Key processing method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a key processing method and device, a storage medium and electronic equipment. The method comprises the steps that a data source identifier of a target data segment is obtained, and the data source identifier at least comprises attribute information of a data table where the target data segment is located; taking a locally generated master key and a data source identifier as input of a target one-way mapping algorithm, and calculating to obtain a secondary key index; storing a locally generated secondary key to a storage address indicated by the secondary key index; and reading the secondary key of the storage address, and encrypting or decrypting the target data segment by adopting the secondary key. Thus, it is avoided that the secondary key is stored in an address outside the cryptographic device, and due to the fact that the target data segment and the secondary key index have unidirectivity, the security of data transmission is guaranteed, and the risk of data leakage is reduced.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a key processing method, apparatus, storage medium and electronic device thereof. Background Technology

[0002] As people place increasing importance on data security, the amount of sensitive data requiring encryption is also gradually increasing, and people's demands for cryptographic services are also rising. In many scenarios, a single key is no longer sufficient to meet users' needs. Therefore, based on this, derived keys generated by key derivation technology are increasingly being used to encrypt sensitive data. Key derivation is the process of deriving one or more derived keys from one or more source keys (usually long random numbers or ciphertexts).

[0003] In related technologies, key derivation techniques employ a layered key system. The master key generated by the cryptographic device is no longer directly used for data encryption and decryption. Instead, other services requiring data encryption use this master key to obtain secondary keys (i.e., derived keys) through a series of derivation operations. These secondary keys are then used to encrypt and decrypt data, achieving "one key per column" to mitigate the risk of master key leakage. However, if this key derivation method is leaked, various information thieves can access the master key generated by the cryptographic device and perform the same derivation operations to obtain secondary keys, leading to a high risk of data leakage. Summary of the Invention

[0004] In view of this, embodiments of this application provide a key processing method and apparatus, storage medium and electronic device, to solve or mitigate the problem of data leakage risk in related technologies.

[0005] According to a first aspect of the embodiments of this application, a key processing method is provided. The method includes: receiving a data source identifier of a target data segment, wherein the data source identifier includes at least attribute information of the data table where the target data segment is located; using a locally generated master key and the data source identifier as inputs to a target one-way mapping algorithm to calculate a secondary key index; storing the locally generated secondary key in a storage address indicated by the secondary key index; reading the secondary key from the storage address, and using the secondary key to encrypt or decrypt the target data segment.

[0006] [HZTC-HXJMJJ241006][HS2411171CCN]

[0007] In some embodiments of this application, the local generated master key and data source identifier are used as inputs to the target one-way mapping algorithm to calculate the secondary key index, including: using the data source identifier as input to the hash function and using the master key as the key parameter of the hash function to calculate the secondary key index.

[0008] In some embodiments of this application, the data source identifier is used as the input of the hash function, and the master key is used as the key parameter of the hash function to calculate the secondary key index, including: performing a hash calculation on the data source identifier based on the hash function to obtain a hash string, wherein the hash string consists of at least one character and at least one number; determining the key index type corresponding to the cryptographic device, and generating a secondary key index that conforms to the key index type based on the hash string.

[0009] In some embodiments of this application, generating a secondary key index that conforms to the key index type based on the hash string includes: when the key index type is a mixed index, directly determining the hash string as the secondary key index; when the key index type is a numeric index, performing a numerical conversion on the hash string, and determining the converted numerical sequence as the secondary key index.

[0010] In some embodiments of this application, the key processing method further includes: associating the data source identifier with the calculated secondary key index to generate a one-way mapping relationship corresponding to the key index type.

[0011] In some embodiments of this application, the key processing method further includes: obtaining and storing a one-way mapping relationship between a data source identifier and a secondary key index; correspondingly, reading the secondary key from the storage address includes: querying the secondary key index corresponding to the data source identifier according to the pre-stored one-way mapping relationship; and reading the secondary key from the storage address indicated by the secondary key index.

