Method for cloud database to use key management service

Abstract

The invention discloses a method for a cloud database to use a key management service, and belongs to the technical field of database security, encryption and decryption of a data key are carried out between a user side and a KMS service, firstly, a key of ciphertext data is obtained from a local storage, and if the key is not obtained, the KMS service is called through an interface to create the ciphertext data key; the user obtains the key ciphertext by using the ciphertext data key and then returns the data key ciphertext to the KMS, so that the plaintext of the data key is obtained through the KMS; acquiring plaintext data to be read by using the plaintext data key and the ciphertext data; the following interfaces are defined through the database plug-in: a key list initialization interface, a key creation interface, a local persistence interface, a key plaintext acquisition interface, a key deletion interface and a Token acquisition interface. According to the method, the database security can be remarkably improved, the operation is simplified, the compliance is enhanced, the cost is reduced and the database performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of database security technology, and in particular to a method for cloud database to use key management services. Background Art

[0002] With the rapid development of cloud computing and big data, many organizations use databases to store sensitive information. Data leakage or unauthorized access may cause serious legal and financial consequences, so effective encryption mechanisms are needed to protect these sensitive data. At present, there are still problems with the centralized storage of keys and the security and compliance of key access in cloud database data encryption. Its security, compliance and database performance need to be improved. Summary of the invention

[0003] The technical task of the present invention is to address the above shortcomings and provide a method for cloud database using key management services, which can significantly improve database security, simplify operations, enhance compliance, reduce costs, and improve database performance.

[0004] The technical solution adopted by the present invention to solve its technical problem is:

[0005] A method for using a key management service in a cloud database to encrypt and decrypt data keys between a user side and a KMS (key management) service. First, the key for ciphertext data is obtained from local storage. If it cannot be obtained, the KMS service is called through an interface to create a ciphertext data key. The user uses the ciphertext data key to obtain the key ciphertext, and then returns the data key ciphertext to the KMS, thereby obtaining the plaintext of the data key through the KMS. The plaintext data key and ciphertext data are used to obtain the plaintext data to be read.

[0006] The following interfaces are defined by the database plugin:

[0007] Key list initialization interface, key creation interface, local persistence interface, key plaintext acquisition interface, key deletion interface, Token (KMS Server) acquisition interface.

[0008] By means of database plug-ins, interfaces are defined to implement calls to the key management service interface, thus solving the problem of database use of key management.

[0009] Furthermore, the key list initialization interface reads the key data ciphertext, the ID and version information of the KMS master key from the local file and caches them in the memory; if no valid KMS master key ID is read, the KMS service interface is called to create a new KMS master key, and the returned key ID is cached in the memory and the local file.

[0010] Furthermore, if the data key is not queried from the memory, the key creation interface uses the KMS service interface to create a ciphertext data key and a plaintext data key; and stores the obtained key in the memory cache and locally.

[0011] Furthermore, the local persistence interface includes a key memory cache and provides a local persistent key storage file, which contains the ciphertext data key, the master key ID of the KMS end, and version information.

[0012] Furthermore, the key plaintext interface is obtained to obtain plaintext data from the memory; if the plaintext data key is not obtained, the data key ciphertext and the ID of the KMS master key are obtained from the memory, and then decrypted through the KMS service interface to obtain the plaintext data key, and the plaintext key is stored in the memory.

[0013] Furthermore, the key deletion interface deletes the corresponding key information in the memory and the local file according to the key_id.

[0014] Furthermore, the Token acquisition interface obtains a Token that can access the KMS service for identity authentication of the Keyring service API call.

[0015] Furthermore, the specific interface definition process is as follows:

[0016] 1) Initialize the cache read-write lock;

[0017] 2) Check whether the master key exists. If not, call the KMS service to create a key;

[0018] 3) Update the configuration storage directory system variables;

[0019] 4) Get key information from cache or service;

[0020] 5) Submit a local key to the cache or service;

[0021] 6) Delete an invalid key;

[0022] 7) Create a new key that can be uniquely retrieved based on the ID and user ID;

[0023] 8) Initialize an iterator object and return a list of key metadata from the global key container;

[0024] 9) Release an iterator object and clean up the key metadata list cached by the object;

[0025] 10) Query whether an iterator object contains a certain key and return its key metadata field;

[0026] 11) Check whether the key type and ID are valid;

[0027] 12) Plugin log output;

[0028] 13) Check whether the key type and the corresponding key length are valid. They may be invalid.

[0029] The present invention also claims protection for a device for implementing a cloud database using a key management service, comprising: at least one memory and at least one processor;

[0030] The at least one memory is used to store a machine-readable program;

[0031] The at least one processor is used to call the machine-readable program to implement the above method.

