Key switching method and device, electronic equipment, storage medium and program product
Patent Information
- Application Number
- CN202510536443.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-25
- Publication Date
- 2026-10-27
AI Technical Summary
[0005]本申请提供一种密钥切换方法、装置、电子设备、存储介质及程序产品，用以解决现有技术中密钥切换的效率较低的技术问题
[0093]本申请提供的密钥切换方法、装置、电子设备、存储介质及程序产品，通过响应于第一密钥切换指令，确定目标逻辑卷中的第一数据和至少一个第二数据，第一数据是在至少一个第二数据之后写入目标逻辑卷的数据，第一密钥切换指令包括目标逻辑卷的标识；根据至少一个第二数据，确定目标逻辑卷对应的当前版本信息，当前版本信息包括至少一个版本号；根据当前版本信息，确定目标版本号和更新密钥，目标版本号大于当前版本信息中任意一个版本号；根据更新密钥，对第一数据进行加密处理，得到目标数据，目标数据的版本号为目标版本号。这样，通过版本更新机制实现密钥的快速切换，无需停机或全量数据重新加密，支持多密钥共存，确保业务的连续性，提高了密钥切换的效率。
Smart Images
Figure CN122993919A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data security, and more particularly to a key switching method, apparatus, electronic device, storage medium, and program product. Background Technology
[0002] As data security threats continue to escalate, the need to ensure data security is growing. Keys, as the core of encryption systems, are crucial for ensuring data security.
[0003] In related technologies, key security can be ensured by securely storing the current key. For example, this can be achieved by encrypting the current key using a key management system or hardware security module. Alternatively, key security can be guaranteed by periodically changing the current key. For instance, all historical data can be re-encrypted using a new key.
[0004] In the aforementioned technologies, if the current key is changed periodically, all historical data needs to be re-encrypted with the new key, which may lead to a surge in storage input and output, increased service latency, and other issues, resulting in low efficiency of key switching. Summary of the Invention
[0005] This application provides a key switching method, apparatus, electronic device, storage medium, and program product to solve the technical problem of low efficiency in key switching in the prior art.
[0006] Firstly, this application provides a key switching method, the method comprising:
[0007] In response to a first key switching instruction, first data and at least one second data in a target logical volume are determined, the first data being data written to the target logical volume after the at least one second data, and the first key switching instruction includes an identifier of the target logical volume;
[0008] Based on the at least one second data, the current version information corresponding to the target logical volume is determined, wherein the current version information includes at least one version number;
[0009] Based on the current version information, a target version number and an update key are determined, wherein the target version number is greater than any version number in the current version information;
[0010] The first data is encrypted using the update key to obtain target data, and the version number of the target data is the target version number.
[0011] In this way, the key can be quickly switched through the version update mechanism without downtime or full data re-encryption, supporting multiple keys to coexist, ensuring business continuity, and improving the efficiency of key switching.
[0012] Optionally, the method described above, determining the target version number and update key based on the current version information, includes:
[0013] Determine the latest version number in the current version information;
[0014] Determine the target version number based on the latest version number;
[0015] Determine the current key based on the current version information;
[0016] Determine the update key based on the current key.
[0017] In this way, the key can be quickly switched through the version update mechanism without downtime or full data re-encryption, ensuring business continuity and improving the efficiency of key switching.
[0018] Optionally, the method described above, determining the update key based on the current key, includes:
[0019] Determine the current encryption algorithm corresponding to the current key, and the algorithm security level corresponding to the current encryption algorithm;
[0020] Determine the target security level corresponding to the first data;
[0021] Determine whether the security level of the algorithm is greater than the target security level;
[0022] If so, determine the update key based on the current encryption algorithm;
[0023] If not, determine the target encryption algorithm based on the target security level, and determine the update key based on the target encryption algorithm.
[0024] In this way, when the security level of the algorithm corresponding to the key is lower than the current security level of the data, the target encryption algorithm is determined, and encryption is performed according to the target encryption algorithm, thereby improving the security of the key.
[0025] Optionally, the method described above, determining the current key based on the current version information, includes:
[0026] Obtain the first mapping table corresponding to the target logical volume. The first mapping table includes multiple keys and a version range corresponding to each key. The version range includes at least one version number.
[0027] The current key is determined based on the latest version number and the first mapping table.
[0028] In this way, the mapping table can be used to quickly identify the key corresponding to each version number, support the coexistence of multiple keys, and ensure business continuity.
