Key management method and device, equipment, storage medium and program product
By introducing an intermediate layer into the database encryption system, the stability issues caused by the key management system's adjustment of the database kernel interaction interface are resolved, achieving stability and scalability under different key management systems.
Patent Information
- Application Number
- CN202511758848.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-27
- Publication Date
- 2026-02-24
AI Technical Summary
In existing technologies, the key management system, as a third-party service, requires adjustments to the interaction interface between the database kernel and the key management system, which affects the stability of the database kernel.
By introducing an intermediate layer into the database encryption system, the database kernel interacts with the key management system through the intermediate layer. The intermediate layer is responsible for processing decryption requests and obtaining keys, including receiving key decryption requests, obtaining the target key from the key management system according to the key identification information and mapping relationship, and sending it to the database kernel for decryption or encryption processing.
When connecting to different key management systems, the middleware layer selects the appropriate interaction interface while keeping the interaction interface between the database kernel and the middleware layer unchanged, thereby improving the stability and scalability of the database kernel.
Smart Images
Figure CN121561965A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of database security technology, and in particular to a key management method, apparatus, device, storage medium, and program product. Background Technology
[0002] In database user data protection, data in the database can be encrypted using keys to improve data security. In this process, keys can be stored through a key management system.
[0003] In existing technologies, as a third-party service, the key management system requires the database to adapt to different key management systems, which necessitates adjustments to the interaction interface between the database kernel and the key management system, thus affecting the stability of the database kernel. Summary of the Invention
[0004] Therefore, it is necessary to provide a key management method, apparatus, device, storage medium, and program product that can improve the stability of the database kernel to address the aforementioned technical problems.
[0005] In a first aspect, this application provides a key management method applied to an intermediate layer in a database encryption system. The database encryption system includes a database kernel, an intermediate layer, and at least one key management system. The database kernel interacts with the key management system through the intermediate layer. The method includes:
[0006] Receive a key decryption request sent by the database kernel. The key decryption request carries the identification information of the first target key.
[0007] Based on the identification information of the first target key and the first mapping relationship, the first target key is obtained from the first key management system; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key;
[0008] The first target key is sent to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
[0009] In one embodiment, the first mapping relationship includes a first sub-mapping relationship and a second sub-mapping relationship. The first sub-mapping relationship includes a mapping relationship between the identification information of the first key and the key management system. The second sub-mapping relationship includes a mapping relationship between the key management system and the storage address of the first key. Obtaining the first target key from the first key management system based on the identification information of the first target key and the first mapping relationship, and based on the storage address of the first target key, includes:
[0010] The first sub-mapping relationship is queried based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key;
[0011] The storage address of the first target key is determined by querying the second sub-mapping relationship according to the first key management system;
[0012] The first target key is obtained from the first key management system according to the storage address of the first target key.
[0013] In one embodiment, retrieving the first target key from the first key management system based on the storage address of the first target key includes:
[0014] Based on the second mapping relationship between the decryption interface and the key management system, the target decryption interface corresponding to the first key management system is determined;
[0015] According to the target decryption interface, the first target key is obtained from the storage address of the first target key in the first key management system.
[0016] In one embodiment, the method further includes:
[0017] Based on the first key creation request sent by the database kernel, a first mapping relationship is determined; the first key creation request carries the identification information of the first key, the key management system, and the storage address of the first key.
[0018] In one embodiment, the method further includes:
[0019] Receive a second key encryption request sent by the database kernel. The second key encryption request carries the identification information of the first key, the identification information of the second key, and the second key.
[0020] Based on the identification information of the first key and the first mapping relationship, determine the second key management system that stores the first key;
[0021] The identification information of the first key and the second key are sent to the second key management system so that the second key management system can encrypt the second key according to the first key to obtain the ciphertext of the second key;
[0022] The system receives the ciphertext of the second key sent by the second key management system and sends the third mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key to the database kernel.
[0023] Secondly, this application provides a key management method applied to the middleware layer of a database encryption system. The database encryption system includes a database kernel, a middleware layer, and at least one key management system. The database kernel interacts with the key management system through the middleware layer. The method includes:
[0024] Send a key decryption request to the intermediate layer of the database encryption system. The key decryption request carries the identification information of the first target key.
[0025] Receive the first target key sent by the intermediate layer; the first target key is the first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key;
[0026] The ciphertext of the second target key is decrypted based on the first target key to determine the second target key;
[0027] The data to be processed is encrypted or decrypted based on the second target key.
[0028] In one embodiment, sending a key decryption request to an intermediate layer in the database encryption system includes:
[0029] Based on the identification information of the second target key corresponding to the data to be processed, query the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key to determine the identification information of the first target key. The first target key is used to encrypt the second target key.
[0030] A key decryption request is generated based on the identification information of the first target key, and then sent to the intermediate layer in the database encryption system.
[0031] Thirdly, this application provides a key management device applied to the middle layer of a database encryption system. The database encryption system includes a database kernel, a middle layer, and at least one key management system. The database kernel interacts with the key management system through the middle layer. The device includes:
[0032] The receiving module is used to receive key decryption requests sent by the database kernel. The key decryption requests carry the identification information of the first target key.
