Full-secret-state database secret key management method and device, electronic equipment and storage medium

Abstract

The invention provides a full-secret-state database secret key management method and device, electronic equipment and a storage medium, relates to the technical field of computers, and is suitable for the field of financial science and technology. The method comprises the following steps: acquiring a data key and a key algorithm; sending a main secret key management information acquisition request to a database server; main secret key management information sent by the database server is obtained, the obtained main secret key management information is sent to the secret key management server side, and the main secret key management information is used for the secret key management server side to search the main secret key; acquiring a main secret key sent by a secret key management server, and performing secret key encryption according to the data secret key, the secret key algorithm and the main secret key to obtain a ciphertext data secret key storage request; and sending a ciphertext data key storage request to the database server and deleting the main key, and extracting ciphertext data key information and storing the ciphertext data key information by the database server. According to the method and the device, the key management security can be improved, and the key management migration and synchronization difficulty is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology and is applicable to the field of financial technology, and in particular to a method and device for managing secret keys of a fully encrypted database, an electronic device, and a storage medium. Background Art

[0002] Personal and sensitive information is stored in databases. If this data is not adequately protected, there is a risk of leakage. Fully encrypted databases use encryption technology to prevent unauthorized access to data during storage and transmission, thereby greatly improving data security. For example, in banking scenarios within the fintech sector, fully encrypted databases can be used to store customer information (such as bank card numbers and bank card passwords). Another example is in insurance scenarios within the fintech sector, fully encrypted databases can be used to store customer information (such as policy numbers and insurance information).

[0003] However, existing technologies have defects in key management, such as security issues caused by the risk of accidental deletion and leakage of keys, and the difficulty of key management migration and synchronization. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a fully confidential database key management method and device, electronic device, and storage medium, which can improve the security of key management and reduce the difficulty of key management migration and synchronization.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application proposes a method for managing secret keys in a fully encrypted database, which is applied to an application client. The method includes:

[0006] Obtain data key and key algorithm;

[0007] Sending a master key management information acquisition request to the database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information;

[0008] Obtaining the master key management information sent by the database server, and sending the obtained master key management information to the key management server, wherein the master key management information is used by the key management server to search for the master key;

[0009] Obtain the master key sent by the key management server, and perform key encryption based on the data key, the key algorithm, and the master key to obtain a ciphertext data key storage request;

[0010] The ciphertext data key storage request is sent to the database server and the master key is deleted, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

[0011] In some embodiments, before obtaining the data key and the key algorithm, the method further includes:

[0012] Obtain master key management information and encryption algorithm;

[0013] Sending a master key management information storage request to the database server and deleting the master key management information, wherein the master key management information storage request is used to request the database server to store the master key management information;

[0014] A master key creation request is sent to the key management server, wherein the master key creation request is used to request the key management server to generate a master key based on the master key management information and the encryption algorithm, and to store the master key management information and the master key in correspondence.

[0015] In some embodiments, the master key management information includes a master key name and a master key acquisition feature code;

[0016] The generating a master key based on the master key management information and the encryption algorithm, and storing the master key management information and the master key in correspondence, includes:

[0017] Performing key generation on the master key name and the master key acquisition feature code using the encryption algorithm to obtain the master key;

[0018] The master key name, the master key acquisition feature code and the master key are stored correspondingly.

[0019] In some embodiments, sending a master key creation request to the key management server includes:

[0020] Sending a connection verification request to the key management server, wherein the connection verification request is used to request the key management server to verify whether the application client is connected to the key management server or not, and obtaining a connection verification result;

[0021] Obtaining the connection verification result sent by the key management server, and if the connection verification result indicates that the application client is connected to the key management server, sending a master key creation permission verification request to the database server, wherein the master key creation permission verification request is used to request the database server to verify whether the target object has master key creation permission, and obtain a permission verification result;

[0022] Obtain the permission verification result sent by the database server. If the permission verification result indicates that the target object has the master key creation permission, generate a master key creation request based on the master key management information and the encryption algorithm, and send the master key creation request to the key management server.

