Data processing method and system, device, and storage medium

Abstract

Embodiments of the present application provide a data processing method and system, a device, and a storage medium. In the embodiments of the present application, on the one hand, confidential data to be backed up in a key management instance is encrypted, and ciphertext of the confidential data is backed up, so that the security of the confidential data when backed up is ensured; and on the other hand, the confidential data in the key management instance is backed up to a storage node, and even if the confidential data in a node where the key management instance is located is lost, the confidential data can still be recovered by means of the backed-up ciphertext of the confidential data, thereby reducing the risk of loss of confidential data on the cloud, and further improving the data security.

Description

Data processing method, system, device and storage medium

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on August 30, 2023, with application number 202311114526.8 and application name “Data processing method, system, device and storage medium”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of data security technology, and in particular to a data processing method, system, device and storage medium. Background Art

[0003] Key management services provide users with key and credential escrow services. As confidential data, the security of keys and credentials is paramount. Permanent loss of cloud data can cause significant losses to an enterprise, and the losses caused by confidential data such as keys and credentials are even more severe than those caused by general data loss. Therefore, for cloud vendors, protecting confidential data in the cloud is crucial to protecting the enterprise's lifeline.

[0004] Summary of the Invention

[0005] Various aspects of the present application provide a data processing method, system, device, and storage medium for automatically backing up confidential data and reducing the risk of confidential data loss.

[0006] The present invention provides a data processing method, including:

[0007] In response to a data backup event, determining confidential data to be backed up in a key management instance in a key management system;

[0008] creating a first encryption key in the key management instance;

[0009] encrypting the confidential data to be backed up using the first encryption key in the key management instance to obtain a ciphertext of the confidential data to be backed up;

[0010] The ciphertext of the confidential data to be backed up is sent to a storage node, so that the confidential data to be backed up is backed up at the storage node.

[0011] An embodiment of the present application also provides a data processing system, including: a key management system and a storage node; the key management system includes: a key management node; the key management node runs a key management instance of a target user; the key management system also includes: a control node of the key management instance; the key management system is used to execute the steps in the above-mentioned data processing method.

[0012] An embodiment of the present application further provides a computing device, comprising: a memory and a processor; wherein the memory is used to store a computer program;

[0013] The processor is coupled to the memory and is configured to execute the computer program to perform the steps in the above data processing method.

[0014] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, causes the one or more processors to execute the steps in the above-mentioned data processing method.

[0015] In an embodiment of the present application, on the one hand, the confidential data to be backed up in the key management instance is encrypted, and the ciphertext of the confidential data is backed up, thereby ensuring the security of the confidential data during backup; on the other hand, the confidential data in the key management instance is backed up to the storage node. Even if the confidential data in the node where the key management instance is located is lost, it can be restored through the ciphertext of the backed up confidential data, thereby reducing the risk of loss of confidential data on the cloud and further improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figures 1 and 2 are schematic diagrams of the structure of a data processing system provided in an embodiment of the present application;

[0018] FIG3 is a schematic diagram of a process of performing data backup on a data processing system provided in an embodiment of the present application;

[0019] FIG4 is a schematic diagram of a data recovery process performed by a data processing system according to an embodiment of the present application;

[0020] 5 and 6 are schematic diagrams of a data download process performed by a data processing system according to an embodiment of the present application;

[0021] 7 and 8 are schematic diagrams of a process of uploading backup data by a data processing system according to an embodiment of the present application;

[0022] FIG9 is a flow chart of a data processing method according to an embodiment of the present application;

[0023] FIG10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0025] In some embodiments of the present application, on the one hand, the confidential data to be backed up in the key management instance is encrypted, and the ciphertext of the confidential data is backed up, thereby ensuring the security of the confidential data during backup; on the other hand, the confidential data in the key management instance is backed up to the storage node. Even if the confidential data in the node where the key management instance is located is lost, it can be restored through the ciphertext of the backed up confidential data, thereby reducing the risk of loss of confidential data on the cloud and further improving data security.

[0026] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0027] It should be noted that the same reference numerals denote the same objects in the following drawings and embodiments, and therefore, once an object is defined in one drawing or embodiment, it does not need to be further discussed in the subsequent drawings and embodiments.

[0028] Figures 1 and 2 are schematic diagrams of the structure of the data processing system provided in an embodiment of the present application. In conjunction with Figures 1 and 2, the data processing system includes: a key management service (KMS) system 10 and a storage node 20. Among them, the key management system 10 includes: a key management node 101; the key management node 101 runs a key management instance 102 of the target user. The key management system also includes: a control node 103 of the key management instance 102. The control node 103 manages the key management instance and can be used to manage the entire life cycle of the key management instance, such as creating, starting or destroying the key management instance.

[0029] In this embodiment, the key management system 10 can provide confidential data hosting services. Confidential data refers to information that is not disclosed and can include keys, credentials, and other user-defined information that is not intended for public disclosure, such as private data. Credentials refer to information required for program operation, such as Secure Shell Protocol keys (SSH keys), tokens, and database passwords.

[0030] Users can entrust confidential data to the key management system 10. The key management system 10 can activate the key management instance 102 to provide users with confidential data management functions. A user's key management instance only manages the confidential data of that user and is a cloud-based key management service exclusive to that user. The user's confidential data is independently encrypted and stored in the user's key management instance. The key management instance is used to manage the confidential data entrusted by the user. The confidential data entrusted by the user can also be encrypted using the user's root key stored in the cryptographic machine corresponding to the key management instance, thereby ensuring the security of the confidential data. The cryptographic machine is a dedicated device that uses passwords to encrypt, decrypt, and authenticate information.

[0031] The control node 103 and the key management node 101 may be deployed on the same physical machine or on different physical machines.

[0032] In this embodiment, storage node 20 refers to a device that provides storage services. Storage node 20 may use a database to store data. The database may be an Object Storage Service (OSS) database, a relational database, a network database, or a tree-structured database. In this embodiment, storage node 20 may store backup data.

[0033] In some embodiments, as shown in Figure 2 , data processing systems can be deployed in different regions, such as the data processing system in Region A and the data processing system in Region B. Each data processing system in each region requires an independent key management system and storage nodes. Data processing systems in different regions can be connected to each other for cross-regional confidential data protection.

[0034] The data processing system provided in the embodiment of the present application can provide a persistent protection solution for confidential data. The following is an exemplary explanation using the key management instance of the target user as an example.

[0035] With reference to Figures 1 and 2 , the control node 103 can manage key management instances. The control node 103 includes a backup task module, a backup data processing module, a user interaction module, and a data recovery module. These modules can be implemented as software modules with corresponding functions. These modules can be located on the same physical machine or on different physical machines.

[0036] The backup task module is mainly used to manage the operation of the backup task, is responsible for sending the backup data to the storage node 20 for storage, and communicates with the key management instance 102 to obtain the confidential data that needs to be backed up.

[0037] The backup data management module compresses downloaded data, such as into a predefined compressed file format (e.g., zip), and decompresses user-uploaded backup data. It also digitally signs downloaded data using a private key and verifies the signature of uploaded backup data, ensuring data integrity through a signature mechanism. The backup data management module also derives keys to encrypt downloaded data and decrypt uploaded data.

[0038] The user interaction module responds to user operations on backup data management to start, stop, delete, and modify the running status of backup tasks. The user interaction module can also handle user requests to download, upload backups, and restore data.

[0039] The data recovery module is used to retrieve backup data from storage nodes and communicate with the key management instance to restore the backup data to the key management instance. The data recovery module can also communicate with management nodes in other regions across regions to process cross-regional recovery requests.

[0040] Key management instance 102 is used to store confidential data (such as keys and credentials). Key management instance 102 is protected by a private network and can communicate with control node 103 through the intranet. The private network can be a local area network, a virtual private cloud (VPC), or a virtual private network (VPN).

[0041] In conjunction with Figures 1 to 3, the data processing system provided in the embodiments of the present application can provide confidential data backup services. Specifically, the control node 103 can determine the confidential data to be backed up in the key management instance 102 in response to the data backup event (corresponding to steps 1 and 2 of Figure 1). In some embodiments, as shown in Figure 3, the amount of confidential data to be backed up is large, and the confidential data to be backed up can be queried in batches. Specifically, the control node 103 can send a data query request to the key management instance 102. The data query request includes: metadata of the confidential data to be backed up. The key management instance 102 can query the stored confidential data in response to the data query request, and obtain the confidential data to be backed up from the stored confidential data.

[0042] In the embodiment of the present application, the specific implementation form of the data backup event is not limited. In conjunction with Figures 1-3, the data processing system provided in the embodiment of the present application can support full backup and incremental backup. For full backup, the management and control node 103 can monitor whether the trigger timing of the full backup event has arrived, and trigger the data backup event when the trigger timing of the full backup event is detected. In this embodiment, the data backup event is implemented by monitoring the arrival of the trigger timing of the full backup event.

