Data encryption and decryption method in key management system, device, and storage medium

Abstract

The present application discloses a data encryption and decryption method in a key management system, a device, and a storage medium. The method comprises: acquiring a key association request of a service side, wherein the key association request comprises an encryption / decryption request and / or a life cycle management request of a key; if the key association request comprises the encryption / decryption request, acquiring corresponding key association information on the basis of the key association request, performing encryption / decryption processing on data to be processed of the service side on the basis of the key association information, and returning the encrypted / decrypted data to the service side; and if the key association request comprises the life cycle management request, performing life cycle management on the key of the service side on the basis of the key association request.

Description

Data encryption and decryption method, device and storage medium in key management system

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202310795273.9 filed on June 30, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of data processing technology, and in particular to a data encryption and decryption method, device, and storage medium in a key management system. Background Art

[0004] To ensure business security, data encryption and decryption processing and management are usually required.

[0005] At present, the cloud service platform mainly implements the processing and management of data encryption and decryption in the business-side key management system through the API interface. The operation is complicated, and the encryption and decryption of business-side data provided by the API interface requires remote transmission, and generally can only perform encryption and decryption rather than other management processes, which reduces the efficiency of encryption and decryption related processing. In addition, in a large number of microservice scenarios, the intensive data encryption and decryption in the key management system will cause a pressure bottleneck in the KMS itself, increase the resource consumption of the KMS, and further affect the efficiency of encryption and decryption.

[0006] Summary of the Invention

[0007] In view of this, the present application provides a data encryption and decryption method, system, device and storage medium in a key management system, aiming to solve the technical problem of low encryption and decryption efficiency caused by implementing encryption and decryption of business-side data through API interface.

[0008] An embodiment of the present application provides a data encryption and decryption method in a key management system, which is applied to a key management agent in the key management system, wherein the key management agent is communicated with a cloud service platform and a business side respectively, and the method includes: obtaining a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; if the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data on the business side based on the key association information, and returning the data after the encryption / decryption processing is completed to the business side; if the key association request includes a lifecycle management request, performing lifecycle management on the key of the business side based on the key association request.

[0009] The present application also provides a data encryption and decryption method in a key management system, which is applied to a cloud service platform, wherein the cloud service platform is respectively communicated with a key management agent and a business side in the key management system, and the method includes: receiving a key association request forwarded by the key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; or if the key association request includes a lifecycle management request, performing lifecycle management on the key of the business side based on the key association request.

[0010] The present application also provides a data encryption and decryption method in a key management system, which is applied to the business side of the key management system. The business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface that provides an entry for key lifecycle management, and realizes online key status negotiation with the cloud service platform based on the key management agent.

[0011] The present application also provides a data encryption and decryption system in a key management system, the data encryption and decryption system in the key management system includes: a business side, which is used to build a key registration model file in a preset directory, the business side includes a key maintenance interface to provide an entry for key life cycle management, and realizes online key status negotiation with the cloud service platform based on the key management agent; a key management agent, which is used to obtain a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a life cycle management request; and is also used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; if the key association request includes a life cycle The cloud service platform is used to receive the key association request forwarded by the key management agent, wherein the key association request includes the encryption / decryption request and / or life cycle management request of the key; and is also used to determine the corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, and send the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; if the key association request includes a life cycle management request, it is also used to interact with the key management agent based on the key association request to realize the life cycle management of the key on the business side.

[0012] The present application also provides a data encryption and decryption device in a key management system, which is applied to a key management agent in the key management system, and the key management agent is communicated with a cloud service platform and a business side respectively, and the device includes: an acquisition module, used to obtain a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; a first encryption / decryption module, used to obtain corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; a first lifecycle management module, used to manage the lifecycle of the key on the business side based on the key association request if the key association request includes a lifecycle management request.

[0013] The present application also provides a data encryption and decryption device in a key management system, which is a physical node device. The data encryption and decryption device in the key management system includes: a memory, a processor, and a program of the data encryption and decryption method in the key management system stored on the memory and runnable on the processor. When the program of the data encryption and decryption method in the key management system is executed by the processor, the steps of the data encryption and decryption method in the key management system as described above can be implemented.

[0014] To achieve the above-mentioned purpose, a storage medium is also provided, on which a data encryption and decryption program in a key management system is stored. When the data encryption and decryption program in the key management system is executed by a processor, the steps of any of the above-mentioned data encryption and decryption methods in the key management system are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] FIG1 is a flow chart of a first embodiment of a data encryption and decryption method in a key management system of the present application;

[0016] FIG2 is a schematic diagram of a detailed flow chart of step S20 in the first embodiment of the data encryption and decryption method in the key management system of the present application;

[0017] FIG3 is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application;

[0018] FIG4 is a schematic diagram of the interaction between the business side, the key management agent, and the cloud service platform involved in the data encryption and decryption method in the key management system of the present application;

[0019] FIG5 is a schematic diagram of generating a master key involved in the data encryption and decryption method in the key management system of the present application;

[0020] FIG6 is a schematic diagram of the registration application management of the working key involved in the data encryption and decryption method in the key management system of the present application;

[0021] FIG7 is a schematic diagram of the encryption and decryption process involved in the data encryption and decryption method in the key management system of the present application;

[0022] FIG8 is a schematic diagram of a specific key query process involved in the data encryption and decryption method in the key management system of the present application;

[0023] FIG9 is a schematic diagram of a specific key update method involved in the data encryption and decryption method in the key management system of the present application;

[0024] FIG10 is a schematic diagram of a specific key revocation method involved in the data encryption and decryption method in the key management system of the present application;

[0025] FIG11 is a schematic diagram of the key state transition process involved in the data encryption and decryption method in the key management system of the present application. DETAILED DESCRIPTION

[0026] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0027] The present invention provides a data encryption and decryption method in a key management system. In one embodiment of the data encryption and decryption method in the key management system of the present invention, referring to FIG1 , the method includes:

[0028] A key management agent is applied to a key management system, wherein the key management agent is respectively connected to a cloud service platform and a business side for communication, and the method includes the following steps.