[0033] The acquisition module is used to acquire the first target key from the first key management system based on the identification information of the first target key and the first mapping relationship; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key;
[0034] The sending module is used to send the first target key to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
[0035] In one embodiment, the first mapping relationship includes a first sub-mapping relationship and a second sub-mapping relationship. The first sub-mapping relationship includes a mapping relationship between the identification information of the first key and the key management system. The second sub-mapping relationship includes a mapping relationship between the key management system and the storage address of the first key. Based on the identification information of the first target key and the first mapping relationship, the acquisition module is specifically used to query the first sub-mapping relationship based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key; query the second sub-mapping relationship based on the first key management system to determine the storage address of the first target key; and obtain the first target key from the first key management system based on the storage address of the first target key.
[0036] In one embodiment, the acquisition module is specifically used to determine the target decryption interface corresponding to the first key management system based on the second mapping relationship between the decryption interface and the key management system; and to acquire the first target key from the storage address of the first target key in the first key management system based on the target decryption interface.
[0037] In one embodiment, the receiving module is further configured to determine a first mapping relationship based on the first key creation request sent by the received database kernel; the first key creation request carries the identification information of the first key, the key management system, and the storage address of the first key.
[0038] In one embodiment, the receiving module is further configured to receive a second key encryption request sent by the database kernel, the second key encryption request carrying identification information of the first key, identification information of the second key, and the second key; determine a second key management system storing the first key based on the identification information of the first key and a first mapping relationship; the sending module is further configured to send the identification information of the first key and the second key to the second key management system, so that the second key management system encrypts the second key based on the first key to obtain ciphertext of the second key; receive the ciphertext of the second key sent by the second key management system, and send the ciphertext of the second key, the identification information of the first key, and the third mapping relationship between the identification information of the second key and the identification information of the second key to the database kernel.
[0039] Fourthly, this application provides a key management device applied to the database kernel of a database encryption system. The database encryption system includes a database kernel, a middleware layer, and at least one key management system. The database kernel interacts with the key management system through the middleware layer. The device includes:
[0040] The sending module is used to send a key decryption request to the middle layer of the database encryption system. The key decryption request carries the identification information of the first target key.
[0041] The receiving module is used to receive the first target key sent by the intermediate layer; the first target key is the first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key;
[0042] The determination module is used to decrypt the ciphertext of the second target key based on the first target key, and determine the second target key;
[0043] The processing module is used to encrypt or decrypt the data to be processed based on the second target key.
[0044] In one embodiment, the sending module is specifically configured to query the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key according to the identification information of the second target key corresponding to the data to be processed, determine the identification information of the first target key, the first target key being used to encrypt the second target key; generate a key decryption request according to the identification information of the first target key, and send the key decryption request to the intermediate layer in the database encryption system.
[0045] Fifthly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first or second aspect above.
[0046] Sixthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first or second aspect above.
[0047] In a seventh aspect, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first or second aspect above.
[0048] In the aforementioned key management method, apparatus, device, storage medium, and program product, within a database encryption system, the database interacts with the key management system through an intermediate layer. The intermediate layer receives key decryption requests sent by the database kernel, these requests carrying identification information of a first target key. Based on this identification information and a first mapping relationship, the intermediate layer retrieves the first target key from the first key management system. The first mapping relationship includes the identification information of the first key, a mapping between the key management system, and the storage address of the first key. The intermediate layer then sends the first target key to the database kernel. The first target key is used by the database kernel to decrypt the ciphertext of a second target key, obtaining a second target key. This second target key is used to encrypt or decrypt data to be processed within the database kernel. In this way, the database kernel can send key decryption requests to the intermediate layer and receive the first target key retrieved from the first key management system. When connecting to different key management systems, the intermediate layer selects the appropriate interaction interface to interact with the key management system. The interaction interface between the database kernel and the intermediate layer remains constant, effectively improving the stability of the database kernel. Attached Figure Description
[0049] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0050] Figure 1 This is a diagram illustrating the application environment of a key management method in one embodiment;
[0051] Figure 2 This is a flowchart illustrating a key management method in one embodiment;
[0052] Figure 3 This is a flowchart illustrating the step of obtaining the first target key in one embodiment;
[0053] Figure 4 This is a flowchart illustrating the step of obtaining the first target key in another embodiment;
[0054] Figure 5 This is a flowchart illustrating the key management method in another embodiment;
[0055] Figure 6 This is a flowchart illustrating the key management method in another embodiment;
[0056] Figure 7 This is a flowchart illustrating the key management method in another embodiment;
[0057] Figure 8 This is a structural block diagram of a key management device in one embodiment;
[0058] Figure 9 This is a structural block diagram of the key management device in another embodiment;
[0059] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0060] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0061] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.
[0062] In database user data protection, data in the database can be encrypted using keys to improve data security. During this process, keys can be stored using a key management system or data files.