[0043] In the embodiments of the present application, the specific implementation of the triggering timing of the full backup event is not limited. In some embodiments, the data processing system may periodically perform full backups. The triggering timing may be the arrival of a full backup cycle. Accordingly, the management and control node 103 may start a timer or counter to count the full backup cycle, and when the full backup cycle is reached, determine that the triggering timing of the full backup event has arrived.

[0044] In other embodiments, the target user or the operation and maintenance personnel of the data processing system can manually trigger the full backup. Accordingly, the management and control node 103 can provide a full backup trigger interface; and when the full backup trigger interface is detected to be triggered, it is determined that the trigger timing of the full backup event has arrived.

[0045] The triggering timing of the full backup event shown in the above embodiment is for illustrative purposes only and is not intended to be limiting. Management and control node 103 may trigger a data backup event upon detecting the arrival of the triggering timing for the full backup event. Furthermore, management and control node 103 may, in response to the data backup event, determine that all confidential data in key management instance 102 is confidential data to be backed up.

[0046] As shown in Figure 3, the incremental data in the key management instance 102 can be newly added confidential data or a new version of confidential data. For example, in some embodiments, the confidential data in the key management instance 102 is a key or a credential, and the key management node 101 can update the key through key rotation. A key supports multiple key versions. Each key version is an independently generated key, and multiple key versions under the same key are cryptographically independent of each other. The key management node 101 can implement key rotation by generating a new key version. The security of a key is inversely correlated with the amount of data encrypted by it. The data amount generally refers to the total number of bytes of data encrypted by the same key. By rotating keys, each key has a smaller cryptanalysis attack surface, making the overall encryption scheme more secure. Accordingly, a new version of confidential data can be implemented as a new version of the key. Similarly, the key management node 101 can also update the credential through credential rotation. The key management node 101 can implement credential rotation by generating a new credential version, thereby improving the security of the credential. Accordingly, a new version of confidential data can be implemented as a new version of the credential.

[0047] Accordingly, incremental backup can be implemented by backing up newly added confidential data and / or newly added versions of confidential data in the key management instance 102. Based on this, the control node 103 can monitor whether there is newly added confidential data and / or newly added versions of confidential data in the key management instance 102, and trigger a data backup event if newly added confidential data and / or newly added versions of confidential data are detected in the key management instance 102. Accordingly, the data backup event is implemented as the presence of newly added confidential data and / or newly added versions of confidential data.

[0048] Furthermore, the management and control node 103 may determine, in response to the data backup event, newly added confidential data and / or newly added versions of confidential data in the key management instance 102 as confidential data to be backed up.

[0049] Among them, for the combination of full backup and real-time incremental backup of confidential data in the key management instance, compared with the existing solutions based on scheduled backup mirrors or manual backup of a certain resource, this embodiment supports full backup to ensure the integrity of the backup data on the one hand; on the other hand, it ensures the timeliness of data backup through real-time incremental backup.

[0050] Accordingly, in conjunction with Figures 1 and 3 , key management node 101 can create an encryption key in key management instance 102 (corresponding to step 3 in Figure 1 ). Specifically, control node 103 can invoke the key management instance via a remote procedure call (RPC). In response to the call from control node 103, key management node 101 can create an encryption key in key management instance 102.

[0051] The specific implementation of the encryption key creation in the key management instance 102 is not limited in the following embodiments of the present application. In some embodiments, the key management node 101 may generate an encryption key of fixed length using a random number or pseudo-random number generation algorithm. In other embodiments, the key management node 101 may generate an encryption key using a key derivation algorithm.

[0052] To improve key security, the key management system can provide a customer master key (CMK). Each user corresponds to a unique CMK. CMK is a key created by the user or cloud service through key management, mainly used to encrypt and protect the data key (DK). A user root key can encrypt multiple data keys. A CMK can derive multiple DKs. Different applications of the user can use different data keys for data encryption, so that even if a DK is lost, it will not affect the use of other applications. If the same CMK is used to encrypt all application data of the user, once the CMK is lost, the security of all application data will be affected. In this embodiment, the root key of the target user can be stored in the cryptographic machine corresponding to the key management instance. Accordingly, the key management node 101 can obtain the root key of the target user stored in the cryptographic machine corresponding to the key management instance; and derive the encryption key based on the root key. Optionally, the key management node 101 can use a key derivation algorithm to derive the encryption key based on the root key.

[0053] Optionally, the key derivation algorithm may be a key-related hash operation message authentication code (Hash-based Message Authentication Code, HMAC)-based key derivation algorithm (HMAC-based Key Derivation, HKDF) or a password-based key derivation algorithm (Password-Base Key Derivation Function 2, PBKDF2). The length of the key is not limited. In some embodiments, the encryption algorithm for encrypting data using an encryption key may be an Advanced Encryption Standard (AES) algorithm, such as an AES128 algorithm, an AES192 algorithm, or an AES256 algorithm. The encryption key corresponding to the AES128 algorithm is 128 bits. The encryption key corresponding to the AES192 algorithm is 192 bits, etc.; the encryption key corresponding to the AES256 algorithm is 256 bits, etc.

[0054] Furthermore, in conjunction with Figures 1 and 3 , the key management node 101 may use the encryption key in the key management instance to encrypt the confidential data to be backed up to obtain the ciphertext of the confidential data to be backed up (corresponding to step 4 in Figure 1 ). The control node 103 may obtain the ciphertext of the confidential data to be backed up from the key management instance 102 (corresponding to step 5 in Figure 1 ), and send the ciphertext of the confidential data to be backed up to the storage node 20. The storage node 20 stores the ciphertext of the confidential data to be backed up, thereby backing up the ciphertext of the confidential data to be backed up on the storage node 20 (corresponding to step 6 in Figure 1 ).

[0055] In this embodiment, on the one hand, the confidential data to be backed up in the key management instance is encrypted, and the ciphertext of the confidential data is backed up, thereby ensuring the security of the confidential data during backup; on the other hand, the confidential data in the key management instance is backed up to the storage node. Even if the confidential data in the node where the key management instance is located is lost, it can be restored through the ciphertext of the backed up confidential data, thereby reducing the risk of loss of confidential data on the cloud and further improving data security.

[0056] In some embodiments, to further improve data security, the key management node 101 may also, within the key management instance, use the target user's root key to encrypt the encryption key to obtain the ciphertext of the encryption key; and provide the ciphertext of the encryption key to the control node 103. The control node 103 may store the ciphertext of the encryption key. Thus, when restoring the confidential data to be backed up, the control node 103 may send the ciphertext of the encryption key and the ciphertext of the confidential data to be backed up to the key management instance 102 and request the key management instance 102 to restore the confidential data to be backed up. Accordingly, the key management node 101 may decrypt the ciphertext of the encryption key within the key management instance using the root key to obtain the encryption key; and decrypt the ciphertext of the confidential data to be backed up within the key management instance using the encryption key to obtain the confidential data to be backed up, thereby restoring the confidential data to be backed up to the key management instance.

[0057] In an embodiment of the present application, in order to facilitate users to query the backed-up confidential data, as shown in FIG3 , the management and control node 103 may also record the metadata of the ciphertext of the confidential data to be backed up. Among them, the metadata of the ciphertext of the confidential data can provide the user with a query basis, and may include: the backup type of the backed-up confidential data (full backup or incremental backup), data identification and backup time, etc. In this way, the user can determine the confidential data that needs to be restored through the metadata of the confidential data. Further, as shown in FIG3 , the management and control node 103 may also send the metadata of the ciphertext of the confidential data to be backed up to the storage node 20, and the storage node 20 may store the metadata of the ciphertext of the confidential data to be backed up, so that the confidential data that needs to be restored can be determined later through the metadata.

[0058] Storage node 20 can provide users with a metadata query interface. Users can use this interface to query metadata for confidential data and select confidential data to be restored based on the metadata. The metadata query interface can be provided in a visual manner, such as by providing a metadata query interface. Alternatively, it can be implemented using an application programming interface (API). Users can call this API to query metadata, etc.

[0059] In addition to providing a method for backing up confidential data, the embodiment of the present application also provides a method for restoring confidential data. The following is an exemplary description of the method for restoring confidential data provided by the embodiment of the present application.

[0060] As shown in Figure 4, the management and control node 103 (or the data recovery module in the management and control node) can obtain the ciphertext of the confidential data to be recovered from the storage node 20 in response to the data recovery event. In the embodiment of the present application, the specific implementation form of the data recovery event is not limited. In some embodiments, as shown in Figure 4, the management and control node 103 (specifically, the user interaction module in the management and control node) can provide a configuration interface for the data to be recovered. The configuration interface for the data to be recovered is provided in a visual manner, such as providing a metadata query interface, on which a data to be recovered selection component can be set. The user can select the metadata of the confidential data to be recovered through the data to be recovered selection component, thereby configuring the metadata of the confidential data to be recovered, etc.

