Key data processing method, apparatus and system, and device and storage medium

Abstract

Provided in the present disclosure are a key data processing method, apparatus and system, and a device and a storage medium. A cipher machine cluster comprises a hardware cipher machine, which is used for running at least one cipher machine instance; and the same initial key is configured for each cipher machine instance. The method comprises: acquiring a device key ciphertext and a domain key ciphertext which are provided by a target cipher machine instance, wherein the device key ciphertext is encrypted by using an initial key after a device key is created, and the domain key ciphertext is encrypted by using the device key after a domain key is created; synchronizing the device key ciphertext and the domain key ciphertext to other cipher machine instances, wherein the other cipher machine instances are used for using the initial key to decrypt the synchronized device key ciphertext so as to obtain the device key, and to decrypt the synchronized domain key ciphertext so as to obtain the domain key; and in response to a password operation request of an initiating end having been received, sending the password operation request to any cipher machine instance, and the cipher machine instance which receives the password operation request processing the password operation request by using a domain key held by the cipher machine instance itself.

Description

Key data processing method, device, system, equipment and storage medium

[0001] This disclosure claims priority to Chinese patent application number 202311135337.9, filed with the Patent Office of China on September 4, 2023, entitled “Method, device, system, equipment and storage medium for processing key data,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present disclosure relates to the field of cloud computing technology, and in particular to a method, apparatus, system, device, and storage medium for processing key data. Background Art

[0003] Currently, some cloud service providers provide encryption services in the cloud. They use tested and certified hardware cryptographic machines as the service underlying layer and create cryptographic machine instances through virtualization technology for users to use. This can help users meet regulatory compliance requirements for data security and protect the privacy of cloud service data.

[0004] In cloud computing scenarios, the demand for high availability and scalability makes cloud-based encryption services highly complex to design. For example, cloud-based encryption services require the configuration of multiple cryptographic machine instances, allowing them to be scheduled arbitrarily to provide cryptographic operations when users request them. This requires that each cryptographic machine instance maintain a unified key. Therefore, meeting the high availability and scalability requirements of cloud computing, as well as ensuring the reliability of key management, has become a pressing technical challenge.

[0005] Summary of the Invention

[0006] To overcome the problems existing in the related art, the present disclosure provides a method, apparatus, system, device and storage medium for processing key data.

[0007] According to a first aspect of an embodiment of this specification, a method for processing key data is provided. The method is applied to a server, the server being configured to manage a cryptographic machine cluster, the cryptographic machine cluster including at least one hardware cryptographic machine configured to run at least one cryptographic machine instance; each hardware cryptographic machine is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method comprising:

[0008] After determining a target cryptographic machine instance in the cryptographic machine cluster, obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates a device key, and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates a domain key;

[0009] Synchronizing the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are configured to decrypt the synchronized device key ciphertext using their own initial keys to obtain the device key, and then decrypt the synchronized domain key ciphertext using the decrypted device key to obtain the domain key;

[0010] In response to receiving the cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

[0011] According to a second aspect of an embodiment of this specification, a cryptographic service management system is provided, the cryptographic service management system being configured to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine configured to run at least one cryptographic machine instance, the hardware cryptographic machine providing a cryptographic machine interface for invocation by the management system, the cryptographic machine interfaces of different hardware cryptographic machines supporting the same interface standard; and each cryptographic machine instance having the same domain key.

[0012] The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine;

[0013] The service interface is used to: after receiving a cryptographic operation request from the initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0014] According to a third aspect of the embodiments of this specification, a device for processing key data is provided. The device is applied to a server, and the server is used to manage a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance. Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance. The device includes:

[0015] an acquisition module, configured to: after determining a target cryptographic machine instance in the cryptographic machine cluster, acquire a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates a device key; and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates a domain key;

[0016] a synchronization module configured to synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are configured to decrypt the synchronized device key ciphertext using their own initial keys to obtain the device key, and then decrypt the synchronized domain key ciphertext using the decrypted device key to obtain the domain key;

[0017] The request operation module is used to: in response to receiving a cryptographic operation request from the initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request uses the domain key it holds to process the cryptographic operation request.

[0018] According to a fourth aspect of the embodiments of this specification, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method embodiment described in the first aspect are implemented.

[0019] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method embodiment described in the first aspect are implemented.

[0020] According to a sixth aspect of the embodiments of this specification, a computer program product is provided, comprising a computer program, which, when executed by a processor, can implement the steps of the method embodiment described in the first aspect.