[0063] In existing technologies, as a third-party service, the key management system requires the database to adapt to different key management systems, which necessitates adjustments to the interaction interface between the database kernel and the key management system, thus affecting the stability of the database kernel.
[0064] In view of this, this application provides a key management method to improve the stability of a database kernel. This key management method can be applied to, for example... Figure 1The database encryption system shown includes a database kernel 10, an intermediate layer 20, and at least one key management system 30 (Key Management Service, KMS). The database kernel 10 interacts with the key management system 30 through the intermediate layer 20. The key management system 30 is used to store keys; the intermediate layer 20 is used to receive key decryption requests sent by the database kernel 10, the key decryption requests carrying the identification information of the first target key; according to the identification information of the first target key and the first mapping relationship, the first target key is obtained from the first key management system; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key; the first target key is sent to the database kernel; the first target key is used by the database kernel 10 to decrypt the ciphertext of the second target key according to the first target key to obtain the second target key, the second target key is used to encrypt or decrypt the data to be processed in the database kernel 10; the database kernel 10 is used to send key decryption requests to the intermediate layer 20 in the database encryption system, the key decryption requests carrying the identification information of the first target key; receive the first target key sent by the intermediate layer 20; the first target key is the first key obtained by the intermediate layer 20 from the first key management system according to the identification information of the first target key in response to the key decryption request; the ciphertext of the second target key is decrypted according to the first target key to determine the second target key; the data to be processed is encrypted or decrypted according to the second target key.
[0065] In this embodiment of the application, when protecting database user data, symmetric keys offer higher performance than asymmetric key encryption, making them more suitable for encrypting large amounts of data. However, since symmetric key encryption and decryption operations use the same key, an asymmetric master key can be used to protect the data key to improve its security. For example, the master key encrypts the data key, and the database kernel stores the ciphertext data key. When needed, the asymmetric master key is used to decrypt the ciphertext data key to obtain the plaintext data key, which is then used for encryption and decryption operations.
[0066] In one exemplary embodiment, such as Figure 2 As shown, a key management method is provided, which can be applied to... Figure 1 The following explanation uses the middleware layer of a database encryption system as an example, including steps 201 to 203. Wherein:
[0067] Step 201: The intermediate layer receives a key decryption request sent by the database kernel. The key decryption request carries the identification information of the first target key.
[0068] The first target key can be any key used to encrypt the second target key, and the second target key is a key used to encrypt or decrypt the data to be processed. For example, the first target key can be a master key, and the second target key can be a data key.
[0069] The following is an exemplary description of the process by which the database kernel sends a key decryption request to the intermediate layer.
[0070] When a user creates an encrypted column or an encrypted table, the database kernel receives the corresponding SQL statement. This SQL statement includes the association between the encrypted column of the table and the data key (second key), or the association between the encrypted table and the data key (second key).
[0071] For example, taking the creation of an encryption table tab11 with the second key identifier "column_encryption_demo" as an example, the SQL statement for creating the table may include:
[0072] CREATE TABLE IF NOT EXISTS tbl1 (
[0073] col INT ENCRYPTED WITH (
[0074] COLUMNS_ENCRYPTION_KEY = column_encryption_demo) );
[0076] Understandably, a key can be uniquely identified using identification information, avoiding the direct disclosure of a second key in the SQL statement during table creation. The database kernel can determine the mapping relationship between the encrypted columns of a table or the encrypted table and the corresponding identification information of the second key from the table creation statement.
[0077] Optionally, when the database kernel inserts data into an encrypted column of a table or into an encrypted table, it needs to encrypt the data to be processed according to its corresponding second target key. When querying data in the encrypted table, it needs to decrypt the data to be processed according to its corresponding second target key.
[0078] The database kernel can determine the identification information of the second target key by querying the encrypted columns of the target table or target column corresponding to the data to be processed, or by mapping the encrypted table to the identification information of the corresponding second key.
[0079] Then, based on the identification information of the second target key, the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key is queried to determine the identification information of the first target key corresponding to the identification information of the second target key.
[0080] Understandably, to ensure the security of the data key and the data itself, the second key is stored in the database kernel in encrypted form. The database kernel stores the mapping relationship between the encrypted second key, the identification information of the first key, and the identification information of the second key.
[0081] After determining the identification information of the first target key that is encrypted with the second target key, the database kernel can generate a key decryption request and send the key decryption request carrying the identification information of the first target key to the middle layer.
[0082] Step 202: The intermediate layer obtains the first target key from the first key management system based on the identification information of the first target key and the first mapping relationship; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key.
[0083] Optionally, after receiving the identification information of the first target key, the intermediate layer needs to determine the first key management system storing the first target key, since the database encryption system includes at least one key management system.
[0084] Optionally, the intermediate layer stores multiple sets of identification information of the first key, the mapping relationship between the key management system and the storage address of the first key, and the first mapping relationship can be queried according to the identification information of the first target key to determine the first key management system and the storage address of the first target key corresponding to the identification information of the first target key.