[0061] Of course, the configuration interface for the data to be restored can also be implemented using an API. Users can call the API to query metadata and use the queried metadata to configure metadata for the confidential data to be restored.

[0062] The confidential data to be recovered may be a single confidential data, such as a single key or a single credential, etc. Of course, the confidential data to be recovered may also be a batch of confidential data, such as a batch of keys and / or a batch of credentials, etc., which may be determined by the configured metadata.

[0063] Accordingly, the management and control node 103 may determine that a data recovery event has occurred upon obtaining metadata of the confidential data to be recovered configured through the data to be recovered configuration interface. Furthermore, the management and control node 103 (specifically, the data recovery module within the management and control node) may, in response to the data recovery event, obtain the ciphertext of the confidential data to be recovered from the storage node 20 based on the obtained metadata of the confidential data to be recovered.

[0064] Furthermore, the control node 103 may request the key management instance to restore the confidential data to be restored. Specifically, the control node 103 may send a data restoration request to the key management instance 102, requesting the key management instance 102 to restore the confidential data to be restored. The data restoration request includes the ciphertext of the encryption key used to encrypt the ciphertext of the confidential data to be restored and the ciphertext of the confidential data to be restored.

[0065] In this embodiment of the present application, for ease of description and distinction, the encryption key used to encrypt the confidential data to be backed up is defined as the first encryption key, and the encryption key used to encrypt the confidential data to be restored is defined as the second encryption key. The ciphertext of the second encryption key is obtained by encrypting the second encryption key using the target user's root key by key management instance 102.

[0066] Accordingly, in response to the data recovery request, key management node 101 can obtain the target user's root key stored in the cryptographic machine corresponding to key management instance 102, and use the target user's root key to decrypt the ciphertext of the second encryption key to obtain the second encryption key. Furthermore, key management node 101 can use the second encryption key in key management instance 102 to decrypt the ciphertext of the confidential data to be recovered to obtain the confidential data to be recovered, and store the confidential data to be recovered in key management instance 102, thereby restoring the confidential data to be recovered to the key management instance, thereby achieving recovery of the confidential data.

[0067] In this embodiment, the confidential data restored in the key management instance can be a single confidential data item or a batch of confidential data items. This allows for the restoration of new confidential data in the key management instance before the restoration of the confidential data to be restored, without affecting the new confidential data. This overcomes the drawback of conventional confidential data restoration methods based on scheduled backup mirroring schemes, which affect new confidential data in the key management instance before data restoration. In conventional confidential data restoration methods based on scheduled backup mirroring schemes, since the data backup is a full backup, a full restore is also performed during data restoration, which overwrites the key management instance and overwrites new data generated in the key management instance after the full backup and before data restoration, thereby affecting new data generated after the full backup and before data restoration.

[0068] The embodiment of the present application also supports users downloading backup confidential data to a local computer. In this way, even if the cloud platform fails, the confidential data downloaded by the user can be used to restore the confidential data in the cloud, reducing the risk of confidential data loss. The following is an exemplary description of the backup data download method provided in the embodiment of the present application.

[0069] As shown in Figure 5, when the target user needs to download backup data, they can initiate a backup data download request to the control node 103 through the terminal device 30. In this embodiment, to improve the security of confidential data, the target user can also provide a password. This password is used to encrypt the ciphertext of the confidential data to be downloaded, achieving double encryption of the confidential data, which helps to improve the security of the confidential data. In this way, when data recovery is performed based on the confidential data downloaded by the user, the user and the cloud key management instance must jointly participate in the recovery, which helps to improve the security of the confidential data. On the other hand, only users with the password can restore the confidential data, which can prevent the ciphertext of the confidential data downloaded by the user from being lost or stolen. Since the stealing user does not have the password, they cannot request the cloud to restore the confidential data, which can further improve the security of the confidential data.

[0070] Accordingly, the control node 103 (specifically, the user interaction module within the control node) can obtain the backup data download request and the password provided by the target user. The backup data download request can include metadata regarding the ciphertext of the confidential data to be downloaded. Furthermore, the control node 103 (specifically, the backup data processing module within the control node) can respond to the backup data download request by determining the ciphertext of the confidential data to be downloaded from the storage node 20 and, based on the password provided by the target user, encrypt the ciphertext of the confidential data to be downloaded, thereby obtaining a doubly encrypted ciphertext of the confidential data to be downloaded.

[0071] In an embodiment of the present application, the management and control node 103 can use the password provided by the target user as the encryption password to encrypt the ciphertext of the confidential data to be downloaded to obtain a double-encrypted ciphertext of the confidential data to be downloaded. Since the password provided by the user is generally a short password, it is easy to be cracked. Based on this, in some embodiments, as shown in Figure 6, in order to improve data security, the management and control node 103 can derive an encryption key (defined as a third encryption key) based on the password provided by the target user. The length of the third encryption key is greater than the length of the password provided by the target user. For example, in some embodiments, the third encryption key can be an AES256 key, that is, a 256-bit key, etc. Regarding the key derivation algorithm used to derive the third encryption key based on the password, please refer to the relevant content of deriving the first encryption key based on the root key of the target user in the above embodiment, which will not be repeated here.

[0072] Because the length of the derived third encryption key is greater than the password provided by the target user, data encryption using the third encryption key provides higher data security. Furthermore, the control node 103 can use the third encryption key to encrypt the ciphertext of the confidential data to be downloaded, thereby obtaining a double-encrypted ciphertext of the confidential data to be downloaded.

[0073] In some embodiments, in order to ensure the integrity of the confidential data, before encrypting the ciphertext of the confidential data to be downloaded based on the password provided by the target user, as shown in Figure 6, the control node 103 (specifically, the backup data processing module in the control node) can also use the private key of the key management system 10 to digitally sign the ciphertext of the confidential data to be downloaded to obtain the ciphertext of the confidential data carrying the signature information. Furthermore, the confidential data carrying the signature information can be encrypted based on the password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the ciphertext of the confidential data to be downloaded carrying the signature information. Regarding the specific implementation method of encrypting the ciphertext of the confidential data to be downloaded carrying the signature information based on the password provided by the target user, please refer to the relevant content of encrypting the ciphertext of the confidential data to be downloaded based on the password provided by the target user, which will not be repeated here.

[0074] In other embodiments, the confidential data to be downloaded may be batch data. To reduce the computational complexity of data encryption and the amount of data to be downloaded, and to increase the speed of data encryption and data download, before encrypting the ciphertext of the confidential data to be downloaded based on the password provided by the target user, as shown in FIG6 , the control node 103 (specifically, the backup data processing module within the control node) may also compress the ciphertext of the key data to be downloaded to obtain a compressed file of the ciphertext of the confidential data to be downloaded. Furthermore, the compressed file of the ciphertext of the confidential data to be downloaded may be encrypted based on the password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the compressed file of the ciphertext of the confidential data to be downloaded. Regarding the specific implementation of encrypting the compressed file of the ciphertext of the confidential data to be downloaded based on the password provided by the target user, please refer to the above-mentioned related content of encrypting the ciphertext of the confidential data to be downloaded based on the password provided by the target user, and will not be repeated here.

[0075] In yet other embodiments, to ensure data security, before encrypting the compressed file containing the ciphertext of the confidential data to be downloaded based on the password provided by the target user, as shown in FIG6 , the control node 103 (specifically, the backup data processing module within the control node) may digitally sign the compressed file using the private key of the key management system 10 to obtain a compressed file carrying the signature information. Furthermore, the compressed file carrying the signature information may be encrypted based on the password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the compressed file carrying the signature information.

[0076] Furthermore, the management and control node 103 may provide the double-encrypted ciphertext of the confidential data to be downloaded to the terminal device 30 of the target user, thereby enabling the user to locally download the confidential data to be downloaded.

[0077] In the embodiment of the present application, the specific implementation method of the control node 103 providing the double encrypted ciphertext of the confidential data to be downloaded to the terminal device 30 of the target user is not limited. In some embodiments, the control node 103 can send the double encrypted ciphertext of the confidential data to be downloaded to the terminal device 30 of the target user. In other embodiments, as shown in Figure 6, the control node 103 (specifically, the backup data processing module in the control node) can also generate a download address for the double encrypted ciphertext of the confidential data to be downloaded, and provide the download address to the terminal device 30 of the target user, so that the target user can download the double encrypted ciphertext of the confidential data to be downloaded from the download address, thereby realizing the user's local download of the confidential data. Among them, the download address can be provided to the terminal device 30 of the target user by the user interaction module in the control node.