[0023] In some embodiments, after sending the ciphertext data key storage request to the database server and deleting the master key, the method further includes:

[0024] Obtaining an original table, and determining table-specified data from the original table;

[0025] Encrypting the table specified data according to the data secret key to obtain ciphertext table specified data;

[0026] Generate an encryption information creation request based on the data key and the ciphertext table specified data;

[0027] Sending the encryption information creation request to the database server, wherein the encryption information creation request is used to request the database server to verify whether the target object has or does not have the associated ciphertext data key permission, and when it is verified that the target object has the associated ciphertext data key permission, extracting encryption information from the encryption information creation request and recording the encryption information in a preset data key management system table;

[0028] Obtain an information creation result sent by the database server based on the encryption information creation request; wherein the information creation result is used to indicate whether the encryption information creation is successful or failed.

[0029] In some embodiments, after sending the ciphertext data key storage request to the database server and deleting the master key, the method further includes:

[0030] Get plaintext object data;

[0031] Sending a ciphertext data key acquisition request to the database server, wherein the ciphertext data key acquisition request requests the database server to search for the ciphertext data key, the master key name, and the master key acquisition feature code;

[0032] Obtaining the ciphertext data key, the master key name, and the master key acquisition feature code sent by the database server, and sending the master key name and the master key acquisition feature code to the key management server, where the master key name and the master key acquisition feature code are used by the key management server to search for the master key;

[0033] Obtain the master key sent by the key management server, and decrypt the ciphertext data key according to the master key to obtain the plaintext data key;

[0034] The plaintext object data is encrypted according to the plaintext data secret key to obtain ciphertext object data, and an object data storage request is sent to the database server and the plaintext object data is deleted. The object data storage request is used to request the database server to store the ciphertext object data.

[0035] In some embodiments, after encrypting the plaintext object data according to the plaintext data key to obtain ciphertext object data, sending an object data storage request to the database server, and deleting the plaintext object data, the method further includes:

[0036] Sending an object data acquisition request to the database server, wherein the object data acquisition request is used to request the database server to search for the ciphertext object data, the ciphertext data key, the master key name, and the master key feature code;

[0037] Obtaining the ciphertext object data, the ciphertext data key, the master key name, and the master key characteristic code sent by the database server, and sending the master key name and the master key acquisition characteristic code to the key management server, where the master key name and the master key acquisition characteristic code are used by the key management server to search for the master key;

[0038] Obtain the master key sent by the key management server, and decrypt the ciphertext data key according to the master key to obtain the plaintext data key;

[0039] The ciphertext object data is decrypted according to the plaintext data secret key to obtain the plaintext object data.

[0040] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a fully encrypted database key management device, which is applied to an application client, and the device includes:

[0041] Key information acquisition module, used to obtain data keys and key algorithms;

[0042] a management information request module, configured to send a master key management information acquisition request to a database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information;

[0043] A master key request acquisition function is used to acquire the master key management information sent by the database server and send the acquired master key management information to the key management server, wherein the master key management information is used by the key management server to search for the master key;

[0044] a data key encryption module, configured to obtain the master key sent by the key management server, and perform key encryption based on the data key, the key algorithm, and the master key to obtain a ciphertext data key storage request;

[0045] The data key transfer module is used to send the ciphertext data key storage request to the database server and delete the master key, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

[0046] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the fully confidential database key management method described in the first aspect above.

[0047] To achieve the above-mentioned purpose, the fourth aspect of the embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the fully confidential database key management method described in the first aspect above.

[0048] The fully confidential database key management method and device, electronic device, and storage medium proposed in this application are mainly used in a communication architecture including an application client, a database server, and a key management server. The data key is used to encrypt and decrypt data. The application client is prone to accidentally deleting the data key and leaking the data key. Therefore, after obtaining the data key, it is expected that the database server will store the data key. However, if the data key is directly stored in plain text on the database server, there is a risk of easy leakage. Therefore, the master key needs to be used to encrypt the data key. However, if the master key is stored on the application client, there is a risk of easy accidental deletion of the master key. If it is stored on the database server, it will bring about master key synchronization and migration problems. Therefore, it is expected that the key management end will store the master key, and considering the risk of master key leakage, the database server and the key management end need to jointly implement master key acquisition. Specifically, the database server stores the master key management information, and the key management server stores the master key management information and the master key accordingly. The application client then requests the master key management information sent by the database server, and based on the master key management information, requests the master key sent by the key management server. The application client then performs key encryption based on the data key, key algorithm, and master key to obtain a ciphertext data key storage request. Finally, the application client sends a ciphertext data key storage request to the database server and deletes the master key. The database server extracts the ciphertext data key information and stores it. In summary, this application can improve the security of key management and reduce the difficulty of key management migration and synchronization. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flowchart of the fully encrypted database key management method provided by an embodiment of the present application;

[0050] Figure 2 This is a flowchart of a fully encrypted database key management method provided by another embodiment of the present application;

[0051] Figure 3 yes Figure 2 Flowchart of step 203 in FIG.

