Data processing method, device, equipment, medium and product based on multi-cloud key

Abstract

The application relates to a multi-cloud key-based data processing method, device, equipment, medium and product, and relates to the technical field of data processing. The method comprises the following steps: in response to a data processing instruction for target data, obtaining a key certificate corresponding to the data processing instruction; obtaining a target key corresponding to the key certificate through the key certificate; the target key is a unified key issued by a center server to a cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on a target key plaintext corresponding to the target key, to obtain a data processing result corresponding to the target data. The method can improve the efficiency of multi-cloud key-based data processing.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data processing method, apparatus, device, medium and product based on multi-cloud keys. Background Technology

[0002] With the rise of the Internet of Things and next-generation communication technologies, the amount of data transmitted between clouds has increased accordingly. In order to ensure the security of data during transmission, data encryption and decryption are essential.

[0003] However, each cloud has its own independent encryption and decryption processing method. When data is transmitted between different clouds, the different encryption and decryption methods between the clouds can easily lead to the data not being able to be processed on other clouds, thus reducing the efficiency of data processing. Summary of the Invention

[0004] Therefore, it is necessary to provide a data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product based on multi-cloud keys that can improve data processing efficiency in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a data processing method based on multi-cloud keys. Applied to a cloud server, the method includes: in response to a data processing instruction for target data, obtaining a key credential corresponding to the data processing instruction; querying the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to the cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on the plaintext of the target key corresponding to the target key to obtain the data processing result corresponding to the target data.

[0006] Secondly, this application also provides a data processing device based on multi-cloud keys. The device includes: a credential acquisition module, used to acquire a key credential corresponding to a data processing instruction for target data; a key acquisition module, used to query the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; and a data processing module, used to perform data processing on the target data based on the plaintext of the target key corresponding to the target key, to obtain the data processing result corresponding to the target data.

[0007] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: in response to a data processing instruction for target data, obtaining a key credential corresponding to the data processing instruction; querying the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on the target key plaintext corresponding to the target key to obtain the data processing result corresponding to the target data.

[0008] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps: in response to a data processing instruction for target data, obtains a key credential corresponding to the data processing instruction; using the key credential, queries and obtains a target key corresponding to the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; based on the target key plaintext corresponding to the target key, performs data processing on the target data to obtain a data processing result corresponding to the target data.

[0009] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps: in response to a data processing instruction for target data, obtains a key credential corresponding to the data processing instruction; using the key credential, queries and obtains a target key corresponding to the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; based on the target key plaintext corresponding to the target key, performs data processing on the target data to obtain a data processing result corresponding to the target data.

[0010] The aforementioned data processing method, apparatus, computer equipment, computer-readable storage medium, and computer program product based on multi-cloud keys, applied to cloud servers, first responds to a data processing instruction for target data by obtaining a key credential corresponding to the instruction. Then, based on this key credential, it queries the target key corresponding to that key credential. The target key is a unified key issued by the central server to each cloud server. This unified key is generated based on multiple different types of keys to ensure its security. Finally, based on the plaintext of the target key, it processes the target data to obtain the corresponding data processing result. Because all cloud servers use a unified target key, data can be processed on each cloud server, overcoming the technical deficiency of reduced data processing efficiency caused by different encryption and decryption methods between different clouds, which prevents data from being processed on other clouds. Therefore, the above method can effectively improve data processing efficiency. Attached Figure Description

[0011] Figure 1 This is a schematic diagram illustrating an application scenario of a data processing method based on multi-cloud keys in one embodiment;

[0012] Figure 2 This is a flowchart illustrating a data processing method based on multi-cloud keys in one embodiment;

[0013] Figure 3 This is a schematic diagram of the data encryption process in one embodiment;

[0014] Figure 4 This is a schematic diagram of the data decryption process in one embodiment;

[0015] Figure 5 This is a flowchart illustrating the process of obtaining the plaintext of the target key in one embodiment;

[0016] Figure 6 This is another flowchart illustrating a data processing method based on multi-cloud keys in one embodiment;

[0017] Figure 7 This is a structural block diagram of a data processing device based on multi-cloud keys in one embodiment;

[0018] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] With the rise of the Internet of Things (IoT) and next-generation communication technologies, the amount of data transmitted between clouds has increased dramatically. To ensure data security during transmission, encryption and decryption are essential. However, each cloud has its own independent encryption and decryption methods. When data is transmitted between different clouds, the inconsistencies in these methods can prevent data from being migrated in encrypted form between different cloud environments, thus hindering its processing on other clouds and reducing data processing efficiency.

[0021] The multi-cloud key data processing method provided in this disclosure can be applied to, for example... Figure 1 The application environment shown includes cloud server 102 and central server 104. Cloud server 102 communicates with central server 104, and multiple cloud servers 102 can exist. Before multi-cloud key data processing, central server 104 can generate a unified key based on multiple candidate keys and distribute the unified key to cloud server 102. When cloud server 102 receives a data processing instruction for target data, it first obtains the key credential corresponding to the instruction, then queries the corresponding target key (i.e., the unified key) based on the key credential. Based on the plaintext of the target key, it processes the target data to obtain the corresponding data processing result. In this way, all cloud servers use a unified data processing method, ensuring that data can be received and processed by any cloud server, regardless of where it is migrated to, thus improving data processing efficiency.