[0085] For example, the first mapping relationship is stored in the form of a database table, file or cache, and the first mapping relationship may include three columns: the identification information of the first key, the key management system and the storage address of the first key.
[0086] When the first mapping relationship is stored in a database table, the intermediate layer can use the identification information of the first target key as a query condition to determine the SQL query statement, query the database table according to the SQL query statement, and determine the storage address of the first key management system and the first target key.
[0087] Once the storage addresses of the first key management system and the first target key are determined, the first target key can be obtained directly from the first key management system based on its storage address through an interactive interface that matches the first key management system.
[0088] Step 203: The intermediate layer sends the first target key to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key based on the first target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
[0089] Optionally, after obtaining the first target key from the first key management system, the intermediate layer can send the first target key to the database kernel.
[0090] The database kernel receives the first target key sent by the middle layer, then decrypts the ciphertext of the second target key based on the first target key to determine the second target key; then it encrypts or decrypts the data to be processed based on the second target key.
[0091] In another possible implementation, the decryption of the ciphertext of the second target key can also be performed by the intermediate layer or the first key management system, and this application embodiment does not limit this. For example, in addition to carrying the identification information of the first target key, the key decryption request can also carry the ciphertext of the second target key. After the intermediate layer obtains the first target key from the first key management system, it decrypts the ciphertext of the second target key according to the first target key, and sends the decrypted second target key to the database kernel. The database kernel then performs encryption or decryption processing on the data to be processed based on the second target key.
[0092] In the aforementioned key management method within the database encryption system, the database interacts with the key management system through an intermediate layer. The intermediate layer receives key decryption requests from the database kernel, which carry the identification information of a first target key. Based on this identification information and a first mapping relationship, the intermediate layer retrieves the first target key from the first key management system. The first mapping relationship includes the identification information of the first key, the mapping between the key management system, and the storage address of the first key. The intermediate layer then sends the first target key to the database kernel. The first target key is used by the database kernel to decrypt the ciphertext of a second target key, obtaining a second target key. This second target key is then used to encrypt or decrypt data to be processed within the database kernel. In this way, the database kernel can send key decryption requests to the intermediate layer and receive the first target key from the first key management system. When connecting to different key management systems, the intermediate layer selects the appropriate interaction interface to interact with the key management system. The interaction interface between the database kernel and the intermediate layer remains constant, improving the scalability of the database encryption system while ensuring the stability of the database kernel.
[0093] In one embodiment, the first mapping relationship includes a first sub-mapping relationship and a second sub-mapping relationship. The first sub-mapping relationship includes a mapping relationship between the identification information of the first key and the key management system, and the second sub-mapping relationship includes a mapping relationship between the key management system and the storage address of the first key. Figure 3As shown, the first target key is obtained from the first key management system according to the identification information and the first mapping relationship of the first target key, including the following steps 301 to 303. Wherein:
[0094] Step 301: The intermediate layer queries the first sub-mapping relationship based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key.
[0095] Optionally, the first sub-mapping relationship may include two columns: the identification information of the first key and the key management system. The intermediate layer can query the first sub-mapping relationship, and if the identification information of the first target key is stored in the first sub-mapping relationship, the key management system corresponding to the identification information of the first target key is determined to be the first key management system. If the identification information of the first target key is not stored in the first sub-mapping relationship, an error message is sent to the database kernel, which is used to indicate that the first target key is abnormal.
[0096] It is understandable that in the first sub-mapping relationship, the identification information of one first key corresponds to one key management system, and one key management system can correspond to the identification information of multiple first keys.
[0097] Step 302: The intermediate layer queries the second sub-mapping relationship according to the first key management system to determine the storage address of the first target key.
[0098] After determining the first key management system, the intermediate layer can query the second sub-mapping relationship based on the first key management system. In the second sub-mapping relationship, one key management system can correspond to the storage address of multiple first keys, and one storage address of a first key corresponds to one key management system.
[0099] Optionally, the second sub-mapping relationship may include multiple data tables or files, wherein the second sub-mapping relationship in one of the data tables or files includes a mapping relationship between a key management system and the storage address of the first key it stores.
[0100] In the second sub-mapping relationship, the storage address of the first key includes the identification information and storage address of the first key. Therefore, the intermediate layer can determine the storage address of the first key, which has the same identification information as the first target key, from the second sub-mapping relationship corresponding to the first key management system.
[0101] Step 303: The intermediate layer retrieves the first target key from the first key management system based on the storage address of the first target key.
[0102] Optionally, the intermediate layer can obtain the first target key from the first key management system through an interactive interface that matches the first key management system.
[0103] It is understandable that different key management systems may have differences in the request methods, interface names, and field naming of their interactive interfaces.
[0104] In one possible implementation, the middleware layer could be based on the adapter pattern in design patterns, creating a dedicated adapter for each key management system. This adapter would be responsible for converting the key decryption request format into a key management system-specific format, while converting the key management system's response into an internally unified format.