[0032] The present invention also claims protection for a computer-readable medium having computer instructions stored thereon, which, when executed by a processor, causes the processor to perform the above method.

[0033] Compared with the prior art, the method for using a key management service for a cloud database of the present invention has the following beneficial effects:

[0034] By using database plug-ins, the key management service interface is called, solving the problem of key management in the database. This enhances data security and compliance, improves management efficiency, and reduces the performance loss of data encryption on the database. It facilitates the use of the database and reduces operation and maintenance costs.

[0035] This method can support the database to use key management services, improve data security, meet compliance requirements, cope with complex network environments, improve operational efficiency, and adapt to technological advances and organizational changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flowchart of a method for using a key management service in a cloud database provided by an embodiment of the present invention;

[0037] Figure 2 It is a development schematic diagram provided by an embodiment of the present invention;

[0038] Figure 3 This is an example diagram of the interface definition code provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0040] The embodiment of the present invention provides a method for a cloud database to use a key management service, such as Figure 1As shown, data keys are encrypted and decrypted between the user side and the key management (hereinafter referred to as KMS) service. First, the key for the ciphertext data is obtained from the local storage. If it cannot be obtained, the KMS service is called through the interface to create a ciphertext data key; the user uses the ciphertext data key to obtain the key ciphertext, and then returns the data key ciphertext to the KMS, so as to obtain the plaintext of the data key through the KMS; the plaintext data key and the ciphertext data are used to obtain the plaintext data to be read.

[0041] To implement this method, the following six interfaces are defined through the database plug-in:

[0042] 1. Key list initialization interface (keyring_init).

[0043] The key list initialization interface reads the key data ciphertext, the ID and version information of the KMS master key from the local file and caches them in the memory; if no valid KMS master key ID is read, the KMS service interface is called to create a new KMS master key and cache the returned key ID in the memory and local file.

[0044] 2. Create a key interface (key_generate).

[0045] Create a key interface. If the data key is not queried from the memory, use the KMS service interface to create a ciphertext data key and a plaintext data key; store the obtained key in the memory cache and locally.

[0046] 3. Local persistence interface (key_store).

[0047] The local persistence interface provides a local persistent key storage file in addition to the key memory cache. The file contains the ciphertext data key, the master key ID and version information on the KMS side.

[0048] 4. Obtain the plaintext key interface (key_fetch).

[0049] Get the key plaintext interface to get the plaintext data from the memory; if the plaintext data key is not obtained, get the data key ciphertext and the ID of the KMS master key from the memory, then decrypt it through the KMS service interface, get the plaintext data key, and store the plaintext key in the memory.

[0050] 5. Delete the key interface (key_remove).

[0051] Delete key interface, delete the corresponding key information in memory and local files according to key_id.

[0052] 6. Token (KMS Server) acquisition interface.

[0053] Get a token that can access the KMS service for authentication of Keyring service API calls.

[0054] The specific interface definition is as follows:

[0055] bool init_keyring_locks() / / Initialize cache read-write lock;

[0056] bool create_keyring_dir_if_not_exist(const char*keyring_file_path) / / Check whether the master key exists. If not, call the KMS service to create the key;

[0057] void update_keyring_file_data(INDB_THDthd MY_ATTRIBUTE((unused)),SYS_VAR*var MY_ATTRIBUTE((unused)),void*var_ptr MY_ATTRIBUTE((unused)),const void=save_ptr); / / Update the configured storage directory system variables;

[0058] bool indb_key fetch(const char*key_id,char*key_type,const char*user_id,void**key,size_t*key_len); / / Get key information from cache or service;

[0059] boo1 indb_key_store(const char*key_id,const char*key_type,const char*user_id,const void*key,size_t key_1en); / / Submit a local key to the cache or service;

[0060] bool indb_key_remove(const char*key_id,const char*user_id); / / Delete an invalid key;

[0061] bool indb_key_generate(const char*key_id,const char*key_type,constchar*user_id,size_t key_len); / / Create a new key, uniquely retrieved based on ID and user ID;

[0062] indb_keyring_iterator_init(Keys_iterator*); / / Initialize an iterator object and return a key metadata list bool from the global key container;

[0063] void indb_keyring_iterator_deinit(Keys_iterator*); / / Release an iterator object and clean up the key metadata list cached by the object;

[0064] bool indb_keyring iterator_get_key(Keys_iterator*, char*key_id, char*user_id); / / Query whether an iterator object contains a key and return its key metadata field;

[0065] boo1 check_key_for_writing(IKey*key,std::string error_for); / / Check whether the key type and ID are valid;

[0066] void 1og_operation_error(const char* failed_operation,const char* plugin_name); / / Plugin log output;

[0067] bool is_key_length_and_type_valid(const char*key_type,size_tkey_len); / / Check whether the key type and the corresponding key length are valid, which may be invalid.