[0078] In this embodiment, even if a cloud platform failure causes the loss of confidential data in the key management instance, the double-encrypted ciphertext of the confidential data downloaded locally by the user can be used to recover the confidential data within the key management instance, reducing the risk of confidential data loss. Furthermore, double encryption of the downloaded ciphertext of the confidential data based on the password provided by the target user helps improve the security of the confidential data. Thus, when recovering the confidential data downloaded by the user, both the user and the cloud-based key management instance are required to perform the recovery, which helps improve the security of the confidential data. Furthermore, only users with the password can recover the confidential data, preventing the loss or theft of the ciphertext of the confidential data downloaded by the user. Without the password, the stealing user would be unable to request the cloud-based key management instance to recover the confidential data, further improving the security of the confidential data.

[0079] The following is an illustrative description of the process of data recovery based on the backup data downloaded locally by the target user. As shown in Figure 7, the control node 103 (specifically, the backup data processing module in the control node) can obtain the double encrypted ciphertext of the target confidential data uploaded by the target user through the terminal device 30 and the password uploaded by the target user. Regarding the implementation method of downloading the double encrypted ciphertext to the target user locally, please refer to the relevant content of the above embodiment, which will not be repeated here. In the embodiment of the present application, for the convenience of description and distinction, the password provided by the target user during the above backup data download process is defined as the first password; and the password uploaded by the target user in this embodiment is defined as the second password. The second password can be the same as or different from the first password. The double encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data based on the second password. The associated data of the ciphertext of the target confidential data can be the ciphertext of the target confidential data itself, or other data generated based on the ciphertext of the target confidential data.

[0080] For example, in some embodiments, the associated data of the ciphertext of the target confidential data may be a compressed file of the ciphertext of the target confidential data. In other embodiments, during the process of downloading the ciphertext of the target confidential data, the private information of the key management system may be used to digitally sign the ciphertext of the target confidential data to obtain the ciphertext of the target confidential data carrying the signature information. Accordingly, the associated data of the ciphertext of the target confidential data is the ciphertext of the target confidential data carrying the signature information. In still other embodiments, during the process of downloading the ciphertext of the target confidential data, the compressed file of the ciphertext of the target confidential data may be compressed to obtain the compressed file of the ciphertext of the target confidential data; and the private information of the key management system may be used to digitally sign the compressed file of the ciphertext of the target confidential data to obtain the compressed file of the ciphertext of the target confidential data carrying the signature information. Accordingly, the associated data of the ciphertext of the target confidential data is the compressed file of the ciphertext of the target confidential data carrying the signature information.

[0081] In the embodiments of the present application, the specific implementation method by which the control node 103 obtains the double-encrypted ciphertext of the target confidential data is not limited. In some embodiments, the target user may directly send the double-encrypted ciphertext of the target confidential data to the control node 103 via the terminal device 30. The control node 103 may receive the double-encrypted ciphertext of the target confidential data sent by the terminal device 30.

[0082] In other embodiments, because the control node 103 cannot determine the amount of data sent by the terminal device 30, if the data amount is too large, it will lead to a shortage of storage space on the control node 103. Therefore, as shown in Figure 8, the terminal device 30 may first send a backup data upload request to the control node 103. The control node 103 (specifically, the backup data processing module within the control node) may generate an upload address in response to the backup data upload request. This upload address is the upload address that instructs the terminal device 30 to upload data.

[0083] In some embodiments, the backup data upload request may include the data size of the dual-confidential ciphertext of the target confidential data. Based on the data size of the dual-confidential ciphertext of the target confidential data, the management and control node 103 may pre-apply for storage space in the storage node 20 sufficient to accommodate the dual-confidential ciphertext of the target confidential data; and generate an upload address based on the requested storage space.

[0084] Furthermore, the control node 103 (specifically, the user interaction module within the control node) may send an upload address to the terminal device 30. The terminal device 30 may upload the double-encrypted ciphertext of the target confidential data to the upload address. The control node 103 (specifically, the backup data processing module within the control node) may obtain the double-encrypted ciphertext of the target confidential data and the second password from the upload address. In some embodiments, the control node 103 may obtain the double-encrypted ciphertext of the target confidential data from the upload address in batches.

[0085] Furthermore, as shown in FIG7 , the control node 103 may decrypt the double-encrypted ciphertext of the target confidential data based on the second password to obtain the associated data of the ciphertext of the target confidential data. In some embodiments, the double-encrypted ciphertext of the target confidential data is obtained by directly encrypting the associated data of the ciphertext of the target confidential data using the second password. In this case, the double-encrypted ciphertext of the target confidential data may be decrypted using the second password as a decryption key to obtain the associated data of the ciphertext of the target confidential data.

[0086] In other embodiments, the double-encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data using an encryption key derived from the second password. As shown in FIG8 , an encryption key (defined as a fourth encryption key) can be derived based on the second password. The length of the fourth encrypted ciphertext is greater than the second password. In this embodiment, the double-encrypted ciphertext of the target confidential data is also obtained by encrypting the associated data of the ciphertext of the target confidential data using the fourth encryption key.

[0087] Accordingly, as shown in FIG8 , the management and control node 103 may use the fourth encryption key to decrypt the double-encrypted ciphertext of the target confidential data to obtain associated data of the ciphertext of the target confidential data.

[0088] Furthermore, in conjunction with Figures 7 and 8 , the control node 103 (specifically, the backup data processing module within the control node) can obtain the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data. For the embodiment in which the associated data of the ciphertext of the target confidential data is the target confidential data itself, the control node 103 can directly obtain the ciphertext of the target confidential data by decrypting the double-encrypted ciphertext of the target confidential data.

[0089] For the embodiment in which the associated data of the ciphertext of the above-mentioned target confidential data is the ciphertext of the target confidential data carrying signature information, as shown in Figure 8, the management and control node 103 (specifically, the backup data processing module in the management and control node) can use the private key of the key management system 10 to perform digital signature verification on the ciphertext of the target confidential data carrying signature information; and when the ciphertext of the target confidential data passes the digital signature verification, the ciphertext of the target confidential data is obtained from the ciphertext of the target confidential data carrying signature information.

[0090] For the embodiment in which the associated data of the ciphertext of the above-mentioned target confidential data is a compressed file of the ciphertext of the target confidential data carrying signature information, as shown in Figure 8, the control node 103 can use the private key of the key management system 10 to perform digital signature verification on the compressed file of the ciphertext of the target confidential data carrying signature information. When the compressed file of the ciphertext of the target confidential data passes the digital signature verification, the compressed file of the ciphertext of the target confidential data is decompressed to obtain the ciphertext of the target confidential data.

[0091] Further, in combination with Figures 7 and 8, the management and control node 103 (specifically, the backup data processing module in the management and control node) can send the ciphertext of the target confidential data to the storage node 20, so that the storage node 20 can store the ciphertext of the target confidential data, thereby realizing the upload of the ciphertext of the target confidential data.

[0092] If the target confidential data in the target user's key management instance is lost, the control node 103 can restore the target confidential data in the key management instance using the ciphertext of the target confidential data uploaded by the user to the storage node 20. The specific restoration process can be found in the restoration process for confidential data to be restored in the above embodiment and will not be repeated here.

[0093] FIG9 is a flow chart of a data processing method according to an embodiment of the present application. As shown in FIG9 , the data processing method mainly includes:

[0094] 901. In response to a data backup event, determine confidential data to be backed up in a key management instance in a key management system.

[0095] 902. Create a first encryption key in a key management instance.

[0096] 903. In the key management instance, encrypt the confidential data to be backed up using the first encryption key to obtain a ciphertext of the confidential data to be backed up.

[0097] 904. Send the ciphertext of the confidential data to be backed up to the storage node, so as to back up the confidential data to be backed up at the storage node.

[0098] In this embodiment, the key management system includes a key management node. The key management node runs a key management instance for the target user. The key management system also includes a control node for the key management instance. For a description of the key management node and the control node, please refer to the relevant content of the above system embodiment and will not be repeated here.

[0099] In this embodiment, a key management system can provide confidential data hosting services. Key management instances are used to manage user-hosted confidential data. The user's confidential data is stored in the cryptographic machine corresponding to the key management instance and can be encrypted using the user's root key stored in the cryptographic machine to ensure the security of the confidential data. In this embodiment, storage nodes can also store backup data.

[0100] The embodiments of the present application provide a persistent protection solution for confidential data. The following is an illustrative explanation using a key management instance of a target user as an example.