[0029] Optionally, the method described above further includes:
[0030] A third data is determined from at least one second data, wherein the third data is the data corresponding to the latest version number in the current version information;
[0031] In the third data, data to be processed that has the same storage location as the first data is identified;
[0032] The data to be processed is deleted from the third data to obtain the processed third data.
[0033] This allows higher version data to be overwritten to the storage location corresponding to lower version data, thus enabling automatic cleanup of lower version data.
[0034] Optionally, the method described above further includes:
[0035] Receive a second key switching instruction, the second key switching instruction being used to instruct the target key to be switched to the updated key, the target key being a key in the first mapping table corresponding to the target logical volume;
[0036] Based on the first mapping table and the target key, determine the data to be switched corresponding to the target key from the at least one second data;
[0037] Based on the target key, the data to be switched is decrypted to obtain the decrypted data to be switched.
[0038] Based on the update key, the decrypted data to be switched is encrypted to obtain the fourth data;
[0039] The first mapping table is updated based on the version number corresponding to the fourth data and the update key.
[0040] In this way, the security of older data is improved by re-encrypting the lower-version data.
[0041] Optionally, the method described above further includes:
[0042] Receive a snapshot creation instruction, the snapshot creation instruction being used to instruct the target data to create a snapshot;
[0043] According to the snapshot creation instruction, the target data is processed to create a snapshot, and the snapshot data corresponding to the target data is obtained;
[0044] The target data is upgraded to obtain fifth data and a version number corresponding to the fifth data. The version number corresponding to the fifth data is determined based on the target version number, and the key corresponding to the fifth data is the update key.
[0045] In this way, when creating a snapshot, the version number increments while the key remains unchanged, supporting multiple keys coexisting and quick access to key information, thus ensuring business continuity.
[0046] Optionally, the method described above further includes:
[0047] Receive a data read instruction, wherein the data read instruction includes a first version number;
[0048] The first key is determined based on the first version number and the first mapping table corresponding to the target logical volume;
[0049] Based on the first key, the data corresponding to the first version number is decrypted to obtain the data corresponding to the data read instruction.
[0050] In this way, data can be read quickly based on the mapping table, thus improving the data read and write speed.
[0051] Secondly, this application provides a key switching device, the device comprising:
[0052] A first determining module is configured to, in response to a first key switching instruction, determine first data and at least one second data in a target logical volume, wherein the first data is data written to the target logical volume after the at least one second data, and the first key switching instruction includes an identifier of the target logical volume.
[0053] The second determining module is used to determine the current version information corresponding to the target logical volume based on the at least one second data, wherein the current version information includes at least one version number;
[0054] The third determining module is used to determine the target version number and the update key based on the current version information, wherein the target version number is greater than any version number in the current version information;
[0055] The processing module is used to encrypt the first data according to the update key to obtain target data, wherein the version number of the target data is the target version number.
[0056] Optionally, in the apparatus described above, the third determining module is specifically used for:
[0057] Determine the latest version number in the current version information;
[0058] Determine the target version number based on the latest version number;
[0059] Determine the current key based on the current version information;
[0060] Determine the update key based on the current key.
[0061] Optionally, in the apparatus described above, the third determining module is specifically used for:
[0062] Determine the current encryption algorithm corresponding to the current key, and the algorithm security level corresponding to the current encryption algorithm;
[0063] Determine the target security level corresponding to the first data;
[0064] Determine whether the security level of the algorithm is greater than the target security level;
[0065] If so, determine the update key based on the current encryption algorithm;
[0066] If not, determine the target encryption algorithm based on the target security level, and determine the update key based on the target encryption algorithm.
[0067] Optionally, in the apparatus described above, the third determining module is specifically used for:
[0068] Obtain the first mapping table corresponding to the target logical volume. The first mapping table includes multiple keys and a version range corresponding to each key. The version range includes at least one version number.
[0069] The current key is determined based on the latest version number and the first mapping table.
[0070] Optionally, in the apparatus described above, the processing module is further configured to:
[0071] A third data is determined from at least one second data, wherein the third data is the data corresponding to the latest version number in the current version information;
[0072] In the third data, data to be processed that has the same storage location as the first data is identified;
[0073] The data to be processed is deleted from the third data to obtain the processed third data.
[0074] Optionally, in the apparatus described above, the apparatus further includes a switching module, which is further configured to:
[0075] Receive a second key switching instruction, the second key switching instruction being used to instruct the target key to be switched to the updated key, the target key being a key in the first mapping table corresponding to the target logical volume;
[0076] Based on the first mapping table and the target key, determine the data to be switched corresponding to the target key from the at least one second data;
[0077] Based on the target key, the data to be switched is decrypted to obtain the decrypted data to be switched.
