National secret transparent encryption method and device for vault data

Abstract

The invention relates to the technical field of data processing, in particular to a vault data national secret transparent encryption method, which comprises the following steps: creating a storage directory name in a vault based on directory specification requirements; and creating corresponding encryption keys for storage directories corresponding to the storage directory names in a key management service system, and performing encryption and decryption processing on data based on an encryption space key carried in the encryption keys and conversion between a data encryption key and an encryption date encryption key, the encryption space keys are in one-to-one correspondence with the encryption areas, and the encryption space keys are generated based on key value pairs of input parameters during encryption creation; the data encryption key is in one-to-one correspondence with each sub-file under the encryption directory, and the data encryption key is an encryption factor of a national secret storage encryption algorithm; the encryption date and the encryption key are stored in the file header of each sub-file of the encryption directory, and the data security can be improved by applying the method.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and device for transparently encrypting treasury data with national secrets. Background Art

[0002] With the vigorous development of information technology, data storage is also developing continuously, especially in data encryption storage.

[0003] The current existing data encryption storage method is disk encryption, such as dm-crypt / LUKS. Use LUKS to create an encrypted disk partition or logical volume on the Linux system, and enter the key for decryption when using it. The vault has the following shortcomings when using this method: a. It has high hardware requirements and relatively high costs. b. It has high operation and maintenance costs for shrinking and expanding capacity. c. Different component developers need different disks to store data to ensure data isolation, which is not conducive to disk utilization.

[0004] The current existing encryption algorithm is usually the AES symmetric encryption algorithm, which is a symmetric encryption algorithm based on the Feistel structure. The vault has the following shortcomings when using this method: a. Compared with the national secret algorithm, it relies on foreign technology and cannot achieve independent control. b. Compared with the national secret algorithm, AES is not China's national standard encryption algorithm.

[0005] In view of this, how to provide a data encryption method to improve data security, ensure fine-grained data access control, and achieve data sharing and cooperation has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The embodiments of the present application provide a method for transparently encrypting treasury data with national secrets, a device for transparently encrypting treasury data with national secrets, an electronic device, and a computer storage medium, which are used to improve data security, ensure fine-grained data access control, and realize data sharing and cooperation.

[0007] In a first aspect of an embodiment of the present application, a method for transparently encrypting treasury data with national secrets is provided, comprising:

[0008] Create a storage directory name in the vault based on directory specification requirements;

[0009] In the key management service system, corresponding encryption keys are created for the storage directories corresponding to the storage directory names respectively, and the data is encrypted and decrypted based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file in the encryption directory.

[0010] In a second aspect of the embodiment of the present application, a device for transparently encrypting treasury data with national secrets is provided, comprising:

[0011] a directory creation module, configured to create a storage directory name in the vault based on the directory specification requirements;

[0012] The key creation module is configured to create corresponding encryption keys for each storage directory corresponding to the storage directory name in the key management service system, and encrypt and decrypt the data based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file in the encryption directory.

[0013] In a third aspect of an embodiment of the present application, a computing device is provided, including:

[0014] Memory and processor;

[0015] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned national secret transparent encryption method for treasury data are implemented.

[0016] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned method for transparent national secret encryption of treasury data are implemented.

[0017] The present application provides a method for transparent encryption of vault data with national secrets, comprising: first, creating a storage directory name in the vault based on directory specification requirements; then, creating corresponding encryption keys for each storage directory corresponding to the storage directory name in the key management service system, and encrypting and decrypting the data based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file of the encryption directory.

[0018] The application of the transparent encryption method for treasury data provided by the embodiment of the present application has the following beneficial effects:

[0019] 1. Data security: It is encrypted and protected during storage and transmission. Even if the data is illegally obtained or leaked, sensitive information cannot be decrypted and used, providing higher data security.

[0020] 2. Fine-grained access control: Fine-grained access control policies can be implemented during data storage and transmission. Only users or applications with corresponding access rights can decrypt and use data, ensuring that sensitive data is only accessed by authorized entities.