[0022] The central server or cloud servers can be implemented using independent servers or server clusters composed of multiple servers. The central server can be deployed in any cloud, while the individual cloud servers can be deployed in other clouds besides the one where the central server is located. The cloud can be a public cloud or a private cloud.

[0023] In one embodiment, the cloud server may further include an encryption / decryption program and a service module. The encryption / decryption program may be a program that generates plaintext data key and ciphertext data key based on plaintext target key. The service module may be a module that receives the plaintext data key and ciphertext data key sent by the encryption / decryption program, and performs encryption / decryption processing on the target data based on the plaintext data key and ciphertext data key.

[0024] In one embodiment, such as Figure 2 As shown, a data processing method based on multi-cloud keys is provided, which can be applied to... Figure 1 Taking cloud server 104 as an example, the explanation includes the following steps:

[0025] Step S202: In response to the data processing instruction for the target data, obtain the key credential corresponding to the data processing instruction.

[0026] The target data can refer to business data that needs to be processed on a cloud server. The data processing instruction can be used to instruct the cloud server to process the target data, including data encryption or decryption. The key credential is a credential representing the target object's access rights to the target key; in one example, the key credential could be an AK / SK credential.

[0027] In one embodiment, while creating the target key, the central server can generate a set of key credentials corresponding to the target key and simultaneously send them to the cloud server. The business module can obtain the plaintext of the target key from the encryption and decryption program through the key credentials, and then use the plaintext of the target key for data processing.

[0028] Specifically, when a business module in the cloud server receives a data processing instruction for target data initiated by a user through a terminal, it first obtains the key credential corresponding to the data processing instruction and sends the key credential to the encryption / decryption program in the cloud server. The encryption / decryption program verifies the target object's access rights to the target key based on the key credential. If it determines that the target object has the right to use the target key, it obtains the target key and the target key plaintext, and sends the corresponding data key plaintext and data key ciphertext to the business module. The business module then processes the target data based on the data key plaintext and data key ciphertext.

[0029] In one embodiment, during the process of requesting the target key plaintext from the encryption / decryption program, the business program can also encrypt the request instruction containing the key credentials initiated by the business program, and encrypt the data key plaintext and data key ciphertext issued by the encryption / decryption program, thereby improving the security of the request instruction, data key plaintext and data key ciphertext, and preventing them from being illegally obtained by intermediate programs.

[0030] Taking the encryption of request commands as an example: First, concatenate the request string according to the concatenation specification to obtain the final request string. In one example, the request string can be represented as: canonicalRequest=httpRequestMethod+”\n”+canonicalHeaders+”\n”+SHA256Hex(params), where canonicalRequest represents the request string, httpRequestMethod represents the HTTP request method, canonicalHeaders represents the request header, and SHA256Hex(params) represents the parameter obtained by hashing the request parameter params using the SHA (Secure Hash Algorithm) 256 algorithm. Next, the signature string is concatenated. In one example, the string to be signed can be represented as: stringToSign = timestamp + "\n" + SHA256Hex(canonicalRequest), where stringToSign represents the string to be signed, timestamp represents the request timestamp, and SHA256Hex(canonicalRequest) represents the hash value obtained after hashing the concatenated request string using SHA256. After obtaining the string to be signed, the signature can be calculated. The signature calculation expression can be: signature = hmac256(sk, stringToSign), where hmac256 (Hash-based Message Authentication Code 256) is a message signature authentication algorithm based on a hash function, and sk refers to the key credential, i.e., the SK part of the AK / SK credential. In the AK / SK credential, AK is the access key used to identify the user's identity, and SK is used to encrypt and sign the access key to verify the identity. Finally, the Authorization is concatenated: authorization = "Credential=" + ak + ", " + "Signature=" + signature, where Credential identifies the scope of the credential. The process of encrypting the plaintext and ciphertext of the data key issued by the encryption / decryption program is similar to the communication encryption process of the request command, and will not be described in detail here.

[0031] Step S204: Using the key credential, retrieve the target key corresponding to the key credential; the target key refers to the unified key issued by the central server to the cloud server, which is generated based on multiple different types of keys.

[0032] Before data processing, the central server can generate a unified key, or target key, based on multiple different types of keys, and then distribute this target key to each cloud server. In one example, the target key can be a CMK (Customer Master Key, user key).

[0033] In practical applications, after receiving the key credential sent by the business module, the encryption / decryption program can first verify the permission relationship between the key credential and the target key. In one embodiment, querying the target key corresponding to the key credential through the key credential includes: verifying the permission of the target object to use the target key through the key credential, and obtaining a usage permission verification result, wherein the target object is the user who triggered the data processing instruction; when the usage permission verification result indicates that the target object has the permission to use the target key, the target key is obtained.

[0034] The verification result is used to characterize whether the target object corresponding to the key credential has the permission to use the target key, and can include permission verification passed and permission verification failed.