[0012] In some embodiments of this application, querying the secondary key index corresponding to the data source identifier based on a pre-stored one-way mapping relationship includes: obtaining an encryption / decryption request, wherein the encryption / decryption request includes a data source identifier and a target key index type; and invoking the one-way mapping relationship corresponding to the target key index type to query the secondary key index corresponding to the data source identifier.

[0013] According to a second aspect of the embodiments of this application, a key processing apparatus is provided, the apparatus comprising: a receiving module, configured to receive a data source identifier of a target data segment, wherein the data source identifier includes at least attribute information of the data table where the target data segment is located; a calculation module, configured to use a locally generated master key and the data source identifier as inputs to a target one-way mapping algorithm to calculate a secondary key index; and a storage module.

[0014] The [HZTC-HXJMJJ241006][HS2411171CCN] block is used to store the locally generated secondary key to the storage address indicated by the secondary key index; the read module is used to read the secondary key from the storage address and use the secondary key to encrypt or decrypt the target data segment.

[0015] According to a third aspect of the present application, an electronic device is provided, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, which causes the processor to perform an operation corresponding to the key processing method of any of the above embodiments.

[0016] According to a fourth aspect of the embodiments of this application, a computer storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the key processing method as described in any of the above embodiments.

[0017] According to the key processing method, apparatus, storage medium, and electronic device provided in the embodiments of this application, by obtaining the data source identifier of the target data segment, and calculating the secondary key index based on the data source identifier and the locally generated master key using a target one-way mapping algorithm, the locally generated secondary key is stored in the storage address indicated by the secondary key index. This enables the target data segment to be encrypted or decrypted based on the locally stored secondary key, thus avoiding storing the secondary key in an address outside the cryptographic device. Furthermore, since there is a one-way relationship between the target data segment and the secondary key index, the security of data transmission is guaranteed, and the risk of data leakage is reduced. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0019] Figure 1 This is a schematic flowchart of a key processing method according to an embodiment of this application;

[0020] Figure 2 This is a schematic diagram illustrating a method for calculating a secondary key index according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram illustrating the data encryption / decryption workflow according to one embodiment of this application;

[0022] Figure 4 This is a structural block diagram of a key processing apparatus according to an embodiment of the present application;

[0023] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of the present application.

[0024] [HZTC-HXJMJJ241006][HS2411171CCN] Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in the embodiments of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art should fall within the protection scope of the embodiments of this application.

[0026] The specific implementation of the embodiments of this application will be further described below with reference to the embodiments and accompanying drawings.

[0027] Figure 1 This is a schematic flowchart of a key processing method according to an embodiment of this application.

[0028] like Figure 1 As shown, this key processing method is applied to a cryptographic device, and the method includes:

[0029] S11: Receive the data source identifier of the target data segment, wherein the data source identifier includes at least the attribute information of the data table where the target data segment is located.

[0030] Specifically, the target data segment is the data segment sent by various software (or hardware) that needs to encrypt or decrypt data to the cryptographic device (such as a cryptographic machine) through the device interface. The data indicated by this target data segment is the data that needs to be encrypted or decrypted (i.e., plaintext or ciphertext). The data source identifier includes, but is not limited to, the database service information to which the target data segment belongs, the table name and field names of the data table to which it belongs, and other factors.

[0031] S12: Use the locally generated master key and data source identifier as input to the target one-way mapping algorithm to calculate the secondary key index.

[0032] The master key is a random sequence generated internally by the cryptographic device. This master key can be a string composed of numbers and characters. The target one-way mapping algorithm can be a hash algorithm or other one-way cryptographic algorithms. Hash algorithms typically process data using hash functions, such as SHA256 in the SHA function (Secure Hash Algorithm). For messages of any length, the SHA256 function produces a 256-bit hash value, called a message digest. This digest is essentially a 32-byte array, totaling 256 bits, and is usually represented by a 64-bit hexadecimal string.

[0033] A hash function, as a public function, can map a message M of arbitrary length to a hash function of length.

[0034] [HZTC-HXJMJJ241006][HS2411171CCN] A short and fixed-length value H(M) is called a hash value, hash value, or message digest. A hash function is a one-way cryptographic system, that is, an irreversible mapping from plaintext to ciphertext, which only has an encryption process and no decryption process.