[0078] Based on the update key, the decrypted data to be switched is encrypted to obtain the fourth data;
[0079] The first mapping table is updated based on the version number corresponding to the fourth data and the update key.
[0080] Optionally, in the apparatus described above, the apparatus further includes a creation module, which is further configured to:
[0081] Receive a snapshot creation instruction, the snapshot creation instruction being used to instruct the target data to create a snapshot;
[0082] According to the snapshot creation instruction, the target data is processed to create a snapshot, and the snapshot data corresponding to the target data is obtained;
[0083] The target data is upgraded to obtain fifth data and a version number corresponding to the fifth data. The version number corresponding to the fifth data is determined based on the target version number, and the key corresponding to the fifth data is the update key.
[0084] Optionally, in the apparatus described above, the apparatus further includes a reading module, which is further configured to:
[0085] Receive a data read instruction, wherein the data read instruction includes a first version number;
[0086] The first key is determined based on the first version number and the first mapping table corresponding to the target logical volume;
[0087] Based on the first key, the data corresponding to the first version number is decrypted to obtain the data corresponding to the data read instruction.
[0088] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;
[0089] The memory stores computer-executed instructions;
[0090] The processor executes computer execution instructions stored in the memory to implement the method described in any of the first aspects.
[0091] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.
[0092] Fifthly, this application provides a computer program product, including a computer program that, when executed by a computer, implements the method as described in any one of the first aspects.
[0093] The key switching method, apparatus, electronic device, storage medium, and program product provided in this application, in response to a first key switching instruction, determine first data and at least one second data in a target logical volume. The first data is data written to the target logical volume after the at least one second data. The first key switching instruction includes an identifier of the target logical volume. Based on the at least one second data, determine the current version information corresponding to the target logical volume. The current version information includes at least one version number. Based on the current version information, determine a target version number and an update key. The target version number is greater than any version number in the current version information. Based on the update key, encrypt the first data to obtain the target data. The version number of the target data is the target version number. Thus, a version update mechanism enables rapid key switching without downtime or full data re-encryption, supports multiple keys coexisting, ensures business continuity, and improves the efficiency of key switching. Attached Figure Description
[0094] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0095] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application;
[0096] Figure 2 A flowchart illustrating a key switching method provided in an embodiment of this application;
[0097] Figure 3 A flowchart illustrating another key switching method provided in an embodiment of this application;
[0098] Figure 4 A flowchart illustrating a snapshot creation and key switching process provided in this application embodiment;
[0099] Figure 5 This is a schematic diagram of the structure of a key switching device provided in an embodiment of this application;
[0100] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.
[0101] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0102] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0103] It should be noted that although the terms "first," "second," etc., are used to describe various types of information in the embodiments of this application, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. Optionally, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information.
[0104] It should be understood that the terms "comprising" or "including" indicate the presence of the previously mentioned features, steps, or operations, but do not preclude the presence, occurrence, or addition of one or more other features, steps, or operations. The terms "and / or," etc., used in this application can be interpreted as inclusive, or mean any one or any combination thereof. Optionally, "A and / or B" means "any one of the following: A; B; A and B." Additionally, the character " / " generally indicates that the preceding and following objects are in an "or" relationship.
[0105] As data security threats continue to escalate, the need to ensure data security is growing. As the core of an encryption system, the key is crucial for ensuring data security.
[0106] In related technologies, key security can be ensured by securely storing the current key. For example, this can be achieved by encrypting the current key using a key management system or hardware security module. Alternatively, key security can be ensured by periodically changing the current key. For example, all historical data can be re-encrypted using a new key.
[0107] In the aforementioned technologies, if the current key is changed periodically, all historical data needs to be re-encrypted with the new key, which may lead to a surge in storage input and output, increased service latency, and other issues, resulting in low efficiency of key switching.
[0108] To address the aforementioned technical problems, this application provides a key switching method. In response to a first key switching instruction, it determines first data and at least one second data in a target logical volume. The first data is data written to the target logical volume after the at least one second data. Based on the at least one second data, it determines the current version information corresponding to the target logical volume. Based on the current version information, it determines the target version number and an update key. The first data is then encrypted using the update key to obtain the target data, where the version number of the target data is the target version number. This method achieves rapid key switching through a version update mechanism, eliminating the need for system downtime or full data re-encryption. It supports multiple keys coexisting, ensures business continuity, and improves the efficiency of key switching.
[0109] Below, in conjunction with Figure 1 Examples of data switching application scenarios are provided.