[0029] Step S10: Obtain a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request.

[0030] Step S20: If the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side.

[0031] Step S30: If the key association request includes a lifecycle management request, perform lifecycle management on the key of the service side based on the key association request.

[0032] The following are the basic technical terms involved in this embodiment: KMS: Key Manager Service; Master Key: The key used to protect the working key; Working Key: The key used to encrypt business data; PBKDF2: Password-Based Key Derivation Function 2; API: Application Programming Interface; Disk: Not cached on disk; Access Token: The identity tag for an application to access KMS. The application must apply to the KMS service before use. Only those holding the access token are allowed to access the KMS service interface.

[0033] The research and development background of this application may be: At present, the cloud service platform mainly realizes the processing and management of data encryption and decryption (such as application, cancellation, etc.) in the business side key management system through the API interface.

[0034] The current plan will have at least the following situations:

[0035] 1. Providing data encryption and decryption processing and management in the business-side key management system through the API interface is complex to operate. In addition, providing encryption and decryption of business-side data through the API interface requires remote transmission, and generally only encryption and decryption can be performed instead of other management processes, which reduces the efficiency of encryption and decryption related processing. In addition, in a large number of microservice scenarios, the dense data encryption and decryption in the key management system will cause pressure bottlenecks in the KMS itself, increase the resource consumption of the KMS, and further affect the efficiency of encryption and decryption.

[0036] 2. The lack of definition of the key life cycle status makes it difficult to meet users' key management needs.

[0037] 3. When implementing the data encryption and decryption processing and management in the business-side key management system through the API interface, some key management services only support one key for one scenario business, but the actual scenario business may not require only one key.

[0038] 4. The update methods required to deal with key risks also need to be carried out through APIs, which will lead to untimely risk management.

[0039] 5. Only the key operation interface is provided through the API. On the one hand, users need to be familiar with the encryption and decryption framework and keys. On the other hand, the business also needs to consider how to store the currently applied keys.

[0040] In this application, since the processing and / or management of data encryption and decryption in the business-side key management system is implemented based on the key management agent rather than the API interface, the processing and / or management of data encryption and decryption in the business-side key management system is implemented based on the key management agent, and no remote transmission is required (because the key management agent is cached locally, and in a large number of microservice scenarios, it can avoid pressure bottlenecks in KMS), which improves the encryption and decryption efficiency. In addition, the processing of encryption / decryption requests and lifecycle management requests is implemented based on the key management agent rather than the API interface (no additional API interface or other components are required), thereby further improving the efficiency of encryption and decryption related processing.

[0041] In this application, the lifecycle management of keys is implemented to meet the user's key management needs.

[0042] In this application, the number of keys can be multiple and is associated with the number of business scenarios on the business side, that is, one business scenario can apply for multiple keys, thereby meeting the business scenario's demand for keys.

[0043] In this application, the revoked keys and protected data can be securely decoupled in real time (and can be negotiated to achieve timely risk management), which not only ensures the security and availability of the keys, but also ensures the security and availability of the protected data. In addition, during the corresponding process, it can also ensure that the protected data will not be interrupted.

[0044] In this application, the corresponding encryption, decryption, and authentication methods are all implemented through the key management agent (KMS-Agent). The business side is completely unaware of this. Users do not need to be familiar with the encryption and decryption framework and keys, and do not consider how to store the currently applied keys.

[0045] In this embodiment, the data encryption and decryption method in the key management system is applied to the data encryption and decryption device in the key management system. The data encryption and decryption device in the key management system belongs to the data encryption and decryption equipment in the key management system. The data encryption and decryption equipment in the key management system can be the key management agent (KMS-Agent) in the key management system, wherein the key management system also includes a cloud service platform (KMS-server cluster) and a business side (KMS-Console), and the key management agent is communicated with the cloud service platform and the business side respectively.

[0046] As shown in Figure 4, the business side (microservice applications 1, 2, N, etc.) can interact with the cloud service platform through the key management agent to achieve encryption and decryption of their business data and / or key lifecycle management.

[0047] As an example, a key lifecycle management interface is provided on the business side (KMS-Console), which makes key management more convenient (users trigger key management requests, such as encryption and decryption requests, on this interface). In addition, the business side also has a customized key maintenance interface, on which corresponding maintenance requests can be triggered. That is, when a specific key is at risk, the original risky key can be negotiated and replaced in a very short time to avoid the risk of leakage of the old key.

[0048] In this embodiment, KMS (Key Management Service) is provided at the cloud service platform (KMS-server cluster), that is, when the cloud service platform receives a lifecycle management request generated by the business side based on its lifecycle management interface, the management requirements matching its lifecycle management request are implemented through the cloud service platform.

[0049] In addition, in this embodiment, a master key is also generated at the cloud service platform. As shown in FIG5 , the master key may be generated specifically by using preset multiple categories (three categories) of key materials (the composition of the key materials may be determined based on security and implementation conditions) and salt values ​​generated corresponding to strong random numbers as inputs to a (secure key derivation algorithm), wherein the key derivation algorithm may be a PBKDF2 algorithm, thereby obtaining the master key.

[0050] As an example, a cloud service platform uses multiple nodes to form a cluster for key services, that is, after it is started, multiple nodes jointly provide key management services.