[0021] The technical solutions provided by the embodiments of this specification may have the following beneficial effects:

[0022] In the embodiments of this specification, after determining the target cipher machine instance in the cipher machine cluster, the device key ciphertext and domain key ciphertext provided by the target cipher machine instance are obtained. The device key ciphertext is encrypted using the initialization key after the target cipher machine instance creates the device key, and the domain key ciphertext is encrypted using the device key after the target cipher machine instance creates the domain key; the device key ciphertext and domain key ciphertext are synchronized to the other cipher machine instances. Each of the hardware cipher machines in the cipher machine cluster configures an initial key that complies with the preset key rules for the running cipher machine instance. In this way, the initial key is used to protect the device key, and the device key is used to protect the domain key, thereby achieving dual protection of the key. A secure and unified domain key can be used for cryptographic operations in the cluster, thereby achieving distributed cryptographic operations through multiple cipher machine instances, meeting the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the disclosure.

[0025] FIG1A and FIG1B are schematic diagrams of a key data processing scenario according to an exemplary embodiment of this specification.

[0026] FIG2 is a flowchart of a method for processing key data according to an exemplary embodiment of this specification.

[0027] FIG3 is a hardware structure diagram of a computer device where a key data processing device is located according to an exemplary embodiment of this specification.

[0028] FIG4 is a block diagram of a device for processing key data according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with this specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of this specification, as detailed in the appended claims.

[0030] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0031] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0032] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0033] Cloud Data Encryption Service (Cloud HSM) uses certified hardware cryptographic machines as its underlying infrastructure. Using virtualization technology, it creates user-friendly instances of these machines, helping users meet regulatory compliance requirements for data security and protecting the privacy of data in cloud services. With Cloud HSM, users can securely and reliably manage keys and utilize a variety of encryption algorithms to reliably encrypt and decrypt data.

[0034] A hardware security module (HSM) is a hardware device that can independently or concurrently provide users with key management or cryptographic operations and other functions.

[0035] Cloud HSM refers to an encryption solution on the cloud that uses a tested and certified hardware HSM as the service foundation. Through virtualization technology, it helps customers meet regulatory compliance requirements for data security and protect the privacy of cloud service data.

[0036] With the Cloud Crypto Machine solution, you can create multiple Crypto Machine instances (also known as Cloud Crypto Machine instances) within a cluster. A Crypto Machine instance is a resource virtualized from the Crypto Machine's hardware encryption module. Crypto Machine instances have the same compliance as hardware encryption modules and can implement all encryption service functions, including the ability to encrypt and decrypt data.

[0037] Key Management Service (KMS): A one-stop key management and data encryption service platform, providing simple, reliable, secure, and compliant data encryption protection capabilities. Specifically, a KMS typically provides a system or service for key custody and management, and provides cryptographic computing capabilities for the managed keys. Ensuring the security and compliance of encryption keys is a core capability of a KMS. National and industry laws and regulations have mandated the use of hardware cryptographic machines that meet security level requirements for key protection and storage.

[0038] As shown in Figure 1A, this specification illustrates a schematic diagram of a key data processing scenario according to an exemplary embodiment. Figure 1A includes a cryptographic machine cluster, a KMS system, and an initiator. The KMS system is used as an example of a server that manages the cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, which is used to run at least one cryptographic machine instance. Figure 1A uses hardware cryptographic machines 1 through 3 as examples, with each hardware cryptographic machine running two cryptographic machine instances. The KMS system is used to manage the cryptographic machine cluster; the initiator can use the cryptographic operation functions of the cryptographic machine cluster through the KMS system. Figure 1A uses three cloud product instances as an example.

[0039] After a cryptographic machine instance is created by a hardware cryptographic machine, it must be initialized before cryptographic operations can be performed. In some related technologies, the hardware cryptographic machine vendor provides a management tool. This tool must be installed manually on the machine, then connected to the hardware cryptographic machine within the tool, manually initialized, synchronized keys, and configured authentication on the server side. All manual operations are complex and error-prone, making them unsuitable for large-scale deployments. Synchronization and other processes are performed by the hardware cryptographic machine, relying on the hardware cryptographic machine vendor.

[0040] In public cloud scenarios, hardware cryptographic machines are configured by the cloud service provider, and users don't necessarily require a specific hardware cryptographic machine manufacturer. In private or hybrid cloud scenarios, however, some users specify a specific hardware cryptographic machine manufacturer. Therefore, the KMS system, as a management platform, needs to be able to connect to hardware cryptographic machines from different manufacturers. However, hardware cryptographic machines from different manufacturers have inconsistent interfaces, and their management and usage methods vary slightly. This results in high costs for the server to adapt to new cloud cryptographic machine manufacturers, and it is difficult to ensure stability. Each time a new cryptographic machine manufacturer is connected, the cryptographic operation interfaces, from the operations and maintenance side to the data plane, must be re-adapted.