[0021] 3. Regulatory and compliance requirements: Help meet specific regulatory and compliance requirements, such as data protection laws, privacy regulations, and industry standards. By encrypting data, you can reduce the risk of data leakage and illegal access, and meet compliance requirements for data security.

[0022] 4. Data sharing and collaboration: Encrypted data can be shared and processed between different component developers without worrying about data security issues. Only users or systems with appropriate access rights can decrypt and use the data, which promotes data sharing and collaboration.

[0023] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0025] Figure 1 A schematic diagram of a process for transparently encrypting treasury data provided by an embodiment of the present application;

[0026] Figure 2 A schematic diagram of key conversion in a method for transparent encryption of treasury data provided by an embodiment of the present application;

[0027] Figure 3 A timing diagram of file decryption in a method for transparent encryption of treasury data provided by an embodiment of the present application;

[0028] Figure 4 A schematic diagram of the structure of a device for transparently encrypting treasury data with national secrets provided in an embodiment of the present application;

[0029] Figure 5 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0031] See also Figure 1 , Figure 1 A schematic diagram of a method for transparently encrypting treasury data provided by an embodiment of the present application. Figure 1 As shown, the specific steps include the following steps.

[0032] Step S102: Based on the directory specification requirements, create a storage directory name in the vault.

[0033] Step S104: In the key management service system, corresponding encryption keys are created for the storage directories corresponding to the storage directory names respectively, and the data is encrypted and decrypted based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key.

[0034] It should be noted that the storage directory name here includes a resource library directory and a component model storage directory. The resource library directory is provided for use by treasury dealers, and the component model storage directory is provided for use by component developers.

[0035] It should be noted that the key management service (i.e. KMS, Key Management Server) system here is used to create encryption keys on the one hand, and each encryption key and storage directory has a one-to-one correspondence; on the other hand, it is used to provide the storage of encryption space keys, data encryption keys and encryption date encryption key conversion functions.

[0036] Among them, the encryption space key (ie, EZ key, encryption zone key) corresponds to each encryption zone one by one, and the encryption space key is generated based on the key-value pair of the input parameter when encryption is created.

[0037] The data encryption key (DEK) corresponds one-to-one to each sub-file under the encryption directory, and the data encryption key is an encryption factor of the national secret storage encryption algorithm (SM4).

[0038] The encryption date encryption key (that is, EDEK is encryption data encryption key) is stored in the file header of each sub-file of the encryption directory.

[0039] In an embodiment of the present application, the method for converting the encryption space key, the data encryption key and the encryption date encryption key includes:

[0040] After encrypting the data encryption key through a symmetric encryption algorithm, an encrypted date encryption key is obtained, wherein the encryption factor used by the symmetric encryption algorithm is the encryption space key, that is, EZ Key+DEK=EDEK (DEK is encrypted through a symmetric encryption algorithm to obtain EDEK, wherein the encryption factor used by the encryption algorithm is EZ Key).

[0041] The encrypted date encryption key is encrypted by a symmetric encryption algorithm to obtain a data encryption key, wherein the encryption factor used by the symmetric encryption algorithm is the encryption space key, that is, EDEK+EZ Key=DEK (EDEK is decrypted by a symmetric encryption algorithm to obtain DEK, wherein the encryption factor used by the encryption algorithm is EZ Key).

[0042] like Figure 2 As shown, Figure 2 A schematic diagram of key conversion in a method for transparent national secret encryption of treasury data provided in an embodiment of the present application.

[0043] In the embodiment of the present application, the method of one-to-one correspondence between the encryption space key and each encryption area includes: marking the common storage directory in the vault as an encryption area, matching the corresponding encryption space key for each encryption area, and recording the binding relationship between the encryption space key and the encryption area in the key management service system, wherein the common storage directory is a non-encrypted directory. That is, the method of binding the EZ key to the corresponding directory.

[0044] In one aspect of the embodiment of the present application, a specific implementation is provided in which the KMS first grants the authority of the treasury exclusive dealer to the resource library, and then the treasury exclusive dealer track data is stored in the resource library, as described below.