[0052] Figure 4 This is a flowchart of a fully encrypted database key management method provided by another embodiment of the present application;

[0053] Figure 5 This is a flowchart of a fully encrypted database key management method provided by another embodiment of the present application;

[0054] Figure 6 This is a flowchart of a fully encrypted database key management method provided by another embodiment of the present application;

[0055] Figure 7This is a module structure diagram of the fully encrypted database key management device provided in an embodiment of the present application;

[0056] Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0058] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0060] Data privacy protection is a critical issue. Personal and sensitive information is stored in databases. If this data is not adequately protected and leaked, it could pose a serious threat to personal privacy and even lead to legal consequences. Fully encrypted databases use encryption technology to prevent unauthorized access to data during storage and transmission, significantly improving data security. Fully encrypted databases also offer advantages in supporting data sharing and collaboration. In today's business environment, data sharing and collaboration are common needs. However, data sharing often carries the risk of privacy breaches. Fully encrypted databases use encryption technology to support data sharing and analysis without leaking the original data, thereby promoting secure data collaboration.

[0061] Based on this, the main purpose of the embodiments of this application is to propose a fully confidential database key management method and device, electronic device, and storage medium, aiming to improve the security of key management and reduce the difficulty of key management migration and synchronization, thereby promoting data sharing and collaboration.

[0062] The fully secret database key management method provided in the embodiment of the present application is applied to the server side (including the key management server side or the database server), and can also be software running on the terminal (including the application client) or the server side. The server side can be configured as an independent physical server, or as a server cluster or distributed system composed of multiple physical servers, or as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the fully secret database key management method, etc., but is not limited to the above forms.

[0063] The present application can be used in many general or special computer system environments or configurations. For example: server computers, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0064] The embodiments of the present application provide a fully encrypted database key management method and device, electronic device, and storage medium, which are specifically illustrated by the following embodiments. First, the fully encrypted database key management method in the embodiments of the present application is described.

[0065] Figure 1 This is an optional flowchart of the fully encrypted database key management method provided in an embodiment of the present application. The fully encrypted database key management method is applied to an application client and may include but is not limited to steps 101 to 105.

[0066] Step 101, obtain the data key and key algorithm;

[0067] Step 102: Send a master key management information acquisition request to the database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information;

[0068] Step 103: Obtain the master key management information sent by the database server, and send the obtained master key management information to the key management server. The master key management information is used by the key management server to find the master key.

[0069] Step 104: Obtain the master key sent by the key management server, and perform key encryption based on the data key, key algorithm, and master key to obtain a ciphertext data key storage request;

[0070] Step 105: Send a ciphertext data key storage request to the database server and delete the master key, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

[0071] Steps 101 to 105 shown in the embodiment of the present application are mainly applied to a communication architecture including an application client, a database server and a key management server. The data key is used to encrypt and decrypt data. The application client is prone to accidentally deleting the data key and leaking the data key. Therefore, after obtaining the data key, it is expected that the database server will store the data key. However, if the data key is directly stored in plain text on the database server, there is a risk of easy leakage. Therefore, it is necessary to use a master key to encrypt the data key. However, if the master key is stored on the application client, there is a risk of accidentally deleting the master key. If it is stored on the database server, it will bring about master key synchronization and migration problems. Therefore, it is expected that the key management end will store the master key. Considering the risk of master key leakage, the database server and the key management end need to jointly implement master key acquisition. Specifically, the database server stores the master key management information, and the key management server stores the master key management information and the master key accordingly. The application client requests to obtain the master key management information sent by the database server, and based on the master key management information, requests to obtain the master key sent by the key management server. The application client then performs key encryption based on the data key, key algorithm, and master key, generating a ciphertext data key storage request. Finally, the application client sends the ciphertext data key storage request to the database server and deletes the master key. The database server extracts the ciphertext data key information and stores it. In summary, this application can improve key management security and reduce the difficulty of key management migration and synchronization.