[0041] Based on this, it is necessary to improve the server so that it can support the access of cloud cryptographic machines from multiple manufacturers and can automate the operation and maintenance and use of cloud cryptographic machines from different manufacturers.

[0042] As shown in Figure 1B, this is a schematic diagram of another cryptographic service scenario shown in this specification according to an exemplary embodiment. In the figure, hardware cryptographic machines are taken as examples of hardware cryptographic machines 1 to hardware cryptographic machines 3, and each hardware cryptographic machine is taken as an example of running two cryptographic machine instances. In actual applications, the number of hardware cryptographic machines and the number of cryptographic machine instances running in each hardware cryptographic machine can be flexibly configured as needed, and this embodiment does not limit this.

[0043] Among them, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard.

[0044] The key mentioned in this embodiment includes information that can be used to encrypt and decrypt data. Keys can be of various types, such as symmetric keys, asymmetric keys, hybrid keys, one-way hash functions, or digital signatures, and this embodiment does not limit these types.

[0045] The server of this embodiment may be run on a computer device, wherein the computer device includes but is not limited to a single server, a server group consisting of multiple servers, or a cloud composed of a large number of hosts based on cloud computing.

[0046] The server side in the figure uses the KMS system as an example, providing an interface service. This interface service comprises one or more service nodes, which can be programs running on a computing instance and providing interface services. Specifically, a service node is configured with one or more service interfaces that support the same interface standards as the cryptographic machine interface. The service node uses these service interfaces to call the cryptographic machine interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0047] In this embodiment, each cryptographic machine instance has the same domain key; the service interface is used to: after receiving a cryptographic operation request from the initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein, the cryptographic machine instance is used to use the domain key it holds to process the cryptographic operation request.

[0048] Optionally, distributed scheduling can be implemented across multiple service nodes, enabling distributed processing on the server side. Different service interfaces are used to initiate different operation requests to the cryptographic machine instance. For example, each service interface is used to initiate an atomic operation on the hardware cryptographic machine / cryptographic machine instance. Therefore, the one or more service interfaces configured in each service node can be understood as a layer of SDK (Software Development Kit) deployed on the service node, through which the cryptographic machine interface is called. This encapsulation of the interface shields the differences in cryptographic machine interfaces from different manufacturers without modifying the upper-layer service code.

[0049] In practice, interface standards can be configured as needed, for example, based on the standards supported by the various cryptographic machine manufacturers to be connected. For example, for cryptographic operations, the interface standard may include PKCS#11 (Public Key Cryptography Standards#11). PKCS#11 defines an interface that allows software applications to communicate with various cryptographic devices and perform cryptographic services such as secure key management, digital signatures, and encryption and decryption operations.

[0050] In this way, the cryptographic machine interfaces of each hardware cryptographic machine in the cryptographic machine cluster support the same interface standard, and the service interface of the KMS system also supports this standard. The server can access hardware cryptographic machines from different manufacturers and call the cryptographic machine interface through the service interface to operate and maintain the cryptographic machine instance or use the cryptographic operation services provided by the cryptographic machine instance.

[0051] For example, the server can run one or more tasks, each of which can execute a process flow. During execution, the process flow can call one or more service interfaces. The called service interfaces will then generate call requests to the cryptographic machine interface, thereby automatically completing the operation and maintenance task. Alternatively, the server can obtain a cryptographic operation request from the initiator, parse the request, and call the corresponding service interface. The called service interface will then generate a call request to the cryptographic machine interface, allowing the called cryptographic machine instance to complete the cryptographic operation.

[0052] In some examples, for any manufacturer's cryptographic machine, the use of the cryptographic machine can be uniformly divided into two stages: the first stage is key initialization, and the second stage is the KMS system providing external services, creating keys for users, and using keys for encryption and decryption operations.

[0053] Optionally, during the first phase of key initialization, a specific cryptographic machine instance needs to be operated, such as initializing a specific cryptographic machine instance and using a specific cryptographic machine instance to initialize the key; while in the process of the server providing external services, any cryptographic machine instance can be used to provide cryptographic operation services without specifying a specific cryptographic machine instance.

[0054] An SDK layer is deployed on each service node, which divides all operations of the cloud cryptographic machine into: stateful management interface and stateless management interface; among them, the calling parameters of the stateful management interface include the information of the called cryptographic machine instance; the calling parameters of the stateless management interface do not include the information of the called cryptographic machine instance.

[0055] Optionally, the types of stateful management interfaces may include device management and domain key management, and the types of stateless management interfaces may include session key management and cryptographic operations.

