide area network, metropolitan area network, local area network, and virtual private network (VPN).

[0173] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0174] The steps of the various methods described above are only for clarity. In practice, they can be combined into one step or some steps can be split into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent. Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are also within the scope of protection of this application.

[0175] The terms "specific example" or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with the embodiments or examples, which are included in at least one embodiment or example of this specification. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0176] Other embodiments of this specification will readily occur to those skilled in the art upon consideration of the specification and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this specification are indicated by the following claims.

[0177] It should be understood that this specification is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this specification is limited only by the appended claims.

[0178] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A method for processing key data, the method being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster including at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; each hardware cryptographic machine configuring an initial key conforming to a preset key rule for the running cryptographic machine instance; the cryptographic machine interfaces of different hardware cryptographic machines supporting the same interface standard; the server including service nodes, the service interfaces configured on the service nodes supporting the interface standard; The service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface; the method includes: After identifying the target cryptographic machine instance in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates the domain key. The device key ciphertext and domain key ciphertext are synchronized to other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; In response to the service interface receiving a cryptographic operation request from the initiating end, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using its own domain key.

2. The method according to claim 1, wherein after determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance includes: After the cryptographic machine instance is created for the first time in the cryptographic machine cluster, the newly created cryptographic machine instance is determined as the target cryptographic machine instance, and the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance are obtained. The step of synchronizing the device key ciphertext and domain key ciphertext to the other cryptographic machine instances includes: After creating other cryptographic machine instances in the cryptographic machine cluster, the device key ciphertext and domain key ciphertext are synchronized to the other cryptographic machine instances.

3. The method according to claim 1, wherein the cryptographic operation request includes a user key creation request, and the step of sending the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and having the cryptographic machine instance receiving the cryptographic operation request process the cryptographic operation request using its own domain key, includes: Send the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtain the user key ciphertext created by the cryptographic machine instance that received the user key creation request using its own domain key; The identifier of the initiating end and the encrypted user key are stored in the database.

4. The method according to claim 3, wherein the cryptographic operation request includes a user key usage request, the user key usage request carrying user data, and the step of sending the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and having the cryptographic machine instance receiving the cryptographic operation request process the cryptographic operation request using its own domain key, includes: Retrieve the ciphertext of the user key corresponding to the identifier of the initiating party from the database; Send the ciphertext of the user key and the user key usage request to any cryptographic machine instance in the cryptographic machine cluster; Obtain the cryptographic operation result and return it to the initiating end; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that received the user key usage request decrypting the ciphertext of the user key using its own domain key to obtain the user key, and then using the decrypted user key to perform cryptographic operations on the user data.

5. The method according to claim 4, further comprising: After the set period is reached, a first cryptographic machine instance is determined in the cryptographic machine cluster, and the updated domain key ciphertext of the first cryptographic machine instance is obtained; wherein, the first cryptographic machine instance is used to create a new domain key to replace the domain key already held, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key; The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that the other cryptographic machine instances can use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace their own existing domain key.

6. The method according to claim 5, after the updated domain key ciphertext is synchronized to other cryptographic machine instances, the method further includes: Obtain the ciphertext of each user key stored in the database, and provide the ciphertext of each user key to one or more cryptographic machine instances in the cryptographic machine cluster; After obtaining the updated ciphertext of each user key returned by the one or more cryptographic machine instances, it is stored in the database; wherein, the updated ciphertext of each user key is obtained by decrypting the ciphertext of the user key with the domain key already held by the one or more cryptographic machine instances, and then encrypting the user key with the updated domain key.

7. The method according to any one of claims 1 to 6, wherein the hardware cryptographic machine provides a cryptographic machine interface for the server to call; The method is applied to the service node.

8. The method according to claim 7, wherein the service interface comprises: A stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information about the cryptographic machine instance being called. The call parameters of the stateless class management interface do not include information about the cryptographic machine instance being called; The step of obtaining the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance includes: Obtain information about the target cryptographic machine instance, use the information about the target cryptographic machine instance to call the stateful class management interface, and after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located based on the information about the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine; After the target hardware cryptographic machine's interface is invoked, obtain the device key ciphertext and domain key ciphertext obtained and returned from the target cryptographic machine instance; And / or, The step of synchronizing the device key ciphertext and domain key ciphertext to the other cryptographic machine instances includes: The system obtains information about the other cryptographic machine instances, uses this information to call the stateful class management interface, and then, based on the information about the other cryptographic machine instances, the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instances are located. Finally, it calls the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instances. And / or, The request to any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes: The stateless class management interface calls the cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster, so that the called hardware cryptographic machine can schedule any cryptographic machine instance to process the cryptographic operation request.

9. A cryptographic service management system, the cryptographic service management system being used to manage a cryptographic machine cluster, the cryptographic machine cluster including at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance, the hardware cryptographic machine providing a cryptographic machine interface for the management system to call, the cryptographic machine interfaces of different hardware cryptographic machines supporting the same interface standard; each cryptographic machine instance having the same domain key; in, The device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance in the cryptographic machine cluster are used to synchronize with other cryptographic machine instances. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates the domain key; The other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key. The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface; The service interface is used to: upon receiving a cryptographic operation request from the initiating end, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using its own domain key.

10. A key data processing apparatus, the apparatus being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster including at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key conforming to a preset key rule for the running cryptographic machine instance; the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; the server includes service nodes, the service interfaces configured on the service nodes supporting the interface standard; The service node communicates with the cryptographic machine instance in the hardware cryptographic machine by calling the cryptographic machine interface through the service interface; the device includes: The acquisition module is used to: after determining the target cryptographic machine instance in the cryptographic machine cluster, acquire the device key ciphertext and domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by the target cryptographic machine instance using the initialization key after creating the device key, and the domain key ciphertext is encrypted by the target cryptographic machine instance using the device key after creating the domain key; The synchronization module is used to: synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein, the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using their own initial key to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; The request operation module is configured to: in response to the service interface receiving a cryptographic operation request from the initiating end, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and have the cryptographic machine instance receiving the cryptographic operation request process the cryptographic operation request using its own domain key.

11. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method of any one of claims 1 to 8.

Images