[0045] The encryption and decryption processing of the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key includes:

[0046] According to the user name corresponding to the vault dealer, the read permission of the encryption area corresponding to the encryption space key is opened in the key management service system;

[0047] The vault dealer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client SDK (i.e. Client) and the vault management node NN (i.e. NameNode).

[0048] Specifically, the method for a treasury specialist user to store data resources into an encryption area is as follows.

[0049] The vault dealer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the vault management node, including:

[0050] The client sends a first instruction to the management node of the vault to request a new resource file to be created in the vault;

[0051] After receiving the first instruction, the management node sends a second instruction to the key management service system to request the encryption date encryption key of the resource file;

[0052] The key management service system, based on the second instruction, generates a first encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the first encryption date encryption key to the management node;

[0053] The management node writes the received first encryption date encryption key into the metadata of the resource file and sends it to the client;

[0054] The client sends the received first encryption date encryption key to the key management service system to request decryption;

[0055] The key management service system uses the first encryption space key corresponding to the encryption zone to decrypt the first encryption date encryption key to obtain a first data encryption key, and sends the first data encryption key to the client;

[0056] The client encrypts the resource file through the national secret storage encryption algorithm with the first data encryption key as the encryption factor, and sends the encrypted resource file to the storage node of the vault for storage.

[0057] In another aspect of the present application, a specific implementation is provided in which the component developer is first granted access to the component model library in the KMS, and then the component developer stores the component model in the component model library, as described below.

[0058] The encryption and decryption processing of the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key includes:

[0059] According to the corresponding user name of the component developer, the read permission of the encryption area of ​​the corresponding encryption space key is opened in the key management service system;

[0060] The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault.

[0061] Specifically, the method for a component developer to store a component model in a library is as follows.

[0062] The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault, including:

[0063] The client sends a third instruction to the management node of the vault to request a new component model file to be created in the vault;

[0064] After receiving the third instruction, the management node sends a fourth instruction requesting the encryption date encryption key of the component model file to the key management service system;

[0065] The key management service system, based on the fourth instruction, generates a second encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the second encryption date encryption key to the management node;

[0066] The management node writes the received second encryption date encryption key into the metadata of the component model file and sends it to the client;

[0067] The client sends the received second encryption date encryption key to the key management service system to request decryption;

[0068] The key management service system uses the second encryption space key corresponding to the encryption zone to decrypt the second encryption date encryption key to obtain a second data encryption key, and sends the second data encryption key to the client;

[0069] The client encrypts the component model file through the national secret storage encryption algorithm with the second data encryption key as the encryption factor, and sends the encrypted component model file to the storage node of the vault for storage.

[0070] The method for granting component developer resource library permissions in the key management service system is described as follows.

[0071] The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault, and also includes:

[0072] The client sends a fifth instruction to the management node of the vault, requesting to read the resource file of the vault;

[0073] The management node, based on the fifth instruction, sends the encrypted resource file to the client;

[0074] The client reads a third encryption date encryption key corresponding to the encrypted resource file, and sends a sixth instruction to the key management service system to decrypt the third encryption date encryption key;

[0075] Based on the sixth instruction, the key management service system uses the encryption space key corresponding to the encryption area to decrypt the third encryption date encryption key into a third data encryption key, and sends the third data encryption key to the client.

[0076] The client decrypts the resource file using the national secret storage encryption algorithm and the third data encryption key as an encryption factor.

[0077] See also Figure 3 , Figure 3 A timing diagram of file decryption in a method for transparent national secret encryption of treasury data provided in an embodiment of the present application.

[0078] The application of the transparent encryption method for treasury data provided by the embodiment of the present application has the following beneficial effects:

[0079] 1. Data security: It is encrypted and protected during storage and transmission. Even if the data is illegally obtained or leaked, sensitive information cannot be decrypted and used, providing higher data security.

[0080] 2. Fine-grained access control: Fine-grained access control policies can be implemented during data storage and transmission. Only users or applications with corresponding access rights can decrypt and use data, ensuring that sensitive data is only accessed by authorized entities.