[0051] As an example, if there are cluster nodes in the cloud service platform, the key material for generating the master key must be synchronized to each cluster node. Only when the cluster nodes use the same key material can the master keys of each cluster node remain consistent.

[0052] As an example, the master key generated by the cloud service platform is stored in the memory and is never written to the disk.

[0053] As an example, the key management agent is the intermediary between the cloud service platform and the business side (all requests sent from the business side to the cloud service platform can be forwarded by the key management agent).

[0054] As an example, overall, the key management agent also acts as an intermediary between the cloud service platform and the business side to implement periodic management and / or encryption and decryption processing of keys.

[0055] As an example, the key management agent can automatically scan and load the key registration model file placed at a specified location by the business side, and then interact with the cloud service platform to implement key registration.

[0056] As an example, the key management agent encrypts and decrypts data input by the business side without the business side having to worry about how the key is obtained and where it is stored, thereby achieving encryption and decryption processing of the business data.

[0057] As an example, the key management agent is also encapsulated into the authentication method of the cloud platform service, making the business side completely unaware, but the use of the corresponding keys is safe.

[0058] The specific steps are as follows: Step S10, obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request.

[0059] As an example, a user triggers a key association request through a management interface of a service side, and the service side sends the key association request to a key management agent, that is, the key management agent receives the key association request from the service side.

[0060] As an example, the key association request includes an encryption request or a decryption request of a key.

[0061] As an example, the data encryption and decryption methods in the key management system can be applied to the encryption and decryption processes involved in microservice business scenarios.

[0062] As an example, the key association request also includes a lifecycle management request.

[0063] As an example, a lifecycle management request may be a request for registration, query, update, revocation, and destruction of a (working) key.

[0064] As an example, the lifecycle management of a key includes the state transition process of the key, as specifically shown in FIG11 (first registration application, then query, then update, then revocation and destruction, etc.).

[0065] Step S20: If the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side.

[0066] As an example, if the key association request includes an encryption / decryption request, corresponding key association information is obtained based on the key association request.

[0067] As an example, the key-associated information may include a working key.

[0068] As an example, based on the working key, the data to be processed on the business side is encrypted, and the encrypted data is returned to the business side.

[0069] As an example, based on the working key, the data to be processed on the business side is decrypted, and the decrypted data is returned to the business side.

[0070] As an example, the key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key;

[0071] As an example, when the working key is in the cloud service platform, it is securely maintained based on the master key generated in the cloud service platform.

[0072] Referring to Figure 2, the step of encrypting / decrypting the data to be processed on the business side based on the key association information also includes: step S21, determining whether the key is within the validity period; step S22, if it is not within the validity period, re-applying for the corresponding key from the cloud service platform, and encrypting / decrypting the data to be processed on the business side based on the re-applied key.

[0073] In this embodiment, the key is described specifically as a working key.

[0074] In this embodiment, it is determined whether the working key is within the validity period. If the working key is within the validity period, encryption / decryption processing is performed on the data to be processed on the business side based on the working key, and the data after the encryption / decryption processing is completed is returned to the business side; if it is not within the validity period, a new application for the corresponding working key is made to the cloud service platform, and encryption / decryption processing is performed on the data to be processed on the business side based on the newly applied working key, and the data after the encryption / decryption processing is completed is returned to the business side.

[0075] It should be emphasized that the key-associated information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally. When the working key is used in the key management agent to encrypt and decrypt business data, the corresponding working key will not be exposed to the business side.

[0076] In this embodiment, the specific steps of encryption and decryption mentioned above are shown in FIG7 .

[0077] 1. The user passes the plain text and key ID information to the KMS-Agent to call the KMS-Agent for encryption.

[0078] 2. The KMS-Agent obtains the current key in memory. The KMS-Agent first confirms whether the key cache time has expired. If so, it proceeds to step 3 below. Otherwise, it proceeds to step 9.

[0079] 3. If the cache expires (the current key does not exist), a key query request (carrying the access token and key model information) is sent to the interface of the security gateway.

[0080] 4. The key query request needs to be verified at the security gateway.

[0081] 5. After verification, the security gateway forwards the key query request to the KMS-Server.

[0082] 6. KMS-Server completes the key query based on the key query request.

[0083] 7. The KMS-Server returns the key ID and key to the security gateway.

[0084] 8. The security gateway returns the key ID and key to the KMS-Agent.

[0085] 9. KMS-Agent uses the returned key to encrypt the plaintext data and returns it to the business side.

[0086] During the above process, the business side will obtain the encrypted ciphertext and key ID for storage, while the key itself will not be exposed to the business side and will not be written to the disk on the business side, making the key safe and reliable.

[0087] In this embodiment, it should be noted that, during the encryption / decryption process, the parameters passed to the key management agent by the business side are different. In the case of encryption, what is passed to the key management agent is the plaintext of the data to be encrypted and the target key ID, where the target key ID includes the registration key ID and / or the available key ID. In the case of decryption, what is passed to the key management agent is the ciphertext of the data to be decrypted and the available key ID, where the registration key ID corresponds to a service scenario, and one registration key ID includes multiple available key IDs, but only one available key ID is in an active state.

[0088] In this embodiment, the available key ID is the available working key ID.

[0089] Step S30: If the key association request includes a lifecycle management request, perform lifecycle management on the key of the service side based on the key association request.

[0090] In this embodiment, if the key association request includes a lifecycle management request, based on the key association request, interaction is performed with the cloud service platform to implement lifecycle management of the key on the business side.

[0091] As an example, based on a specific lifecycle management request, interaction is performed with the cloud service platform to implement specific lifecycle management of the key on the business side.

[0092] As an example, a lifecycle management request may be a request for registration, query, update, revocation, and destruction of a (working) key.

[0093] If the key association request is a key registration application request, the lifecycle management is a working key registration application management.

