Key management method and device, equipment, storage medium and program product

Abstract

The invention discloses a key management method and device, equipment, a storage medium and a program product, and belongs to the field of communication. The method comprises the following steps: a key management node determines key configuration information of a plurality of target computing nodes, wherein the plurality of target computing nodes are partial or all computing nodes which communicate with each other in computing nodes included in a data center; generating a first key based on the key configuration information; and indicating the first key to the plurality of target computing nodes, so that the plurality of target computing nodes encrypt and decrypt data messages which communicate with one another according to the first key. Wherein the key management node is any one computing node in the plurality of target computing nodes, or any one network device used for realizing mutual communication of the plurality of target computing nodes. Namely, the key management node indicates the key to the plurality of target computing nodes in a one-to-many manner, so that the number of security sessions when the plurality of computing nodes negotiate the key is reduced, and the complexity of a security control surface is reduced.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a key management method, device, equipment, storage medium and program product. Background Art

[0002] To improve communication security, after establishing a secure channel, both ends of the communication need to negotiate an encryption key through a key negotiation protocol, so that the encryption key can be used to encrypt the transmitted data messages during the communication process.

[0003] In related technologies, for a networking scenario with N computing nodes, in order to ensure the communication security of the computing nodes, in the worst case, each computing node needs to establish a secure session with the other N-1 computing nodes to negotiate the encryption key when communicating with the other N-1 computing nodes. In this scenario, the number of secure sessions that the N computing nodes need to establish during the key negotiation phase is N×(N-1) / 2, and the complexity of its security control plane is O(N 2 ).

[0004] However, for a large-scale artificial intelligence (AI) data center with tens of thousands of computing nodes, if key management is performed in the above manner, a large number of security sessions need to be established, resulting in a high complexity of the security management and control surface, a huge consumption of the central processing unit (CPU) resources of each computing node and the memory resources in the network card, and the need to maintain a large number of encryption keys for each computing node. Summary of the invention

[0005] The present application provides a key management method, apparatus, device, storage medium and program product, which can reduce the number of secure sessions when multiple computing nodes negotiate keys and reduce the complexity of the security control plane. The technical solution is as follows:

[0006] In a first aspect, a key management method is provided, which is applied to a key management node in a data center; the method comprises:

[0007] Determine key configuration information of multiple target computing nodes, wherein the multiple target computing nodes are computing nodes belonging to the same communication group in the data center or all computing nodes in the data center; wherein the key management node is any one of the multiple target computing nodes, or is any network device used to enable the multiple target computing nodes to communicate with each other; generate a first key based on the key configuration information; indicate the first key to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages that communicate with each other according to the first key.

[0008] In an embodiment of the present application, for multiple target computing nodes that use the same key for encrypted communication, when negotiating the key, one computing node can be selected from the multiple target computing nodes as a key management node, or any network device used to realize the communication between the multiple target computing nodes can be used as a key management node, and then through the key management node, key negotiation is performed with the multiple target computing nodes respectively to indicate to the multiple target computing nodes the keys for encrypting and decrypting the data messages that communicate with each other. In this key negotiation process, the key management node indicates the key to the multiple target computing nodes in a "one-to-many" manner, and the multiple target computing nodes do not need to negotiate the key separately. Therefore, the number of security sessions when multiple computing nodes negotiate keys is greatly reduced, and the complexity of the security management and control surface is reduced.

[0009] Optionally, the key configuration information includes a security connection associated key CAK and key attribute information, the CAK is used to generate an encryption key, the key attribute information indicates an encryption algorithm and a key length when the encryption key is used to encrypt and decrypt data messages, and a key validity period of the encryption key.

[0010] That is, in the case where the key configuration information includes key attribute information, the key management node may also further limit the encryption algorithm, key length and key validity period corresponding to the key based on the key attribute information when sending the key negotiation message.

[0011] Optionally, indicating the first key to the multiple target computing nodes includes: encrypting the first key to obtain a key ciphertext; generating a key negotiation message, the key negotiation message carrying the key ciphertext; and indicating the key negotiation message to the multiple target computing nodes.

[0012] Since the first key is a key used by multiple target computing nodes to encrypt and decrypt data messages that communicate with each other, to ensure the security of the first key distribution process, the key management node can encrypt the first key and then indicate it to the multiple target computing nodes.

[0013] Optionally, the key agreement message further carries first key attribute information, where the first key attribute information indicates an encryption algorithm and a key length when the first key is used to encrypt and decrypt data messages, and a key validity period of the first key.

[0014] Based on this, after receiving the key negotiation message, the target computing node can encrypt and decrypt the data message communicated with each other based on the encryption algorithm and the first key. At the same time, based on the key validity period, after the first key expires, the key management node is requested to indicate a new key.

[0015] Optionally, the method also includes: receiving a negotiation success message sent by the multiple target computing nodes, the negotiation success message indicating that the target computing nodes have successfully received the first key; in response to the negotiation success message, sending a key synchronization message to the multiple target computing nodes, the key synchronization message indicating that the multiple target computing nodes and the key management node can use the first key to encrypt and decrypt data messages communicated with each other.

[0016] Thus, by receiving the negotiation success message, the key management node can determine whether each target computing node receives and enables the key. By sending the key synchronization message, the key management node and multiple target computing nodes can synchronize the key enabling status, thereby using the same first key for encrypted communication.

[0017] Optionally, the method also includes: if a negotiation success message sent by any of the multiple target computing nodes is not received within the key negotiation duration, generating a second key based on the key configuration information; indicating the second key to the multiple target computing nodes so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other based on the second key.

[0018] That is, if the key management node does not receive the negotiation success message sent by all target computing nodes, it is determined that the first key has not been successfully distributed to each target computing node, or each target computing node has not successfully enabled the first key. However, considering that the first key has been sent out once, there is a risk of leakage. Therefore, if the negotiation success message sent by all target computing nodes is not received within the key negotiation period, the key management node will no longer resend the first key, but generate a second key and indicate the second key to multiple target computing nodes.

[0019] Optionally, the method also includes: generating a third key based on the key configuration information every other key update cycle; indicating the third key to the multiple target computing nodes so that the multiple target computing nodes update the key used when encrypting and decrypting data packets communicating with each other to the third key.

[0020] That is, the key management node updates the keys of multiple target computing nodes based on the key configuration information according to the key update cycle, so that multiple target computing nodes can use the newly distributed keys to encrypt and decrypt transmitted data messages within the key update cycle, thereby ensuring the security of communication between nodes.

[0021] Optionally, the method also includes: if the number of computing nodes in normal working state among the multiple target computing nodes changes, generating a fourth key based on the key configuration information; indicating the fourth key to the computing nodes in normal working state, so that the computing nodes in normal working state encrypt and decrypt data messages communicated with each other based on the fourth key.