[0035] Specifically, the encryption / decryption program verifies the access rights of the target object corresponding to the key credential regarding the target key. That is, it verifies whether the target object triggering the data processing instruction has permission to use the target key. If an access relationship is detected between the key credential and the target key, it means the target object corresponding to the key credential has the permission to use the target key, and the access verification passes. The program then obtains the target key and its plaintext, and sends the corresponding plaintext and ciphertext data key to the business module, allowing the business module to process the target data based on these data key plaintext and ciphertext. If no access relationship is detected between the key credential and the target key, it means the target object corresponding to the key credential does not have the permission to use the target key, and the access verification fails, rejecting the data processing request.

[0036] Step S206: Based on the plaintext of the target key corresponding to the target key, perform data processing on the target data to obtain the data processing result corresponding to the target data.

[0037] Here, the target key plaintext refers to the plaintext information of the target key. It can be understood that the target key has corresponding plaintext and ciphertext versions. The central server pre-encrypts the target key plaintext using various different keys to obtain a unified target key ciphertext, and then distributes the target key ciphertext to each cloud server. Each cloud server can request the target key plaintext from the central server, and thus perform data encryption and decryption processing based on the target key plaintext.

[0038] Specifically, after receiving the plaintext and ciphertext of the data key sent by the encryption / decryption program, the business module can encrypt or decrypt the target data based on the plaintext and ciphertext of the data key to obtain the data processing result corresponding to the target data.

[0039] In this embodiment, in response to a data processing instruction for target data, the key credential corresponding to the data processing instruction is first obtained. Based on this key credential, the target key corresponding to it is retrieved. The target key is a unified key issued by the central server to each cloud server. This unified key is generated based on multiple different types of keys to ensure its security. Finally, based on the plaintext of the target key, data processing is performed on the target data to obtain the corresponding data processing result. Since all cloud servers use the same target key, data can be processed on each cloud server, overcoming the technical defect that data cannot be processed on other clouds due to different encryption and decryption methods, thus reducing data processing efficiency. Therefore, this embodiment can effectively improve data processing efficiency.

[0040] In one embodiment, such as Figure 3 As shown, based on the plaintext of the target key corresponding to the target key, data processing is performed on the target data to obtain the data processing result corresponding to the target data, including:

[0041] Step S302: The business module receives the plaintext data key and the ciphertext data key sent by the encryption / decryption program; the ciphertext data key is obtained by the encryption / decryption program encrypting the plaintext data key based on the plaintext target key.

[0042] The data processing instructions can include data encryption instructions and data decryption instructions. Data encryption instructions are used to encrypt the target data, and data decryption instructions are used to decrypt the target data. The target data may include the data to be encrypted, and the data processing result includes the target encrypted data corresponding to the data to be encrypted. Both the plaintext and ciphertext of the data key correspond to the same data encryption key (Disk Encryption Key, DEK). The plaintext data key is used to encrypt the target data to obtain the initial encrypted data. The ciphertext data key is used to combine with the initial encrypted data to obtain the final target encrypted data.

[0043] Specifically, after the business module sends the key credential to the encryption / decryption program, the encryption / decryption program obtains the target key and the target key plaintext, and randomly generates a unique data key plaintext. It then uses the target key plaintext to encrypt the data key plaintext to obtain the corresponding data key ciphertext. Finally, the encryption / decryption program returns the data key ciphertext and the data key plaintext to the business module after communication encryption.

[0044] In step S304, the business module encrypts the data to be encrypted based on the plaintext of the data key to obtain the initial encrypted data corresponding to the data to be encrypted.

[0045] Step S306: Combine the data key ciphertext and the initial encrypted data to obtain the target encrypted data.

[0046] The initial encrypted data refers to the data obtained after encrypting the data to be encrypted using the plaintext of the data key.

[0047] Specifically, after receiving the plaintext and ciphertext of the data key, the business module first uses the plaintext data key to encrypt the data to be encrypted to obtain the initial encrypted data. Then, it combines this initial encrypted data, the ciphertext data key, and the index ciphertext of the target key to obtain the target encrypted data. It should be noted that the order of combination can be set according to the actual situation and is not restricted here. The index ciphertext refers to the ciphertext obtained by encrypting the index position of the target key; the index ciphertext is used by the encryption / decryption program to query the target key.

[0048] In this embodiment, the security of the data to be encrypted is ensured by encrypting it multiple times, and the ciphertext of the data key used to encrypt the data to be encrypted is also encrypted, which also ensures the security of each key during the data processing.

[0049] In one embodiment, such as Figure 4 As shown, based on the plaintext of the target key corresponding to the target key, data processing is performed on the target data to obtain the data processing result corresponding to the target data, which also includes:

[0050] Step S402: The business module parses the ciphertext of the data key in the data to be decrypted and sends the ciphertext of the data key to the encryption / decryption program.

[0051] The data processing instructions include data decryption instructions, the target data includes the data to be decrypted, and the data processing result includes the target decrypted data corresponding to the data to be decrypted.

[0052] Specifically, the business module can first parse the data key ciphertext and index ciphertext from the data to be decrypted, and send them to the encryption / decryption program together with the key credentials.