[0110] Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. Please refer to [link / reference]. Figure 1 , Figure 1 It can include the application layer, the cryptographic service layer, the key management layer, and the storage layer.
[0111] The application layer can send read and write requests to the encryption service layer. These requests may include version information.
[0112] For example, a read / write request can be used to read the first data, with version information V4.
[0113] The encryption service layer may include a key switching controller, a version-key mapping table, and an encryption / decryption engine. The key switching controller receives key switching commands, triggers version number increment, and updates the version-key mapping table. The encryption / decryption engine selects the corresponding key for encryption and decryption based on the version-key mapping table.
[0114] The key management layer can be used for key management services and key storage. Key management services can include generating, distributing, and rotating keys, supporting both symmetric and asymmetric encryption. Key storage can be used to store all historical keys.
[0115] The storage layer can be used to store data and its corresponding version information, as well as manage snapshots. Stored data can be tagged with version information, supporting the coexistence of multiple versions. Version information can be used to maintain a global version number sequence, ensuring strict increment, and recording the latest version information and at least one historical version information for each data block.
[0116] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0117] The technical solutions shown in this application will now be described in detail through specific embodiments. It should be noted that the following embodiments may exist independently or in combination with each other; for the same or similar content, the description will not be repeated in different embodiments.
[0118] Figure 2 This is a flowchart illustrating a key switching method provided in an embodiment of this application. The execution entity in this embodiment can be a processor. The processor can be implemented in software or a combination of software and hardware. Please refer to... Figure 2 The method includes:
[0119] S201, in response to the first key switching instruction, determine the first data and at least one second data in the target logical volume.
[0120] The first key switching instruction includes the identifier of the target logical volume.
[0121] The first key switching command can be used to dynamically change keys to address security threats, meet compliance requirements, or optimize key management.
[0122] The first data can be data written to the target logical volume after at least one second data.
[0123] At least one second piece of data may be data that was already stored in the target logical volume before the first data was written.
[0124] It can receive a first key switching instruction, parse the first key switching instruction to obtain the identifier of the target logical volume, and determine the first data and at least one second data in the target logical volume based on the identifier of the target logical volume.
[0125] S202. Determine the current version information corresponding to the target logical volume based on at least one second data.
[0126] The current version information includes at least one version number.
[0127] The current version information can be used to indicate the data status of the target logical volume at a specific time, as well as encryption information, etc.
[0128] The version number corresponding to at least one second data can be determined, and the current version information corresponding to the target logical volume can be determined based on the version number corresponding to at least one second data.
[0129] In this way, the current version information of the target logical volume can be determined based on the old data previously stored in the target logical volume, ensuring data consistency for proper operation and management, and ensuring business continuity.
[0130] S203. Based on the current version information, determine the target version number and update key.
[0131] The target version number is greater than any version number in the current version information.
[0132] The updated key can be used to encrypt newly written data to improve data security.
[0133] The configuration information in the current version information can be determined, and the target version number and update key can be determined based on the configuration information.
[0134] The configuration information may include version number naming information and key configuration information.
[0135] Version number naming information may include naming rules and configuration information, which are not limited here.
[0136] Key configuration information may include key update rules and configuration information, etc., which are not limited here.
[0137] Key update rules can be used to determine the key algorithm corresponding to the updated key in order to generate the updated key.
[0138] Optionally, the target version number and update key can be determined based on the current version information in the following ways: determine the latest version number in the current version information; determine the target version number based on the latest version number; determine the current key based on the current version information; and determine the update key based on the current key.
[0139] This can be achieved by determining the update key based on the encryption algorithm corresponding to the current key, or by re-determining the target encryption algorithm and then determining the update key based on the target encryption algorithm.
[0140] S204. Based on the updated key, encrypt the first data to obtain the target data.
[0141] The version number of the target data is the target version number.
[0142] The encryption method can be determined based on the updated key. Based on the encryption method and the updated key, the first data is encrypted to obtain the target data.
[0143] The encryption method can include symmetric encryption and asymmetric encryption, etc., and is not limited here.
[0144] Optionally, the method further includes a current key, which is used to encrypt the second data. After encrypting the first data according to the updated key to obtain the target data, a security check is performed on the current key to obtain a check result. If the check result is insecure, at least one piece of second data is re-encrypted according to the updated key to obtain at least one piece of updated second data.
[0145] Thus, if the security check result of the current key is determined to be insecure, there may be a situation where the key is leaked. In this case, the key should be replaced, and the second data should be re-encrypted with the updated key, while keeping the version information of the second data unchanged, to ensure the security of the data.