[0072] Before introducing steps 101 to 105 in detail, the communication architecture provided by the embodiment of the present application is first introduced. In one embodiment, the communication architecture includes an application client, a database server, and a key management server.

[0073] An application client is a software program that runs on a user's device (such as a computer, smartphone, or tablet), typically used to access and execute specific functions or services. Working in conjunction with the server, the application client interacts with the server over the network, obtaining and processing data to provide the desired functionality and experience.

[0074] A database server is a computer system or software specifically used to store, manage, and provide database operation services. It typically runs a database management system and processes requests from application clients to implement data storage, retrieval, and management.

[0075] A Key Management Service (KMS) is a server-side service that provides key management services. It manages keys throughout their lifecycle, allowing users to easily create and manage keys to meet requirements such as data encryption and decryption, and digital signature verification.

[0076] In one embodiment, referring to Figure 2 Before step 101, the fully encrypted database key management method further includes:

[0077] Step 201: Obtain master key management information and encryption algorithm;

[0078] Step 202: Send a master key management information storage request to the database server and delete the master key management information, wherein the master key management information storage request is used to request the database server to store the master key management information;

[0079] Step 203: Send a master key creation request to the key management server, wherein the master key creation request is used to request the key management server to generate a master key based on the master key management information and the encryption algorithm, and store the master key management information and the master key in correspondence.

[0080] In step 201, the application client obtains master key management information and an encryption algorithm. The master key is used to encrypt and decrypt data keys. The encryption algorithm is the algorithm used to generate the master key. The user enters the master key management information and encryption algorithm through an input box or selects them through a checkbox.

[0081] In step 202, the application client generates a master key management information storage request based on the master key management information. It then sends the master key management information storage request to the database server and deletes the master key management information. The master key management information storage request may include the application client's address, user ID, master key management information, and a first operation request. The first operation request is used to request the database server to store the user ID and master key management information in a corresponding manner.

[0082] In one embodiment, the master key management information includes a master key name and a master key acquisition signature. Step 202 may include: performing a key generation operation on the master key name and the master key acquisition signature using an encryption algorithm to obtain a master key; and storing the master key name, the master key acquisition signature, and the master key in a corresponding manner. This eliminates the need for the application client to store the master key and requires only the master key name and the master key acquisition signature to be obtained from the key management server, thereby enhancing security.

[0083] In one example, the database server creates a master key management system table to store master key management information. The master key management information mainly includes fields such as the master key number, master key name, master key owner, master key acquisition feature code, and master key authorization information.

[0084] In step 203, the application client generates a master key creation request based on the master key management information and the encryption algorithm, and then sends the master key creation request to the key management server. In response to the master key creation request, the key management server generates a master key based on the master key management information and the encryption algorithm, and stores the master key management information in a corresponding manner. For example, the database server creates a master key table that stores the correspondence between the master key management information and the master key.

[0085] The benefits of the embodiment of steps 201 to 203 above are that, by having the database server store the master key management information and the key management server store the correspondence between the master key management information and the master key, the risk of application clients accidentally deleting the master key is reduced. Furthermore, obtaining the master key requires both the database server and the key management server, reducing the risk of master key leakage. Furthermore, when the master key needs to be updated (including migration, synchronization, and modification), it can be performed on a per-user basis, without having to synchronize it with all application clients.

[0086] In one embodiment, referring to Figure 3 , step 203 may include:

[0087] Step 301: Send a connection verification request to the key management server. The connection verification request is used to request the key management server to verify whether the application client is connected to the key management server or not, and obtain a connection verification result.

[0088] Step 302: Obtain a connection verification result from the key management server. If the connection verification result indicates that the application client is connected to the key management server, a master key creation permission verification request is sent to the database server. The master key creation permission verification request is used to request the database server to verify whether the target object has master key creation permission, and obtain a permission verification result.

[0089] Step 303: Obtain the permission verification result sent by the database server. If the permission verification result indicates that the target object has the master key creation permission, generate a master key creation request based on the master key management information and encryption algorithm, and send the master key creation request to the key management server.