[0053] In step S404, the service module receives the plaintext data key returned by the encryption / decryption program based on the ciphertext data key; the plaintext data key is obtained by the encryption / decryption program decrypting the ciphertext data key based on the plaintext target key.

[0054] Specifically, after receiving the ciphertext of the data key, the ciphertext of the index, and the key credential from the business module, the encryption / decryption program can first verify the permission relationship between the key credential and the target key. If the permission verification is successful, it can further index the target key and the target key plaintext based on the index ciphertext. The target key plaintext is then used to decrypt the ciphertext of the data key to obtain the data key plaintext, and the data key plaintext is returned to the business module.

[0055] In step S406, the business module decrypts the data to be decrypted based on the plaintext of the data key to obtain the target decrypted data.

[0056] Specifically, after receiving the plaintext data key sent by the encryption / decryption program, the business module uses the plaintext data key to decrypt the initial decryption data extracted from the data to be decrypted, and obtains the final target decryption data.

[0057] In one embodiment, after the business module completes the data encryption or decryption process, it can clear the plaintext of the data key.

[0058] In this embodiment, the security of the data is ensured by first decrypting the plaintext of the data key and then decrypting the data to be decrypted based on the plaintext of the data key.

[0059] In one embodiment, such as Figure 5 As shown, prior to the step of responding to a data processing instruction for the target data, a process of receiving the plaintext of the target key is also included:

[0060] In step S502, in response to the instruction to receive the plaintext of the target key, the pre-stored ciphertext of the protection key is sent to the central server.

[0061] The receiving instruction is a command that instructs the cloud server to request the plaintext of the target key from the central server. The protection key ciphertext refers to the ciphertext of the protection key. The protection key is a symmetric key that can be used to encrypt the public key, and the public key can be used to decrypt the key encrypted by the private key. In other words, the private key can encrypt the target key, and the public key can decrypt it. The protection key ciphertext is obtained by the central server encrypting a randomly generated symmetric key using an encryption machine. The central server then distributes this protection key ciphertext to each cloud server for storage.

[0062] Specifically, the cloud server may also include a management program, which acts as a key relay station. When the cloud service receives a receive instruction for the plaintext of the target key, it obtains the pre-stored ciphertext of the protection key and sends the ciphertext of the protection key to the central server to request the plaintext of the protection key.

[0063] Step S504: Receive the communication ciphertext returned by the central server based on the protection key ciphertext; the communication ciphertext is the ciphertext obtained by encrypting the protection key plaintext with multiple communication keys.

[0064] The communication key refers to the key used to encrypt the plaintext of the protection key. The communication key can include a local key, a database key, and a random key.

[0065] Specifically, after the central server receives the ciphertext of the protection key sent by the management program, it first decrypts the ciphertext of the protection key using an encryption machine to obtain the plaintext of the protection key. In order to ensure the security of the plaintext of the protection key, it can be encrypted, that is, the plaintext of the protection key is encrypted using the communication key to obtain the communication ciphertext, and the communication ciphertext is returned to the management program.

[0066] Step S506: Decrypt the ciphertext of the communication to obtain the plaintext of the protection key.

[0067] Specifically, after receiving the encrypted communication, the management program first decrypts the random key, then calculates the local key and the database key. The decryption method is not limited; an encryption machine can be used, or other decryption methods can be selected based on the actual situation. Finally, the plaintext protection key is obtained.

[0068] Step S508: Obtain the target key plaintext based on the protection key plaintext.

[0069] In one embodiment, obtaining the target key plaintext based on the protection key plaintext further includes: decrypting the public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext; the public key ciphertext refers to the ciphertext of the public key corresponding to the private key that encrypts the target key in the central server; obtaining the pre-stored target key ciphertext, and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext.

[0070] The public key and the private key are a pair of asymmetric keys. In one example, the public key can be the root key and the private key can be the cloud key.

[0071] In one embodiment, the central server can pre-generate a private key plaintext and a public key plaintext corresponding to the private key plaintext, and encrypt the private key plaintext with an encryption machine to obtain the private key ciphertext, and encrypt the public key plaintext with an encryption machine to obtain the public key ciphertext.

[0072] It should be noted that before data processing, the central server can perform key initialization, that is, generate different types of keys, including protection keys, private keys and public keys. The private key is used to encrypt the target key, the public key is used to decrypt the target key, and the protection key is used to encrypt and decrypt the public key.

[0073] Specifically, after the management program decrypts the plaintext of the protection key, it uses this plaintext to decrypt the ciphertext of the public key, obtaining the ciphertext of the public key encrypted with the encryption machine. Then, the encryption machine is used to decrypt the current ciphertext of the public key, thus obtaining the plaintext of the public key. It can be understood that after the central server generates the ciphertext of the public key, it sends it to the cloud server for storage. Therefore, after the management program obtains the plaintext of the protection key, it can directly use this plaintext to decrypt the ciphertext of the public key, obtaining the plaintext of the public key. Since the target key is encrypted with the private key, it can be decrypted using the plaintext of the public key, that is, the target key is decrypted using the plaintext of the public key, obtaining the plaintext of the target key.