[0035] In some embodiments, the secondary key index is calculated by using the locally generated master key and data source identifier as inputs to the target one-way mapping algorithm, including: using the data source identifier as input to the hash function and using the master key as the key parameter of the hash function to calculate the secondary key index.

[0036] For example, Figure 2 This is a schematic diagram illustrating a method for calculating a secondary key index according to an embodiment of this application, as shown below. Figure 2 As shown, the data source identifier of the target data segment is used as the unique identifier S1…S N (Where N = 1, 2, ..., N) are input into the hash function, and the master key M1 is used as the hash key. The device interface of the cryptographic device is called to process the unique identifiers S1...S N Perform hash calculations to obtain one-way unique values ​​H1…H N (where N = 1, 2…N), so that this one-way unique value is used as the secondary key index I1…I N (Where N = 1, 2, ..., N), and the secondary key index and the data source identifier have a one-to-one correspondence. This ensures unidirectionality and stability between the target data segment and the secondary key index.

[0037] It should be noted that this example uses the common database encryption requirement of one key per segment. However, the method for calculating the secondary key index in this application is not only applicable to database encryption, but also to all scenarios that require the use of multiple keys and key index management.

[0038] S13: Store the locally generated subkey at the storage address indicated by the subkey index.

[0039] Specifically, both the master key and the secondary key are randomly generated internally by the cryptographic device. Therefore, the security of both the master key and the secondary key is guaranteed by the cryptographic device itself. There is no need to derive the secondary key from the master key, and both the master key and the secondary key are stored within the cryptographic device. This prevents information theft from occurring if the key derivation method is leaked, allowing various information theft parties to use the master key generated by the cryptographic device to perform the same derivation operation to obtain the secondary key and store it locally. The initialization method for storing the secondary key generated by the cryptographic device at the storage address indicated by the secondary key index can use the cryptographic device's own initialization method or other preset derivation methods.

[0040] S14: Read the secondary key of the storage address and use the secondary key to encrypt or decrypt the target data segment.

[0041] Furthermore, continue to refer to Figure 2 The cryptographic device generates the secondary key K1…K. N

[0042] [HZTC-HXJMJJ241006][HS2411171CCN] (where N = 1, 2…N) is stored in the subkey index I1…I N The storage addresses (where N = 1, 2, ..., N) indicate the storage addresses, allowing the cryptographic device to read the secondary keys for each storage address, and then use these secondary keys to encrypt or decrypt the target data segment. When using the secondary keys to encrypt or decrypt the target data segment, the data information of the target data segment needs to be obtained from the various software components that call the cryptographic device, so that the data information can be encrypted or decrypted using the secondary keys.

[0043] For example, Figure 3 This is a schematic diagram of the data encryption / decryption workflow according to one embodiment of this application.

[0044] like Figure 3 As shown, if the target data segment is plaintext (i.e., data to be encrypted), the cryptographic device obtains the data source identifier of the data to be encrypted as its unique identifier S1, and obtains other information to calculate the secondary key index I1 corresponding to the data source identifier S1. The cryptographic device then reads the encryption key from the secondary key K1 stored at the storage address indicated by the secondary key index I1, and uses this encryption key to encrypt the data to be encrypted, obtaining the encrypted ciphertext. Similarly, if the target data segment is ciphertext (i.e., data to be decrypted), the cryptographic device reads the decryption key from the secondary key stored at the storage address, and uses this decryption key to decrypt the data to be decrypted, obtaining the decrypted plaintext.

[0045] In summary, this application obtains the data source identifier of the target data segment and calculates the secondary key index based on the data source identifier and the master key generated by the cryptographic device using a target one-way mapping algorithm. The secondary key generated by the cryptographic device is then stored in the storage address indicated by the secondary key index. This allows the target data segment to be encrypted or decrypted based on the secondary key stored in the cryptographic device, thus avoiding storing the secondary key at an address outside the cryptographic device. Furthermore, the one-way nature between the target data segment and the secondary key index ensures the security of data transmission and reduces the risk of data leakage.