[0056] As an example, the device management type service interface may include any of the following: a service interface for obtaining cryptographic machine information, a service interface for performing cryptographic machine user management, a service interface for cryptographic machine initialization, an interface for cryptographic machine certificate management, or a service interface for cryptographic machine device key management.

[0057] The domain key management type service interface may include any one of the following: a service interface for creating a domain key; a service interface for exporting / importing a domain key.

[0058] The service interface of the session key management type may include a service interface for creating a session key and / or a service interface for wrapping / unwrapping a session key.

[0059] The service interface of the cryptographic operation type may include any of the following: a service interface for symmetric encryption and decryption, a service interface for generating random numbers, or a service interface for asymmetric encryption and decryption; among which, the service interface for asymmetric encryption and decryption may include a service interface for encryption / decryption, and / or a service interface for signing / verifying signatures.

[0060] Among them, the stateful management interface can be used to realize the automation of the operation and maintenance of the cipher machine, while the stateless management interface can be used to process the cryptographic operation request of the initiator to the cipher machine instance.

[0061] As an example, one or more tasks can be configured on the server side. The task can be a program that is used to execute a specific process. For example, the task can be an initialization task, including a cipher instance initialization task, a key initialization task, a key synchronization task, and so on. When a cipher instance is created in the cipher cluster, the KMS system can start the initialization task of the cipher instance. For example, taking the creation of the target cipher instance as an example, the KMS system can obtain the information of the target cipher instance and start the cipher instance initialization task based on the information of the target cipher instance. During the operation of this task, the following process can be executed:

[0062] After logging into the target cryptographic machine instance using the factory default authentication data configured for the cryptographic machine instance using the hardware cryptographic machine, change the password of the target cryptographic machine instance and log in again, and obtain the API token (Application Programming Interface token, a token used for application authentication and authorization) returned by the target cryptographic machine instance.

[0063] After obtaining the API token, the service interface for initializing the cryptographic machine can be called, so that the service interface for initializing the cryptographic machine calls the cryptographic machine interface to initialize the target cryptographic machine instance.

[0064] Assuming that the target cipher instance is the first cipher instance created in the cipher cluster, a key initialization task is also started. During the running process, the key initialization task can execute the following process:

[0065] Invoke a service interface for managing device keys of an encryption machine, so that the interface calls the encryption machine interface, requests the target encryption machine instance to create a device key, and then returns a ciphertext of the device key, wherein the ciphertext of the device key is encrypted by the target encryption machine using the initial key;

[0066] The service interface for creating a domain key is called so that the interface calls the cryptographic machine interface to request the target cryptographic machine instance to create a domain key.

[0067] The service interface for exporting / importing domain keys is called so that the interface calls the cryptographic machine interface, requests the target cryptographic machine instance to return the domain key ciphertext, and then returns the domain key ciphertext. The domain key ciphertext is encrypted by the device key after the target cryptographic machine instance creates the domain key.

[0068] In this way, the server can obtain the device key ciphertext and domain key ciphertext.

[0069] Subsequently, other cipher machine instances will also be created. Similarly, the server can start the cipher machine instance initialization task. The execution process can be seen in the above embodiment. Since other subsequent cipher machine instances need to synchronize keys, a key synchronization task can also be started. During the operation of the key synchronization task, the following process can be executed:

[0070] Calling the service interface for encryption machine device key management, so that the interface calls the cipher machine interface to request the transmission of the device key ciphertext to the other cipher machine instance;

[0071] The service interface for exporting / importing the domain key is called, so that the interface calls the cryptographic machine interface to request that the domain key ciphertext be transmitted to the other cryptographic machine instance.

[0072] In this way, the server can synchronize the device key ciphertext and domain key ciphertext with other cipher machine instances. Each cipher machine instance then uses its own initial key to decrypt the synchronized device key ciphertext to obtain the device key. It then uses the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key. This ensures that each cipher machine instance in the cluster has the same device key and domain key.

[0073] In some examples, the device key and / or domain key may be updated according to a set period. For example, the server automatically triggers the update using a set rule, which can be configured as needed, such as a set time period.

[0074] When the update is triggered, one of the cipher machine instances is selected in the cipher machine cluster to create a new device key and domain key; in this way, an update task can be created, and the update task can use the selected cipher machine instance as the aforementioned target cipher machine instance to start the aforementioned key initialization task. The execution process of the task is as described above, so that the cipher machine instance generates a new device key and / or domain key, and returns the device key ciphertext and / or domain key ciphertext to the KMS system.