[0146] Optionally, the method further includes deleting data with the same storage location as the first data in at least one second data, which can be achieved by: determining third data in at least one second data; determining data to be processed in the third data that has the same storage location as the first data; deleting the data to be processed in the third data to obtain the processed third data.
[0147] The third piece of data can be the data corresponding to the latest version number in the current version information.
[0148] The data to be processed can be data in the same storage location as the first data, corresponding to the latest version number of at least one second data.
[0149] This allows for the automatic overwriting of old data in the target logical volume that is in the same location as the newly written data, thus automatically cleaning up old data, reducing data redundancy, and improving the efficiency of key switching.
[0150] Optionally, the method further includes key switching processing of the second data, which can be implemented as follows: receiving a second key switching instruction; determining the data to be switched corresponding to the target key in at least one of the second data according to the first mapping table and the target key; decrypting the data to be switched according to the target key to obtain the decrypted data to be switched; encrypting the decrypted data to be switched according to the update key to obtain the fourth data; and updating the first mapping table according to the version number corresponding to the fourth data and the update key.
[0151] The second key switching instruction is used to instruct the target key to be switched to the updated key.
[0152] The target key is a key in the first mapping table corresponding to the target logical volume.
[0153] Optionally, the first mapping table may include multiple keys and a version range corresponding to each key, wherein the version range includes at least one version number.
[0154] Optionally, the first mapping table may include multiple keys and a starting version number corresponding to each key.
[0155] Optionally, the method further includes creating a snapshot of the target data, which can be achieved by: receiving a snapshot creation instruction; creating a snapshot of the target data according to the snapshot creation instruction to obtain snapshot data corresponding to the target data; and performing a version upgrade on the target data to obtain the fifth data and the version number corresponding to the fifth data.
[0156] The Create Snapshot command is used to instruct the creation of a snapshot of the target data.
[0157] The version number corresponding to the fifth data is determined based on the target version number.
[0158] The key corresponding to the fifth piece of data is the update key.
[0159] Snapshot data can be a read-only copy of the target data at a specific point in time.
[0160] Snapshot data can be used to record the complete state of target data at a certain moment. When the target data is restored to its historical state due to misoperation, software failure or data corruption, the snapshot data can be used.
[0161] Optionally, the first mapping table corresponding to the target logical volume can be updated based on the version number and update key corresponding to the fifth data.
[0162] Optionally, the method further includes reading data, which can be achieved by: receiving a data reading instruction, the data reading instruction including a first version number; determining a first key based on the first version number and a first mapping table corresponding to the target logical volume; and decrypting the data corresponding to the first version number based on the first key to obtain the data corresponding to the data reading instruction.
[0163] The key switching method provided in this embodiment, in response to a first key switching instruction, determines first data and at least one second data in the target logical volume. The first data is data written to the target logical volume after the at least one second data. The first key switching instruction includes an identifier of the target logical volume. Based on the at least one second data, it determines the current version information corresponding to the target logical volume, which includes at least one version number. Based on the current version information, it determines a target version number and an update key, where the target version number is greater than any version number in the current version information. Based on the update key, it encrypts the first data to obtain the target data, where the version number of the target data is the target version number. Thus, a version update mechanism enables rapid key switching without requiring system downtime or full data re-encryption, supports multiple keys coexisting, ensures business continuity, and improves the efficiency of key switching.
[0164] Below, in conjunction with Figure 3 The process of determining the target version number and update key based on the current version information (S203) is explained.
[0165] Figure 3 This is a flowchart illustrating another key switching method provided in an embodiment of this application. Based on the above embodiments, see [link to relevant documentation]. Figure 3 The method includes:
[0166] S301. Determine the latest version number in the current version information.
[0167] The latest version number can be the version number with the largest value among all version numbers.
[0168] For example, assuming the version numbers include V1, V2, and V3, then V3 is the latest version number.
[0169] It can retrieve at least one version number from the current version information and determine the latest version number from the current version information based on the at least one version number.
[0170] S302. Determine the target version number based on the latest version number.
[0171] It can obtain preset version upgrade rules and determine the target version number based on the latest version number and version upgrade rules.
[0172] S303. Obtain the first mapping table corresponding to the target logical volume.
[0173] The first mapping table includes multiple keys and the version range corresponding to each key.
[0174] The version range includes at least one version number.
[0175] The first mapping table corresponding to the target logical volume can be obtained from the preset storage space.
[0176] S304. Determine the current key based on the latest version number and the first mapping table.