[0105] In this way, after the first key management system is determined, the intermediate layer can convert the key decryption request based on the adapter corresponding to the first key management system, match the interaction interface with the first key management system, and then obtain the first target key from the storage address of the first target key in the first key management system.
[0106] Another possible way to achieve this is, such as Figure 4 As shown, obtaining the first target key from the first key management system includes the following steps 401 to 402. Wherein:
[0107] Step 401: The intermediate layer determines the target decryption interface corresponding to the first key management system based on the second mapping relationship between the decryption interface and the key management system.
[0108] The decryption interface can be an interface used to interact with the key management system and obtain the first key from the key management system.
[0109] Optionally, the intermediate layer stores a second mapping relationship between multiple decryption interfaces and the key management system, which can be stored in the form of configuration files or database tables.
[0110] The intermediate layer can query the second mapping relationship and use the decryption interface corresponding to the first key management system in the second mapping relationship as the target decryption interface.
[0111] Step 402: The intermediate layer obtains the first target key from the storage address of the first target key in the first key management system according to the target decryption interface.
[0112] Optionally, the intermediate layer interacts with the first key management system through a target decryption interface. The parameters in the target decryption interface include the storage address of the first target key and may also include the identification information of the first target key, so that the first target key can be obtained from the first key management system.
[0113] The above-mentioned process involves querying the first sub-mapping relationship based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key; querying the second sub-mapping relationship based on the first key management system to determine the storage address of the first target key; and retrieving the first target key from the first key management system based on the storage address of the first target key. By determining the first key management system storing the first target key and then retrieving the first target key from that first key management system, the intermediate layer can avoid direct interaction between the database kernel and different key management systems, thereby improving the scalability of the database encryption system while ensuring the stability of the database kernel.
[0114] In an exemplary embodiment, since the intermediate layer determines the first key management system based on the identification information of the first key, the first mapping relationship between the key management system and the storage address of the first key, the process of establishing the first mapping relationship is described below.
[0115] The middle layer determines the first mapping relationship based on the first key creation request sent by the database kernel; the first key creation request carries the identification information of the first key, the key management system, and the storage address of the first key.
[0116] Optionally, after receiving the SQL statement used to create the first key, the database kernel will send a first key creation request to the middle layer. The middle layer can obtain the identification information of the first key, the key management system, and the storage address of the first key by parsing the first key creation request, and establish a set of first mapping relationships.
[0117] For example, the SQL statement for creating the first key can be:
[0118] CREATE CLIENT MASTER KEY master_key_demo WITH (
[0119] KEY_STORE = key_store_demo,
[0120] KEY_PATH = "key_path_demo",
[0121] ALGORITHM = SM2 );
[0123] In this context, “master_key_demo” represents the identifier of the first key, “KEY_STORE” represents the key management system that stores the first key, which is “key_store_demo” in the above SQL, “KEY_PATH” represents the storage address of the first key in the key management system, specifically “key_path_demo”, “ALGORITHM” represents the encryption algorithm, and “SM2” represents the asymmetric encryption algorithm.
[0124] Optionally, after receiving the first key creation request, the intermediate layer can create the first key at the storage address of the first key in the key management system through the creation interface that matches the corresponding key management system. This will not be elaborated further in the embodiments of this application.
[0125] Since the first key is needed to encrypt the second key, and then the ciphertext of the second key is stored in the database kernel, in an exemplary embodiment, such as... Figure 5 As shown, the encryption process for the second key is illustrated, including steps 501 to 504. Wherein:
[0126] Step 501: The intermediate layer receives the second key encryption request sent by the database kernel. The second key encryption request carries the identification information of the first key, the identification information of the second key, and the second key.
[0127] In one possible implementation, the database kernel can receive a second key encryption request sent by the user and forward the second key encryption request to the intermediate layer.
[0128] In another possible implementation, after receiving the SQL statement for creating the second key, the database kernel will create a second key object in the database kernel. The SQL statement for creating the second key may include the identification information of the second key, the second key, and the identification information of the first key that encrypts the second key.
[0129] For example, the SQL statement for creating a second key can be:
[0130] CREATE COLUMN ENCRYPTION KEY column_encryption_demo WITH(
[0131] CLIENT_MASTER_KEY = master_key_demo,
[0132] ALGORITHM = SM4,
[0133] ENCRYPTED_VALUE = '0123456789' );
[0135] Among them, “column_encryption_demo” is the identification information of the second key, “CLIENT_MASTER_KEY” represents the identification information of the first key that encrypts the second key, specifically “master_key_demo”, “SM4” identifies the symmetric encryption algorithm, and “ENCRYPTED_VALUE” represents the second key.
[0136] The database kernel determines the second key encryption request based on the SQL statement that creates the second key, and sends the second key encryption request to the middle layer.
[0137] Step 502: The intermediate layer determines the second key management system for storing the first key based on the identification information of the first key and the first mapping relationship.
[0138] Optionally, the second key management system can be the first key management system or other key management systems.
[0139] The process of determining the two-key management system in step 502 can be referred to step 301, and will not be repeated here in this embodiment.