[0074] In this embodiment, the target key undergoes multiple layers of encryption. Therefore, when obtaining the plaintext of the target key, it also needs to undergo multiple layers of decryption. This greatly protects the security of the target key, thereby further protecting the security of subsequent data processing using the target key.

[0075] In one specific embodiment, such as Figure 6 As shown, the central server is deployed on a private cloud. It should be noted that the central server is not limited to a private cloud; it can also be deployed on a public cloud. The diagram is for illustrative purposes only. A cloud server is a server in a public cloud. Similarly, a cloud server is not limited to a public cloud; it can also be a server in a private cloud. A cloud server includes management programs, encryption / decryption programs, and business modules.

[0076] Before data processing, the central server can initialize the keys by creating symmetric and asymmetric keys. The symmetric key can be a protection key, and the asymmetric keys can be a public key and a private key. The public key can be a cloud key, and the private key can be a root key. These keys are then encrypted using an encryption device and stored in either the central server's database or the cloud server's database. In this embodiment, the root key plaintext is encrypted using an HSM (Hardware Security Module) to generate root key ciphertext, which is stored in the private cloud database. Similarly, the protection key plaintext is encrypted using an HSM to generate protection key ciphertext, which is stored in the public cloud database. The cloud key plaintext is also encrypted using an HSM to generate temporary cloud key ciphertext, which is stored in the public cloud database. Finally, the temporary cloud key ciphertext is further encrypted using the protection key ciphertext in the public cloud to obtain the final cloud key ciphertext. Storing each key on a different cloud side further ensures key security.

[0077] After the central server creates different types of keys, it needs to create a unified target key, or CMK key, for data encryption and decryption. Simultaneously, the central server can generate plaintext CMK. It's understood that subsequent data encryption and decryption are performed using this plaintext. To ensure the security of the plaintext CMK, the central server uses the encrypted root key ciphertext to encrypt the plaintext CMK, obtaining the ciphertext CMK, which is then sent to the cloud server's database for storage. It's important to note that when the central server synchronizes the ciphertext CMK to the cloud server, it generates a key credential corresponding to the CMK key, namely the AK / SK credential. The AK / SK credential is used to verify whether the target object initiating the data encryption / decryption command has the authorization to use the CMK key.

[0078] Since the CMK ciphertext is stored on the cloud server, and the cloud server needs to use the plaintext CMK for data processing, it needs to decrypt the CMK ciphertext. The management program on the cloud server sends the ciphertext of the protection key to the central server to request the plaintext protection key. After receiving the ciphertext, the central server first decrypts it using an encryption machine to obtain the plaintext protection key. To ensure the security of the plaintext protection key during transmission, the central server encrypts it using a local key, a database key, and a random key to obtain a communication ciphertext, which is then returned to the management program. After receiving the communication ciphertext, the management program first decrypts the random key, then calculates the local key and the database key, and finally calculates the plaintext protection key. It's understandable that since the CMK ciphertext is obtained by encrypting the root key ciphertext, and the root key and cloud key are a set of asymmetric keys, the root key ciphertext can be used to encrypt the plaintext CMK, and the cloud key ciphertext can be used to decrypt the CMK ciphertext. Since the cloud key ciphertext is obtained by encrypting the protection key ciphertext, and the protection key is a symmetric key, the protection key ciphertext is first decrypted to obtain the protection key plaintext. Then, the protection key plaintext is used to decrypt the cloud key ciphertext to obtain the temporary cloud key ciphertext encrypted by the encryption machine. The encryption machine is then used to decrypt the temporary cloud key ciphertext to obtain the cloud key plaintext. Finally, the cloud key plaintext is used to decrypt the CMK ciphertext to obtain the CMK plaintext.

[0079] When a business module in the cloud server receives a data encryption command for the data to be encrypted, it first obtains the AK / SK credential carried by the command and sends it to the encryption / decryption program in the cloud server. Upon receiving the key credential, the encryption / decryption program first verifies whether the key credential has an authorization relationship with the CMK key, i.e., whether the target object corresponding to the key credential has the authorization to use the CMK key. If the verification result indicates that the target object has the authorization to use the CMK key, the encryption / decryption program randomly generates a unique plaintext data key, i.e., the DEK plaintext, and obtains the CMK key and its CMK plaintext. It then uses the CMK plaintext to encrypt the DEK plaintext, obtaining the ciphertext data key, i.e., the DEK ciphertext. Finally, the encryption / decryption program returns both the DEK plaintext and the DEK ciphertext to the business module, allowing the business module to use the DEK plaintext to encrypt the data to be encrypted to obtain the initial encrypted data. The initial encrypted data, the DEK ciphertext, and the CMK index ciphertext are then combined to obtain the final target encrypted data.

[0080] When a business module in the cloud server receives a data decryption command for the data to be decrypted, it first obtains the AK / SK credentials carried in the command, and parses the DEK ciphertext, CMK index ciphertext, and initial decryption data from the data to be decrypted. It then sends the DEK ciphertext, CMK index ciphertext, initial decryption data, and AK / SK credentials to the encryption / decryption program. The encryption / decryption program first verifies whether the target object initiating the data decryption command has permission to use the CMK key. If the verification result indicates that the target object has permission to use the CMK key, the encryption / decryption program decrypts the CMK index ciphertext to obtain the CMK index, and then queries according to the CMK index to obtain the CMK plaintext. The CMK plaintext is then used to decrypt the DEK ciphertext to obtain the DEK plaintext, which is returned to the business module. The business module uses the received DEK plaintext to decrypt the initial decryption data to obtain the final target decrypted data.