[0177] The current key can be the key corresponding to the latest version number.
[0178] You can find the current key corresponding to the latest version number in the first mapping table.
[0179] S305. Determine the current encryption algorithm corresponding to the current key, and the algorithm security level corresponding to the current encryption algorithm.
[0180] The current encryption algorithm is the same as the encryption algorithm corresponding to the current key.
[0181] The algorithm security level can be the security level corresponding to the current encryption algorithm.
[0182] The current key can be analyzed and processed to determine the current encryption algorithm corresponding to the current key, obtain the second mapping table, and determine the algorithm security level corresponding to the current encryption algorithm based on the current encryption algorithm and the second mapping table.
[0183] The second mapping table may include multiple encryption algorithms and the corresponding security level of each encryption algorithm.
[0184] S306. Determine the target security level corresponding to the first data.
[0185] It is possible to obtain the metadata corresponding to the first data, and determine the target security level corresponding to the first data based on the metadata.
[0186] S307. Determine whether the algorithm's security level is greater than the target security level.
[0187] Optionally, a first value corresponding to the algorithm security level and a second value corresponding to the target security level can be determined separately, and it can be determined whether the first value is greater than the second value.
[0188] If so, then execute S308;
[0189] If not, then execute S309.
[0190] S308. Determine the update key based on the current encryption algorithm.
[0191] A key can be generated using the current encryption algorithm, and this key can be used as the update key.
[0192] S309. Based on the target security level, determine the target encryption algorithm, and based on the target encryption algorithm, determine the update key.
[0193] The target encryption algorithm corresponding to the target security level can be determined, a key can be generated based on the target encryption algorithm, and this key can be used as the update key.
[0194] The implementation details of each step in this application embodiment can be found in the description of the corresponding steps or operations in the above method embodiments; repeated content will not be repeated.
[0195] The key switching method provided in this embodiment involves: determining the latest version number in the current version information; determining the target version number based on the latest version number; determining the current key based on the current version information; determining the update key based on the current key; obtaining a first mapping table corresponding to the target logical volume, the first mapping table including multiple keys and a version range corresponding to each key, the version range including at least one version number; determining the current key based on the latest version number and the first mapping table; determining the current encryption algorithm corresponding to the current key and the algorithm security level corresponding to the current encryption algorithm; determining the target security level corresponding to the first data; determining whether the algorithm security level is greater than the target security level; if so, determining the update key based on the current encryption algorithm; if not, determining the target encryption algorithm based on the target security level and the update key based on the target encryption algorithm. This achieves rapid key switching through a version update mechanism, without requiring system downtime or full data re-encryption, supports multiple keys coexisting, ensures business continuity, and improves the efficiency of key switching.
[0196] Below, in conjunction with Figure 4 The technical solutions shown in this application will be illustrated through specific examples.
[0197] Figure 4 This is a flowchart illustrating a snapshot creation and key switching process provided in an embodiment of this application. Figure 4 This includes multiple version information (V1-V5), multiple keys (key1 and key2), and multiple snapshots (snap1-snap3) corresponding to the data. See also... Figure 4 The method includes:
[0198] In version V1, the second data can be encrypted using key1.
[0199] The second data can be data already stored in the target logical volume.
[0200] Version V1 can represent the initial state of the second data when it is stored.
[0201] Upon receiving the snapshot creation instruction, the second data is processed for snapshot creation and version upgrade according to the snapshot creation instruction, resulting in snap1 and the second data in version V2. The key corresponding to the second data in version V2 is still key1.
[0202] If a snapshot creation instruction is received again, snapshot creation and version upgrade processing are performed on the second data in version V2 and the newly written first data according to the snapshot creation instruction, to obtain snap2 and the second data in version V3. The key corresponding to the second data in version V3 is still key1.
[0203] Upon receiving a first key switching instruction, in response to the instruction, multiple sets of second data from versions V1 to V3 and the newly written first data are identified. Based on the multiple sets of second data from versions V1 to V3, the target version number is determined to be V4 and the update key is key2. The first data is then encrypted using key2 to obtain the target data, which corresponds to version V4. Furthermore, since there is no snapshot of the second data from version V3, it can be overwritten by data from higher versions. Figure 4 (× can be used to indicate that it can be covered);
[0204] If a snapshot creation command is received again, in response to the snapshot creation command, snapshot creation and version upgrade processing are performed on the target data in version V4 to obtain snap3 and target data in version V5. The key corresponding to the target data in version V5 is key2.