[0046] In some embodiments, the data source identifier is used as input to the hash function, and the master key is used as the key parameter of the hash function to calculate the secondary key index, including: performing a hash calculation on the data source identifier based on the hash function to obtain a hash string, wherein the hash string consists of at least one character and at least one number; determining the key index type corresponding to the cryptographic device, and generating a secondary key index that conforms to the key index type based on the hash string.

[0047] Some cryptographic devices can only accept strings consisting of numbers as key indices, while others can accept strings consisting of both characters and numbers as key indices. This is because they are based on...

[0048] [HZTC-HXJMJJ241006][HS2411171CCN] The hash function performs a hash calculation on the data source identifier, and the resulting hash string is a string composed of numbers and characters. Therefore, it is necessary to process the calculated hash string according to the key index type corresponding to the cryptographic device to obtain the secondary key index that conforms to each cryptographic device.

[0049] Furthermore, in some embodiments, generating a secondary key index that conforms to the key index type based on the hash string includes: when the key index type is a mixed index, directly determining the hash string as the secondary key index; when the key index type is a numeric index, performing a numerical conversion on the hash string, and determining the converted numerical sequence as the secondary key index.

[0050] In other words, for cryptographic devices that support the use of mixed character and number strings as key indexes, such as... Figure 2 The calculated one-way unique values ​​H1…H N , (where N = 1, 2, ..., N), are used as the secondary key indexes I1...I of the cryptographic device. N (where N = 1, 2, ..., N).

[0051] For cryptographic devices that only support numeric strings as key indexes, it is necessary to... Figure 2 The calculated one-way unique values ​​H1…HN (where N = 1, 2…N), perform numerical transformations (such as truncation, numerical conversion, hashing, etc.) to transform the string H1…H, composed of numbers and characters, into a string. N Convert to numeric secondary key index I1…I N In practice, the numerical conversion method needs to consider common user scenarios, reduce the possibility of hash collisions in the algorithm, and reasonably design the hash collision handling method.

[0052] For example, the base64 encoding of a one-way unique value (a method of encoding a byte array into a string) in the form 5aSp5aSp5aW95b+D5oOF5ZOf is converted into a numerical sequence 25478 after numerical conversion. 25478 is then used as the secondary key index, and the secondary key corresponding to the one-way unique value is stored in the cryptographic device at index 25478. In this way, the target data segment can be encrypted or decrypted based on the secondary key stored in the cryptographic device, ensuring the security of data transmission and reducing the risk of data leakage.

[0053] In some embodiments, the key processing method further includes: associating the data source identifier with the calculated subkey index to generate a one-way mapping relationship corresponding to the key index type.

[0054] In other words, the data source is identified as S1…S N The calculated secondary key index I1…I N This association generates a one-way mapping relationship (MAP) corresponding to the key index type. Thus, given the data source identifier of the target data segment to be encrypted or decrypted, the key can be mapped based on that data source identifier and the master key.

[0055] The [HZTC-HXJMJJ241006][HS2411171CCN] key calculates the secondary key index for decryption or decryption, ensuring that the method of creating the mapping relationship MAP is stable and unidirectional. This allows external software or hardware to transmit only the target data segment (plaintext or ciphertext) and the secondary key index during data transmission with the cryptographic device, without having to transmit the key multiple times.

[0056] Therefore, when using the key for encryption or decryption, the corresponding secondary key index position can be calculated through the data source identifier, and this mapping relationship MAP can be saved in the cryptographic device memory space (data table or cache space). Subsequently, the secondary key in the storage address indicated by the secondary key index corresponding to the data source identifier can be directly called to encrypt or decrypt the target data segment corresponding to the data source identifier.

[0057] If the mapping relationship MAP is lost, the data source identifier of the target data segment can be retrieved from the database characteristics to which the target data segment belongs, based on the characteristic that the data source identifier of the target data segment is bound to the data characteristics itself, and the data source identifier S1…S can be further reconstructed. N The calculated secondary key index I1…I N The mapping relationship MAP between them ensures the recoverability of user data in extreme cases.