[0090] In step 301, the connection verification request includes fields such as the application client's IP address, machine number, digital certificate, and username. In response to the connection verification request, the key management server performs a first verification on the application client's IP address, machine number, digital certificate, and username. After the first verification passes, the application client sends a user password acquisition request. In response to the user key acquisition request, the application client sends password information to the key management server. The key management server performs a second verification on the password information. After the second verification passes, it sends a connection verification result to the application client indicating that the application client is connected to the key management server. If either the first verification or the second verification fails, the key management server sends a connection verification result to the application client indicating that the application client and the key management server are not connected.

[0091] In step 302, the database server creates a master key management system table that stores master key authorization information. This master key authorization information includes multiple candidate identifiers of users with master key creation permission. A master key creation permission verification request includes the target identifier of the target object. The database server compares the target identifier with the candidate identifiers. If the target identifier matches one of the candidate identifiers, a permission verification result is generated indicating that the target object has master key creation permission. If the target identifier does not match any of the candidate identifiers, a permission verification result is generated indicating that the target object does not have master key creation permission.

[0092] In step 303, if the permission check result indicates that the target object does not have the master key creation permission, a master key creation permission request is sent to the key management server. The master key creation permission request is used to request the key management server to assign the master key creation permission to the target object and notify the database server.

[0093] The benefit of the embodiment of the above steps 301 to 303 is that it improves the security of master key management by improving permission verification.

[0094] In step 101 of some embodiments, the application client obtains a data key and a key algorithm. The data key is used to encrypt and decrypt data. The key algorithm refers to the algorithm used to encrypt and decrypt the data key. The data key and key algorithm are entered by the user through an input box or selected through a checkbox.

[0095] In step 102 of some embodiments, the application client generates a master key management information acquisition request and then sends the master key management information acquisition request to the database server. The master key management information acquisition request includes the application client's address, user ID, a secondary operation request, and additional information. The secondary operation request is used to request that the database server search for the master key management information associated with the user ID. The additional information includes notes and instructions, such as any supplementary information or special requirements related to the request. The additional information may also include a request timestamp, such as recording the time the request was generated, to facilitate traceability and management.

[0096] In one example, the database server matches the user identifier in the master key management information acquisition request with the master key user field in the master key management system table to obtain the matching user field; and extracts the master key management information corresponding to the matching user field from the master key management system table.

[0097] In step 103 of some embodiments, the application client obtains the master key management information sent by the database server and sends the obtained master key management information to the key management server. The master key management information is used by the key management server to find the master key.

[0098] The key management server creates a master key table that stores the correspondence between master key management information and master keys. The key management server can retrieve the master key from the master key management information sent by the application client by searching the master key table.

[0099] In some embodiments, in steps 104 and 105, the application client obtains the master key sent by the key management server; the application client performs key encryption based on the data key, the key algorithm, and the master key to obtain the ciphertext data key; the application client generates a ciphertext data key storage request based on the ciphertext data key; and the application client sends the ciphertext data key storage request to the database server and deletes the master key. The ciphertext data key storage request is used to request the database server to extract and store the ciphertext data key information. For example, the ciphertext data key storage request includes fields such as the application client's address, user ID, ciphertext data key, and a third operation request. The third operation request is used to request the database server to store the user ID and ciphertext data key information in a corresponding manner.

[0100] In one example, the database server creates a data key system table for storing ciphertext data key information. The ciphertext data key information primarily includes fields such as the ciphertext data key number, ciphertext data key name, ciphertext data key owner, ciphertext data key authorization information, associated master key number, and ciphertext data key.

[0101] In one embodiment, referring to Figure 4 After step 105, the fully encrypted database key management method may further include:

[0102] Step 401: Obtain the original table and determine the table-specified data from the original table;

[0103] Step 402: Encrypt the table-specified data using the data key to obtain the ciphertext table-specified data.

[0104] Step 403: Generate an encryption information creation request based on the data key and the ciphertext table specified data;

[0105] Step 404: Send an encryption information creation request to the database server. The encryption information creation request is used to request the database server to verify whether the target object has the associated ciphertext data key permission. If it is verified that the target object has the associated ciphertext data key permission, the database server extracts the encryption information from the encryption information creation request and records the encryption information in a preset data key management system table.

[0106] Step 405: Obtain the information creation result sent by the database server based on the encryption information creation request; wherein the information creation result is used to indicate whether the encryption information creation is successful or failed.