[0081] In this embodiment, the central server pre-generates a unified key, namely the CMK key, and distributes it to each cloud server. The cloud server first responds to the data processing instruction for the target data, obtains the AK / SK credential corresponding to the data processing instruction, and then, based on the AK / SK credential, queries the corresponding CMK key. Finally, based on the CMK plaintext corresponding to the CMK key, it performs data encryption processing on the data to be encrypted, obtaining the target encrypted data corresponding to the data to be encrypted, or it performs data decryption processing on the data to be decrypted, obtaining the target decrypted data corresponding to the data to be decrypted. Since all cloud servers use the same CMK key, data can be processed on each cloud server, overcoming the technical defect that data cannot be processed on other clouds due to different encryption and decryption methods, thus reducing data processing efficiency. Therefore, the above method can effectively improve data processing efficiency. Moreover, the CMK key is obtained by encryption based on other different types of keys, further ensuring the security of the CMK key, thereby protecting the security of data processing based on the CMK key.

[0082] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0083] Based on the same inventive concept, this application also provides a multi-cloud key-based data processing apparatus for implementing the multi-cloud key-based data processing method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the multi-cloud key-based data processing apparatus provided below can be found in the limitations of the multi-cloud key-based data processing method described above, and will not be repeated here.

[0084] In one embodiment, such as Figure 7 As shown, a data processing device based on multi-cloud keys is provided, including: a credential acquisition module 702, a key acquisition module 704, and a data processing module 706, wherein:

[0085] The credential acquisition module 702 is used to obtain the key credential corresponding to the data processing instruction in response to the data processing instruction for the target data; the key acquisition module 704 is used to query the target key corresponding to the key credential through the key credential; the target key refers to the unified key issued by the central server to the cloud server, and the unified key is generated based on multiple different types of keys; the data processing module 706 is used to process the target data based on the target key plaintext corresponding to the target key to obtain the data processing result corresponding to the target data.

[0086] In one embodiment, the data processing module 706 further includes: a data receiving unit, configured to receive plaintext data key and ciphertext data key sent by the encryption / decryption program through the service module; the ciphertext data key is obtained by the encryption / decryption program encrypting the plaintext data key based on the target plaintext; an encryption processing unit, configured to encrypt the data to be encrypted based on the plaintext data key to obtain the initial encrypted data corresponding to the data to be encrypted; and a combination unit, configured to combine the ciphertext data key and the initial encrypted data to obtain the target encrypted data.

[0087] In one embodiment, the key acquisition module 704 is further configured to: verify the target object's permission to use the target key using the key credentials, and obtain a usage permission verification result, wherein the target object is the user who triggered the data processing instruction; and acquire the target key when the usage permission verification result indicates that the target object has the permission to use the target key.

[0088] In one embodiment, the data processing module 706 is further configured to: parse the ciphertext of the data key in the data to be decrypted through the business module, and send the ciphertext of the data key to the encryption / decryption program; the business module receives the plaintext of the data key returned by the encryption / decryption program based on the ciphertext of the data key; the plaintext of the data key is obtained by the encryption / decryption program after decrypting the ciphertext of the data key based on the plaintext of the target key; the business module performs decryption processing on the data to be decrypted based on the plaintext of the data key to obtain the target decrypted data.

[0089] In one embodiment, the data processing apparatus based on multi-cloud keys further includes: a protection key sending unit, configured to send pre-stored protection key ciphertext to a central server in response to a receiving instruction for target key plaintext; a communication ciphertext receiving unit, configured to receive communication ciphertext returned by the central server based on the protection key ciphertext; the communication ciphertext is ciphertext obtained by encrypting the protection key plaintext with multiple communication keys; a decryption unit, configured to decrypt the communication ciphertext to obtain the protection key plaintext; and a target key plaintext acquisition unit, configured to obtain the target key plaintext based on the protection key plaintext.

[0090] In one embodiment, the target key plaintext acquisition unit is further configured to: decrypt the public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext; the public key ciphertext refers to the ciphertext of the public key corresponding to the private key that encrypts the target key in the central server; acquire the pre-stored target key ciphertext, and decrypt the target key ciphertext through the public key plaintext to obtain the target key plaintext.

[0091] Each module in the aforementioned multi-cloud key-based data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0092] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores item recommendation data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a multi-cloud key-based data processing method.

[0093] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0094] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to perform the following steps: in response to a data processing instruction for target data, obtaining a key credential corresponding to the data processing instruction; querying the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on the target key plaintext corresponding to the target key to obtain a data processing result corresponding to the target data.

[0095] In one embodiment, when the processor executes the computer program, it further performs the following steps: receiving plaintext data key and ciphertext data key sent by an encryption / decryption program through a business module; the ciphertext data key is obtained by the encryption / decryption program encrypting the plaintext data key based on the target plaintext data key; the business module encrypts the data to be encrypted based on the plaintext data key to obtain the initial encrypted data corresponding to the data to be encrypted; and the ciphertext data key and the initial encrypted data are combined to obtain the target encrypted data.