[0022] It should be noted that when a new computing node is added to multiple target computing nodes, resulting in an increase in the number of target computing nodes; or when at least one computing node among multiple target computing nodes is offline, resulting in a decrease in the number of target computing nodes, key update is required to ensure the communication security between computing nodes in normal working state, to avoid key leakage after a single node is offline, resulting in key leakage of multiple target computing nodes; at the same time, in order to ensure global key consistency, key update is also performed when a new computing node is added, so that the new computing node and other computing nodes in normal working state among the multiple target computing nodes can use the same key for encrypted communication.

[0023] Optionally, the communication group includes multiple computing nodes processing the same service in the data center, or multiple computing nodes in the same network domain.

[0024] That is, the computing nodes in the data center can be divided according to business type, network domain, etc., so that the key management method provided by the embodiment itself is used to distribute and manage keys for multiple computing nodes belonging to the same communication group.

[0025] In other words, since the keys distributed by the key management node to multiple target computing nodes in the embodiment of the present application are the same, the computing nodes in the data center used to process the same business, or the computing nodes in the same network domain, can be regarded as a communication group, and the keys of multiple computing nodes in the communication group can be managed by the key management method provided in the embodiment of the present application.

[0026] In a second aspect, a key management device is provided, wherein the key management device has the function of implementing the key management method in the first aspect. The key management device includes at least one module, and the at least one module is used to implement the key management method provided in the first aspect.

[0027] In a third aspect, a key management node is provided, the key management node comprising a processor and a memory, the memory being used to store a computer program for executing the key management method provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the key management method described in the first aspect.

[0028] Optionally, the key management node may further include a communication bus, and the communication bus is used to establish a connection between the processor and the memory.

[0029] In a fourth aspect, a computer-readable storage medium is provided, wherein the storage medium stores instructions, and when the instructions are executed on a key management node, the key management node executes the steps of the key management method described in the first aspect above.

[0030] In a fifth aspect, a computer program product comprising instructions is provided, and when the instructions are executed on a key management node, the key management node executes the steps of the key management method described in the first aspect. In other words, a computer program is provided, and when the computer program is executed on a key management node, the key management node executes the steps of the key management method described in the first aspect.

[0031] The technical effects obtained by the above-mentioned second, third, fourth and fifth aspects are similar to the technical effects obtained by the corresponding technical means in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a node session diagram of a multi-computing node network provided in an embodiment of the present application;

[0033] Figure 2 This is another node session diagram of a multi-computing node network provided in an embodiment of the present application;

[0034] Figure 3 This is a schematic diagram of the architecture of a data center provided in an embodiment of the present application;

[0035] Figure 4 It is a structural diagram of a key management node provided in an embodiment of the present application;

[0036] Figure 5 is a flowchart of a key management method provided by an embodiment of the present application;

[0037] Figure 6 This is a schematic diagram of a key management process in a single rack provided by an embodiment of the present application;

[0038] Figure 7 This is another schematic diagram of a key management process in a single rack provided by an embodiment of the present application;

[0039] Figure 8 It is a structural diagram of a key management device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0041] Before explaining the key management method provided by this application, the application scenario and implementation environment of this application are first introduced.

[0042] With the rise and rapid development of AI big models, a new generation of artificial intelligence technology has been launched. The models, parameters and data used in AI training and reasoning have gradually become the core competitiveness of enterprises and are very important and sensitive business assets. Traditional data centers are based on trust mechanisms. East-west communications within data centers mostly use plain text to transmit data messages, and no encryption protection measures are taken. For emerging scenarios such as future large-scale AI data centers and intelligent computing centers, there may be attacks such as eavesdropping on internal communications in data centers. At present, more and more organizations and individuals are aware of the risks of network attacks on internal communications in data centers. Based on this, the UltraEthernet Consortium (UEC) recommended in a technical white paper released in July 2023 that communication messages between computing nodes used for AI training and reasoning in data centers need to be encrypted and authenticated. Google also released a technical white paper in November 2022, launching the PSP solution (a private security mechanism for encrypting internal communications in large-scale data centers) to encrypt communication messages within and between data centers. It can be seen that encryption of internal communication messages in future data centers will also become a necessary capability for data centers.

[0043] If both ends of the communication are to be able to encrypt the data messages of the communication, they need to have the same key used to encrypt the data messages. Therefore, before transmitting the data messages, the two ends of the communication will first negotiate the key used for communication through the key management mechanism. The key negotiation process is: first establish a secure channel for transmitting messages between the two ends of the communication, and maintain the state of the secure channel; then, based on the key negotiation protocol, the two ends of the communication transmit key negotiation messages through the secure channel to negotiate the key used for data plane encryption.

[0044] Existing standardized security mechanisms, such as the transport layer security (TLS) protocol, the internet protocol security (IPSec), and the VLAN in clear mode of the media access control security (MACSec) protocol, all have their own key management mechanisms. However, in a networking scenario with N computing nodes, if the key management mechanisms of these standardized security mechanisms are used to negotiate the keys for communication between N computing nodes, then in theory, N×(N-1) / 2 sessions need to be established, resulting in a high complexity of the security control plane, which is O(N 2 ).

[0045] For easier understanding, see Figure 1 In the multi-computing node networking scenario shown in the figure, for each computing node, in the worst case, the computing node needs to establish a secure session with other N-1 computing nodes. For N such computing nodes, the number of secure sessions established when negotiating keys in the network is N×(N-1); and because only one bidirectional secure session is usually established between computing node A and computing node B, the total number of secure sessions when negotiating keys in the network is N×(N-1) / 2. Therefore, in Figure 1 In the network of 6 computing nodes shown, the number of secure sessions on the data plane is N×(N-1) / 2=15, and the number of secure sessions on the security control plane is N×(N-1) / 2=15.

[0046] It should be understood that Figure 1 The example of networking with 6 computing nodes is taken only, which does not constitute a limitation on the number of computing nodes in the network. In the actual networking process, more or fewer computing nodes may be included.

[0047] For a large-scale AI data center with tens of thousands of computing nodes, if key negotiation and management are performed according to the above key management mechanism, each computing node will need to maintain a large number of security sessions and keys during traffic peaks. This consumes a lot of CPU resources of the computing nodes and memory resources in the network card, making it difficult for the node devices to bear the burden.

[0048] Based on this, the present application provides a key management method. For computing nodes in a data center, for multiple target computing nodes that communicate with each other, a key management node is determined, and the key management node generates and distributes keys for multiple target computing nodes. The multiple target computing nodes only receive the keys sent by the key management node, and there is no need to communicate with each other to negotiate the keys. Therefore, the number of secure sessions when multiple computing nodes negotiate keys is greatly reduced, and the complexity of the security management and control surface is reduced.

[0049] With the above Figure 1 For example, the key management method of the embodiment of the present application is to first determine computing node a as a key management node, and then computing node a distributes keys to other computing nodes. In this process, computing nodes b, computing node c, computing node d, computing node e and computing node f do not need to establish a separate security session to negotiate keys. After receiving the key distributed by computing node a, computing nodes a-computing nodes f in the network can use the key to encrypt and decrypt data messages communicated with each other.