[0094] The step of obtaining the key association request from the business side includes: step S11, when the business side service is started, reading the key registration model file from the business side, and generating a registration application request from the business side based on the key registration model file.

[0095] The step of performing lifecycle management on the key of the service side based on the key association request includes:

[0096] Step S31: Based on the registration application request, obtain the corresponding working key and corresponding key ID, wherein the working key and corresponding key ID are generated and fed back by the cloud service platform based on the registration application request.

[0097] Step S32: Feedback the ID corresponding to the working key to the service side.

[0098] In this embodiment, it should be noted that after the business side service is started, KMS-Agent will scan and parse the key registration model file provided by the business (or the key model file, the key registration model file is set in the preset directory on the business side), KMS-Agent parses the key registration related information in the key registration model file, and then based on the key registration related information, carries a legal access token to the cloud service platform to apply for a key (registration application request). It should be noted that if KMS-Agent needs to access the cloud service platform, it needs to be authenticated through a unified security gateway and obtain a legal access token before it can access it (the business application has applied for an access token for the corresponding service account of the cloud service platform for this tenant during deployment. The permission of the access token of the service account is: limited to access by this tenant to the KMS-Server).

[0099] After the authenticated registration application request is sent to the KMS-Server (cloud service platform), the KMS-Server generates the required working key for the application and returns it. In the above process, the working key is protected by the master key.

[0100] The KMS-Agent receives the requested (working) key and temporarily puts it into the cache. If the (working) key is not used within the specified time, it will be discarded from the cache.

[0101] As an example, the business side provides a key registration model file according to the preset key registration model. It should be noted that one key registration model file can register multiple (working) keys, which means that an application or a scenario (microservice scenario) can apply for multiple keys according to its needs.

[0102] As an example, other registration methods are also possible (not just the above-modeled key registration method). For example, the business side can also choose to use the native API for key registration, which is not specifically limited.

[0103] As an example, a key registration model file is shown in Error! Reference source not found. (The key registration model file includes business registration information and key specifications.) Business registration information specifies the information that business applications using the key need to register with the KMS server. Key specifications primarily confirm the number of bits in the key, the algorithm used, the parameters required by the encryption algorithm, and key display information.

[0104] Table 1

[0105] In this embodiment, there may be multiple keys, and the number of the keys is associated with the number of business scenarios on the business side. Specifically, the number of keys can be specified in the key registration model file.

[0106] In this embodiment, if there are multiple business scenarios on the business side (the number of business scenarios is determined based on the functions of the business data), there will be multiple corresponding keys. For example, sensitive data in the enterprise can apply for a key, and critical data in the enterprise can apply for a key, etc.

[0107] The registration application management of the above-mentioned working key (business key registration step) is specifically shown in Figure 6 (wherein, KMS-Agent is integrated into this (business) microservice, and the key model file is configured in the specified directory):

[0108] 1. Start the (business) microservice and KMS-Agent.

[0109] 2. KMS-Agent loads the key model file, obtains key registration information such as key specifications and key-related services, and generates a corresponding registration application request.

[0110] 3. Obtain an access token for accessing the cloud service platform (KMS service), and then send the registration application request to the security gateway of the cloud service platform (KMS service) through a secure channel with the legal access token and key registration information.

[0111] 4. The security gateway confirms the legitimacy of the access token and whether it is authorized to access the cloud service platform (KMS service).

[0112] 5. After the access token is verified to be valid, the security gateway transfers the registration application request to the cloud service platform (KMS cluster or KMS-Server).

[0113] 6. The KMS-Server receives the registration request from the business microservice, generates a data (work) key based on the key specifications and key-related business through a strong random algorithm, and encrypts the data (work) key using the master key and persists it to the KMS-Server.

[0114] 7. The KMS-Server returns the data (working) key and key ID to the security gateway.

[0115] 8. Send the key and key ID to the KMS-Agent via the security gateway.

[0116] 9. KMS-Agent receives the key and key ID, and places them in the current memory for subsequent encryption / decryption of business data.

[0117] Compared with the related art, which uses API interface to realize encryption and decryption of business side data, resulting in low encryption and decryption efficiency, in this application, a key association request of the business side is obtained, wherein the key association request includes encryption / decryption request and / or life cycle management request of the key; if the key association request includes encryption / decryption request, corresponding key association information is obtained based on the key association request, encryption / decryption processing is performed on the to-be-processed data of the business side based on the key association information, and the data after encryption / decryption processing is completed is returned to the business side; if the key association request includes life cycle management request, the key of the business side is processed based on the key association request. As for the management of the life cycle, it can be understood that in this application, the processing and / or management of data encryption and decryption on the business side is implemented based on the key management agent rather than the API interface. The processing and / or management of data encryption and decryption on the business side is implemented based on the key management agent, and no remote transmission is required (because the key management agent is cached locally, and in a large number of microservice scenarios, it can avoid pressure bottlenecks in KMS), which improves the efficiency of encryption and decryption. In addition, the processing of encryption / decryption requests and life cycle management requests is implemented based on the key management agent rather than the API interface (no additional API interface or other components are required), thereby further improving the efficiency of encryption and decryption related processing.

[0118] Based on the first embodiment of the present application, another embodiment of the present application is provided. In this embodiment, if the key association request is a key query request, the lifecycle management is query management of the working key;

[0119] The step of managing the life cycle of the key on the business side based on the key association request includes: step S33, forwarding the key query request to the cloud service platform, and receiving the key ID of the working key fed back by the cloud service platform based on the key query request; step S34, feeding back the key ID of the working key to the business side.

[0120] In this embodiment, the specific key query process is shown in FIG8 .