[0107] In step 401, the original table is a data table containing multiple data columns. Table-specific data refers to the data columns in the original table that are designated to be encrypted. The target object selects the table-specific data from the original table based on its requirements. In one example, the original table can be the target object's bank statement, insurance claim record, or the like.

[0108] In step 402, the table-specified data may be encrypted using a data key and a selected data encryption algorithm. The specific process is as follows: the table-specified data is divided into blocks of a fixed size; the encryption algorithm and the data key are applied to each data block to generate a corresponding ciphertext data block; and the ciphertext data blocks are merged to obtain the ciphertext table-specified data.

[0109] In step 403, the address of the application client, the target identifier of the target object, the associated information of the data key (such as the ciphertext data key number, the associated master key number) and the ciphertext table specified data can be assembled to obtain an encryption information creation request.

[0110] In step 404, the database server compares the target identifier of the target object in the encryption information creation request with multiple candidate identifiers in the ciphertext data key authorization information in the data key system table. If the target identifier is the same as one of the candidate identifiers, the target object is verified to have the associated ciphertext data key permission. If the target identifier is different from any of the candidate identifiers, the target object is verified to not have the associated ciphertext data key permission. If it is verified that the target object has the associated ciphertext data key permission, the encryption information is extracted from the encryption information creation request and recorded in the data key management system table, specifically in the field description in the data key management system table. The encryption information includes the ciphertext table-specified data and the source type of the table-specified data, so that the target object is aware of the source type.

[0111] The benefit of the embodiment of steps 401 to 404 is that the table-specified data of the encrypted target object can be stored in a database server, thereby improving the flexibility of data encryption management and meeting user needs in a personalized manner.

[0112] In one embodiment, referring to Figure 5 After step 105, the fully encrypted database key management method may further include:

[0113] Step 501, obtaining plaintext object data;

[0114] Step 502: Send a ciphertext data key acquisition request to the database server, wherein the ciphertext data key acquisition request database server searches for the ciphertext data key, the master key name, and the master key acquisition feature code;

[0115] Step 503: Obtain the ciphertext data key, master key name, and master key acquisition code sent by the database server, and send the master key name and master key acquisition code to the key management server. The master key name and master key acquisition code are used by the key management server to find the master key.

[0116] Step 504: Obtain the master key sent by the key management server, decrypt the ciphertext data key using the master key, and obtain the plaintext data key;

[0117] Step 505: Encrypt the plaintext object data according to the plaintext data key to obtain ciphertext object data, and send an object data storage request to the database server and delete the plaintext object data. The object data storage request is used to request the database server to store the ciphertext object data.

[0118] In step 501, for example, in a banking scenario within the FinTech field, the plaintext object data may include bank account information, bank account passwords, bank statements, etc. For another example, in an insurance scenario within the FinTech field, the plaintext object data may include insurance account information, insurance account passwords, insurance application records, and claims records.

[0119] The benefit of the above embodiment is that the master key is stored by the key management server, and when obtaining the master key, it is necessary to go through both the database server and the key management server, thereby improving the security of data encryption.

[0120] In one embodiment, referring to Figure 6 After step 105, the fully encrypted database key management method may further include:

[0121] Step 601: Send an object data acquisition request to a database server. The object data acquisition request is used to request the database server to search for ciphertext object data, ciphertext data key, master key name, and master key signature.

[0122] Step 602: Obtain the ciphertext object data, ciphertext data key, master key name, and master key signature code from the database server, and send the master key name and master key acquisition signature code to the key management server. The master key name and master key acquisition signature code are used by the key management server to locate the master key.

[0123] Step 603: Obtain the master key sent by the key management server, decrypt the ciphertext data key using the master key, and obtain the plaintext data key;

[0124] Step 604: decrypt the ciphertext object data according to the plaintext data key to obtain the plaintext object data.

[0125] The benefit of the above embodiment is that the master key is stored by the key management server, and when obtaining the master key, it is necessary to go through both the database server and the key management server, thereby improving the security of data decryption.