[0050] See also Figure 2 , the data plane still needs to establish 15 secure sessions between the key management node a and other computing nodes (i.e., computing nodes b, c, d, e, and f), and the data session complexity is O(N 2 ); However, during the key negotiation process, the security control plane only needs to establish 5 security sessions, and the complexity is reduced from O(N 2 ) is reduced to O(N). That is, the key management method provided in the embodiment of the present application separates the security control plane from the data plane, and implements one-to-many key negotiation by determining the key management node, thereby reducing the number of security sessions when multiple computing nodes negotiate keys.

[0051] Next, the implementation environment of the key management method provided in the embodiment of the present application is introduced.

[0052] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the architecture of a data center according to an embodiment of the present application. A data center is generally a four-layer architecture including a computing layer, an access layer, a convergence layer, and a core layer.

[0053] Among them, the computing layer includes multiple racks, each rack includes multiple servers, these servers provide data services for different tenants, and are used to process the data services of different tenants; the server resources in these racks constitute the computing nodes of the data center. The access layer includes access switches (top of rack, referred to as TOR switches) in each cabinet, each TOR switch is physically connected to multiple servers in the rack, and is used to receive and forward messages sent by multiple servers in the rack. The aggregation layer includes multiple spine switches, each spine switch is connected to at least two TOR switches. As far as the east-west communication within the data center is concerned, the spine switch is used to forward the messages sent by at least two TOR switches to servers in different racks, that is, through the spine switch and the TOR switch, the mutual communication between the servers in at least two racks can be realized. The core layer includes at least one core switch, each core switch is connected to multiple spine switches in the aggregation layer, and is used to receive messages sent by multiple spine switches; and the core switch can communicate with computing devices outside the data center, so the core switch can also send messages sent by the spine switch to other computing devices outside the data center.

[0054] Optionally, in order to shorten the communication path between servers, reduce communication latency, and enhance the scalability of east-west communication, a leaf switch may be included between the TOR switch and the spine switch. Each leaf switch is connected to multiple TOR switches and is connected to a spine switch at the same time. The leaf switch is used to forward data link layer (i.e., L2 layer) and network layer (i.e., L3 layer) messages. In other words, the two-layer network architecture of TOR-spine can be expanded to a three-layer network architecture of TOR-leaf-spine. The embodiments of the present application do not limit this.

[0055] It should be understood that Figure 3 The various layers of the data center shown may also include more or fewer node devices. Figure 3 This is just an example and does not limit the number of device nodes at each layer. Figure 3 The switch shown in the figure can also be replaced by a router or other device to achieve the same function. The embodiment of the present application does not limit the specific type of network device.

[0056] Please refer to Figure 4 , Figure 4 is a schematic diagram of a key management node according to an embodiment of the present application. The key management node may be Figure 3The key management node may be any computing node in a data center, or a network device that enables multiple computing nodes to communicate with each other. For example, the key management node may be any server in the computing layer, or any network device such as a switch or a router. The key management node includes at least one processor 401, a communication bus 402, a memory 403, and at least one communication interface 404.

[0057] The processor 401 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or may be one or more integrated circuits for implementing the solution of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0058] The communication bus 402 is used to transmit information between the above components. The communication bus 402 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0059] The memory 403 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0060] Optionally, the memory 403 may exist independently and be connected to the processor 401 via the communication bus 402 ; the memory 403 may also be integrated with the processor 401 .

[0061] The communication interface 404 uses any transceiver-like device for communicating with other devices or communication networks. The communication interface 404 includes a wired communication interface and may also include a wireless communication interface. Among them, the wired communication interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.

[0062] Optionally, the processor 401 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 are shown in the figure.

[0063] Optionally, the key management node may include multiple processors, such as Figure 4 401 and processor 405 shown in FIG. Each of these processors may be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (such as computer program instructions).

[0064] In some embodiments, the key management node may further include an output device 406 and an input device 407. The output device 406 communicates with the processor 401 and may display information in a variety of ways. For example, the output device 406 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 407 communicates with the processor 401 and may receive user input in a variety of ways. For example, the input device 407 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0065] In some embodiments, the memory 403 is used to store program codes for executing the solution of the present application, and the processor 401 can execute the program codes stored in the memory 403. The program code may include one or more software modules. The key management node may implement the following by the processor 401 and the program codes in the memory 403. Figure 5 The embodiment provides a key management method.

[0066] Figure 5This is a flowchart of a key management method provided by an embodiment of the present application, which is applied to a key management node in a data center. Figure 5 , the method comprises the following steps.

[0067] Step 501: Determine key configuration information of multiple target computing nodes, where the multiple target computing nodes are computing nodes belonging to the same communication group in a data center or all computing nodes in a data center.

[0068] The key management node is any one of the multiple target computing nodes, or any network device used to enable multiple target computing nodes to communicate with each other. The network device may be a switch, a router, or other device.

[0069] See above Figure 3 The computing layer of the data center includes multiple servers, which constitute multiple computing nodes, and each computing node corresponds to a server. The multiple target computing nodes can be some or all of the servers that communicate with each other in the computing layer. The network device can be a TOR switch that enables multiple servers to communicate with each other, or a leaf switch or a spine switch connected to each TOR switch.

[0070] As an example, if the multiple target computing nodes are multiple servers in a rack, the key management node can be any server in the rack, or a TOR switch that connects multiple servers in the rack. Since the TOR switch is physically connected to the multiple servers in the rack, the TOR switch can realize mutual communication between the multiple servers in the rack at the physical layer (i.e., L1 layer). Of course, when multiple servers in the rack have established communication connections, each server can also communicate with each other at the L2 layer, L3 layer, and even the application layer (i.e., L4 layer) through the TOR switch.

[0071] In some embodiments, since the key management node in the embodiment of the present application distributes the same key to multiple target computing nodes, the multiple target computing nodes may be computing nodes belonging to the same communication group in the data center. Each communication group includes multiple computing nodes that process the same business in the data center, or multiple computing nodes in the same network domain. The embodiment of the present application does not limit the basis for dividing the communication groups, and the number of computing nodes included in each communication group.

[0072] As an example, for computing nodes included in a data center, multiple computing nodes can be classified according to the business type of each computing node processing business, and a computing node set corresponding to each business type can be obtained. Then, according to the communication security requirements of each business, for a computing node set corresponding to a business requiring encrypted communication, multiple computing nodes in the computing node set are used as target computing nodes, and the key management method provided in the embodiment of the present application is executed, so that the key management node can distribute keys to multiple target computing nodes at one time.

[0073] As another example, if a data center is divided into multiple network domains, and the computing nodes in each network domain communicate with each other. For the computing nodes included in the data center, the computing node set corresponding to each network domain can be determined according to the network domain in which each computing node is located. Then, according to the communication security requirements of each network domain, for the computing node set corresponding to the network domain requiring encrypted communication, multiple computing nodes in the computing node set are used as target computing nodes, and the key management method provided in the embodiment of the present application is executed, so that the key management node can distribute keys to multiple target computing nodes at one time.