[0075] The server can synchronize the new device key ciphertext and / or domain key ciphertext with other cipher machine instances in the cluster. The synchronization process is described in the preceding embodiment. After synchronization, other cipher machine instances can use the new device key ciphertext and / or domain key ciphertext to obtain new device keys and / or domain keys, replacing their existing old device keys and / or domain keys.

[0076] In the second phase, the server uses the service interfaces of each service node to provide external services, creating keys for users and performing key operations using them. For example, a KMS system includes a gateway, which can be configured with one or more API servers for the initiator. Optionally, the API server can be a program running on a computing instance, which is used to handle cryptographic operation requests from the initiator. Cryptographic operation requests can be of various types, such as user key creation, encryption and decryption, signing, or signature verification.

[0077] For example, when the gateway receives a cryptographic operation request from the initiator, it can request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein, the cryptographic machine instance is used to process the cryptographic operation request using the domain key it holds.

[0078] After an API Server in the gateway receives a cryptographic operation request, it dispatches it to any interface service node, which runs the cryptographic operation task. The task can call the service interface, which can be a stateless service interface. The called service interface initiates a request to the cryptographic machine interface of any hardware cryptographic machine, requesting the cryptographic machine instance to perform cryptographic operations.

[0079] For example, a cryptographic operation request, including a user key creation request, can invoke a session key creation service interface. This service interface then calls the cryptographic interface of any hardware cryptographic machine in the cluster to request the creation of a user key from any cryptographic machine instance. After receiving the user key ciphertext returned by the cryptographic machine instance, the initiator's identifier and the user key ciphertext are stored in the database. The user key ciphertext is encrypted by the requested cryptographic machine instance using its own domain key.

[0080] As an example, a cryptographic operation request includes a user key creation request, which can also include a user key usage request, which carries user data. The interface service node can obtain the user key creation request, query the database for the user key ciphertext corresponding to the initiator's identifier, and use the user data and user key ciphertext to invoke the service interface for session key wrapping / unwrapping. This interface can invoke the cryptographic interface of any hardware cryptographic machine in the cryptographic machine cluster, thereby requesting any cryptographic machine instance to perform processing. The requested cryptographic machine instance returns the cryptographic operation result, which is returned to the initiator by the KMS system. The cryptographic operation result is obtained by the requested cryptographic machine instance using its own domain key to decrypt the user key ciphertext to obtain the user key, and then performing a cryptographic operation on the user data using the decrypted user key.

[0081] As can be seen from the above examples, the KMS system implements a service interface in the embodiments of this specification. Through the service interface, hardware cryptographic machines and cryptographic machine instances interact, allowing access to hardware cryptographic machines from different manufacturers. Different manufacturers have different cryptographic machines, and the KMS system helps users shield the differences between the underlying hardware cryptographic machines of different manufacturers.

[0082] In the embodiments of this specification, it is taken into account that in cloud computing scenarios, the demand for high availability and scalability makes the cloud encryption service have a high design complexity. For example, in cloud encryption services, it is hoped that multiple cryptographic machine instances can be configured, and when facing a user's cryptographic operation request, the cryptographic machine instance can be arbitrarily scheduled to provide cryptographic operation services. In this way, each cryptographic machine instance is required to hold a unified key. Therefore, how to meet the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management. Therefore, as shown in Figure 2, this specification shows a method for processing key data according to an exemplary embodiment. The method can be applied to a server, and the server is used to manage a cryptographic machine cluster, the cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance; each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method may include the following steps:

[0083] Step 202: After determining a target cryptographic machine instance in the cryptographic machine cluster, obtain a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance. The device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates a device key. The domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates a domain key.

[0084] Step 204: Synchronize the device key ciphertext and the domain key ciphertext to the other cryptographic machine instance; wherein the other cryptographic machine instance is used to use its own initial key to decrypt the synchronized device key ciphertext to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key.

[0085] Step 206: In response to receiving the cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

[0086] In practical applications, the key data processing method of this embodiment can be applied to a server, such as the KMS system in the scenarios shown in Figures 1A or 1B. For example, the KMS system can be used to access a hardware cryptographic machine from a single manufacturer, and the KMS system can adapt to the cryptographic machine interface of the hardware cryptographic machine from that manufacturer. Alternatively, as in the aforementioned embodiment, the KMS system can be used to access hardware cryptographic machines from multiple manufacturers, configuring the service node to implement one or more service interfaces, and interacting with the cryptographic machine interface of the hardware cryptographic machine through the service interfaces.