[0126] In summary of the above embodiments, the present application can achieve the following beneficial effects: (1) Through management by the KMS system (key management server), the risk of accidental deletion and leakage of the master key is avoided. (2) The hierarchical management mechanism of the master key and the data key makes the use of the key safer. The master key is used to manage the data key, and the data key is used to encrypt and decrypt data. This hierarchical design reduces the risk of key leakage. (3) Only one copy of the master key information needs to be stored, and all trusted machines (application clients) can obtain the master key through authentication permissions, avoiding the migration and synchronization risks brought by local storage. At the same time, key rotation (modification) only needs to modify the master key in the KMS system, avoiding the risk of needing to synchronously modify all local master keys. (5) By defining the mutual recognition method between the trusted client and the KMS system, it is ensured that only authenticated clients can obtain the master key, and untrusted clients cannot obtain the key, further improving security.

[0127] See also Figure 7 The embodiment of the present application also provides a fully encrypted database key management device, which is applied to the application client and can implement the above-mentioned fully encrypted database key management method. Figure 7 This is a block diagram of the module structure of the fully encrypted database key management device provided in an embodiment of the present application, which includes:

[0128] The key information acquisition module 701 is used to obtain the data key and key algorithm;

[0129] A management information request module 702 is configured to send a master key management information acquisition request to a database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information;

[0130] The master key request module 703 is used to obtain the master key management information sent by the database server and send the obtained master key management information to the key management server. The master key management information is used by the key management server to find the master key;

[0131] The data key encryption module 704 is used to obtain the master key sent by the key management server and perform key encryption based on the data key, key algorithm and master key to obtain a ciphertext data key storage request;

[0132] The data key transfer module 705 is used to send a ciphertext data key storage request to the database server and delete the master key, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

[0133] In another embodiment, before obtaining the data key and the key algorithm, the fully encrypted database key management device further includes:

[0134] Master key information acquisition module, used to obtain master key management information and encryption algorithm;

[0135] An information transfer module is configured to send a master key management information storage request to a database server and delete the master key management information, wherein the master key management information storage request is used to request the database server to store the master key management information;

[0136] The master key creation module is used to send a master key creation request to the key management server, where the master key creation request is used to request the key management server to generate a master key based on the master key management information and the encryption algorithm, and to store the master key management information and the master key in correspondence.

[0137] It should be noted that the specific implementation of the fully confidential database key management device is basically the same as the specific embodiment of the above-mentioned fully confidential database key management method, and will not be repeated here.

[0138] The present application also provides an electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, the above-described method for managing secret keys in a fully encrypted database is implemented. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0139] See also Figure 8 , Figure 8 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0140] The processor 801 can be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0141] The memory 802 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 802 and is called by the processor 801 to execute the fully encrypted database key management method of the embodiments of this application.

[0142] Input / output interface 803, used to implement information input and output;

[0143] Communication interface 804, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0144] Bus 805 , which transmits information between various components of the device (e.g., processor 801 , memory 802 , input / output interface 803 , and communication interface 804 );

[0145] The processor 801 , the memory 802 , the input / output interface 803 and the communication interface 804 are connected to each other in communication within the device via a bus 805 .

[0146] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned fully confidential database key management method.

[0147] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0148] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0149] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0150] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0151] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0152] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0153] It should be understood that in this application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0155] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0156] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0157] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes multiple instructions for enabling an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store programs, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0158] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for managing secret keys in a fully encrypted database, characterized in that: Applied to an application client, the method includes: Obtain data key and key algorithm; Sending a master key management information acquisition request to the database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information; Obtaining the master key management information sent by the database server, and sending the obtained master key management information to the key management server, wherein the master key management information is used by the key management server to search for the master key; Obtain the master key sent by the key management server, and perform key encryption based on the data key, the key algorithm, and the master key to obtain a ciphertext data key storage request; The ciphertext data key storage request is sent to the database server and the master key is deleted, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

2. The method according to claim 1, characterized in that Before obtaining the data key and the key algorithm, the method further includes: Obtain master key management information and encryption algorithm; Sending a master key management information storage request to the database server and deleting the master key management information, wherein the master key management information storage request is used to request the database server to store the master key management information; A master key creation request is sent to the key management server, wherein the master key creation request is used to request the key management server to generate a master key based on the master key management information and the encryption algorithm, and to store the master key management information and the master key in correspondence.