[0074] It should be noted that the embodiment of the present application only uses business type and network domain as the basis for dividing computing nodes to illustrate the process of determining multiple target computing nodes, and does not constitute a limitation on the embodiment of the present application for determining multiple target computing nodes. In specific implementation, multiple target computing nodes that need to negotiate and use the same key can also be determined from the data center based on other information.

[0075] In some embodiments, the key configuration information includes a connectivity association key (CAK) and key attribute information, wherein the CAK is used to generate an encryption key, and the key attribute information indicates the encryption algorithm and key length used when encrypting and decrypting data messages using the encryption key, as well as the key validity period of the encryption key.

[0076] As an example, the encryption algorithm may be an advanced encryption standard (AES) algorithm, the key length may be 128 bits, 256 bits, etc., and the key validity period may be 1 hour, 1 day, etc. The embodiment of the present application does not limit this, and can be flexibly set according to actual needs.

[0077] Since the CAKs of multiple target computing nodes and key management nodes are the same, multiple target computing nodes and key management nodes can determine the same encryption key based on the same CAK. In other words, the CAKs of multiple target computing nodes that need to use the same encryption key to encrypt and decrypt data messages that communicate with each other are the same, and the key management node that distributes encryption keys to the multiple target computing nodes is also configured with the same CAK.

[0078] As an example, the key configuration information can be configured by an administrator in real time to multiple target computing nodes and key management nodes. Of course, the key configuration information can also be pre-stored in network devices and computing nodes in the data center. In this way, after determining multiple target computing nodes and key management nodes, the key configuration information can be read from the corresponding devices. The method for determining the key configuration information in the embodiment of the present application is not limited.

[0079] In some embodiments, when the key management node stores multiple key configuration information but is not sure about the correspondence between the key configuration information and the target computing node, the key configuration information can also be broadcast through the network device. The computing node that receives the broadcast information compares the key configuration information with the key configuration information stored by itself to see if they are the same. If they are the same, the key management node sends a response message to the key management node in response to the broadcast information. In this way, the key management node can determine the computing node corresponding to each key configuration information.

[0080] Optionally, when configuring the key management information, a node identifier corresponding to the key management information may be configured at the same time, thereby facilitating the key management node to determine multiple target computing nodes corresponding to the key configuration information.

[0081] Step 502: Generate a first key based on the key configuration information.

[0082] As described above, when the key configuration information is CAK, a secure association key (SAK) derived from the CAK is used as the first key.

[0083] In a possible implementation manner, the implementation process of step 502 may be: the key management node generates a first key, namely, a first SAK, through a key derivation function (KDF) based on CAKs of multiple target computing nodes.

[0084] As an example, the first SAK may be generated by the following formula (1).

[0085] SAK = KDF(Key, Label, nonce, SAK length) (1)

[0086] Wherein, “Key” is CAK; “Label” is the SAK type defined by the IEEE 8021 protocol; “nonce” is a random number for a SAK length, generated by the random number generator of the key management node. Each time a SAK is generated, the key management node will recalculate a random number to generate a different SAK through the above formula (1); “SAK length” is the SAK length, which can be 128 bits, 256 bits, etc.

[0087] Step 503: Indicate the first key to multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other according to the first key.

[0088] Since the first key is a key used by multiple target computing nodes to encrypt and decrypt data messages that communicate with each other, to ensure the security of the first key distribution process, the key management node can encrypt the first key and then indicate it to the multiple target computing nodes.

[0089] In some embodiments, the implementation process of step 503 is as follows: the key management node encrypts the first key to obtain a key ciphertext. Then, the key management node generates a key negotiation message, the key negotiation message carries the key ciphertext; then, the key management node indicates the key negotiation message to multiple target computing nodes.

[0090] In a possible implementation, the key management node first generates a key encryption key (KEK) through a KDF function, and then uses the KEK to encrypt the first key to obtain a key ciphertext.

[0091] As an example, KEK can be generated by the following formula (2).

[0092] KEK = KDF(Key, Label, Key id, KEK Length) (2)

[0093] In the formula, "Key" is CAK; "Label" is the CAK type defined by the IEEE 8021 protocol; "Key id" is the first 16 fields of the connectivity association key name (CKN). If CKN is less than 16 fields, it is filled with empty fields; "KEK Length" is the KEK length, which can be 128 bits, 256 bits, etc.

[0094] In some embodiments, the key agreement message further carries first key attribute information, where the first key attribute information indicates an encryption algorithm and a key length when the first key is used to encrypt and decrypt data messages, as well as a key validity period of the first key.

[0095] Based on this, after receiving the key negotiation message, the target computing node can encrypt and decrypt the data message communicated with each other based on the encryption algorithm and the first key. At the same time, based on the key validity period, after the first key expires, the key management node is requested to indicate a new key.

[0096] Optionally, in addition to the key ciphertext and key attribute information, the key agreement message may also carry at least one of the following information.

[0097] (1) Message type

[0098] It should be understood that before performing key management, the key management node may be in a mutual communication state with multiple target computing nodes, and at this time, data messages may still be transmitted between the key management node and the multiple target computing nodes. Therefore, it is necessary to mark whether the currently transmitted message is a data message or a key negotiation message by the message type. In other words, the message type is used to indicate whether the message is a data message or a key negotiation message, so that multiple target computing nodes can accurately identify the key negotiation message from the multiple messages received and participate in the key negotiation process in a timely manner.

[0099] As an example, when the message type tag value is 1, it indicates that the message is a message for negotiating a key, i.e., a key negotiation message; after receiving the key negotiation message, multiple target computing nodes need to parse the key from it and update the original key. When the message type tag value is 0, it indicates that the message is a data message; after receiving the data message, multiple target computing nodes continue to decrypt the data message according to the original key.

[0100] (2) Node information

[0101] The node information is used to indicate the identity information of the key management node, and the node information may be the node ID, node port number, node media access control address (MAC address), etc. of the key management node. The node information may be pre-configured or generated in real time by the key management node when distributing keys, and the embodiments of the present application do not limit this.

[0102] (3) Key message number

[0103] It should be understood that during the key negotiation process, in order to ensure that each target computing node can successfully receive the key, the key management node may need to indicate the key to multiple target computing nodes multiple times. In the case of indicating multiple keys, the key management node also needs to determine which key the multiple target computing nodes have successfully received.

[0104] Based on this, during the key negotiation phase, each time the key management node sends a key negotiation message, the key message number is automatically increased by 1. When the target computing node replies to the key negotiation message, it also carries the key message number, so that the key management node can determine which key negotiation message the target computing node is replying to.