[0101] As shown in Figure 9, the data processing method provided in the embodiment of the present application can provide a confidential data backup service. Specifically, in step 901, the confidential data to be backed up in the key management instance can be determined in response to the data backup event. In the embodiment of the present application, the specific implementation form of the data backup event is not limited. The data processing system provided in the embodiment of the present application can support full backup and incremental backup. For full backup, it is possible to monitor whether the triggering timing of the full backup event has arrived, and when it is monitored that the triggering timing of the full backup event has arrived, it is determined that a data backup event has occurred. In this embodiment, the data backup event is implemented by monitoring the arrival of the triggering timing of the full backup event. Further, it is possible to determine that all confidential data in the key management instance are confidential data to be backed up in response to the data backup event.

[0102] In this embodiment, the incremental data in the key management instance may be newly added confidential data or a new version of confidential data. Accordingly, for incremental backup, it can be implemented as backing up newly added confidential data and / or new versions of confidential data in the key management instance. Based on this, it is possible to monitor whether there is newly added confidential data and / or new versions of confidential data in the key management instance; and when it is detected that newly added confidential data and / or new versions of confidential data appear in the key management instance, it is determined that a data backup event has occurred. Accordingly, the data backup event is implemented as the appearance of newly added confidential data and / or new versions of confidential data. Further, in response to the data backup event, it is possible to determine that the newly added confidential data and / or new versions of confidential data in the key management instance are confidential data to be backed up.

[0103] Among them, for the combination of full backup and real-time incremental backup of confidential data in the key management instance, compared with the existing solutions based on scheduled backup mirrors or manual backup of a certain resource, this embodiment supports full backup to ensure the integrity of the backup data on the one hand; on the other hand, it ensures the timeliness of data backup through real-time incremental backup.

[0104] Accordingly, in step 902, an encryption key may be created in the key management instance. Specifically, the key management instance may be called via a remote procedure call. The key management node may create the encryption key in the key management instance in response to the call from the control node.

[0105] The specific implementation of the encryption key creation in the key management implementation is not limited in the following embodiments of the present application. In some embodiments, a random number or pseudo-random number generation algorithm can be used to generate a fixed-length encryption key. In other embodiments, a key derivation algorithm can be used to generate the encryption key.

[0106] To improve key security, the key management system can provide a user root key. In this embodiment, the target user's root key can be stored in the cryptographic machine corresponding to the key management instance. Accordingly, the target user's root key stored in the cryptographic machine corresponding to the key management instance can be obtained; based on the root key, an encryption key can be derived. Optionally, a key derivation algorithm can be used to derive the encryption key from the root key.

[0107] Furthermore, in step 903, the encryption key can be used in the key management instance to encrypt the confidential data to be backed up, thereby obtaining the ciphertext of the confidential data to be backed up. Furthermore, the ciphertext of the confidential data to be backed up can be obtained from the key management instance, and in step 904, the ciphertext of the confidential data to be backed up can be sent to the storage node, thereby backing up the ciphertext of the confidential data to be backed up at the storage node.

[0108] In this embodiment, on the one hand, the confidential data to be backed up in the key management instance is encrypted, and the ciphertext of the confidential data is backed up, thereby ensuring the security of the confidential data during backup; on the other hand, the confidential data in the key management instance is backed up to the storage node. Even if the confidential data in the node where the key management instance is located is lost, it can be restored through the ciphertext of the backed up confidential data, thereby reducing the risk of loss of confidential data on the cloud and further improving data security.

[0109] In some embodiments, to further enhance data security, the encryption key can be encrypted within the key management instance using the target user's root key to obtain the ciphertext of the encryption key. This ciphertext can then be provided to the control node. The control node can store the ciphertext of the encryption key. Thus, when restoring the confidential data to be backed up, the control node can send the ciphertext of the encryption key and the ciphertext of the confidential data to be backed up to the key management instance and request the key management instance to restore the confidential data to be backed up. Accordingly, the ciphertext of the encryption key can be decrypted within the key management instance using the root key to obtain the encryption key. Furthermore, the ciphertext of the confidential data to be backed up can be decrypted within the key management instance using the encryption key to obtain the confidential data to be backed up, thereby restoring the confidential data to be backed up to the key management instance.

[0110] In an embodiment of the present application, in order to facilitate users to query the backed-up confidential data, the metadata of the ciphertext of the confidential data to be backed up can also be recorded. The metadata of the ciphertext of the confidential data can provide the user with a basis for query, and may include: the backup type of the backed-up confidential data (full backup or incremental backup), data identification, and backup time, etc. In this way, the user can determine the confidential data that needs to be restored through the metadata of the confidential data. Furthermore, the metadata of the ciphertext of the confidential data to be backed up can also be sent to the storage node so that the storage node can store the metadata; and the confidential data that needs to be restored can be determined based on the metadata.

[0111] Storage nodes can provide users with a metadata query interface. Users can use this interface to query metadata for confidential data and select confidential data for recovery based on the metadata. The metadata query interface can be provided visually, such as by providing a metadata query interface, or it can be implemented using an API. Users can call this API to query metadata, etc.

[0112] In addition to providing a method for backing up confidential data, the embodiment of the present application also provides a method for restoring confidential data. The following is an exemplary description of the method for restoring confidential data provided by the embodiment of the present application.

[0113] Specifically, in response to the data recovery event, the ciphertext of the confidential data to be recovered can be obtained from the storage node. Regarding the specific implementation of the data recovery event, please refer to the relevant content of the above system embodiment, which will not be repeated here.

[0114] The confidential data to be recovered may be a single confidential data, such as a single key or a single credential, etc. Of course, the confidential data to be recovered may also be a batch of confidential data, such as a batch of keys and / or a batch of credentials, etc., which may be determined by the configured metadata.

[0115] Furthermore, the key management instance may be requested to restore the confidential data to be restored. Specifically, the control node may send a data restoration request to the key management instance, requesting the key management instance to restore the confidential data to be restored. The data restoration request includes the ciphertext of the encryption key used to encrypt the ciphertext of the confidential data to be restored and the ciphertext of the confidential data to be restored.

[0116] In this embodiment of the present application, for ease of description and distinction, the encryption key used to encrypt the confidential data to be backed up is defined as the first encryption key, and the encryption key used to encrypt the confidential data to be restored is defined as the second encryption key. The ciphertext of the second encryption key is obtained by encrypting the second encryption key using the target user's root key in the key management instance.

[0117] Accordingly, in response to a data recovery request, the target user's root key stored in the cryptographic machine corresponding to the key management instance can be obtained; the target user's root key can be used to decrypt the ciphertext of the second encryption key to obtain the second encryption key. Furthermore, the second encryption key can be used in the key management instance to decrypt the ciphertext of the confidential data to be recovered to obtain the confidential data to be recovered; the confidential data to be recovered is then stored in the key management instance, and the confidential data to be recovered can be restored to the key management instance, thereby achieving recovery of the confidential data.

[0118] In this embodiment, the confidential data restored in the key management instance can be a single confidential data item or a batch of confidential data items. This allows for the restoration of new confidential data in the key management instance before the restoration of the confidential data to be restored, without affecting the new confidential data. This overcomes the drawback of conventional confidential data restoration methods based on scheduled backup mirroring schemes, which affect new confidential data in the key management instance before data restoration. In conventional confidential data restoration methods based on scheduled backup mirroring schemes, since the data backup is a full backup, a full restore is also performed during data restoration, which overwrites the key management instance and overwrites new data generated in the key management instance after the full backup and before data restoration, thereby affecting new data generated after the full backup and before data restoration.

[0119] The embodiment of the present application also supports users downloading backup confidential data to a local computer. In this way, even if the cloud platform fails, the confidential data downloaded by the user can be used to restore the confidential data in the cloud, reducing the risk of confidential data loss. The following is an exemplary description of the backup data download method provided in the embodiment of the present application.

[0120] When the target user needs to download backup data, he can initiate a backup data download request to the management and control node through the terminal device. In this embodiment, in order to improve the security of confidential data, the target user can also provide a password (defined as the first password), which is used to encrypt the ciphertext of the confidential data to be downloaded, thereby achieving double encryption of the confidential data, which helps to improve the security of the confidential data. In this way, when data recovery is performed based on the confidential data downloaded by the user, the user and the key management instance in the cloud need to participate together to recover it, which helps to improve the security of the confidential data. On the other hand, only users with the first password can recover the confidential data, which can prevent the ciphertext of the confidential data downloaded by the user from being lost or stolen. Since the stealing user does not have the first password, he cannot request the cloud to recover the confidential data, which can further improve the security of the confidential data.

[0121] Accordingly, a backup data download request and a first password provided by the target user may be obtained. The backup data download request may include metadata regarding the ciphertext of the confidential data to be downloaded. Furthermore, in response to the backup data download request, the ciphertext of the confidential data to be downloaded may be determined from the storage node; and the ciphertext of the confidential data to be downloaded may be encrypted based on the first password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded.