[0140] Step 503: The intermediate layer sends the identification information of the first key and the second key to the second key management system, so that the second key management system encrypts the second key according to the first key to obtain the ciphertext of the second key.
[0141] Optionally, the intermediate layer can determine the parameters of the key encryption interface for interacting with the second key management system based on the identification information of the first key and the second key.
[0142] For example, the intermediate layer can convert the parameter format based on the adapter corresponding to the second key management system and send the identification information of the first key and the second key to the second key management system. Alternatively, the intermediate layer can determine the target key encryption interface corresponding to the second key management system based on the fourth mapping relationship between the key encryption interface and the key management system, and send the identification information of the first key and the second key to the second key management system through the target key encryption interface.
[0143] Optionally, after receiving the identification information of the first key and the second key, the second key management system can obtain the first key, encrypt the second key according to the first key to obtain the ciphertext of the second key, and respond to the target key encryption interface to send the ciphertext of the second key to the middle layer.
[0144] Step 504: The intermediate layer receives the ciphertext of the second key sent by the second key management system, and sends the third mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key to the database kernel.
[0145] Optionally, the intermediate layer can receive the ciphertext of the second key sent by the second key management system through the key encryption interface, and establish a third mapping relationship based on the ciphertext of the second key, the identification information of the first key, and the identification information of the second key. In response to the second key encryption request, the mapping relationship is sent to the database kernel.
[0146] Alternatively, the intermediate layer can respond to the second key encryption request and send the ciphertext of the second key to the database kernel. The database kernel can then establish a third mapping relationship based on the ciphertext of the second key, the identification information of the first key, and the identification information of the second key. This application embodiment does not limit this.
[0147] In another possible implementation, the encryption process of the second key can also be performed by the database kernel. For example, the middle layer can receive the second key encryption request sent by the database kernel, determine the second key management system storing the first key according to the identification information of the first key and the first mapping relationship, obtain the first key from the second key management system, and then send the first key to the database kernel, so that the database kernel can encrypt the second key according to the first key.
[0148] The process involves receiving a second key encryption request from the database kernel, which carries the identification information of the first key, the identification information of the second key, and the second key itself. Based on the identification information of the first key and a first mapping relationship, a second key management system storing the first key is determined. The identification information of the first key and the second key are sent to the second key management system, enabling it to encrypt the second key using the first key, resulting in ciphertext of the second key. The ciphertext of the second key sent by the second key management system is received, and a third mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key is sent to the database kernel. This approach ensures that when connecting to different key management systems to encrypt the second key, the middleware layer selects the appropriate interaction interface to interact with the key management system, while the interaction interface between the database kernel and the middleware layer remains constant, effectively improving the stability of the database kernel.
[0149] In one exemplary embodiment, such as Figure 6 As shown, a key management method is provided, which can be applied to... Figure 1 The following steps, 601 and 604, will be used as an example to illustrate the process:
[0150] Step 601: The database kernel sends a key decryption request to the intermediate layer in the database encryption system. The key decryption request carries the identification information of the first target key.
[0151] Step 602: The database kernel receives the first target key sent by the intermediate layer; the first target key is the first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key.
[0152] Step 603: The database kernel decrypts the ciphertext of the second target key based on the first target key to determine the second target key.
[0153] Step 604: The database kernel encrypts or decrypts the data to be processed based on the second target key.
[0154] In one embodiment, sending a key decryption request to an intermediate layer in the database encryption system includes:
[0155] The database kernel queries the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key based on the identification information of the second target key corresponding to the data to be processed, and determines the identification information of the first target key. The first target key is used to encrypt the second target key.
[0156] The database kernel generates a key decryption request based on the identification information of the first target key and sends the key decryption request to the intermediate layer in the database encryption system.
[0157] For the implementation method and beneficial effects of the key management method for the database kernel in a database encryption system, please refer to the relevant description in the above embodiment of the key management method for the intermediate layer in a database encryption system, which will not be repeated here.
[0158] As an optional implementation method, such as Figure 7 As shown, the key management method provided in this application embodiment may include the following specific steps:
[0159] Step 701: The intermediate layer determines the first mapping relationship based on the first key creation request sent by the database kernel.
[0160] The first key creation request includes the identification information of the first key, the key management system, and the storage address of the first key.
[0161] Step 702: The intermediate layer receives the second key encryption request sent by the database kernel.
[0162] The second key encryption request carries the identification information of the first key, the identification information of the second key, and the second key.
[0163] Step 703: The intermediate layer determines the second key management system for storing the first key based on the identification information of the first key and the first mapping relationship.
[0164] Step 704: The intermediate layer sends the identification information of the first key and the second key to the second key management system.
[0165] Step 705: The second key management system encrypts the second key based on the first key to obtain the ciphertext of the second key.
[0166] Step 706: The intermediate layer receives the ciphertext of the second key sent by the second key management system.
[0167] Step 707: The intermediate layer sends the third mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key to the database kernel.