[0105] (4) Integrity check value (ICV)

[0106] Based on the key negotiation message, the key management node calculates and generates the ICV according to the encrypted message authentication algorithm and places it at the end of the message. After receiving the key negotiation message, the target computing node uses the same encrypted message authentication algorithm to calculate the ICV and compares the calculated ICV with the ICV carried in the key negotiation message. If the two ICVs are the same, it means that the key negotiation message has not been modified and the integrity check passes; otherwise, it is considered that the key negotiation message has been modified, and the key management node is requested to re-indicate the key.

[0107] As an example, the encryption algorithm may be an AES algorithm, and the message authentication algorithm may be a CMAC (cipher-based message authentication code, a message authentication code based on a symmetric key block encryption algorithm) algorithm. That is, the above-mentioned encrypted message authentication algorithm is an AES-CMAC algorithm. Of course, ICV can also be generated based on other encryption algorithms and message authentication codes, and the embodiments of the present application do not limit this.

[0108] It should be noted that the embodiments of the present application do not restrict the information that can be carried in the key negotiation message. Moreover, without changing the message structure, the information carried in the key negotiation message can be written into an empty field in the message structure; of course, the message structure can also be modified based on the carried information to determine the writing position and field length of each information in the message, and the embodiments of the present application do not restrict this either.

[0109] Since the key management node can be any one of the multiple target computing nodes, or any network device used to implement communication between the multiple target computing nodes, when the key management nodes are different, the implementation methods of the key management node indicating the first key to the multiple target computing nodes are also different. They are introduced below.

[0110] In the first implementation, the key management node is any one of the multiple target computing nodes. In this case, the multiple target computing nodes belong to the same level and are connected to the same network device. Therefore, the key management node can send a key negotiation message to the connected network device. After receiving the key negotiation message, the network device broadcasts the key negotiation message to other target computing nodes.

[0111] As an example, the multiple target computing nodes are multiple servers in a rack, the key management node is a key server in the rack, and the network device is a TOR switch in the rack. The key server can send a key negotiation message to the TOR switch, and after receiving the key negotiation message, the TOR switch broadcasts the key negotiation message to other servers in the rack.

[0112] That is, when the key management node is a computing node, the key management node communicates with multiple target computing nodes at the L2 layer. In this process, the TOR switch does not participate in the key negotiation, but is only responsible for forwarding the key negotiation message to the multiple target computing nodes.

[0113] In a second implementation, the key management node is a network device. Since the network device is connected to multiple target computing nodes, the network device directly sends key negotiation messages to the multiple target computing nodes respectively through the device connection port.

[0114] As an example, the multiple target computing nodes are multiple servers in a rack, and the key management node is the TOR switch of the rack. At this time, after generating the first key, the TOR switch can directly send key negotiation messages to the multiple servers in the rack through the connection ports of each device.

[0115] That is, when the key management node is a network device, the key management node communicates with the multiple target computing nodes at the L1 layer to send key negotiation messages to the multiple target computing nodes.

[0116] Optionally, referring to the third implementation manner described below, the key management node may also indicate the key negotiation message to other target computing nodes at the L1 layer through a network device.

[0117] In the third implementation, the key management node is any one of the multiple target computing nodes. In this case, the multiple target computing nodes belong to the same level and are connected to the same network device. Therefore, the key management node can send a key negotiation message to the connected network device. After receiving the key negotiation message, the network device parses the key negotiation message and regenerates the key negotiation message. Then, the regenerated key negotiation message is sent to other target computing nodes through the device connection port.

[0118] As an example, multiple target computing nodes are multiple servers in a rack, the key management node is a key server in the rack, and the network device is a TOR switch in the rack. The key server can send a key negotiation message to the TOR switch, and after receiving the key negotiation message, the TOR switch first parses the key negotiation message, then regenerates the key negotiation message, and then sends the regenerated key negotiation message to other servers in the rack through the device connection port.

[0119] That is, because L1 layer communication has the characteristic of hop-by-hop termination, when the key management node is a computing node, the network equipment needed to realize communication between multiple target computing nodes also participates in the key negotiation process, and is used to parse the key negotiation message sent by the key management node, and the network equipment sends the key negotiation message to multiple target computing nodes.

[0120] It should be noted that in the first implementation, since the network device only forwards messages and does not participate in key negotiation, it is sufficient to configure the same key configuration information for multiple target computing nodes so that the multiple target computing nodes can generate / parse the same key. In the third implementation, since the network device also participates in key negotiation, it is sufficient to configure the same key configuration information for multiple target computing nodes and network devices so that the multiple target computing nodes and network devices can generate / parse the same key.

[0121] It should also be noted that the above only uses the L1 layer and L2 layer to distribute keys as an example. In actual applications, the key management node can also distribute keys to multiple target computing nodes based on the L3 layer and L4 layer. The embodiments of the present application do not limit this.

[0122] In some embodiments, after the key management node indicates the key negotiation message to multiple target computing nodes, if the target computing node receives the first key, it is necessary to send a negotiation success message to the key management node so that the key management node can confirm the key reception status of each target computing node. Of course, the target computing node can also send a negotiation success message to the key management node after enabling the first key, and the embodiment of the present application does not limit this.

[0123] Here, “enable” means that the target computing node has installed the first key on the port and will use the first key to encrypt and decrypt data packets transmitted by the port.

[0124] Moreover, when the key management node determines that multiple target computing nodes all possess the first key, it is also necessary to perform key synchronization among the multiple target computing nodes so that any target computing node can determine the first key enabling status of the key management node and other target computing nodes, thereby using the first key to perform encrypted communication with the key management node and other target computing nodes.

[0125] In one possible implementation, a key management node receives a negotiation success message sent by multiple target computing nodes, and the negotiation success message indicates that the target computing nodes have successfully received the first key; in response to the negotiation success message, the key management node sends a key synchronization message to the multiple target computing nodes, and the key synchronization message indicates that the multiple target computing nodes and the key management node can use the first key to encrypt and decrypt data messages communicated with each other.

[0126] Thus, by receiving the successful negotiation message, the key management node can determine the key reception status of each target computing node. By sending the key synchronization message, the key management node and multiple target computing nodes can synchronize the key usage status, so that multiple target computing nodes, or multiple target computing nodes and the key management node can use the same first key for encrypted communication.

[0127] Similarly, since the key management node indicates the first key to multiple target computing nodes in different ways, the target computing node sends the negotiation success message to the key management node in different ways, which are described below.

[0128] In the first case, when the key management node broadcasts the first key to multiple target computing nodes through a network device, the key negotiation message may also include the MAC address of the key management node. At this time, after receiving the key negotiation message, the multiple target computing nodes use the MAC address as the destination address and send a negotiation success message to the network device. After receiving the negotiation success messages sent by the multiple target computing nodes, the network device forwards the negotiation success message to the key management node according to the MAC address.

[0129] That is, when the key management node instructs the key negotiation message to multiple target computing nodes through the L2 layer, the multiple target computing nodes also send negotiation success messages to the key management node at the L2 layer according to the MAC address of the key management node.