[0122] In an embodiment of the present application, the password provided by the target user can be used as the encryption password to encrypt the ciphertext of the confidential data to be downloaded to obtain a double-encrypted ciphertext of the confidential data to be downloaded. Since the password provided by the user is generally a short password, it is easy to be cracked. Based on this, in some embodiments, in order to improve data security, an encryption key (defined as a third encryption key) can be derived based on the first password provided by the target user. The length of the third encryption key is greater than the length of the first password provided by the target user. Since the length of the derived third encryption key is greater than the first password provided by the target user, the data is encrypted using the third encryption key, and the data security is higher. Further, the ciphertext of the confidential data to be downloaded can be encrypted using the third encryption key to obtain a double-encrypted ciphertext of the confidential data to be downloaded.

[0123] In some embodiments, in order to ensure the integrity of confidential data, before encrypting the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, the ciphertext of the confidential data to be downloaded may be digitally signed using the private key of the key management system to obtain the ciphertext of the confidential data carrying the signature information. Furthermore, the confidential data carrying the signature information may be encrypted based on the first password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the ciphertext of the confidential data to be downloaded carrying the signature information. Regarding the specific implementation method of encrypting the ciphertext of the confidential data to be downloaded carrying the signature information based on the first password provided by the target user, please refer to the above-mentioned content related to encrypting the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, which will not be repeated here.

[0124] In other embodiments, the confidential data to be downloaded may be batch data. In order to reduce the computational complexity of data encryption and the amount of data to be downloaded, and to increase the data encryption speed and data download speed, before encrypting the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, the ciphertext of the key data to be downloaded may be compressed to obtain a compressed file of the ciphertext of the confidential data to be downloaded. Furthermore, the compressed file of the ciphertext of the confidential data to be downloaded may be encrypted based on the first password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the compressed file of the ciphertext of the confidential data to be downloaded. For the specific implementation of encrypting the compressed file of the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, please refer to the above-mentioned content related to encrypting the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, and will not be repeated here.

[0125] In yet other embodiments, to ensure data security, before encrypting the compressed file containing the ciphertext of the confidential data to be downloaded based on the first password provided by the target user, the compressed file may be digitally signed using the private key of the key management system to obtain a compressed file carrying the signature information. Furthermore, the compressed file carrying the signature information may be encrypted based on the first password provided by the target user to obtain a doubly encrypted ciphertext of the confidential data to be downloaded. In this embodiment, the doubly encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the compressed file carrying the signature information.

[0126] Furthermore, the double-encrypted ciphertext of the confidential data to be downloaded can be provided to the terminal device of the target user, thereby enabling the user to download the confidential data locally.

[0127] In the embodiments of the present application, the specific implementation method for providing the double-encrypted ciphertext of the confidential data to be downloaded to the terminal device of the target user is not limited. In some embodiments, the double-encrypted ciphertext of the confidential data to be downloaded can be sent to the terminal device of the target user. In other embodiments, a download address can be generated for the double-encrypted ciphertext of the confidential data to be downloaded, and the download address can be provided to the terminal device of the target user, so that the target user can download the double-encrypted ciphertext of the confidential data to be downloaded from the download address, thereby realizing local user download of the confidential data. The download address can be provided to the terminal device of the target user by the user interaction module in the control node.

[0128] In this embodiment, even if a cloud platform failure causes the loss of confidential data in the key management instance, the double-encrypted ciphertext of the confidential data downloaded locally by the user can be used to recover the confidential data within the key management instance, reducing the risk of confidential data loss. Furthermore, double encryption of the downloaded ciphertext of the confidential data based on the password provided by the target user helps improve the security of the confidential data. Thus, when recovering the confidential data downloaded by the user, both the user and the cloud-based key management instance are required to perform the recovery, which helps improve the security of the confidential data. Furthermore, only users with the password can recover the confidential data, preventing the loss or theft of the ciphertext of the confidential data downloaded by the user. Without the password, the stealing user would be unable to request the cloud-based key management instance to recover the confidential data, further improving the security of the confidential data.

[0129] The following is an illustrative description of the process of data recovery based on the backup data downloaded locally by the target user. The double-encrypted ciphertext of the target confidential data uploaded by the target user through the terminal device and the second password uploaded by the target user can be obtained. Regarding the implementation method of downloading the double-encrypted ciphertext to the target user locally, please refer to the relevant content of the above embodiment, which will not be repeated here. Among them, the second password and the first password can be the same or different. Among them, the double-encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data based on the second password. Among them, the associated data of the ciphertext of the target confidential data can refer to the relevant content of the above system embodiment, which will not be repeated here.

[0130] In the embodiments of the present application, the specific implementation method for the control node to obtain the double-encrypted ciphertext of the target confidential data is not limited. In some embodiments, the target user can directly send the double-encrypted ciphertext of the target confidential data to the control node via a terminal device. Correspondingly, the control node can receive the double-encrypted ciphertext of the target confidential data sent by the terminal device.

[0131] In other embodiments, because the amount of data sent by the terminal device cannot be determined, and an excessively large amount of data could lead to a shortage of storage space on the control node, the terminal device may first send a backup data upload request to the control node. The control node may generate an upload address in response to the backup data upload request. This upload address instructs the terminal device to upload data.

[0132] In some embodiments, the backup data upload request may include the data size of the dual-confidential ciphertext of the target confidential data. Accordingly, based on the data size of the dual-confidential ciphertext of the target confidential data, storage space sufficient to accommodate the dual-confidential ciphertext of the target confidential data may be requested in advance on the storage node; and an upload address may be generated based on the requested storage space.

[0133] Furthermore, an upload address can be sent to the terminal device. The terminal device can upload the double-encrypted ciphertext of the target confidential data to the upload address. The control node can obtain the double-encrypted ciphertext of the target confidential data and the second password from the upload address. In some embodiments, the double-encrypted ciphertext of the target confidential data can be obtained from the upload address in batches.

[0134] Furthermore, the double-encrypted ciphertext of the target confidential data can be decrypted based on the second password to obtain the associated data of the ciphertext of the target confidential data. In some embodiments, the double-encrypted ciphertext of the target confidential data is obtained by directly encrypting the associated data of the ciphertext of the target confidential data using the second password. The double-encrypted ciphertext of the target confidential data can then be decrypted using the second password as a decryption key to obtain the associated data of the ciphertext of the target confidential data.

[0135] In other embodiments, the double-encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data using an encryption key derived from the second password. An encryption key (defined as a fourth encryption key) can be derived based on the second password. The length of the fourth encrypted ciphertext is greater than the second password. In this embodiment, the double-encrypted ciphertext of the target confidential data is also obtained by encrypting the associated data of the ciphertext of the target confidential data using the fourth encryption key.

[0136] Accordingly, the doubly encrypted ciphertext of the target confidential data may be decrypted using the fourth encryption key to obtain associated data of the ciphertext of the target confidential data.

[0137] Furthermore, the ciphertext of the target confidential data can be obtained based on the associated data of the ciphertext of the target confidential data. For the embodiment in which the associated data of the ciphertext of the target confidential data is the target confidential data itself, the ciphertext of the target confidential data can be directly obtained by decrypting the double-encrypted ciphertext of the target confidential data.

[0138] For the embodiment in which the associated data of the ciphertext of the above-mentioned target confidential data is the ciphertext of the target confidential data carrying signature information, the private key of the key management system can be used to perform digital signature verification on the ciphertext of the target confidential data carrying signature information; and when the ciphertext of the target confidential data passes the digital signature verification, the ciphertext of the target confidential data can be obtained from the ciphertext of the target confidential data carrying signature information.

[0139] For the embodiment in which the associated data of the ciphertext of the above-mentioned target confidential data is a compressed file of the ciphertext of the target confidential data carrying signature information, the private key of the key management system can be used to perform digital signature verification on the compressed file of the ciphertext of the target confidential data carrying signature information. When the compressed file of the ciphertext of the target confidential data passes the digital signature verification, the compressed file of the ciphertext of the target confidential data is decompressed to obtain the ciphertext of the target confidential data.

[0140] Furthermore, the ciphertext of the target confidential data may be sent to a storage node, so that the storage node can store the ciphertext of the target confidential data, thereby achieving uploading of the ciphertext of the target confidential data.

[0141] If the target confidential data in the target user's key management instance is lost, the target confidential data can be restored in the key management instance by using the ciphertext of the target confidential data uploaded by the user to the storage node. The specific recovery process can be found in the recovery process of confidential data to be restored in the above embodiment, and will not be repeated here.

[0142] It should be noted that the execution entity of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution entity of steps 901 and 902 can be device A; for another example, the execution entity of step 901 can be device A, and the execution entity of step 902 can be device B; and so on.

[0143] In addition, some of the processes described in the above embodiments and the accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The sequence numbers of the operations, such as 901 and 902, are merely used to distinguish between different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0144] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, causes the one or more processors to execute the steps in the above-mentioned data processing method.