[0121] 1. The business side (system security administrator) triggers a key query request or a key information viewing request in its management interface (it should be noted that what is viewed is the key ID, status, and part of the registration information rather than the actual key); that is, the key ID of the working key rather than the working key is fed back to the business side.

[0122] 2. The KMS-Agent forwards the key query request to the cloud service platform's security gateway based on the access token.

[0123] 3. The cloud service platform's security gateway verifies the legitimacy of the access token.

[0124] 4. After the legitimacy of the access token is verified, the key query request is forwarded to the KMS-Server.

[0125] 5. Based on the key query request, the KMS-Server prepares the corresponding key ID and registration information.

[0126] 6. Return the key ID and registration information to the security gateway.

[0127] 7. Return the key ID and registration information to the KMS-Agent through the security gateway.

[0128] 8. The KMS-Agent sends the key ID and registration information back to the KMS-Console to complete the key query.

[0129] If the key association request is a key update request, the lifecycle management is update management of the working key.

[0130] The step of performing lifecycle management on the key of the service side based on the key association request includes:

[0131] Step S34: forward the key update request to the cloud service platform, and receive the first information fed back by the cloud service platform, wherein the first information includes information indicating that the update of the original key status corresponding to the key update request has been completed, and the first information also includes a key in a historical state or a key in an activated state. The key in the historical state is only used to decrypt existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data.

[0132] Step S35: Encrypt and decrypt the new data sent by the service side based on the activated key in the first information.

[0133] Among them, the key in the historical state is only used to decrypt the existing data and can no longer be used to encrypt new data. After receiving the update request, the cloud service platform updates the original key state corresponding to the key update request.

[0134] In this embodiment, the specific key update process is shown in FIG9 .

[0135] 1. The business side (system security administrator) triggers a key update request on its management interface (the user first selects the key to be updated in the interface provided by KMS-Console to trigger the key update request).

[0136] 2. The KMS-Agent forwards the key update request to the cloud service platform's security gateway based on the access token.

[0137] 3. The cloud service platform's security gateway verifies the legitimacy of the access token.

[0138] 4. After the legitimacy of the access token is verified, the key update request is forwarded to the KMS-Server.

[0139] 5. Based on the key update request, the KMS-Server updates the original key to the historical state and generates a new key.

[0140] 6. The KMS-Server returns the key update success status to the security gateway.

[0141] 7. The key update success status is returned to the KMS-Agent through the security gateway.

[0142] 8. The KMS-Agent sends the key update success status back to the KMS-Console to complete the key update.

[0143] Among them, the key in the historical state is only used to decrypt the existing data and can no longer be used to encrypt new data. After receiving the update request, the cloud service platform updates the original key state corresponding to the key update request.

[0144] That is, after the key is updated, the old key is set to the historical state. The KMS-Server will regenerate a new key for the business microservice and set it to the active state (the key in the active state is used to encrypt and decrypt subsequent new data). In other words, after the KMS-Agent key cache on the business side expires, it will obtain a new key to be used for data encryption and decryption in the key management system of the business microservice.

[0145] In this embodiment, periodic management of key registration, query, and update can be implemented.

[0146] Based on the above embodiments of the present application, another embodiment of the present application is provided. In this embodiment, if the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state.

[0147] The life cycle management is the revocation management of the working key;

[0148] After the step of forwarding the key update request to the cloud service platform and receiving the first information fed back by the cloud service platform, the method further includes:

[0149] Step S36: Receive a key revocation request from the service side, forward the key revocation request to the cloud service platform, and receive second information fed back by the cloud service platform, wherein the second information includes information on changing the key status to a pending revocation status based on the key revocation request.

[0150] Step S37: During the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information and feeds back the processing to the key management agent after completion, then the service side receives third information fed back from the service side, the third information including information indicating that the data encrypted by the key to be revoked has been processed, and forwards the third information to the cloud service platform so that the cloud service platform can change the key's status to be revoked to a disabled state. The disabled key cannot be used for data encryption or decryption.

[0151] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key will be updated to the historical state.

[0152] In this embodiment, the specific key revocation process is shown in FIG10 .

[0153] 1. The business side (system security administrator) triggers a key revocation request on its management interface. (The user first selects the historical key to be revoked in the interface provided by KMS-Console to trigger the key revocation request.)

[0154] 2. The KMS-Agent forwards the key revocation request to the cloud service platform's security gateway based on the key ID information corresponding to the access token and the historical key.

[0155] 3. The cloud service platform's security gateway verifies the legitimacy of the access token.

[0156] 4. After the legitimacy of the access token is verified, the key revocation request is forwarded to the KMS-Server.

[0157] 5. Based on the key revocation request, the KMS-Server updates the original key to "being revoked."

[0158] 6. The KMS-Server returns the current status of the key to the security gateway.

[0159] 7. Return the current status of the key to the KMS-Agent through the security gateway.

[0160] 8. KMS-Agent sends the current status of the key to KMS-Consol.

[0161] 9. KMS-Consol sends a key revocation negotiation request to the business application (client) on the business side.

[0162] 10. The business application (client) on the business side processes the relevant data protected by the current key.

[0163] 11. After processing the relevant data protected by the current key, the business application (client) on the business side sends an instruction to agree to revoke the key (negotiation result) to KMS-Consol.

[0164] 12. KMS-Consol sends the negotiation results to KMS-Agent.

[0165] 13. KMS-Agent forwards the negotiation result to the security gateway of the cloud service platform based on the access token.

[0166] 14. The cloud service platform’s security gateway verifies the legitimacy of the access token.

[0167] 15. After the legitimacy of the access token is verified, the negotiation result is forwarded to the KMS-Server.