3. The method according to claim 2, characterized in that The master key management information includes the master key name and the master key acquisition feature code; The generating a master key based on the master key management information and the encryption algorithm, and storing the master key management information and the master key in correspondence, includes: Performing key generation on the master key name and the master key acquisition feature code using the encryption algorithm to obtain the master key; The master key name, the master key acquisition feature code and the master key are stored correspondingly.

4. The method according to claim 2, characterized in that The sending of a master key creation request to the key management server includes: Sending a connection verification request to the key management server, wherein the connection verification request is used to request the key management server to verify whether the application client is connected to the key management server or not, and obtaining a connection verification result; Obtaining the connection verification result sent by the key management server, and if the connection verification result indicates that the application client is connected to the key management server, sending a master key creation permission verification request to the database server, wherein the master key creation permission verification request is used to request the database server to verify whether the target object has master key creation permission, and obtain a permission verification result; Obtain the permission verification result sent by the database server. If the permission verification result indicates that the target object has the master key creation permission, generate a master key creation request based on the master key management information and the encryption algorithm, and send the master key creation request to the key management server.

5. The method according to any one of claims 1 to 4, characterized in that After sending the ciphertext data key storage request to the database server and deleting the master key, the method further includes: Obtaining an original table, and determining table-specified data from the original table; Encrypting the table specified data according to the data secret key to obtain ciphertext table specified data; Generate an encryption information creation request based on the data key and the ciphertext table specified data; Sending the encryption information creation request to the database server, wherein the encryption information creation request is used to request the database server to verify whether the target object has or does not have the associated ciphertext data key permission, and when it is verified that the target object has the associated ciphertext data key permission, extracting encryption information from the encryption information creation request and recording the encryption information in a preset data key management system table; Obtain an information creation result sent by the database server based on the encryption information creation request; wherein the information creation result is used to indicate whether the encryption information creation is successful or failed.

6. The method according to any one of claims 1 to 4, characterized in that After sending the ciphertext data key storage request to the database server and deleting the master key, the method further includes: Get plaintext object data; Sending a ciphertext data key acquisition request to the database server, wherein the ciphertext data key acquisition request requests the database server to search for the ciphertext data key, the master key name, and the master key acquisition feature code; Obtaining the ciphertext data key, the master key name, and the master key acquisition feature code sent by the database server, and sending the master key name and the master key acquisition feature code to the key management server, where the master key name and the master key acquisition feature code are used by the key management server to search for the master key; Obtain the master key sent by the key management server, and decrypt the ciphertext data key according to the master key to obtain the plaintext data key; The plaintext object data is encrypted according to the plaintext data key to obtain ciphertext object data, and an object data storage request is sent to the database server and the plaintext object data is deleted. The object data storage request is used to request the database server to store the ciphertext object data.

7. The method according to claim 6, characterized in that After encrypting the plaintext object data according to the plaintext data key to obtain ciphertext object data, sending an object data storage request to the database server, and deleting the plaintext object data, the method further includes: Sending an object data acquisition request to the database server, wherein the object data acquisition request is used to request the database server to search for the ciphertext object data, the ciphertext data key, the master key name, and the master key feature code; Obtaining the ciphertext object data, the ciphertext data key, the master key name, and the master key characteristic code sent by the database server, and sending the master key name and the master key acquisition characteristic code to the key management server, where the master key name and the master key acquisition characteristic code are used by the key management server to search for the master key; Obtain the master key sent by the key management server, and decrypt the ciphertext data key according to the master key to obtain the plaintext data key; The ciphertext object data is decrypted according to the plaintext data secret key to obtain the plaintext object data.

8. A fully encrypted database key management device, characterized in that: Applied to an application client, the device includes: Key information acquisition module, used to obtain data keys and key algorithms; a management information request module, configured to send a master key management information acquisition request to a database server, wherein the master key management information acquisition request is used to request the database server to search for master key management information; a master key request module, configured to obtain the master key management information sent by the database server and send the obtained master key management information to the key management server, wherein the master key management information is used by the key management server to search for the master key; a data key encryption module, configured to obtain the master key sent by the key management server, and perform key encryption based on the data key, the key algorithm, and the master key to obtain a ciphertext data key storage request; The data key transfer module is used to send the ciphertext data key storage request to the database server and delete the master key, wherein the ciphertext data key storage request is used to request the database server to extract the ciphertext data key information and store the ciphertext data key information.

9. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images