[0058] In some embodiments, the key processing method further includes: acquiring and storing a one-way mapping relationship between a data source identifier and a secondary key index; accordingly, reading the secondary key from the storage address includes: querying the secondary key index corresponding to the data source identifier according to the pre-stored one-way mapping relationship; and reading the secondary key from the storage address indicated by the secondary key index.

[0059] Specifically, when identifying the data source as S1…S N With secondary key index I1…I N After the corresponding one-way mapping relationship MAP is saved to the memory space (data table or cache space) of the cryptographic device, if a target data segment (the target data segment is plaintext or ciphertext) sent by a certain software calling the device interface of the cryptographic device is received, the secondary key index I1 corresponding to the data source identifier S1 is queried according to the pre-stored one-way mapping relationship MAP, and the corresponding secondary key K1 is read from the storage address indicated by the secondary key index I1, so as to encrypt or decrypt the target data segment corresponding to the data source identifier S1 according to the secondary key K1.

[0060] Furthermore, in some embodiments, querying the secondary key index corresponding to the data source identifier based on a pre-stored one-way mapping relationship includes: obtaining an encryption / decryption request, the encryption / decryption request including a data source identifier and a target key index type; invoking the one-way mapping relationship corresponding to the target key index type to query the secondary key index corresponding to the data source identifier.

[0061] [HZTC-HXJMJJ241006][HS2411171CCN]

[0062] In other words, if a cryptographic device receives an encryption / decryption request sent by a software calling the device's interface, the cryptographic device will invoke the one-way mapping relationship corresponding to the target key index type (hybrid index or numeric index) it supports, and then query the secondary key index corresponding to the data source identifier from the one-way mapping relationship, thereby reading the secondary key in the storage address indicated by the secondary key index, in order to encrypt or decrypt the target data segment indicated by the data source identifier in the encryption / decryption request.

[0063] In summary, from the perspective of key security, this application ensures that the security of both the master key and the secondary key is guaranteed by the cryptographic device. There is no possibility of derivation calculations based on a certain key, nor is there any possibility of storing the key outside the cryptographic device. Furthermore, after calculating the secondary key index based on the master key and the data source identifier through the target one-way mapping algorithm, the relationship between the data source identifier and the secondary key index is one-way and repeatable. This means that during data transmission between external software or hardware and the cryptographic device, only the target data segment (plaintext or ciphertext) and the secondary key index information need to be transmitted, without the need to transmit the key multiple times. This ensures data security from different dimensions and also guarantees the recoverability of user data in extreme cases.

[0064] The key processing method of this embodiment can be executed by any suitable electronic device with data processing capabilities, including but not limited to: servers, mobile terminals (such as mobile phones, PADs, etc.) and PCs.

[0065] Furthermore, the technical solutions of the various embodiments described above in this application can be combined with each other, and no limitation is made here.

[0066] Figure 4 This is a structural block diagram of a key processing apparatus according to an embodiment of the present application.

[0067] like Figure 4 As shown, the key processing device 400 can perform... Figure 1 The key generation method, the key processing device 400 includes: a receiving module 401, used to receive the data source identifier of the target data segment, wherein the data source identifier includes at least the attribute information of the data table where the target data segment is located; a calculation module 402, used to use the locally generated master key and the data source identifier as input to the target one-way mapping algorithm to calculate the secondary key index; a storage module 403, used to store the locally generated secondary key to the storage address indicated by the secondary key index; and a reading module 404, used to read the secondary key at the storage address and use the secondary key to encrypt or decrypt the target data segment.

[0068] In some embodiments of this application, the calculation module 402 is specifically used to: take the data source identifier as the input of the hash function and use the master key as the key parameter of the hash function to calculate the secondary key index.

[0069] [HZTC-HXJMJJ241006][HS2411171CCN]

[0070] In some embodiments of this application, the calculation module 402 is specifically used to: perform hash calculation on the data source identifier based on the hash function to obtain a hash string, wherein the hash string consists of at least one character and at least one number; determine the key index type corresponding to the cryptographic device, and generate a secondary key index that conforms to the key index type based on the hash string.