[0168] 16. Based on the negotiation result, the KMS-Server forwards the revocation success information to the KMS-Agent through the security gateway.

[0169] 17. KMS-Agent sends the revocation success information back to KMS-Console.

[0170] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key will be updated to the historical state.

[0171] If the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state.

[0172] The life cycle management is the destruction management of the working key.

[0173] After the step of forwarding the third information to the cloud service platform so that the cloud service platform changes the state of the key to be revoked to a disabled state, the method further includes:

[0174] Step S38: Receive a key destruction request from the service side, forward the key destruction request to the cloud service platform, and receive fourth information fed back by the cloud service platform, where the fourth information includes information indicating that the corresponding key is marked as destroyed based on the key destruction request.

[0175] Step S39: Feedback the fourth information to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

[0176] It should be noted that a key in a deactivated (revoked) state means that the key will no longer be used, and the user can decide whether to destroy the key.

[0177] When a key needs to be destroyed, the user first selects a key in the revoked (disabled) state in the interface provided by the KMS-Console and triggers the key destruction logic (it should be noted that only keys in the revoked (disabled) state can be destroyed, and keys in other states cannot be directly destroyed). The KMS-Agent then forwards the key destruction request to the cloud service platform (all requests sent to the KMS-Server must undergo security authentication). After authentication is passed, the KMS-Server receives the key destruction request, marks the key as destroyed, updates the key status to destroyed, and returns it to the KMS-Console.

[0178] When the KMS-Console receives a key destruction response, it clears the key information in the KMS-Console. Other services can no longer obtain the key.

[0179] In this embodiment, it should be noted that the above-mentioned destruction strategy is soft destruction, which marks the key as destroyed. The real destruction requires the key to be cleared from the database after evaluation by the management process.

[0180] Based on the above embodiments in the present application, another embodiment of the present application is provided. In this embodiment, it is applied to a cloud service platform, and the cloud service platform is respectively communicated with the key management agent and the business side in the key management system. The method includes the following steps.

[0181] Receive a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; if the key association request includes an encryption / decryption request, determine corresponding key association information based on the key association request, and send the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; or if the key association request includes a lifecycle management request, perform lifecycle management on the key of the business side based on the key association request.

[0182] The data encryption and decryption method in the key management system also includes: if it is detected that the key management function is started, a preset key generation algorithm is used to generate a master key based on a preset type of key material and a preset strong random number; and the working key in the cloud service platform is securely maintained based on the master key.

[0183] The specific implementation of the data encryption and decryption method in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the key management system mentioned above, and will not be repeated here.

[0184] Based on the above-mentioned embodiments in the present application, another embodiment of the present application is provided. In this embodiment, the business side is applied to the key management system, and the business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and realizes online key status negotiation with the cloud service platform based on the key management agent.

[0185] The specific implementation of the data encryption and decryption method in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the key management system mentioned above, and will not be repeated here.

[0186] Based on the above-mentioned embodiment of the present application, another embodiment of the present application is provided. In this embodiment, a data encryption and decryption system in the key management system is provided, and the system includes: a business side, which is used to build a key registration model file in a preset directory, and the business side includes a key maintenance interface to provide an entry for key lifecycle management, and realizes online key status negotiation with the cloud service platform based on the key management agent; a key management agent, which is used to obtain a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and is also used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; if the key association request includes an encryption / decryption request The request includes a lifecycle management request, and is also used to manage the lifecycle of the key on the business side based on the key association request; the cloud service platform is used to receive the key association request forwarded by the key management agent, wherein the key association request includes the encryption / decryption request and / or lifecycle management request of the key; it is also used to determine the corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, and send the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; if the key association request includes a lifecycle management request, it is also used to interact with the key management agent based on the key association request to realize the lifecycle management of the key on the business side.

[0187] The specific implementation of the data encryption and decryption system in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0188] Refer to Figure 3, which is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0189] As shown in FIG3 , the data encryption and decryption device in the key management system may include: a processor 1001 , a memory 1005 , and a communication bus 1002 . The communication bus 1002 is used to implement connection and communication between the processor 1001 and the memory 1005 .

[0190] In one embodiment, the data encryption and decryption device in the key management system may further include a user interface, a network interface, a camera, an RF (Radio Frequency) circuit, a sensor, a WiFi module, and the like. The user interface may include a display screen and an input submodule such as a keyboard. The user interface may also include a standard wired interface and a wireless interface. The network interface may include a standard wired interface and a wireless interface (such as a WiFi interface).

[0191] Those skilled in the art will understand that the data encryption and decryption device structure in the key management system shown in Figure 3 does not constitute a limitation on the data encryption and decryption device in the key management system, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0192] As shown in Figure 3, memory 1005, a storage medium, may include an operating system, a network communication module, and the data encryption and decryption programs within the key management system. The operating system manages and controls the hardware and software resources of the data encryption and decryption devices within the key management system, supporting the execution of the data encryption and decryption programs and other software and / or programs within the key management system. The network communication module facilitates communication between the cameras within memory 1005, as well as with other hardware and software within the device.

[0193] In the data encryption and decryption device in the key management system shown in Figure 3, the processor 1001 is used to execute the data encryption and decryption program in the key management system stored in the memory 1005 to implement the steps of the data encryption and decryption method in the key management system described in any one of the above items.

[0194] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0195] The present application also provides a data encryption and decryption device in a key management system, which is applied to a key management agent in the key management system, and the key management agent is communicated with a cloud service platform and a business side respectively, and the device includes: an acquisition module, used to obtain a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; a first encryption / decryption module, used to obtain corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; a first lifecycle management module, used to manage the lifecycle of the key on the business side based on the key association request if the key association request includes a lifecycle management request.