[0168] Step 708: The database kernel queries the third mapping relationship based on the identification information of the second target key corresponding to the data to be processed, and determines the identification information of the first target key.
[0169] Step 709: The database kernel generates a key decryption request based on the identification information of the first target key.
[0170] Step 710: The database kernel sends a key decryption request to the intermediate layer, and the key decryption request carries the identification information of the first target key.
[0171] Step 711: The intermediate layer queries the first sub-mapping relationship based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key.
[0172] The first sub-mapping relationship includes the mapping relationship between the identification information of the first key and the key management system.
[0173] Step 712: The intermediate layer queries the second sub-mapping relationship according to the first key management system to determine the storage address of the first target key.
[0174] The second sub-mapping relationship includes the mapping relationship between the key management system and the storage address of the first key.
[0175] Step 713: The intermediate layer determines the target decryption interface corresponding to the first key management system based on the second mapping relationship between the decryption interface and the key management system.
[0176] Step 714: The intermediate layer obtains the first target key from the storage address of the first target key in the first key management system according to the target decryption interface.
[0177] Step 715: The intermediate layer sends the first target key to the database kernel.
[0178] Step 716: Decrypt the ciphertext of the second target key in the database based on the first target key to determine the second target key.
[0179] Step 717: The database kernel encrypts or decrypts the data to be processed based on the second target key.
[0180] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.
[0181] Based on the same inventive concept, this application also provides a key management device for implementing the key management method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more key management device embodiments provided below can be found in the limitations of the key management method described above, and will not be repeated here.
[0182] In one exemplary embodiment, such as Figure 8 As shown, a key management device 800 is provided, applied to the middle layer of a database encryption system. The database encryption system includes a database kernel, a middle layer, and at least one key management system. The database kernel interacts with the key management system through the middle layer, including: a receiving module 801, an acquisition module 802, and a sending module 803, wherein:
[0183] The receiving module 801 is used to receive a key decryption request sent by the database kernel, wherein the key decryption request carries the identification information of the first target key;
[0184] The acquisition module 802 is used to acquire the first target key from the first key management system according to the identification information of the first target key and the first mapping relationship; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key;
[0185] The sending module 803 is used to send the first target key to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key according to the first target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
[0186] In one embodiment, the first mapping relationship includes a first sub-mapping relationship and a second sub-mapping relationship. The first sub-mapping relationship includes a mapping relationship between the identification information of the first key and the key management system, and the second sub-mapping relationship includes a mapping relationship between the key management system and the storage address of the first key. Based on the identification information of the first target key and the first mapping relationship, the acquisition module 802 is specifically used to query the first sub-mapping relationship based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key; query the second sub-mapping relationship based on the first key management system to determine the storage address of the first target key; and obtain the first target key from the first key management system based on the storage address of the first target key.
[0187] In one embodiment, the acquisition module 802 is specifically used to determine the target decryption interface corresponding to the first key management system based on the second mapping relationship between the decryption interface and the key management system; and to obtain the first target key from the storage address of the first target key in the first key management system based on the target decryption interface.
[0188] In one embodiment, the receiving module 801 is further configured to determine a first mapping relationship based on the first key creation request sent by the database kernel; the first key creation request carries the identification information of the first key, the key management system, and the storage address of the first key.
[0189] In one embodiment, the receiving module 801 is further configured to receive a second key encryption request sent by the database kernel, the second key encryption request carrying the identification information of the first key, the identification information of the second key, and the second key; determine the second key management system storing the first key according to the identification information of the first key and the first mapping relationship; the sending module 803 is further configured to send the identification information of the first key and the second key to the second key management system, so that the second key management system encrypts the second key according to the first key to obtain the ciphertext of the second key; receive the ciphertext of the second key sent by the second key management system, and send the ciphertext of the second key, the identification information of the first key, and the third mapping relationship between the identification information of the second key and the identification information of the second key to the database kernel.
[0190] In one exemplary embodiment, such as Figure 9 As shown, a key management device 900 is provided, applied to the database kernel of a database encryption system. The database encryption system includes a database kernel, a middleware layer, and at least one key management system. The database kernel interacts with the key management system through the middleware layer. The device includes: a sending module 901, a receiving module 902, a determining module 903, and a processing module 904, wherein:
[0191] The sending module 901 is used to send a key decryption request to the intermediate layer of the database encryption system. The key decryption request carries the identification information of the first target key.
[0192] The receiving module 902 is used to receive the first target key sent by the intermediate layer; the first target key is the first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key;
[0193] The determination module 903 is used to decrypt the ciphertext of the second target key based on the first target key to determine the second target key;
[0194] The processing module 904 is used to encrypt or decrypt the data to be processed according to the second target key.
[0195] In one embodiment, the sending module 901 is specifically configured to query the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key according to the identification information of the second target key corresponding to the data to be processed, determine the identification information of the first target key, the first target key being used to encrypt the second target key; generate a key decryption request according to the identification information of the first target key, and send the key decryption request to the intermediate layer in the database encryption system.
[0196] Each module in the aforementioned key management device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.