[0071] In some embodiments of this application, the calculation module 402 is specifically used to: directly determine the hash string as the secondary key index when the key index type is a mixed index; and to perform numerical conversion on the hash string when the key index type is a numeric index, and determine the converted numerical sequence as the secondary key index.

[0072] In some embodiments of this application, the generation module (not shown in the figure) is used to: associate the data source identifier with the calculated secondary key index to generate a one-way mapping relationship corresponding to the key index type.

[0073] In some embodiments of this application, the acquisition module 401 is further configured to: acquire and store the one-way mapping relationship between the data source identifier and the secondary key index; accordingly, read the secondary key at the storage address, including: querying the secondary key index corresponding to the data source identifier according to the pre-stored one-way mapping relationship; and reading the secondary key from the storage address indicated by the secondary key index.

[0074] In some embodiments of this application, the query module (not shown in the figure) is used to: obtain an encryption / decryption request, which includes a data source identifier and a target key index type; and invoke a one-way mapping relationship corresponding to the target key index type to query the secondary key index corresponding to the data source identifier.

[0075] According to the key processing apparatus of this application embodiment, by obtaining the data source identifier of the target data segment, and calculating the secondary key index based on the data source identifier and the master key generated by the cryptographic device using a target one-way mapping algorithm, the secondary key generated by the cryptographic device is stored in the storage address indicated by the secondary key index. This enables the target data segment to be encrypted or decrypted based on the secondary key stored in the cryptographic device, thereby avoiding storing the secondary key at an address outside the cryptographic device. Furthermore, since there is a one-way relationship between the target data segment and the secondary key index, the security of data transmission is guaranteed, and the risk of data leakage is reduced.

[0076] The key processing device 400 of this embodiment is used to implement the corresponding key processing devices in the foregoing multiple method embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here. In addition, the functional implementation of each module in the key processing device 400 of this embodiment can refer to the description of the corresponding part in the foregoing method embodiments, which will also not be repeated here.

[0077] [HZTC-HXJMJJ241006][HS2411171CCN]

[0078] Figure 5 This is a structural block diagram of an electronic device according to one embodiment of the present application. The specific embodiments of the present application do not limit the specific implementation of the electronic device.

[0079] like Figure 5 As shown, the electronic device 500 may include: a processor 501, a memory 502, a communication interface 503, and a communication bus 504. The processor 501, the memory 502, and the communication interface 503 communicate with each other through the communication bus 504. The memory 502 is used to store at least one executable instruction, which causes the processor 501 to perform the operation corresponding to the indexing method of any of the above embodiments.

[0080] The processor 501 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application. The smart device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0081] Memory 502, used to store programs, may include high-speed RAM memory and may also include non-volatile memory, such as at least one disk storage device.

[0082] The electronic device according to the embodiments of this application obtains the data source identifier of the target data segment and calculates the secondary key index based on the data source identifier and the master key generated by the cryptographic device using a target one-way mapping algorithm. The secondary key generated by the cryptographic device is then stored in the storage address indicated by the secondary key index. This enables the target data segment to be encrypted or decrypted based on the secondary key stored in the cryptographic device, thus avoiding storing the secondary key in an address outside the cryptographic device. Furthermore, since there is a one-way relationship between the target data segment and the secondary key index, the security of data transmission is guaranteed, and the risk of data leakage is reduced.

[0083] This application also provides a computer storage medium storing a computer program that, when executed by a processor, implements the key processing method of any of the above embodiments.

[0084] According to the computer storage medium of this application embodiment, by obtaining the data source identifier of the target data segment, and calculating the secondary key index based on the data source identifier and the master key generated by the cryptographic device using a target one-way mapping algorithm, the secondary key generated by the cryptographic device is stored in the storage address indicated by the secondary key index. This allows the target data segment to be encrypted or decrypted based on the secondary key stored in the cryptographic device, avoiding the need to store the secondary key at an address outside the cryptographic device. Furthermore, the one-way relationship between the target data segment and the secondary key index ensures the security of data transmission and reduces the risk of data leakage.