[0087] The initial key can be a key that complies with preset key rules, such as the factory key configured by a hardware cryptographic machine for a cryptographic machine instance. The factory key is typically stored in the hardware cryptographic machine's trusted execution environment and is used to create and protect the keys required by the hardware cryptographic machine during subsequent operation. Each hardware cryptographic machine in a cryptographic machine cluster configures the same initial key for the running cryptographic machine instance, and the initial key is stored within the cryptographic machine instance. The cryptographic machine cluster can be hardware cryptographic machines from the same manufacturer. In this way, if there are multiple hardware cryptographic machines, the multiple cryptographic machine instances running within the multiple hardware cryptographic machines use a unified initial key.

[0088] The initial key is used to create and protect the device key, while the device key is used to protect the domain key. Considering the high availability requirements of cloud computing, cryptographic machine instances may be created and shut down dynamically. A hardware cryptographic machine used by user A can be subsequently initialized and made available to other users. Therefore, the initial key is used to generate different device keys after the cryptographic machine instance is initialized. The device key for a cryptographic machine instance is created after each initialization, meaning it will be different after each initialization. This ensures that different users can use different device keys. The device key is then used to create and protect the domain key, achieving dual key protection and unified domain keys for a single user. For example, the initial key can be used to create the device key, while the device key is used to create the domain key. The domain key can then be authenticated using the device key. This allows a secure and unified domain key to be used for cryptographic operations within the cluster, enabling distributed cryptographic operations across multiple cryptographic machine instances. This meets the high availability and scalability requirements of cloud computing scenarios, as well as ensures reliable key management.

[0089] In step 202, the device key and domain key can be created by selecting a target cipher machine instance from the cipher machine cluster. This step can be triggered in a variety of ways.

[0090] After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes:

[0091] After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining that the cryptographic machine instance created for the first time is a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance;

[0092] The synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0093] After the cipher machine cluster creates other cipher machine instances, the device key ciphertext and domain key ciphertext are synchronized to the other cipher machine instances.

[0094] In this way, the key can be initialized after the first cipher machine instance in the cluster is started. Subsequent cipher machine instances can synchronize the existing device key ciphertext and domain key ciphertext, eliminating the need to create them again.

[0095] Therefore, the first cryptographic machine instance started in the cluster can be used to create device keys and domain keys, while the cryptographic machine instances started subsequently do not need to be created. The KMS system ensures the uniformity of device keys and domain keys in the cluster through synchronization.

[0096] Optionally, in other examples, after the set update period arrives, after the target cipher machine instance is determined in the cipher machine cluster, the device key ciphertext and domain key ciphertext provided by the target cipher machine instance are obtained.

[0097] In other examples, key updates can be performed as needed. For example, after a set update period has expired, the target cipher instance in the cipher cluster is identified and the device key ciphertext and domain key ciphertext provided by the target cipher instance are retrieved. The KMS system can then synchronize the updated device key ciphertext and domain key ciphertext with other cipher instances in the cluster. This allows for regularly triggered key updates, effectively preventing cryptographic attacks and further ensuring security.

[0098] In other examples, only the domain key can be updated. For example, after a set update period has expired, the target cipher machine instance is identified in the cipher machine cluster, and the domain key ciphertext provided by the target cipher machine instance is obtained. The KMS system can then synchronize the updated domain key ciphertext with other cipher machine instances in the cluster.

[0099] For example, the method may further include:

[0100] After a set period has expired, determining a first cryptographic machine instance in the cryptographic machine cluster, obtaining a domain key ciphertext updated by the first cryptographic machine instance, wherein the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key;

[0101] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already hold.

[0102] In this embodiment, the domain key can be updated in the above manner when the set period arrives, which can effectively prevent cryptographic attacks and ensure the security of the user's cryptographic operations.

[0103] During the process of providing external services, the KMS system may face a large number of cryptographic operation requests from the initiator. The cryptographic operation request from the initiator includes the creation of a user key. As the information to be protected, one approach is to store the user key in the hardware cryptographic machine in the cluster. However, this approach will consume the storage resources of the hardware cryptographic machine. Based on this, in some examples, the cryptographic operation request includes a user key creation request. The cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster. The cryptographic machine instance that receives the cryptographic operation request uses its own domain key to process the cryptographic operation request. This may include:

[0104] Sending the user key creation request to any cipher machine instance in the cipher machine cluster, and obtaining the user key ciphertext created by the cipher machine instance that received the user key creation request using the domain key held by itself;

[0105] The identifier of the initiator and the user key ciphertext are stored in a database.

[0106] In this embodiment, the cryptographic machine instance protects the user key with the domain key and then provides the user key ciphertext to the server. This eliminates the need for the hardware cryptographic machine to store the domain key, thus saving its storage resources. The domain key protection within the cryptographic machine instance ensures the security of the user key. The server then stores the initiator's identifier and the user key ciphertext in a database for subsequent use by the initiator.