[0081] 3. Regulatory and compliance requirements: Help meet specific regulatory and compliance requirements, such as data protection laws, privacy regulations, and industry standards. By encrypting data, you can reduce the risk of data leakage and illegal access, and meet compliance requirements for data security.

[0082] 4. Data sharing and collaboration: Encrypted data can be shared and processed between different component developers without worrying about data security issues. Only users or systems with appropriate access rights can decrypt and use the data, which promotes data sharing and collaboration.

[0083] Corresponding to the above method embodiment, this specification also provides an embodiment of a treasury data national secret transparent encryption device, Figure 4 This is a schematic diagram of the structure of a device for transparently encrypting treasury data provided by an embodiment of the present application. Figure 4 As shown, the device comprises:

[0084] A directory creation module 402 is configured to create a storage directory name in the vault based on directory specification requirements;

[0085] The key creation module 404 is configured to create corresponding encryption keys for each storage directory corresponding to the storage directory name in the key management service system, and encrypt and decrypt the data based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file in the encryption directory.

[0086] In an optional embodiment, the key creation module 404 is further configured to:

[0087] After encrypting the data encryption key by a symmetric encryption algorithm, an encryption date encryption key is obtained, wherein the encryption factor used by the symmetric encryption algorithm is an encryption space key;

[0088] The encrypted date encryption key is encrypted by a symmetric encryption algorithm to obtain a data encryption key, wherein the encryption factor used by the symmetric encryption algorithm is an encryption space key.

[0089] In an optional embodiment, the key creation module 404 is further configured to: mark the ordinary storage directory in the vault as an encryption area, match the corresponding encryption space key for each encryption area, and record the binding relationship between the encryption space key and the encryption area in the key management service system, wherein the ordinary storage directory is a non-encrypted directory.

[0090] In an optional embodiment, the key creation module 404 is further configured to:

[0091] According to the user name corresponding to the vault dealer, the read permission of the encryption area corresponding to the encryption space key is opened in the key management service system;

[0092] The vault dealer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the vault management node.

[0093] In an optional embodiment, the key creation module 404 is further configured to:

[0094] The client sends a first instruction to the management node of the vault to request a new resource file to be created in the vault;

[0095] After receiving the first instruction, the management node sends a second instruction to the key management service system to request the encryption date encryption key of the resource file;

[0096] The key management service system, based on the second instruction, generates a first encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the first encryption date encryption key to the management node;

[0097] The management node writes the received first encryption date encryption key into the metadata of the resource file and sends it to the client;

[0098] The client sends the received first encryption date encryption key to the key management service system to request decryption;

[0099] The key management service system uses the first encryption space key corresponding to the encryption zone to decrypt the first encryption date encryption key to obtain a first data encryption key, and sends the first data encryption key to the client;

[0100] The client encrypts the resource file through the national secret storage encryption algorithm with the first data encryption key as the encryption factor, and sends the encrypted resource file to the storage node of the vault for storage.

[0101] In an optional embodiment, the key creation module 404 is further configured to: open a read permission for the encryption area corresponding to the encryption space key in the key management service system according to the user name corresponding to the component developer;

[0102] The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault.

[0103] In an optional embodiment, the key creation module 404 is further configured to: the client sends a third instruction to the management node of the vault to request to create a new component model file in the vault;

[0104] After receiving the third instruction, the management node sends a fourth instruction requesting the encryption date encryption key of the component model file to the key management service system;

[0105] The key management service system, based on the fourth instruction, generates a second encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the second encryption date encryption key to the management node;

[0106] The management node writes the received second encryption date encryption key into the metadata of the component model file and sends it to the client;

[0107] The client sends the received second encryption date encryption key to the key management service system to request decryption;

[0108] The key management service system uses the second encryption space key corresponding to the encryption zone to decrypt the second encryption date encryption key to obtain a second data encryption key, and sends the second data encryption key to the client;

[0109] The client encrypts the component model file through the national secret storage encryption algorithm with the second data encryption key as the encryption factor, and sends the encrypted component model file to the storage node of the vault for storage.