[0130] In the second case, when the key management node is a network device, there is a physical connection relationship between the network device and multiple target computing nodes. Therefore, the network device can directly send a key negotiation message to each target computing node through the device connection port. Similarly, after the target computing node receives the key negotiation message from the corresponding connection port, it can parse the first key from it and enable the first key. After that, the target computing node can send a negotiation success message to the network device through the corresponding connection port.

[0131] Referring to the third implementation mode above, when the key management node is a computing node, the key management node can also communicate with multiple target computing nodes at the L1 layer through a network device. Referring to the third case below, both the key management node and the network device need to participate in the key negotiation process.

[0132] In the third case, the same key configuration information is configured in multiple target computing nodes and network devices, and the key management node is any one of the multiple target computing nodes. After receiving the key negotiation message sent by the network device, the multiple target computing nodes parse the first key therefrom, and after enabling the first key, send a negotiation success message to the network device through the connection port. After receiving the negotiation success message, the network device first parses the negotiation success message, and then sends the re-encapsulated negotiation success message to the key management node through the device connection port.

[0133] In addition, if the key management node does not receive a negotiation success message sent by any of the multiple target computing nodes within the key negotiation duration, a second key is generated based on the key configuration information. Then, the key management node indicates the second key to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt the data messages communicated with each other based on the second key.

[0134] That is, if the key management node does not receive the negotiation success message sent by all target computing nodes, it is determined that the first key has not been successfully distributed to each target computing node, or each target computing node has not successfully enabled the first key. However, considering that the first key has been sent out once, there is a risk of leakage. Therefore, if the negotiation success message sent by all target computing nodes is not received within the key negotiation period, the key management node will no longer resend the first key, but generate a second key and indicate the second key to multiple target computing nodes.

[0135] The key negotiation duration is any set duration, such as 30 seconds, 1 minute, etc. This embodiment of the present application does not limit this.

[0136] As an example, the key negotiation duration can be set according to the communication route between the key management node and each target computing node. In the case of a long communication route, the key negotiation duration can be set to a larger value so that the key management node can receive the successful negotiation message sent by each target computing node as much as possible; in the case of a short communication route, the key negotiation duration can be set to a smaller value, which is not limited in the embodiments of the present application.

[0137] In other words, each time the key is negotiated, the key management node periodically indicates the key to the multiple target computing nodes based on the key negotiation duration until receiving negotiation success messages sent by the multiple target computing nodes.

[0138] In summary, after the key management node and multiple target computing nodes complete key negotiation, the key management node and multiple target computing nodes can use the successfully negotiated key (such as the first key or the second key mentioned above) to encrypt and decrypt data packets communicated with each other.

[0139] In some embodiments, since the key management node and multiple target computing nodes all use the successfully negotiated key to encrypt and decrypt data packets that communicate with each other, the frequency of use of the key will be very high. Therefore, in order to ensure the security of communication between the key management node and multiple target computing nodes, the key can be updated regularly.

[0140] In one possible implementation, the key update process is as follows: every other key update cycle, the key management node generates a third key based on the key configuration information; and then indicates the third key to multiple target computing nodes, so that the multiple target computing nodes update the key used when encrypting and decrypting data messages communicating with each other to the third key.

[0141] That is, the key management node updates the keys of multiple target computing nodes based on the key configuration information according to the key update cycle, so that multiple target computing nodes can use the newly distributed keys to encrypt and decrypt transmitted data messages within the key update cycle, thereby ensuring the security of communication between nodes.

[0142] In some embodiments, if the number of computing nodes in normal working state among multiple target computing nodes changes, the key management node generates a fourth key based on the key configuration information, and then indicates the fourth key to the computing nodes in normal working state, so that the computing nodes in normal working state can encrypt and decrypt data messages communicated with each other based on the fourth key.

[0143] It should be noted that when a new computing node is added to multiple target computing nodes, resulting in an increase in the number of target computing nodes; or when at least one computing node among multiple target computing nodes is offline, resulting in a decrease in the number of target computing nodes, key update is required to ensure the communication security between computing nodes in normal working state, to avoid key leakage after a single node is offline, resulting in key leakage of multiple target computing nodes; at the same time, in order to ensure global key consistency, key update is also performed when a new computing node is added, so that the new computing node and other computing nodes in normal working state among the multiple target computing nodes can use the same key for encrypted communication.

[0144] There are many factors that may cause changes in the number of computing nodes in normal working condition, such as a computing node being attacked and disconnected, a computing node being disconnected due to abnormal operation, or a new computing node being added due to expansion of computing resources. The embodiments of the present application do not impose any restrictions on this. It only requires that when a change is detected in the number of computing nodes in normal working condition among multiple target computing nodes, new keys are distributed for the number of computing nodes in normal working condition.

[0145] In summary, in an embodiment of the present application, for multiple target computing nodes that use the same key for encrypted communication, when negotiating the key, one computing node can be selected from the multiple target computing nodes as a key management node, or any network device used to realize mutual communication between multiple target computing nodes can be used as a key management node, and then through the key management node, key negotiation is performed with the multiple target computing nodes respectively to indicate to the multiple target computing nodes the keys for encrypting and decrypting data packets that communicate with each other. In this key negotiation process, the key management node indicates the key to the multiple target computing nodes in a "one-to-many" manner, and the multiple target computing nodes do not need to negotiate the key separately. Therefore, the number of security sessions when multiple computing nodes negotiate keys is greatly reduced, and the complexity of the security management and control surface is reduced.

[0146] Based on the above embodiment, the key management method provided in the embodiment of the present application is explained by taking a TOR switch of a rack and multiple servers as an example.

[0147] In some embodiments, see Figure 6 , the administrator configures the same CAK for multiple servers in the rack, and selects one server from the multiple servers as the key server, configures the key negotiation state of the key server to be active, and the key negotiation state of other servers to be silent. Among them, the key server in the active key negotiation state can distribute keys to other servers in the rack, while other servers are in a silent state before key negotiation, and can receive key negotiation start messages, but cannot actively send key negotiation start messages.

[0148] The key server generates a SAK based on the configured CAK, installs the SAK on the device connection port, enables the key server to receive data, and then sends a key negotiation message to the TOR switch. The key negotiation message carries the MAC address of the key server, the encrypted SAK, and key attribute information. After receiving the key negotiation message, the TOR switch broadcasts the key negotiation message to other servers in the rack except the key server based on the MAC address of the key server and the MAC address table of the rack server maintained by itself.

[0149] After receiving the key negotiation message, other servers in the rack use the configured CAK to parse the SAK from the key negotiation message. Then the SAK is stored and installed on the device connection port, and the server is enabled to encrypt the data received and sent by the device connection port through the installed SAK. After completing the installation and enabling of the SAK on the device connection port, the MAC address of the key server is set as the destination address, and a negotiation success message is sent to the TOR switch. The negotiation success message carries the MAC address of the key server, as well as information such as the successful reception and enabling of the SAK. After receiving the negotiation success message sent by other servers in the rack, the TOR switch forwards the negotiation success message to the key server according to the destination address carried in the negotiation success message.

