Multi-tenant oriented commercial cryptographic cloud service key derivation method and system

Abstract

The application discloses a multi-tenant-oriented commercial cryptographic cloud service key derivation method and system, which is suitable for hosting tenants to provide key derivation services for a large number of downstream tenants. The system introduces a control subject and a control window in a commercial cryptographic device, and through the upper limit of the number of control windows and the upper limit of the capacity of a single window, the number of state records related to the disabled control state of the downstream tenants changes with the current number of disabled control subjects. Through the downstream tenant control record management mechanism, the downstream tenant control records are maintained in the control window on demand under the sparse storage and capacity constraint rules. Through the downstream tenant derivation path version judgment mechanism, the version coordination judgment is performed based on the window-level control version value and the request version number before the master key derivation operation, a derivation decision result is generated, and the instant unified disabling of the downstream tenant key derivation request under the condition of multiple regions and multiple instances is realized.

Images