[0205] In this way, the version number is incremented during key switching to ensure that each version number corresponds to the corresponding key, enabling fast key switching without downtime or full data re-encryption. It also supports the coexistence of multiple keys, ensuring business continuity and improving the efficiency of key switching.
[0206] Figure 5 This is a schematic diagram of a key switching device provided in an embodiment of this application. Please refer to... Figure 5 The key switching device 500 includes a first determining module 501, a second determining module 502, a third determining module 503, and a processing module 504, wherein...
[0207] The first determining module 501 is configured to, in response to a first key switching instruction, determine first data and at least one second data in a target logical volume, wherein the first data is data written to the target logical volume after the at least one second data, and the first key switching instruction includes an identifier of the target logical volume.
[0208] The second determining module 502 is used to determine the current version information corresponding to the target logical volume based on the at least one second data, wherein the current version information includes at least one version number;
[0209] The third determining module 503 is used to determine the target version number and the update key based on the current version information, wherein the target version number is greater than any version number in the current version information;
[0210] The processing module 504 is used to encrypt the first data according to the update key to obtain target data, wherein the version number of the target data is the target version number.
[0211] Optionally, in the apparatus described above, the third determining module 503 is specifically used for:
[0212] Determine the latest version number in the current version information;
[0213] Determine the target version number based on the latest version number;
[0214] Determine the current key based on the current version information;
[0215] Determine the update key based on the current key.
[0216] Optionally, in the apparatus described above, the third determining module 503 is specifically used for:
[0217] Determine the current encryption algorithm corresponding to the current key, and the algorithm security level corresponding to the current encryption algorithm;
[0218] Determine the target security level corresponding to the first data;
[0219] Determine whether the security level of the algorithm is greater than the target security level;
[0220] If so, determine the update key based on the current encryption algorithm;
[0221] If not, determine the target encryption algorithm based on the target security level, and determine the update key based on the target encryption algorithm.
[0222] Optionally, in the apparatus described above, the third determining module 503 is specifically used for:
[0223] Obtain the first mapping table corresponding to the target logical volume. The first mapping table includes multiple keys and a version range corresponding to each key. The version range includes at least one version number.
[0224] The current key is determined based on the latest version number and the first mapping table.
[0225] Optionally, in the apparatus described above, the processing module 504 is further configured to:
[0226] A third data is determined from at least one second data, wherein the third data is the data corresponding to the latest version number in the current version information;
[0227] In the third data, data to be processed that has the same storage location as the first data is identified;
[0228] The data to be processed is deleted from the third data to obtain the processed third data.
[0229] Optionally, in the apparatus described above, the apparatus further includes a switching module 505, which is further configured to:
[0230] Receive a second key switching instruction, the second key switching instruction being used to instruct the target key to be switched to the updated key, the target key being a key in the first mapping table corresponding to the target logical volume;
[0231] Based on the first mapping table and the target key, determine the data to be switched corresponding to the target key from the at least one second data;
[0232] Based on the target key, the data to be switched is decrypted to obtain the decrypted data to be switched.
[0233] Based on the update key, the decrypted data to be switched is encrypted to obtain the fourth data;
[0234] The first mapping table is updated based on the version number corresponding to the fourth data and the update key.
[0235] Optionally, in the apparatus described above, the apparatus further includes a creation module 506, which is further configured to:
[0236] Receive a snapshot creation instruction, the snapshot creation instruction being used to instruct the target data to create a snapshot;
[0237] According to the snapshot creation instruction, the target data is processed to create a snapshot, and the snapshot data corresponding to the target data is obtained;
[0238] The target data is upgraded to obtain fifth data and a version number corresponding to the fifth data. The version number corresponding to the fifth data is determined based on the target version number, and the key corresponding to the fifth data is the update key.
[0239] Optionally, in the apparatus described above, the apparatus further includes a reading module 507, which is used for:
[0240] Receive a data read instruction, wherein the data read instruction includes a first version number;
[0241] The first key is determined based on the first version number and the first mapping table corresponding to the target logical volume;
[0242] Based on the first key, the data corresponding to the first version number is decrypted to obtain the data corresponding to the data read instruction.
[0243] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Please refer to... Figure 6 The electronic device 600 may include: a memory 601, a processor 602, and a transceiver 603.
[0244] Memory 601 is used to store program instructions;
[0245] The processor 602 is used to execute the program instructions stored in the memory so that the electronic device 600 performs the above-described method.
[0246] Transceiver 603 may include a transmitter and / or a receiver. The transmitter may also be referred to as a transmitter, transmitter port, or transmitter interface, and the receiver may also be referred to as a receiver port, receiver interface, or similar descriptions. Exemplarily, memory 601, processor 602, and transceiver 603 are interconnected via bus 604.