[0096] In one embodiment, when the processor executes the computer program, it further performs the following steps: verifying the target object's permission to use the target key using key credentials to obtain a usage permission verification result, wherein the target object is the user who triggered the data processing instruction; and when the usage permission verification result indicates that the target object has the permission to use the target key, obtaining the target key.

[0097] In one embodiment, when the processor executes the computer program, it further performs the following steps: parses the ciphertext of the data key in the data to be decrypted through the business module, and sends the ciphertext of the data key to the encryption / decryption program; the business module receives the plaintext of the data key returned by the encryption / decryption program based on the ciphertext of the data key; the plaintext of the data key is obtained by the encryption / decryption program after decrypting the ciphertext of the data key based on the plaintext of the target key; the business module performs decryption processing on the data to be decrypted based on the plaintext of the data key to obtain the target decrypted data.

[0098] In one embodiment, when the processor executes the computer program, it further performs the following steps: in response to a receiving instruction for a target key, it sends a pre-stored ciphertext of a protection key to a central server; receives ciphertext of communication returned by the central server based on the ciphertext of the protection key; the ciphertext of communication is obtained by encrypting the plaintext of the protection key based on multiple communication keys; decrypts the ciphertext of communication to obtain the plaintext of the protection key; and obtains the plaintext of the target key based on the plaintext of the protection key.

[0099] In one embodiment, when the processor executes the computer program, it further performs the following steps: decrypting the public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext; the public key plaintext refers to the plaintext of the public key corresponding to the private key that encrypts the target key in the central server; obtaining the pre-stored target key ciphertext, and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext.

[0100] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it performs the following steps: in response to a data processing instruction for target data, obtaining a key credential corresponding to the data processing instruction; querying the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on the target key plaintext corresponding to the target key to obtain the data processing result corresponding to the target data.

[0101] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: receiving plaintext data key and ciphertext data key sent by the encryption / decryption program through the business module; the ciphertext data key is obtained by the encryption / decryption program encrypting the plaintext data key based on the target plaintext data key; the business module encrypts the data to be encrypted based on the plaintext data key to obtain the initial encrypted data corresponding to the data to be encrypted; and the ciphertext data key and the initial encrypted data are combined to obtain the target encrypted data.

[0102] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: verifying the target object's permission to use the target key using key credentials to obtain a usage permission verification result, wherein the target object is the user who triggered the data processing instruction; and when the usage permission verification result indicates that the target object has the permission to use the target key, obtaining the target key.

[0103] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: the business module parses the ciphertext of the data key in the data to be decrypted and sends the ciphertext of the data key to the encryption and decryption program; the business module receives the plaintext of the data key returned by the encryption and decryption program based on the ciphertext of the data key; the plaintext of the data key is obtained by the encryption and decryption program after decrypting the ciphertext of the data key based on the plaintext of the target key; the business module performs decryption processing on the data to be decrypted based on the plaintext of the data key to obtain the target decrypted data.

[0104] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: in response to a receiving instruction for the target key, sending a pre-stored ciphertext of the protection key to the central server; receiving ciphertext of communication returned by the central server based on the ciphertext of the protection key; the ciphertext of communication is obtained by encrypting the plaintext of the protection key based on multiple communication keys; decrypting the ciphertext of communication to obtain the plaintext of the protection key; and obtaining the plaintext of the target key based on the plaintext of the protection key.

[0105] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: decrypting the public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext; the public key plaintext refers to the plaintext of the public key corresponding to the private key that encrypts the target key in the central server; obtaining the pre-stored target key ciphertext, and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext.

[0106] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps: in response to a data processing instruction for target data, obtaining a key credential corresponding to the data processing instruction; querying the target key corresponding to the key credential using the key credential; the target key refers to a unified key issued by a central server to a cloud server, and the unified key is generated based on multiple different types of keys; and performing data processing on the target data based on the target key plaintext corresponding to the target key to obtain a data processing result corresponding to the target data.

[0107] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: receiving plaintext data key and ciphertext data key sent by the encryption / decryption program through the business module; the ciphertext data key is obtained by the encryption / decryption program encrypting the plaintext data key based on the target plaintext data key; the business module encrypts the data to be encrypted based on the plaintext data key to obtain the initial encrypted data corresponding to the data to be encrypted; and the ciphertext data key and the initial encrypted data are combined to obtain the target encrypted data.

[0108] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: verifying the target object's permission to use the target key using key credentials to obtain a usage permission verification result, wherein the target object is the user who triggered the data processing instruction; and when the usage permission verification result indicates that the target object has the permission to use the target key, obtaining the target key.

[0109] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: receiving plaintext and ciphertext of the data key sent by the encryption / decryption program through the business module; the ciphertext of the data key is obtained by the encryption / decryption program encrypting the plaintext of the data key based on the target plaintext of the data key; the business module encrypts the data to be encrypted based on the plaintext and ciphertext of the data key to obtain the target encrypted data.