[0107] In some examples, when a domain key is updated, after synchronizing the updated domain key ciphertext to other cryptographic machine instances, the method may further include:

[0108] Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster;

[0109] After obtaining the updated ciphertexts of each user key returned by the one or more cipher machine instances, they are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts using the domain keys already held by the one or more cipher machine instances themselves to obtain the user key, and then encrypting the user key using the updated domain key.

[0110] One or more cipher instances can be selected from the cipher cluster to update the ciphertext of each user's key stored in the database. For example, a single cipher instance can perform updates for all user ciphertexts, or distributed processing can be used across multiple cipher instances, with each instance updating one or more keys. This ensures the security of user keys.

[0111] In some examples, the cryptographic operation request includes a user key usage request, the user key usage request carries user data, and the sending of the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, wherein the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using a domain key held by the cryptographic machine instance, includes:

[0112] Querying a user key ciphertext corresponding to the identifier of the initiating terminal from a database;

[0113] Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster;

[0114] Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

[0115] In this embodiment, since the user key is not stored in the cryptographic machine, upon receiving a user key usage request, the KMS can query the database for the user key ciphertext corresponding to the initiator's identifier. It then uses the user data and the user key ciphertext to request that any cryptographic machine instance in the cluster process the user key usage request. The requested cryptographic machine instance can then perform the cryptographic operation and return the result. This allows the user's key operation needs to be met without consuming the hardware cryptographic machine's storage resources.

[0116] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0117] The service end includes at least one service node, the method is applied to the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0118] In this embodiment, the server can configure a service interface in the service node, as described in FIG1B , and the interface standard supported by the service interface is the same as the interface standard supported by the cryptographic machine interface, thereby shielding the interface differences between different hardware cryptographic machines. The details can be found in the previous embodiment and will not be repeated here.

[0119] In some examples, the service interface includes: a stateful management interface and / or a stateless management interface; the calling parameters of the stateful management interface include information about the called cryptographic machine instance; the calling parameters of the stateless management interface do not include information about the called cryptographic machine instance;

[0120] The obtaining of the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes:

[0121] Obtaining information of a target cryptographic machine instance, calling the stateful class management interface using the information of the target cryptographic machine instance, and having the stateful class management interface determine the target hardware cryptographic machine where the target cryptographic machine instance is located based on the information of the target cryptographic machine instance, and then calling the cryptographic machine interface of the target hardware cryptographic machine;

[0122] Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware cipher machine instance after the cipher machine interface is called;

[0123] and / or,

[0124] The synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0125] Obtaining information about the other cryptographic machine instance, calling the stateful class management interface using the information about the other cryptographic machine instance, and after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located based on the information about the other cryptographic machine instance, calling the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine with the other cryptographic machine instance;

[0126] and / or,

[0127] The requesting any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes:

[0128] The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

[0129] Through the above classification of service interfaces, the operation and maintenance of the cryptographic machine can be carried out using a stateful management interface, and the user's cryptographic operation requests can be carried out using a stateless management interface, thereby realizing effective management of the cryptographic machine.

[0130] As can be seen from the above embodiments, a secure and unified domain key can be used for cryptographic operations in the cluster, thereby realizing distributed cryptographic operations through multiple cryptographic machine instances, meeting the high availability and scalability requirements in cloud computing scenarios, as well as the reliability of key management.

[0131] This embodiment also defines the management plane interface for KMS system operation and maintenance of cryptographic machines, as well as the data plane interface standard for providing services. This provides two advantages: cloud cryptographic machines are equipped with automated operation and maintenance capabilities, and the data plane is standardized using the PKCS11 interface. Based on this standard, KMS systems can access compliant cloud cryptographic machines at a low cost, achieving automated operation and maintenance. This automates the traditional cloud cryptographic machine initialization process, standardizes the data plane usage process, and eliminates the need for extensive duplication of work across different cryptographic machine vendors.

[0132] Corresponding to the embodiments of the aforementioned key data processing method, this specification also provides embodiments of a key data processing apparatus and a computer device to which it is applied.

[0133] The embodiment of the key data processing device of this specification can be applied to a computer device, such as a server or a terminal device. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, as shown in Figure 3, it is a hardware structure diagram of the computer device where the key data processing device of this specification is located. In addition to the processor 310, memory 330, network interface 320, and non-volatile memory 340 shown in Figure 3, the computer device where the key data processing device 331 in the embodiment is located can usually include other hardware according to the actual function of the computer device, which will not be described in detail.