[0150] After the key server receives the successful negotiation message sent by other servers in the rack, it can confirm that all servers in the rack have installed the same SAK. The key server adjusts the SAK of its own device connection port to be in the enabled state, and sends a key synchronization message to other servers in the rack through the TOR switch to inform other servers that all servers in the rack have enabled the same SAK, and can encrypt and decrypt the data messages communicating with each other based on the SAK.

[0151] It can be seen that for multiple servers in a rack, when multiple servers negotiate SAK based on CAK, the key server can distribute SAK to other servers so that multiple servers in the rack have the same SAK. Since the key server distributes SAK to multiple other servers at one time in a "one-to-many" manner, and there is no need for the servers in the rack to communicate with each other to negotiate SAK, the number of security sessions when multiple servers in the rack negotiate SAK is greatly reduced.

[0152] In some embodiments, see Figure 7, the administrator configures the same CAK for multiple servers in the rack and the TOR switch of the rack, and configures the TOR switch to distribute keys, that is, configures the key negotiation state of the TOR switch to be active, and configures the key negotiation state of all servers in the rack connected to the TOR switch to be silent. Among them, the TOR switch can distribute keys to multiple servers in the rack, and multiple servers in the rack are in a silent state before key negotiation. They can receive the key negotiation start message sent by the TOR switch, but cannot actively send the key negotiation start message.

[0153] It should be understood that since the multiple servers in the rack are respectively physically connected to a port in the TOR switch, the TOR switch and each server can communicate directly through the device connection port.

[0154] The TOR switch generates a SAK based on the configured CAK, installs the SAK on the device connection port, and enables the TOR switch to receive data. Then, through multiple device connection ports, it sends key negotiation messages to multiple servers in the rack respectively. The key negotiation messages carry the encrypted SAK and key attribute information. After receiving the key negotiation message sent by the TOR switch, each server in the rack first uses the configured CAK to parse the SAK from the key negotiation message, then stores the SAK, and installs the SAK on the device connection port, and then enables the server to encrypt and decrypt the data received and sent by the device connection port through the installed SAK. After completing the installation and enabling of the SAK on the device connection port, each server sends a negotiation success message to the TOR switch through the device connection port. The negotiation success message indicates that the server has successfully received and enabled the SAK. After the TOR switch receives the successful negotiation messages sent by multiple servers in the rack, it adjusts the SAK of each device connection port to be enabled, and sends key synchronization messages to multiple servers in the rack through multiple connection ports to inform each server that all servers in the rack have enabled the same SAK, and can encrypt and decrypt data messages communicating with each other based on the SAK.

[0155] It can be seen that for multiple servers in a rack, when multiple servers negotiate SAK based on CAK, the TOR switch physically connected to multiple servers can distribute SAK so that multiple servers in the rack have the same SAK. Since the TOR switch distributes SAK to multiple servers in the rack in a "one-to-many" manner at one time, without the need for the servers in the rack to communicate with each other to negotiate SAK, the number of security sessions when multiple servers in the rack negotiate SAK is greatly reduced.

[0156] Figure 8is a schematic diagram of a key management device provided in an embodiment of the present application. The key management device 800 can be implemented by software, hardware, or a combination of both. Figure 4 Some or all of the key management nodes shown. Figure 8 The key management device 800 includes: an information acquisition module 801, a first key generation module 802 and a first key distribution module 803.

[0157] The information determination module 801 is used to determine the key configuration information of multiple target computing nodes, where the multiple target computing nodes are computing nodes belonging to the same communication group in the data center or all computing nodes in the data center. For the detailed implementation process, please refer to the relevant content in the above step 501, which will not be repeated here.

[0158] The key management node is any one of the multiple target computing nodes, or any network device used to enable multiple target computing nodes to communicate with each other;

[0159] The first key generation module 802 is used to generate a first key based on the key configuration information; for the detailed implementation process, please refer to the relevant content in the above step 502, which will not be repeated here.

[0160] The first key distribution module 803 is used to indicate the first key to multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt the data messages communicated with each other according to the first key. Please refer to the relevant content in the above step 503 for the detailed implementation process, which will not be repeated here.

[0161] Optionally, the key configuration information includes a security connection associated key CAK and key attribute information, the CAK is used to generate an encryption key, the key attribute information indicates an encryption algorithm and a key length when the encryption key is used to encrypt and decrypt data messages, and a key validity period of the encryption key.

[0162] Optionally, the first key distribution module 803 includes:

[0163] A key encryption unit, used for encrypting the first key to obtain a key ciphertext;

[0164] A message encapsulation unit, used to generate a key negotiation message, where the key negotiation message carries a key ciphertext;

[0165] The message sending unit is used to indicate the key agreement message to multiple target computing nodes.

[0166] Optionally, the key agreement message further carries first key attribute information, where the first key attribute information indicates an encryption algorithm and a key length when the first key is used to encrypt and decrypt data messages, and a key validity period of the first key.

[0167] Optionally, the key management device 800 further includes:

[0168] A message receiving module, used to receive negotiation success messages sent by multiple target computing nodes, where the negotiation success messages indicate that the target computing nodes have successfully received the first key;

[0169] The message sending module is used to send a key synchronization message to multiple target computing nodes in response to the negotiation success message, and the key synchronization message indicates that the multiple target computing nodes and the key management node can use the first key to encrypt and decrypt the data messages communicated with each other.

[0170] Optionally, the key management device 800 further includes:

[0171] A second key generation module, configured to generate a second key based on the key configuration information if no negotiation success message sent by any target computing node among the multiple target computing nodes is received within the key negotiation duration;

[0172] The second key distribution module is used to indicate the second key to multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other based on the second key.

[0173] Optionally, the key management device 800 further includes:

[0174] A key updating module, configured to generate a third key based on the key configuration information at every key updating period;

[0175] The key updating module is further used to indicate the third key to multiple target computing nodes, so that the multiple target computing nodes update the key used when encrypting and decrypting data messages communicated with each other to the third key.

[0176] Optionally, the key management device 800 further includes:

[0177] A key updating module, configured to generate a fourth key based on the key configuration information if the number of computing nodes in a normal working state among the plurality of target computing nodes changes;

[0178] The key updating module is also used to indicate the fourth key to the computing nodes in a normal working state, so that the computing nodes in a normal working state encrypt and decrypt the data messages communicated with each other based on the fourth key.

[0179] Optionally, the communication group includes multiple computing nodes processing the same service in a data center, or multiple computing nodes in the same network domain.

[0180] In an embodiment of the present application, for multiple target computing nodes that use the same key for encrypted communication, when negotiating the key, one computing node can be selected from the multiple target computing nodes as a key management node, or any network device used to realize the communication between the multiple target computing nodes can be used as a key management node, and then through the key management node, key negotiation is performed with the multiple target computing nodes respectively to indicate to the multiple target computing nodes the keys for encrypting and decrypting the data messages that communicate with each other. In this key negotiation process, the key management node indicates the key to the multiple target computing nodes in a "one-to-many" manner, and the multiple target computing nodes do not need to negotiate the key separately. Therefore, the number of security sessions when multiple computing nodes negotiate keys is greatly reduced, and the complexity of the security management and control surface is reduced.