[0196] In a possible implementation manner of the present application, the key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key;

[0197] The first encryption / decryption module is used to implement the following: determining whether the key is within the validity period; if not, reapplying for the corresponding key from the cloud service platform, and encrypting / decrypting the data to be processed on the business side based on the reapplied key.

[0198] In a possible implementation manner of the present application, if the key association request is a key registration application request, the lifecycle management is a working key registration application management.

[0199] The acquisition module is used to realize: when the service of the business side is started, reading the key registration model file of the business side, and generating a registration application request of the business side based on the key registration model file.

[0200] The first lifecycle management module is used to implement: based on the registration application request, obtaining the corresponding working key and corresponding key ID, wherein the working key and corresponding key ID are generated and fed back by the cloud service platform based on the registration application request; and feeding back the working key corresponding ID to the business side.

[0201] In a possible implementation manner of the present application, if the key association request is a key update request, the lifecycle management is update management of the working key.

[0202] The first lifecycle management module is used to implement: forwarding the key update request to the cloud service platform, and receiving first information fed back by the cloud service platform, wherein the first information includes information that the update of the original key status corresponding to the key update request has been completed, and the first information also includes a key in a historical state or a key in an activated state. The key in the historical state is only used to decrypt existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data.

[0203] Based on the activated key in the first information, the new data sent by the service side is encrypted and decrypted.

[0204] In a possible implementation manner of the present application, if the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state.

[0205] The life cycle management is the revocation management of the working key.

[0206] The first lifecycle management module is used to implement: receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, receiving second information fed back by the cloud service platform, the second information including information on changing the key status to a pending revocation status based on the key revocation request; feeding back the second information to the service side so that the service side and the cloud service platform can enter into a key status negotiation process; during the key status negotiation process, if the service side processes the data encrypted by the pending revocation key based on the second information, and feeds back the data to the key management agent after the processing is completed, then receiving third information fed back by the service side, the third information including information that the data encrypted by the key corresponding to the pending revocation status has been processed, and forwarding the third information to the cloud service platform so that the cloud service platform can change the pending revocation status of the key to a disabled state, and the key in the disabled state cannot be used for data encryption and decryption.

[0207] If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key will be updated to the historical state.

[0208] In a possible implementation manner of the present application, if the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state.

[0209] The life cycle management is the destruction management of the working key.

[0210] The first lifecycle management module is configured to: receive a key destruction request from the service side, forward the key destruction request to the cloud service platform, receive fourth information fed back by the cloud service platform, the fourth information including information marking the corresponding key as destroyed based on the key destruction request; and feed back the fourth information to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

[0211] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0212] An embodiment of the present application provides a data encryption and decryption device in a key management system, which is applied to a cloud service platform, and the cloud service platform is respectively communicated with the key management agent and the business side in the key management system. The device includes: a receiving module, which is used to receive a key association request forwarded by the key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; a second encryption / decryption module, which is used to determine the corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, and send the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; or a second lifecycle management module, which is used to manage the lifecycle of the key on the business side based on the key association request if the key association request includes a lifecycle management request.

[0213] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0214] The present application also provides a data encryption and decryption device in a key management system, which is applied to the business side of the key management system. The business side has a built-in key registration model file in a preset directory. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and realizes online key status negotiation with the cloud service platform based on the key management agent.

[0215] The specific implementation of the data encryption and decryption device in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0216] The present application also provides a data encryption and decryption system in a key management system, the data encryption and decryption system in the key management system comprising: a business side, for storing a built-in key registration model file in a preset directory, the business side including a key maintenance interface providing an entry for key lifecycle management, and realizing online key status negotiation with a cloud service platform based on a key management agent; a key management agent, for obtaining a key association request from the business side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and further for obtaining corresponding key association information based on the key association request if the key association request includes an encryption / decryption request. Based on the key association information, encryption / decryption processing is performed on the data to be processed on the business side, and the data after the encryption / decryption processing is completed is returned to the business side; if the key association request includes a lifecycle management request, it is also used to manage the lifecycle of the key on the business side based on the key association request; the cloud service platform is used to receive the key association request forwarded by the key management agent, wherein the key association request includes an encryption / decryption request and / or a lifecycle management request of the key; it is also used to determine the corresponding key association information based on the key association request if the key association request includes an encryption / decryption request, and send the key association information to the key management agent, so that the key management agent can encrypt / decrypt the data to be processed on the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; if the key association request includes a lifecycle management request, it is also used to interact with the key management agent based on the key association request to realize lifecycle management of the key on the business side.

[0217] The specific implementation of the data encryption and decryption system in the key management system of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0218] An embodiment of the present application provides a storage medium, and the storage medium stores one or more programs, and the one or more programs can also be executed by one or more processors to implement the steps of the data encryption and decryption method in the key management system described in any of the above items.

[0219] The specific implementation of the storage medium of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0220] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the data encryption and decryption method in the above-mentioned key management system.

[0221] The specific implementation of the computer program product of the present application is basically the same as the various embodiments of the data encryption and decryption method in the above-mentioned key management system, and will not be repeated here.

[0222] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0223] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0224] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus hardware platform, or by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM) and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0225] The above are only some embodiments of the present application and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A data encryption and decryption method in a key management system, wherein: Applied to a key management agent, the key management agent is respectively connected to a cloud service platform and a business side for communication, the method comprising: Obtaining a key association request from the service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; If the key association request includes an encryption / decryption request, obtaining corresponding key association information based on the key association request, performing encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returning the data after the encryption / decryption processing to the service side; If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

2. The data encryption and decryption method in the key management system according to claim 1, wherein: The key-related information is obtained from the cloud service platform, or is obtained from the cloud service platform and then stored locally, and the key-related information includes a key; The step of encrypting / decrypting the data to be processed on the service side based on the key association information further includes: Determining whether the key is within a validity period; If it is not within the validity period, re-apply for the corresponding key from the cloud service platform, and encrypt / decrypt the data to be processed on the business side based on the re-applied key.