[0197] In one exemplary embodiment, a computer device is provided, which may be a server, and a database encryption system is set in the server. Its internal structure diagram may be as follows. Figure 10 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to key management methods. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a key management method.
[0198] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0199] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps described in any of the above method embodiments.
[0200] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps described in any of the above method embodiments.
[0201] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps described in any of the above method embodiments.
[0202] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.
[0203] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.
[0204] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A key management method, characterized in that, An intermediate layer applied in a database encryption system, the database encryption system including a database kernel, the intermediate layer, and at least one key management system, wherein the database kernel interacts with the key management system through the intermediate layer, the method comprising: Receive a key decryption request sent by the database kernel, wherein the key decryption request carries the identification information of the first target key; Based on the identification information of the first target key and the first mapping relationship, the first target key is obtained from the first key management system; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key; The first target key is sent to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
2. The method according to claim 1, characterized in that, The first mapping relationship includes a first sub-mapping relationship and a second sub-mapping relationship. The first sub-mapping relationship includes a mapping relationship between the identification information of the first key and the key management system. The second sub-mapping relationship includes a mapping relationship between the key management system and the storage address of the first key. Obtaining the first target key from the first key management system based on the identification information of the first target key and the first mapping relationship includes: The first sub-mapping relationship is queried based on the identification information of the first target key to determine the first key management system corresponding to the identification information of the first target key; The storage address of the first target key is determined by querying the second sub-mapping relationship according to the first key management system; The first target key is obtained from the first key management system according to the storage address of the first target key.
3. The method according to claim 2, characterized in that, The step of obtaining the first target key from the first key management system according to the storage address of the first target key includes: Based on the second mapping relationship between the decryption interface and the key management system, the target decryption interface corresponding to the first key management system is determined; According to the target decryption interface, the first target key is obtained from the storage address of the first target key in the first key management system.
4. The method according to claim 2, characterized in that, The method further includes: The first mapping relationship is determined based on the first key creation request sent by the database kernel; the first key creation request carries the identification information of the first key, the key management system, and the storage address of the first key.
5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Receive a second key encryption request sent by the database kernel, wherein the second key encryption request carries the identification information of the first key, the identification information of the second key, and the second key; Based on the identification information of the first key and the first mapping relationship, determine the second key management system that stores the first key; The identification information of the first key and the second key are sent to the second key management system so that the second key management system encrypts the second key according to the first key to obtain the ciphertext of the second key; The system receives the ciphertext of the second key sent by the second key management system, and sends the third mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key to the database kernel.
6. A key management method, characterized in that, A database kernel applied in a database encryption system, the database encryption system including a database kernel, a middleware layer, and at least one key management system, wherein the database kernel interacts with the key management system through the middleware layer, the method comprising: Send a key decryption request to the intermediate layer of the database encryption system, wherein the key decryption request carries the identification information of the first target key; The intermediate layer receives the first target key sent by the intermediate layer; the first target key is a first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key. The ciphertext of the second target key is decrypted based on the first target key to determine the second target key; The data to be processed is encrypted or decrypted according to the second target key.
7. The method according to claim 6, characterized in that, Sending a key decryption request to the intermediate layer of the database encryption system includes: Based on the identification information of the second target key corresponding to the data to be processed, the mapping relationship between the ciphertext of the second key, the identification information of the first key, and the identification information of the second key is queried to determine the identification information of the first target key. The first target key is used to encrypt the second target key. The key decryption request is generated based on the identification information of the first target key, and then sent to the intermediate layer of the database encryption system.
8. A key management device, characterized in that, An intermediate layer for use in a database encryption system, the database encryption system including a database kernel, the intermediate layer, and at least one key management system, wherein the database kernel interacts with the key management system through the intermediate layer, the device comprising: The receiving module is used to receive a key decryption request sent by the database kernel, wherein the key decryption request carries the identification information of the first target key; The acquisition module is configured to acquire the first target key from the first key management system based on the identification information of the first target key and the first mapping relationship; the first mapping relationship includes the identification information of the first key, the mapping relationship between the key management system and the storage address of the first key; The sending module is used to send the first target key to the database kernel; the first target key is used by the database kernel to decrypt the ciphertext of the second target key according to the first target key to obtain the second target key, and the second target key is used to encrypt or decrypt the data to be processed in the database kernel.
9. A key management device, characterized in that, A database kernel used in a database encryption system, the database encryption system including a database kernel, the middleware layer, and at least one key management system, the database kernel interacting with the key management system through the middleware layer, the device comprising: The sending module is used to send a key decryption request to the intermediate layer of the database encryption system, wherein the key decryption request carries the identification information of the first target key; A receiving module is configured to receive the first target key sent by the intermediate layer; the first target key is a first key obtained by the intermediate layer from the first key management system in response to the key decryption request, based on the identification information of the first target key; The determining module is used to decrypt the ciphertext of the second target key based on the first target key to determine the second target key; The processing module is used to encrypt or decrypt the data to be processed according to the second target key.
10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.