[0181] It should be noted that: the key management device provided in the above embodiment only uses the division of the above functional modules as an example to illustrate when managing the keys of data packets transmitted by multiple target computing nodes in a data center. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the key management device provided in the above embodiment and the key management method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0182] The embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed on a key management node, the key management node executes the above Figure 5 The steps of the key management method are shown.

[0183] The embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is run on a key management node, the key management node executes the above Figure 5 The steps of the key management method are shown.

[0184] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, node or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, node or data center. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a node or data center that includes one or more available media integrations. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiment of the present application may be a non-volatile storage medium, in other words, a non-transient storage medium.

[0185] It should be understood that the "multiple" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish between the same items or similar items with basically the same functions and effects. Those skilled in the art can understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not limit them to be necessarily different.

[0186] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of the present application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0187] The above-mentioned embodiments are provided for the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A key management method, characterized in that: Applied to a key management node in a data center; the method comprises: Determining key configuration information of multiple target computing nodes, where the multiple target computing nodes are computing nodes in the data center that belong to the same communication group or all computing nodes in the data center; The key management node is any one of the multiple target computing nodes, or any one of the network devices used to enable the multiple target computing nodes to communicate with each other; Based on the key configuration information, generate a first key; The first key is indicated to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other according to the first key.

2. The method according to claim 1, characterized in that The key configuration information includes a security connection associated key CAK and key attribute information, the CAK is used to generate an encryption key, the key attribute information indicates an encryption algorithm and a key length when the encryption key is used to encrypt and decrypt data messages, and a key validity period of the encryption key.

3. The method according to claim 1, characterized in that The step of indicating the first key to the plurality of target computing nodes comprises: Encrypting the first key to obtain a key ciphertext; Generate a key negotiation message, wherein the key negotiation message carries the key ciphertext; The key agreement message is indicated to the multiple target computing nodes.

4. The method according to claim 3, characterized in that The key agreement message also carries first key attribute information, where the first key attribute information indicates an encryption algorithm and a key length when the first key is used to encrypt and decrypt data messages, and a key validity period of the first key.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Receiving negotiation success messages sent by the multiple target computing nodes, the negotiation success messages indicating that the target computing nodes have successfully received the first key; In response to the negotiation success message, a key synchronization message is sent to the multiple target computing nodes, wherein the key synchronization message indicates that the multiple target computing nodes and the key management node can use the first key to encrypt and decrypt data messages communicated with each other.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If no negotiation success message sent by any target computing node among the multiple target computing nodes is received within the key negotiation duration, generating a second key based on the key configuration information; The second key is indicated to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other based on the second key.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Generate a third key based on the key configuration information at every key update period; The third key is indicated to the multiple target computing nodes, so that the multiple target computing nodes update the key used when encrypting and decrypting data messages communicated with each other to the third key.

8. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: If the number of computing nodes in a normal working state among the multiple target computing nodes changes, generating a fourth key based on the key configuration information; The fourth key is indicated to the computing nodes in normal working state, so that the computing nodes in normal working state encrypt and decrypt data messages communicated with each other based on the fourth key.

9. The method according to any one of claims 1 to 8, characterized in that: The communication group includes multiple computing nodes in the data center that process the same service, or multiple computing nodes in the same network domain.

10. A key management device, characterized in that: The device comprises: An information determination module, used to determine key configuration information of multiple target computing nodes, wherein the multiple target computing nodes are computing nodes belonging to the same communication group in the data center or all computing nodes in the data center; The key management node is any one of the multiple target computing nodes, or any one of the network devices used to enable the multiple target computing nodes to communicate with each other; A first key generation module, used to generate a first key based on the key configuration information; The first key distribution module is used to indicate the first key to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other according to the first key.

11. The device according to claim 10, characterized in that The key configuration information includes a security connection associated key CAK and key attribute information, the CAK is used to generate an encryption key, the key attribute information indicates an encryption algorithm and a key length when the encryption key is used to encrypt and decrypt data messages, and a key validity period of the encryption key.

12. The device according to claim 10, characterized in that The first key distribution module includes: A key encryption unit, used for encrypting the first key to obtain a key ciphertext; A message encapsulation unit, used to generate a key negotiation message, wherein the key negotiation message carries the key ciphertext; A message sending unit is used to indicate the key agreement message to the multiple target computing nodes.

13. The device according to claim 12, characterized in that The key agreement message also carries first key attribute information, where the first key attribute information indicates an encryption algorithm and a key length when the first key is used to encrypt and decrypt data messages, and a key validity period of the first key.

14. The device according to any one of claims 10 to 13, characterized in that: The device also includes: A message receiving module, used to receive negotiation success messages sent by the multiple target computing nodes, wherein the negotiation success messages indicate that the target computing nodes have successfully received the first key; The message sending module is used to send a key synchronization message to the multiple target computing nodes in response to the negotiation success message, and the key synchronization message indicates that the multiple target computing nodes and the key management node can use the first key to encrypt and decrypt data messages communicated with each other.

15. The device according to any one of claims 10 to 13, characterized in that: The device also includes: A second key generation module, configured to generate a second key based on the key configuration information if no negotiation success message sent by any target computing node among the multiple target computing nodes is received within the key negotiation duration; The second key distribution module is used to indicate the second key to the multiple target computing nodes, so that the multiple target computing nodes encrypt and decrypt data messages communicated with each other based on the second key.

16. The device according to any one of claims 10 to 15, characterized in that The device also includes: A key updating module, configured to generate a third key based on the key configuration information at every key updating period; The key updating module is further used to indicate the third key to the multiple target computing nodes, so that the multiple target computing nodes update the key used when encrypting and decrypting data messages communicated with each other to the third key.

17. The device according to any one of claims 10 to 15, characterized in that The device also includes: A key updating module, configured to generate a fourth key based on the key configuration information if the number of computing nodes in a normal working state among the plurality of target computing nodes changes; The key updating module is further used to indicate the fourth key to the computing nodes in normal working state, so that the computing nodes in normal working state encrypt and decrypt data messages communicated with each other based on the fourth key.

18. The device according to any one of claims 10 to 17, characterized in that The communication group includes multiple computing nodes in the data center for processing the same service, or multiple computing nodes in the same network domain.

19. A key management node, characterized in that: The key management node includes a memory and a processor, the memory stores a computer program, and the processor implements the key management method described in any one of claims 1 to 9 when calling and executing the computer program.

20. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program runs on the key management node, the key management node executes the key management method according to any one of claims 1 to 9.

21. A computer program product, characterized in that The program product includes a computer program, and when the computer program runs on the key management node, the key management node executes the key management method according to any one of claims 1 to 9.

Images