[0085] [HZTC-HXJMJJ241006][HS2411171CCN] Risk.

[0086] It should be noted that, depending on the implementation needs, the various components / steps described in the embodiments of this application can be broken down into more components / steps, or two or more components / steps or parts of the operation of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of this application.

[0087] The methods described in the embodiments of this application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code downloaded over a network that is originally stored in a remote recording medium or a non-transitory machine-readable medium and will be stored in a local recording medium. Thus, the methods described herein can be stored as software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the key processing methods described herein. Furthermore, when a general-purpose computer accesses code used to implement the key processing methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for executing the key processing methods shown herein.

[0088] Those skilled in the art will recognize that the units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this application.

[0089] The above embodiments are only used to illustrate the embodiments of this application and are not intended to limit the embodiments of this application. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of this application. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of this application, and the patent protection scope of the embodiments of this application should be defined by the claims. The systems, devices, or modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions.

Claims

1. A key processing method, characterized in that, Applied to cryptographic devices, including: Receive the data source identifier of the target data segment, wherein the data source identifier includes at least the attribute information of the data table where the target data segment is located; The locally generated master key and the data source identifier are used as inputs to the target one-way mapping algorithm to calculate the secondary key index; Store the locally generated secondary key at the storage address indicated by the secondary key index; Read the secondary key of the storage address, and use the secondary key to encrypt or decrypt the target data segment.

2. The key processing method according to claim 1, characterized in that, Using the locally generated master key and the data source identifier as inputs to the target one-way mapping algorithm, the secondary key index is calculated, including: The data source identifier is used as the input to the hash function, and the master key is used as the key parameter of the hash function to calculate the secondary key index.

3. The key processing method according to claim 2, characterized in that, The data source identifier is used as input to the hash function, and the master key is used as the key parameter of the hash function to calculate the secondary key index, including: The data source identifier is hashed based on the hash function to obtain a hash string, wherein the hash string consists of at least one character and at least one number; Determine the key index type corresponding to the cryptographic device, and generate a secondary key index that conforms to the key index type based on the hash string.

4. The key processing method according to claim 3, characterized in that, Based on the hash string, generate a secondary key index that conforms to the key index type, including: When the key index type is a hybrid index, the hash string is directly determined as the secondary key index; When the key index type is a numeric index, the hash string is numerically converted, and the converted numerical sequence is determined as the secondary key index.

5. The key processing method according to claim 3, characterized in that, The method further includes: Associating the data source identifier with the calculated secondary key index generates a one-way mapping relationship corresponding to the key index type.

6. The key processing method according to claim 1, characterized in that, The method further includes: Obtain and store the one-way mapping relationship between the data source identifier and the secondary key index; Accordingly, reading the secondary key of the storage address includes: Query the secondary key index corresponding to the data source identifier based on the pre-stored one-way mapping relationship; The secondary key is read from the storage address indicated by the secondary key index.

7. The key processing method according to claim 6, characterized in that, Querying the secondary key index corresponding to the data source identifier based on the pre-stored one-way mapping relationship includes: Obtain an encryption / decryption request, wherein the encryption / decryption request includes the data source identifier and the target key index type; Invoke the one-way mapping relationship corresponding to the target key index type to query the secondary key index corresponding to the data source identifier.

8. A key processing device, characterized in that, include: A receiving module is used to receive the data source identifier of the target data segment, wherein the data source identifier includes at least the attribute information of the data table where the target data segment is located; The calculation module is used to take the locally generated master key and the data source identifier as inputs to the target one-way mapping algorithm to calculate the secondary key index; A storage module is used to store locally generated subkeys at the storage address indicated by the subkey index; The reading module is used to read the secondary key of the storage address and use the secondary key to encrypt or decrypt the target data segment.

9. An electronic device, comprising: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the key processing method as described in any one of claims 1-7.

10. A computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the key processing method as described in any one of claims 1-7.

Images