[0110] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: in response to a receiving instruction for the target key, sending a pre-stored ciphertext of the protection key to the central server; receiving ciphertext of communication returned by the central server based on the ciphertext of the protection key; the ciphertext of communication is obtained by encrypting the plaintext of the protection key based on multiple communication keys; decrypting the ciphertext of communication to obtain the plaintext of the protection key; and obtaining the plaintext of the target key based on the plaintext of the protection key.

[0111] In one embodiment, when the computer program is executed by the processor, it further performs the following steps: decrypting the public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext; the public key plaintext refers to the plaintext of the public key corresponding to the private key that encrypts the target key in the central server; obtaining the pre-stored target key ciphertext, and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext.

[0112] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0113] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0114] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0115] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data processing method based on multi-cloud keys, characterized in that, Applied to cloud servers, the method includes: Receiving the target key plaintext specifically includes: in response to a receiving instruction for the target key plaintext, sending a pre-stored protection key ciphertext to a central server; receiving a communication ciphertext returned by the central server based on the protection key ciphertext, wherein the communication ciphertext is ciphertext obtained by encrypting the protection key plaintext using multiple communication keys; decrypting the communication ciphertext to obtain the protection key plaintext; decrypting a public key ciphertext based on the protection key plaintext to obtain the public key plaintext corresponding to the public key ciphertext, wherein the public key ciphertext refers to the ciphertext of the public key corresponding to the private key used to encrypt the target key plaintext in the central server; acquiring the pre-stored target key ciphertext, and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext; In response to a data processing instruction for target data, a key credential corresponding to the data processing instruction is obtained, wherein the key credential is a credential representing the target object's right to use the target key; Using the key credential, the target key corresponding to the key credential is obtained; the target key refers to the unified key issued by the central server to the cloud server, and the unified key is generated by the central server based on multiple different types of keys; Based on the plaintext of the target key corresponding to the target key, the target data is processed to obtain the data processing result corresponding to the target data.

2. The method according to claim 1, characterized in that, The cloud server includes an encryption / decryption program and a business module; the data processing instruction includes a data encryption instruction; the target data includes data to be encrypted; and the data processing result includes the target encrypted data corresponding to the data to be encrypted. The step of processing the target data based on the plaintext of the target key corresponding to the target key to obtain the data processing result corresponding to the target data includes: The service module receives plaintext and ciphertext of the data key sent by the encryption / decryption program; the ciphertext of the data key is obtained by the encryption / decryption program encrypting the plaintext of the data key based on the plaintext of the target key. The business module encrypts the data to be encrypted based on the plaintext of the data key to obtain the initial encrypted data corresponding to the data to be encrypted. The target encrypted data is obtained by combining the data key ciphertext and the initial encrypted data.

3. The method according to claim 1, characterized in that, The step of retrieving the target key corresponding to the key credential through the key credential includes: The permission of the target object to use the target key is verified by the key credential to obtain the permission verification result, wherein the target object is the user who triggered the data processing instruction; When the permission verification result indicates that the target object has permission to use the target key, the target key is obtained.

4. The method according to claim 1, characterized in that, The cloud server includes an encryption / decryption program and a business module; the data processing instruction includes a data decryption instruction; the target data includes data to be decrypted; and the data processing result includes the target decrypted data corresponding to the data to be decrypted. The step of processing the target data based on the plaintext of the target key corresponding to the target key to obtain the data processing result corresponding to the target data includes: The business module parses the ciphertext of the data key in the data to be decrypted and sends the ciphertext of the data key to the encryption / decryption program. The service module receives the data key plaintext returned by the encryption / decryption program based on the data key ciphertext; the data key plaintext is obtained by the encryption / decryption program after decrypting the data key ciphertext based on the target key plaintext; The business module decrypts the data to be decrypted based on the plaintext of the data key to obtain the target decrypted data.

5. A data processing device based on multi-cloud keys, characterized in that, The device includes: The credential acquisition module is used to receive target key plaintext, specifically including: in response to a receiving instruction for the target key plaintext, sending pre-stored protection key ciphertext to a central server; receiving communication ciphertext returned by the central server based on the protection key ciphertext, wherein the communication ciphertext is ciphertext obtained by encrypting the protection key plaintext with multiple communication keys; decrypting the communication ciphertext to obtain the protection key plaintext; decrypting public key ciphertext based on the protection key plaintext to obtain public key plaintext corresponding to the public key ciphertext, wherein the public key ciphertext refers to the ciphertext of the public key corresponding to the private key used to encrypt the target key plaintext in the central server; acquiring pre-stored target key ciphertext and decrypting the target key ciphertext using the public key plaintext to obtain the target key plaintext; and in response to a data processing instruction for target data, acquiring the key credential corresponding to the data processing instruction, wherein the key credential is a credential representing the target object initiating the data processing instruction's access rights to the target key. The key acquisition module is used to query and obtain the target key corresponding to the key credential using the key credential; the target key refers to the unified key issued by the central server to the cloud server, and the unified key is generated by the central server based on multiple different types of keys; The data processing module is used to process the target data based on the plaintext of the target key corresponding to the target key, and obtain the data processing result corresponding to the target data.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images