[0068] Through the implementation of the above specific functions, the database can be supported to use the KMS service and realize the reading of encrypted data.

[0069] Using key management to encrypt data can effectively prevent potential external and internal data leakage risks. In the complex IT environment of multi-cloud and hybrid cloud environments, key management can help provide consistent key management processes between different cloud environments and local environments, and can reduce the maintenance and operation requirements of internal key management infrastructure, thereby reducing costs. In addition, key management can quickly integrate new technologies to ensure data security.

[0070] This method defines an interface by means of a database plug-in to implement the call to the key management service interface, thereby solving the problem of using the database for key management.

[0071] An embodiment of the present invention also provides a device for implementing a cloud database using a key management service, comprising: at least one memory and at least one processor;

[0072] The at least one memory is used to store a machine-readable program;

[0073] The at least one processor is used to call the machine-readable program to implement the method for the cloud database to use the key management service described in the above embodiment.

[0074] The embodiment of the present invention also provides a computer-readable medium, on which computer instructions are stored, and when the computer instructions are executed by a processor, the processor executes the method for using a key management service for a cloud database described in the above embodiment. Specifically, a system or device equipped with a storage medium can be provided, on which a software program code that implements the functions of any of the above embodiments is stored, and a computer (or CPU or MPU) of the system or device reads and executes the program code stored in the storage medium.

[0075] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0076] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0077] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0078] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or written to a memory provided in an expansion unit connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or the expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0079] The present invention is shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the code review methods in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A method for using a key management service in a cloud database, characterized in that: Encrypt and decrypt data keys between the user side and the KMS service. First, obtain the key for the ciphertext data from the local storage. If it cannot be obtained, call the KMS service through the interface to create the ciphertext data key. The user uses the encrypted data key to obtain the key ciphertext, and then returns the data key ciphertext to KMS, thereby obtaining the plaintext of the data key through KMS; Use the plaintext data key and ciphertext data to obtain the plaintext data to be read; The following interfaces are defined by the database plugin: Key list initialization interface, key creation interface, local persistence interface, key plaintext acquisition interface, key deletion interface, and Token acquisition interface.

2. A method for using a key management service in a cloud database according to claim 1, characterized in that: The key list initialization interface reads the key data ciphertext, the ID and version information of the KMS master key from the local file and caches them in the memory; if no valid KMS master key ID is read, the KMS service interface is called to create a new KMS master key, and the returned key ID is cached in the memory and the local file.

3. A method for using a key management service in a cloud database according to claim 1, characterized in that: The key creation interface uses the KMS service interface to create a ciphertext data key and a plaintext data key if no data key is found in the memory; the obtained key is stored in the memory cache and locally.

4. A method for using a key management service in a cloud database according to claim 1, characterized in that: The local persistence interface includes a key memory cache and provides a local persistent key storage file, which contains the ciphertext data key, the master key ID of the KMS end, and version information.

5. A method for using a key management service in a cloud database according to claim 1, characterized in that: The key plaintext interface is used to obtain plaintext data from the memory; if the plaintext data key is not obtained, the data key ciphertext and the ID of the KMS master key are obtained from the memory, and then decrypted through the KMS service interface to obtain the plaintext data key, and the plaintext key is stored in the memory.

6. A method for using a key management service in a cloud database according to claim 1, characterized in that: The key deletion interface deletes the corresponding key information in the memory and local file according to the key_id.

7. A method for using a key management service in a cloud database according to claim 1, characterized in that: The Token acquisition interface obtains the Token that can access the KMS service for identity authentication of Keyring service API calls.

8. A method for using a key management service in a cloud database according to claim 1, characterized in that: The specific interface definition process is as follows: 1) Initialize the cache read-write lock; 2) Check whether the master key exists. If not, call the KMS service to create a key; 3) Update the configuration storage directory system variables; 4) Get key information from cache or service; 5) Submit a local key to the cache or service; 6) Delete an invalid key; 7) Create a new key that can be uniquely retrieved based on the ID and user ID; 8) Initialize an iterator object and return a list of key metadata from the global key container; 9) Release an iterator object and clean up the key metadata list cached by the object; 10) Query whether an iterator object contains a certain key and return its key metadata field; 11) Check whether the key type and ID are valid; 12) Plugin log output; 13) Check whether the key type and the corresponding key length are valid.

9. A device for implementing a cloud database using a key management service, characterized in that: include: at least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is used to call the machine-readable program to implement the method described in any one of claims 1 to 8.

10. A computer-readable medium, characterized in that The computer readable medium stores computer instructions, which, when executed by a processor, enable the processor to execute the method according to any one of claims 1 to 8.

Images