[0110] In an optional embodiment, the key creation module 404 is further configured to:

[0111] The client sends a fifth instruction to the management node of the vault, requesting to read the resource file of the vault;

[0112] The management node, based on the fifth instruction, sends the encrypted resource file to the client;

[0113] The client reads a third encryption date encryption key corresponding to the encrypted resource file, and sends a sixth instruction to the key management service system to decrypt the third encryption date encryption key;

[0114] Based on the sixth instruction, the key management service system uses the encryption space key corresponding to the encryption area to decrypt the third encryption date encryption key into a third data encryption key, and sends the third data encryption key to the client.

[0115] The client decrypts the resource file using the national secret storage encryption algorithm and the third data encryption key as an encryption factor.

[0116] The application of the treasury data national secret transparent encryption device provided in the embodiment of the present application has the following beneficial effects:

[0117] 1. Data security: It is encrypted and protected during storage and transmission. Even if the data is illegally obtained or leaked, sensitive information cannot be decrypted and used, providing higher data security.

[0118] 2. Fine-grained access control: Fine-grained access control policies can be implemented during data storage and transmission. Only users or applications with corresponding access rights can decrypt and use data, ensuring that sensitive data is only accessed by authorized entities.

[0119] 3. Regulatory and compliance requirements: Help meet specific regulatory and compliance requirements, such as data protection laws, privacy regulations, and industry standards. By encrypting data, you can reduce the risk of data leakage and illegal access, and meet compliance requirements for data security.

[0120] 4. Data sharing and collaboration: Encrypted data can be shared and processed between different component developers without worrying about data security issues. Only users or systems with appropriate access rights can decrypt and use the data, which promotes data sharing and collaboration.

[0121] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the treasury data national secret transparent encryption device, since it is basically similar to the treasury data national secret transparent encryption method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the treasury data national secret transparent encryption method embodiment.

[0122] Figure 5 This is a block diagram of a computing device provided in an embodiment of the present application. The components of the computing device 500 include but are not limited to a memory 510 and a processor 520. The processor 520 is connected to the memory 510 via a bus 530, and the database 550 is used to store data.

[0123] The computing device 500 also includes an access device 540, which enables the computing device 500 to communicate via one or more networks 560. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 540 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0124] In one embodiment of the present specification, the above components of the computing device 500 and Figure 5 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 5 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0125] The computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 500 may also be a mobile or stationary server.

[0126] Among them, the processor 520 is used to execute the following computer-executable instructions, which, when executed by the processor, implement the steps of the above-mentioned national secret transparent encryption method for treasury data.

[0127] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the embodiment of the method for transparent encryption of treasury data, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for transparent encryption of treasury data.

[0128] An embodiment of the present specification also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned method for transparent encryption of treasury data.

[0129] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the embodiment of the method for transparent encryption of treasury data, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for transparent encryption of treasury data.

[0130] An embodiment of the present specification also provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned method for transparent encryption of treasury data.

[0131] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer program embodiment, since it is basically similar to the embodiment of the method for transparent encryption of treasury data, the description is relatively simple, and the relevant parts can be referred to the partial description of the embodiment of the method for transparent encryption of treasury data.

[0132] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0133] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0134] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0135] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0136] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A method for transparent encryption of treasury data, characterized in that: include: Create a storage directory name in the vault based on directory specification requirements; In the key management service system, corresponding encryption keys are created for the storage directories corresponding to the storage directory names respectively, and the data is encrypted and decrypted based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file in the encryption directory.

2. The method according to claim 1, characterized in that The method for converting the encryption space key, the data encryption key and the encryption date encryption key comprises: After encrypting the data encryption key by a symmetric encryption algorithm, an encryption date encryption key is obtained, wherein the encryption factor used by the symmetric encryption algorithm is an encryption space key; The encrypted date encryption key is encrypted by a symmetric encryption algorithm to obtain a data encryption key, wherein the encryption factor used by the symmetric encryption algorithm is an encryption space key.

3. The method according to claim 1, characterized in that The method of one-to-one correspondence between the encryption space key and each encryption area includes: Mark the common storage directory in the vault as an encryption area, match the corresponding encryption space key for each encryption area, and record the binding relationship between the encryption space key and the encryption area in the key management service system, wherein the common storage directory is a non-encrypted directory.