[0145] Figure 10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. As shown in Figure 10, the computing device mainly includes: a memory 100a and a processor 100b. Among them, the memory 100a is used to store computer programs.

[0146] The processor 100b is coupled to the memory 100a, and is used to execute a computer program for: determining, in response to a data backup event, confidential data to be backed up in a key management instance in the key management system; creating a first encryption key in the key management instance; encrypting the confidential data to be backed up using the first encryption key in the key management instance to obtain a ciphertext of the confidential data to be backed up; and sending the ciphertext of the confidential data to be backed up to a storage node to back up the confidential data to be backed up at the storage node.

[0147] In some embodiments, the processor 100b is further used to: monitor whether there is new confidential data or new versions of confidential data in the key management instance; and trigger a data backup event when new confidential data and / or new versions of confidential data are detected in the key management instance.

[0148] When the processor 100b determines the confidential data to be backed up in the key management instance in response to the data backup event, it is specifically used to: determine the newly added confidential data and / or newly added version of the confidential data in the key management instance as the confidential data to be backed up in response to the data backup event.

[0149] Alternatively, processor 100b is configured to monitor whether a triggering timing for a full backup event has arrived, and upon detecting that the triggering timing for the full backup event has arrived, determine that a data backup event has occurred. Accordingly, when processor 100b determines the confidential data to be backed up in the key management instance in response to the data backup event, it is specifically configured to determine, in response to the data backup event, that all confidential data in the key management instance is confidential data to be backed up.

[0150] Optionally, when the processor 100b creates the first encryption key in the key management instance, it is specifically used to: obtain the root key of the target user stored in the cryptographic machine corresponding to the key management instance; and derive the first encryption key based on the root key.

[0151] Optionally, the processor 100b is also used to: encrypt the first encryption key using the root key in the key management instance to obtain the ciphertext of the first encryption key; store the ciphertext of the first encryption key in the control node in the key management service, so that in the process of recovering the confidential data to be backed up, the ciphertext of the first encryption key and the ciphertext of the data to be recovered are provided to the key management instance, so that the key management instance can use the root key to decrypt the ciphertext of the first encryption key, and use the ciphertext of the first encryption key to decrypt the ciphertext of the confidential data to be backed up.

[0152] Optionally, the processor 100b is also used to: record the metadata of the ciphertext of the confidential data to be backed up; and send the metadata of the ciphertext of the confidential data to be backed up to the storage node, so that the storage node stores the metadata of the ciphertext of the confidential data to be backed up, and determines the confidential data that needs to be restored based on the metadata of the ciphertext of the confidential data to be backed up.

[0153] In some embodiments of the present application, the processor 100b is also used to: in response to a data recovery event, obtain the ciphertext of the confidential data to be recovered from the storage node; send a data recovery request to the key management instance to request the key management instance to recover the confidential data to be recovered; the data recovery request includes: the ciphertext of the second encryption key for encrypting the confidential data to be recovered and the ciphertext of the confidential data to be recovered; in response to the data recovery request, obtain the root key of the target user stored in the cryptographic machine corresponding to the key management instance; use the root key to decrypt the ciphertext of the second encryption key to obtain the second encryption key; use the second encryption key to decrypt the ciphertext of the confidential data to be recovered in the key management instance to obtain the confidential data to be recovered; and, store the confidential data to be recovered in the key management instance.

[0154] In some embodiments, the processor 100b is further configured to: provide a data to be recovered configuration interface; and upon obtaining metadata of the confidential data to be recovered configured via the data to be recovered configuration interface, determine that a data recovery event has occurred. Accordingly, when the processor 100b obtains the ciphertext of the confidential data to be recovered from the storage node in response to the data recovery event, the processor 100b is specifically configured to: obtain the ciphertext of the confidential data to be recovered from the storage node based on the metadata of the confidential data to be recovered in response to the data recovery event.

[0155] In other embodiments of the present application, the processor 100b is also used to: obtain a backup data download request and a first password provided by a target user through the communication component 100c; determine the ciphertext of the confidential data to be downloaded from the storage node in response to the backup data download request; encrypt the ciphertext of the confidential data to be downloaded based on the first password to obtain a doubly encrypted ciphertext of the confidential data to be downloaded; and provide the doubly encrypted ciphertext of the confidential data to be downloaded to the terminal device of the target user through the communication component 100c.

[0156] Optionally, when the processor 100b encrypts the ciphertext of the confidential data to be downloaded based on the first password, it is specifically used to: derive a third encryption key based on the first password; the length of the third encryption key is greater than the first password; and use the third encryption key to encrypt the ciphertext of the confidential data to be downloaded to obtain a double-encrypted ciphertext of the confidential data to be downloaded.

[0157] Optionally, the processor 100b is also used to: compress the ciphertext of the confidential data to be downloaded before encrypting the ciphertext of the confidential data to be downloaded based on the first password to obtain a first compressed file of the ciphertext of the confidential data to be downloaded; and digitally sign the first compressed file using the private key of the key management system to obtain a first compressed file carrying signature information.

[0158] Correspondingly, when the processor 100b encrypts the ciphertext of the confidential data to be downloaded based on the first password, it is specifically used to: encrypt the first compressed file carrying the signature information based on the first password to obtain the double-encrypted ciphertext of the confidential data to be downloaded; the double-encrypted ciphertext of the confidential data to be downloaded is the ciphertext of the first compressed file carrying the signature information.

[0159] Optionally, when the processor 100b provides the doubly encrypted ciphertext of the confidential data to be downloaded to the terminal device of the target user, it is specifically used to: generate a download address for the doubly encrypted ciphertext of the confidential data to be downloaded; and provide the download address to the terminal device of the target user through the communication component 100c, so that the target user can download the doubly encrypted ciphertext of the confidential data to be downloaded from the download address.

[0160] In some embodiments, the processor 100b is also used to: obtain, through the communication component 100c, the doubly encrypted ciphertext of the target confidential data uploaded by the target user and the second password uploaded by the target user; the doubly encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data based on the second password; based on the second password, decrypt the doubly encrypted ciphertext of the target confidential data to obtain the associated data of the ciphertext of the target confidential data; based on the associated data of the ciphertext of the target confidential data, obtain the ciphertext of the target confidential data; and send the ciphertext of the target confidential data to the storage node so that the storage node can store the ciphertext of the target confidential data.

[0161] Optionally, the associated data of the ciphertext of the target confidential data is a second compressed file of the ciphertext of the target confidential data that carries signature information; the signature information is obtained by digitally signing the compressed file using the private key of the key management system. Accordingly, the processor 100b is further configured to: before obtaining the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data, use the private key of the key management system to verify the digital signature of the second compressed file that carries the signature information; and if the second compressed file that carries the signature information passes the digital signature verification, execute an operation to obtain the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data.

[0162] Accordingly, when the processor 100b obtains the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data, it is specifically configured to: decompress the second compressed file to obtain the ciphertext of the target confidential data.

[0163] Optionally, when the processor 100b obtains the double-encrypted ciphertext of the target confidential data uploaded by the target user, it is specifically used to: generate an upload address in response to the backup data upload request; send the upload address to the terminal device of the target user through the communication component 100c, so that the target user can upload the double-encrypted ciphertext of the target confidential data to the upload address; and obtain the double-encrypted ciphertext of the target confidential data from the upload address.

[0164] In some embodiments, when the processor 100b decrypts the double-encrypted ciphertext of the target confidential data based on the second password, it is specifically used to: derive a fourth encryption key based on the second password; the length of the fourth encrypted ciphertext is greater than the second password; the double-encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data using the fourth encryption key; and, decrypt the double-encrypted ciphertext of the target confidential data using the fourth encryption key to obtain the associated data of the ciphertext of the target confidential data.

[0165] In some optional embodiments, as shown in FIG10 , the computing device may further include components such as a power supply component 100d. In some embodiments, the computing device may be implemented as a terminal device such as a computer or workstation. Accordingly, the computing device may further include components such as a display component 100e and an audio component 100f. FIG10 schematically illustrates only some components, and does not imply that the computing device must include all components shown in FIG10 , nor does it imply that the computing device must include only the components shown in FIG10 .

[0166] The computing device provided in this embodiment, on the one hand, encrypts the confidential data to be backed up in the key management instance and backs up the ciphertext of the confidential data, thereby ensuring the security of the confidential data during backup; on the other hand, the confidential data in the key management instance is backed up to the storage node. Even if the confidential data in the node where the key management instance is located is lost, it can be restored through the ciphertext of the backed-up confidential data, thereby reducing the risk of loss of confidential data on the cloud and further improving data security.