[0247] This application also provides a computer program product that can be executed by a processor, and when the computer program product is executed, the above-described method can be implemented.
[0248] The key switching device, electronic device, computer-readable storage medium, and computer program product of the embodiments of this application can execute the technical solutions shown in the above-described key switching method embodiments. Their implementation principles and beneficial effects are similar and will not be described again here.
[0249] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.
[0250] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.
[0251] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.
[0252] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.
[0253] When an integrated unit / module is implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.
[0254] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0255] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as these combinations of technical features do not contradict each other, they should be considered within the scope of this specification.
[0256] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0257] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A key switching method, characterized in that, The method includes: In response to a first key switching instruction, first data and at least one second data in a target logical volume are determined, the first data being data written to the target logical volume after the at least one second data, and the first key switching instruction includes an identifier of the target logical volume; Based on the at least one second data, the current version information corresponding to the target logical volume is determined, wherein the current version information includes at least one version number; Based on the current version information, a target version number and an update key are determined, wherein the target version number is greater than any version number in the current version information; The first data is encrypted using the update key to obtain target data, and the version number of the target data is the target version number.
2. The method according to claim 1, characterized in that, Based on the current version information, determine the target version number and update key, including: Determine the latest version number in the current version information; Determine the target version number based on the latest version number; Determine the current key based on the current version information; Determine the update key based on the current key.
3. The method according to claim 2, characterized in that, Determine the update key based on the current key, including: Determine the current encryption algorithm corresponding to the current key, and the algorithm security level corresponding to the current encryption algorithm; Determine the target security level corresponding to the first data; Determine whether the security level of the algorithm is greater than the target security level; If so, determine the update key based on the current encryption algorithm; If not, determine the target encryption algorithm based on the target security level, and determine the update key based on the target encryption algorithm.
4. The method according to claim 2, characterized in that, Based on the current version information, the current key is determined, including: Obtain the first mapping table corresponding to the target logical volume. The first mapping table includes multiple keys and a version range corresponding to each key. The version range includes at least one version number. The current key is determined based on the latest version number and the first mapping table.
5. The method according to any one of claims 1-4, characterized in that, The method further includes: A third data is determined from at least one second data, wherein the third data is the data corresponding to the latest version number in the current version information; In the third data, data to be processed that has the same storage location as the first data is identified; The data to be processed is deleted from the third data to obtain the processed third data.
6. The method according to any one of claims 1-4, characterized in that, The method further includes: Receive a second key switching instruction, the second key switching instruction being used to instruct the target key to be switched to the updated key, the target key being a key in the first mapping table corresponding to the target logical volume; Based on the first mapping table and the target key, determine the data to be switched corresponding to the target key from the at least one second data; Based on the target key, the data to be switched is decrypted to obtain the decrypted data to be switched. Based on the update key, the decrypted data to be switched is encrypted to obtain the fourth data; The first mapping table is updated based on the version number corresponding to the fourth data and the update key.
7. The method according to any one of claims 1-4, characterized in that, The method further includes: Receive a snapshot creation instruction, the snapshot creation instruction being used to instruct the target data to create a snapshot; According to the snapshot creation instruction, the target data is processed to create a snapshot, and the snapshot data corresponding to the target data is obtained; The target data is upgraded to obtain fifth data and a version number corresponding to the fifth data. The version number corresponding to the fifth data is determined based on the target version number, and the key corresponding to the fifth data is the update key.
8. The method according to any one of claims 1-4, characterized in that, The method further includes: Receive a data read instruction, wherein the data read instruction includes a first version number; The first key is determined based on the first version number and the first mapping table corresponding to the target logical volume; Based on the first key, the data corresponding to the first version number is decrypted to obtain the data corresponding to the data read instruction.
9. A key switching device, characterized in that, The device includes: A first determining module is configured to, in response to a first key switching instruction, determine first data and at least one second data in a target logical volume, wherein the first data is data written to the target logical volume after the at least one second data, and the first key switching instruction includes an identifier of the target logical volume; The second determining module is used to determine the current version information corresponding to the target logical volume based on the at least one second data, wherein the current version information includes at least one version number; The third determining module is used to determine the target version number and the update key based on the current version information, wherein the target version number is greater than any version number in the current version information; The processing module is used to encrypt the first data according to the update key to obtain target data, wherein the version number of the target data is the target version number.
10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 8.
11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 8.
12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.