3. The data encryption and decryption method in the key management system according to claim 1, wherein: If the key association request is a key registration application request, the life cycle management is a working key registration application management; The step of obtaining a key association request from the service side also includes: When the service on the business side is started, read the key registration model file on the business side, and generate a registration application request on the business side based on the key registration model file; The step of managing the life cycle of the key of the service side based on the key association request includes: Based on the registration application request, obtain a corresponding working key and a corresponding key ID, wherein the working key and the corresponding key ID are generated and fed back by the cloud service platform based on the registration application request; Feedback the ID corresponding to the working key to the service side.

4. The data encryption and decryption method in the key management system according to claim 1, wherein: If the key association request is a key update request, the life cycle management is update management of the working key; The step of managing the life cycle of the key of the service side based on the key association request includes: Forwarding the key update request to the cloud service platform, and receiving first information fed back by the cloud service platform, wherein the first information includes information that the update of the original key status corresponding to the key update request has been completed, and the first information also includes a key in a historical state or a key in an activated state, wherein the key in the historical state is only used to decrypt the existing data, and the key in the activated state is used to encrypt and decrypt subsequent new data; Based on the activated key in the first information, the new data sent by the service side is encrypted and decrypted.

5. The data encryption and decryption method in the key management system according to claim 4, wherein: If the key association request is a key revocation request, the key revocation request is generated based on a key in a historical state; The life cycle management is the revocation management of the working key; After the step of forwarding the key update request to the cloud service platform and receiving the first information fed back by the cloud service platform, the method further includes: Receiving a key revocation request from the service side, forwarding the key revocation request to the cloud service platform, and receiving second information fed back by the cloud service platform, the second information including information for changing the key state to a pending revocation state based on the key revocation request; Feeding back the second information to the service side, so that the service side and the cloud service platform can enter into a key state negotiation process; During the key status negotiation process, if the service side processes the data encrypted by the key to be revoked based on the second information, and feeds back to the key management agent after the processing is completed, then the service side receives third information fed back by the service side, the third information including information that the data encrypted by the key corresponding to the state to be revoked has been processed, and forwards the third information to the cloud service platform, so that the cloud service platform changes the state of the key to be revoked to a disabled state, and the key in the disabled state cannot be used for encryption and decryption of data; If any of the processes before changing the pending revocation state of the key to the disabled state fails, the pending revocation state of the key is updated to the historical state.

6. The data encryption and decryption method in the key management system according to claim 5, wherein: If the key association request is a key destruction request, the key destruction request is generated based on a key in a deactivated state; The life cycle management is the destruction management of the working key; After the step of forwarding the third information to the cloud service platform so that the cloud service platform can change the pending revocation state of the key to the deactivated state, the method further comprises: receiving a key destruction request from the service side, forwarding the key destruction request to the cloud service platform, and receiving fourth information fed back by the cloud service platform, the fourth information including information that the corresponding key is marked as destroyed based on the key destruction request; The fourth information is fed back to the service side so that the service side can clear the data corresponding to the key marked as destroyed.

7. A data encryption and decryption method in a key management system, wherein: Applied to a cloud service platform, the cloud service platform is respectively connected to a key management agent and a service side in a key management system, and the method includes: Receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; If the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to a key management agent, so that the key management agent performs encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and returns the data after the encryption / decryption processing to the service side; or If the key association request includes a lifecycle management request, lifecycle management is performed on the key of the service side based on the key association request.

8. A method for encryption and decryption, applied to the business side of a key management system, wherein the business side has a built-in key registration model file in a preset directory, the business side includes a key maintenance interface that provides an entry for key lifecycle management, and implements online key status negotiation with a cloud service platform based on a key management agent.

9. A data encryption and decryption system in a key management system, wherein: The data encryption and decryption system in the key management system includes: The business side is used to preset the directory to build in the key registration model file. The business side includes a key maintenance interface to provide an entry for key lifecycle management, and implements online key status negotiation with the cloud service platform based on the key management agent. A key management agent, used to obtain a key association request from a service side, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; further used to, if the key association request includes an encryption / decryption request, obtain corresponding key association information based on the key association request, perform encryption / decryption processing on the to-be-processed data of the service side based on the key association information, and return the data after the encryption / decryption processing is completed to the service side; if the key association request includes a lifecycle management request, further used to perform lifecycle management on the key of the service side based on the key association request; A cloud service platform, for receiving a key association request forwarded by a key management agent, wherein the key association request includes a key encryption / decryption request and / or a lifecycle management request; and for, if the key association request includes an encryption / decryption request, determining corresponding key association information based on the key association request, and sending the key association information to the key management agent, so that the key management agent can perform encryption / decryption processing on the pending data of the business side based on the key association information, and return the data after the encryption / decryption processing is completed to the business side; and if the key association request includes a lifecycle management request, for interacting with the key management agent based on the key association request to implement lifecycle management of the key of the business side.

10. A data encryption and decryption device in a key management system, wherein: The invention comprises a memory, a processor and a data encryption and decryption program in a key management system which is stored in the memory and can be run on the processor. When the processor executes the data encryption and decryption program in the key management system, the steps of the data encryption and decryption method in the key management system described in any one of claims 1 to 7 are implemented.

11. A storage medium, wherein: The storage medium stores a data encryption and decryption program in a key management system, and when the data encryption and decryption program in the key management system is executed by a processor, the steps of the data encryption and decryption method in the key management system according to any one of claims 1 to 7 are implemented.

Images