[0167] In an embodiment of the present application, the memory is used to store computer programs and can be configured to store various other data to support operations on the device where it is located. The processor can execute the computer program stored in the memory to implement the corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0168] In the embodiment of the present application, the processor can be any hardware processing device that can execute the logic of the above method. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU) or a microcontroller unit (MCU); it can also be a programmable device such as a field programmable gate array (FPGA), a programmable array logic device (PAL), a general array logic device (GAL), a complex programmable logic device (CPLD); or an advanced reduced instruction set (RISC) processor (Advanced RISC Machines, ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0169] In an embodiment of the present application, the communication component is configured to facilitate wired or wireless communication between the device in which it is located and other devices. The device in which the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G or 3G, 4G, 5G or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component can also be based on near field communication (NFC) technology, radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra wide band (UWB) technology, Bluetooth (BT) technology or other technologies to implement.

[0170] In an embodiment of the present application, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor can not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0171] In embodiments of the present application, a power supply assembly is configured to provide power to various components of the device in which it is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0172] In an embodiment of the present application, the audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals. The received audio signal may be further stored in a memory or sent via a communication component. In some embodiments, the audio component further includes a speaker for outputting audio signals. For example, for a device with a language interaction function, voice interaction with the user can be achieved through the audio component.

[0173] It should be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent the order of precedence, nor do they limit "first" and "second" to different types.

[0174] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, compact disc read-only memory (Compact Disc Read-Only Memory, CD-ROM), optical storage, etc.) that contain computer-usable program code.

[0175] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0176] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0177] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0178] In a typical configuration, a computing device includes one or more processors (CPU, etc.), input / output interfaces, network interfaces, and memory.

[0179] Memory may include non-permanent storage in a computer-readable medium, random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0180] Computer storage media is readable storage media, also known as computer-readable media. Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology to store information. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0181] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, the elements defined by the phrase "comprising a..." do not preclude the presence of additional identical elements in the process, method, commodity, or apparatus that includes the aforementioned elements.

[0182] The above contents are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A data processing method, characterized in that: include: In response to a data backup event, determining confidential data to be backed up in a key management instance in a key management system; creating a first encryption key in the key management instance; In the key management instance, the confidential data to be backed up is encrypted using the first encryption key to obtain a ciphertext of the confidential data to be backed up; The ciphertext of the confidential data to be backed up is sent to a storage node, so as to back up the confidential data to be backed up at the storage node.

2. The method according to claim 1, characterized in that The method further comprises: In case of monitoring the presence of newly added confidential data and / or newly added versions of confidential data in the key management instance, triggering the data backup event; The determining, in response to the data backup event, the confidential data to be backed up in the key management instance comprises: determining, in response to the data backup event, newly added confidential data and / or newly added versions of confidential data in the key management instance as the confidential data to be backed up; or, When the triggering time of the full backup event is detected to have arrived, the data backup event is triggered; The step of determining, in response to a data backup event, confidential data to be backed up in the key management instance comprises: In response to a data backup event, all confidential data in the key management instance is determined as the confidential data to be backed up.

3. The method according to claim 1, characterized in that The creating a first encryption key in the key management instance includes: Obtaining a root key of a target user stored in a cryptographic machine corresponding to the key management instance; the target user is a user to which the key management instance belongs; Based on the root key, the first encryption key is derived.

4. The method according to claim 3, characterized in that: Also includes: encrypting the first encryption key using the root key in the key management instance to obtain a ciphertext of the first encryption key; and storing the ciphertext of the first encryption key in the control node in the key management service, so that in the process of restoring the confidential data to be backed up, the ciphertext of the first encryption key and the ciphertext of the confidential data to be backed up are provided to the key management instance, so that the key management instance uses the root key to decrypt the ciphertext of the first encryption key, and uses the ciphertext of the first encryption key to decrypt the ciphertext of the confidential data to be backed up; and / or, Recording metadata of the ciphertext of the confidential data to be backed up; The metadata of the ciphertext of the confidential data to be backed up is sent to the storage node so that the storage node stores the metadata of the ciphertext of the confidential data to be backed up, and determines the confidential data to be restored based on the metadata of the ciphertext of the confidential data to be backed up.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: In response to a data recovery event, obtaining a ciphertext of the confidential data to be recovered from the storage node; Sending a data recovery request to the key management instance to request the key management instance to recover the confidential data to be recovered; the data recovery request includes: a ciphertext of a second encryption key used to encrypt the confidential data to be recovered and the ciphertext of the confidential data to be recovered; In response to the data recovery request, obtaining the root key of the target user stored in the cryptographic machine corresponding to the key management instance; decrypting the ciphertext of the second encryption key using the root key to obtain the second encryption key; decrypting the ciphertext of the confidential data to be restored by using the second encryption key in the key management instance to obtain the confidential data to be restored; The confidential data to be restored is stored in the key management instance.

6. The method according to claim 5, characterized in that The method further comprises: In the case where metadata of the confidential data to be restored configured through the to-be-restored data configuration interface is acquired, determining that the data restoration event occurs; The step of obtaining, in response to a data recovery event, ciphertext of confidential data to be recovered from the storage node comprises: In response to a data recovery event, the ciphertext of the confidential data to be recovered is obtained from the storage node according to the metadata of the confidential data to be recovered.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Obtaining a backup data download request and a first password provided by the target user; In response to the backup data download request, determining the ciphertext of the confidential data to be downloaded from the storage node; Based on the first password, encrypting the ciphertext of the confidential data to be downloaded to obtain a double encrypted ciphertext of the confidential data to be downloaded; The double encrypted ciphertext of the confidential data to be downloaded is provided to the terminal device of the target user.

8. The method according to claim 7, characterized in that The step of encrypting the ciphertext of the confidential data to be downloaded based on the first password includes: Based on the first password, deriving a third encryption key; the length of the third encryption key is greater than the first password; The ciphertext of the confidential data to be downloaded is encrypted using the third encryption key to obtain the double-encrypted ciphertext of the confidential data to be downloaded.

9. The method according to claim 7, characterized in that: Before encrypting the ciphertext of the confidential data to be downloaded based on the first password, the method further includes: Compressing the ciphertext of the confidential data to be downloaded to obtain a first compressed file of the ciphertext of the confidential data to be downloaded; Digitally signing the first compressed file using the private key of the key management system to obtain a first compressed file carrying signature information; The step of encrypting the ciphertext of the confidential data to be downloaded based on the first password to obtain the double encrypted ciphertext of the confidential data to be downloaded includes: Based on the first password, the first compressed file carrying the signature information is encrypted to obtain a double encrypted ciphertext of the confidential data to be downloaded.

10. The method according to claim 7, characterized in that The method further comprises: Obtaining a double encrypted ciphertext of the target confidential data uploaded by the target user and a second password uploaded by the target user; the double encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data based on the second password; decrypting the double encrypted ciphertext of the target confidential data based on the second password to obtain associated data of the ciphertext of the target confidential data; Based on the associated data of the ciphertext of the target confidential data, obtaining the ciphertext of the target confidential data; The ciphertext of the target confidential data is sent to the storage node, so that the storage node stores the ciphertext of the target confidential data.

11. The method according to claim 10, characterized in that The associated data of the ciphertext of the target confidential data is a second compressed file of the ciphertext of the target confidential data carrying signature information; The signature information is obtained by digitally signing the compressed file using the private key of the key management system; The method further comprises: Before obtaining the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data, using the private key of the key management system to perform digital signature verification on the second compressed file carrying the signature information; When the second compressed file carrying the signature information passes the digital signature verification, executing the operation of acquiring the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data; The step of obtaining the ciphertext of the target confidential data based on the associated data of the ciphertext of the target confidential data comprises: The second compressed file is decompressed to obtain the ciphertext of the target confidential data.

12. The method according to claim 10, characterized in that The decrypting, based on the second password, the double encrypted ciphertext of the target confidential data to obtain the associated data of the ciphertext of the target confidential data includes: A fourth encryption key is derived based on the second password; the length of the fourth encrypted ciphertext is greater than the second password; the double encrypted ciphertext of the target confidential data is obtained by encrypting the associated data of the ciphertext of the target confidential data using the fourth encryption key; The double encrypted ciphertext of the target confidential data is decrypted using the fourth encryption key to obtain associated data of the ciphertext of the target confidential data.

13. A data processing system, characterized in that: include: Key management system and storage nodes; The key management system includes: a key management node; the key management node runs a key management instance of a target user; the key management system also includes: a control node of the key management instance; the key management system is used to execute the steps in the method described in any one of claims 1-12.

14. A computing device, characterized in that include: A memory and a processor; wherein the memory is used to store a computer program; The processor is coupled to the memory and configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 12.

15. A computer-readable storage medium storing computer instructions, characterized in that: When the computer instructions are executed by one or more processors, the one or more processors are caused to execute the steps in the method according to any one of claims 1 to 12.

Images