4. The method according to claim 1, characterized in that: The storage directory name includes a resource library directory and a component model storage directory. The resource library directory is provided to the vault dealers, and the component model storage directory is provided to the component developers. The encryption and decryption processing of data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key includes: According to the user name corresponding to the vault dealer, the read permission of the encryption area corresponding to the encryption space key is opened in the key management service system; The vault dealer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the vault management node.

5. The method according to claim 4, characterized in that The vault dealer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the vault management node, including: The client sends a first instruction to the management node of the vault to request a new resource file to be created in the vault; After receiving the first instruction, the management node sends a second instruction to the key management service system to request the encryption date encryption key of the resource file; The key management service system, based on the second instruction, generates a first encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the first encryption date encryption key to the management node; The management node writes the received first encryption date encryption key into the metadata of the resource file and sends it to the client; The client sends the received first encryption date encryption key to the key management service system to request decryption; The key management service system uses the first encryption space key corresponding to the encryption zone to decrypt the first encryption date encryption key to obtain a first data encryption key, and sends the first data encryption key to the client; The client encrypts the resource file through the national secret storage encryption algorithm with the first data encryption key as the encryption factor, and sends the encrypted resource file to the storage node of the vault for storage.

6. The method according to claim 4, characterized in that The encryption and decryption processing of the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key includes: According to the corresponding user name of the component developer, the read permission of the encryption area of ​​the corresponding encryption space key is opened in the key management service system; The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault.

7. The method according to claim 6, characterized in that The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault, including: The client sends a third instruction to the management node of the vault to request a new component model file to be created in the vault; After receiving the third instruction, the management node sends a fourth instruction requesting the encryption date encryption key of the component model file to the key management service system; The key management service system, based on the fourth instruction, generates a second encryption date encryption key using the encryption space key corresponding to the encryption zone, and sends the second encryption date encryption key to the management node; The management node writes the received second encryption date encryption key into the metadata of the component model file and sends it to the client; The client sends the received second encryption date encryption key to the key management service system to request decryption; The key management service system uses the second encryption space key corresponding to the encryption zone to decrypt the second encryption date encryption key to obtain a second data encryption key, and sends the second data encryption key to the client; The client encrypts the component model file through the national secret storage encryption algorithm with the second data encryption key as the encryption factor, and sends the encrypted component model file to the storage node of the vault for storage.

8. The method according to claim 6, characterized in that The component developer who obtains the read permission encrypts and decrypts the data based on the encryption space key carried in the encryption key and the conversion of the data encryption key and the encryption date encryption key by interacting with the client and the management node of the vault, and also includes: The client sends a fifth instruction to the management node of the vault, requesting to read the resource file of the vault; The management node, based on the fifth instruction, sends the encrypted resource file to the client; The client reads a third encryption date encryption key corresponding to the encrypted resource file, and sends a sixth instruction to the key management service system to decrypt the third encryption date encryption key; Based on the sixth instruction, the key management service system uses the encryption space key corresponding to the encryption area to decrypt the third encryption date encryption key into a third data encryption key, and sends the third data encryption key to the client. The client decrypts the resource file using the national secret storage encryption algorithm and the third data encryption key as an encryption factor.

9. A device for transparently encrypting treasury data, characterized in that: include: a directory creation module, configured to create a storage directory name in the vault based on the directory specification requirements; The key creation module is configured to create corresponding encryption keys for each storage directory corresponding to the storage directory name in the key management service system, and encrypt and decrypt the data based on the encryption space key carried in the encryption key, and the conversion of the data encryption key and the encryption date encryption key, wherein the encryption space key corresponds to each encryption area one by one, and the encryption space key is generated based on the key-value pair of the input parameter when the encryption is created; the data encryption key corresponds to each sub-file under the encryption directory one by one, and the data encryption key is the encryption factor of the national secret storage encryption algorithm; the encryption date encryption key is stored in the file header of each sub-file in the encryption directory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an implementation program for information transmission, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images