[0134] As shown in FIG4 , FIG4 is a block diagram of a key data processing device according to an exemplary embodiment of this specification. The device is applied to a server, and the server is used to manage a cryptographic machine cluster. The cryptographic machine cluster includes at least one hardware cryptographic machine, and the hardware cryptographic machine is used to run at least one cryptographic machine instance. Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance. The device includes:

[0135] The acquisition module 41 is configured to: after determining a target cryptographic machine instance in the cryptographic machine cluster, acquire a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted using the initialization key after the target cryptographic machine instance creates a device key; and the domain key ciphertext is encrypted using the device key after the target cryptographic machine instance creates a domain key;

[0136] Synchronization module 42, configured to synchronize the device key ciphertext and the domain key ciphertext to the other cryptographic machine instance; wherein the other cryptographic machine instance is configured to decrypt the synchronized device key ciphertext using its own initial key to obtain the device key, and then decrypt the synchronized domain key ciphertext using the decrypted device key to obtain the domain key;

[0137] The request operation module 43 is used to: in response to receiving the cryptographic operation request from the initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request uses the domain key it holds to process the cryptographic operation request.

[0138] In some examples, the acquisition module 41 is further configured to:

[0139] After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining that the cryptographic machine instance created for the first time is a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance;

[0140] The synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes:

[0141] After the cipher machine cluster creates other cipher machine instances, the device key ciphertext and domain key ciphertext are synchronized to the other cipher machine instances.

[0142] In some examples, the cryptographic operation request includes a user key creation request, and the request operation module 43 is further configured to:

[0143] Sending the user key creation request to any cipher machine instance in the cipher machine cluster, and obtaining the user key ciphertext created by the cipher machine instance that received the user key creation request using the domain key held by itself;

[0144] The identifier of the initiator and the user key ciphertext are stored in a database.

[0145] In some examples, the cryptographic operation request includes a user key use request, and the request operation module 43 is further configured to:

[0146] Querying a user key ciphertext corresponding to the identifier of the initiating terminal from a database;

[0147] Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster;

[0148] Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

[0149] In some examples, the apparatus further includes an updating module configured to:

[0150] After a set period has expired, determining a first cryptographic machine instance in the cryptographic machine cluster, obtaining a domain key ciphertext updated by the first cryptographic machine instance, wherein the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key;

[0151] The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already hold.

[0152] In some examples, the update module is further configured to:

[0153] Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster;

[0154] After obtaining the updated ciphertexts of each user key returned by the one or more cipher machine instances, they are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts using the domain keys already held by the one or more cipher machine instances themselves to obtain the user key, and then encrypting the user key using the updated domain key.

[0155] In some examples, the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard;

[0156] The service end includes at least one service node, the device is applied to the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

[0157] In some examples, the service interface includes: a stateful management interface and / or a stateless management interface; the calling parameters of the stateful management interface include information about the called cryptographic machine instance; the calling parameters of the stateless management interface do not include information about the called cryptographic machine instance;

[0158] The acquisition module 41 is further configured to:

[0159] Obtaining information of a target cryptographic machine instance, calling the stateful class management interface using the information of the target cryptographic machine instance, and having the stateful class management interface determine the target hardware cryptographic machine where the target cryptographic machine instance is located based on the information of the target cryptographic machine instance, and then calling the cryptographic machine interface of the target hardware cryptographic machine;

[0160] Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware cipher machine instance after the cipher machine interface is called;

[0161] and / or,

[0162] The acquisition module 41 is further configured to:

[0163] Obtaining information about the other cryptographic machine instance, calling the stateful class management interface using the information about the other cryptographic machine instance, and after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located based on the information about the other cryptographic machine instance, calling the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine with the other cryptographic machine instance;

[0164] and / or,

[0165] The request operation module is further configured to:

[0166] The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

[0167] The implementation process of the functions and effects of each module in the above-mentioned key data processing device is specifically described in the implementation process of the corresponding steps in the above-mentioned key data processing method, and will not be repeated here.

[0168] Accordingly, an embodiment of this specification further provides a computer program product, including a computer program, which implements the steps of the aforementioned key data processing method embodiment when executed by a processor.

[0169] Accordingly, an embodiment of this specification also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the embodiment of the method for processing key data when executing the program.

[0170] Accordingly, an embodiment of this specification further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the embodiment of the method for processing key data are implemented.

[0171] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0172] The above embodiments can be applied to one or more computer devices, where the computer device is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. The hardware of the computer device includes but is not limited to a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0173] The computer device may be any electronic product that can interact with a user, such as a personal computer, a tablet computer, a smart phone, a personal digital assistant (PDA), a game console, an interactive network television (IPTV), a smart wearable device, etc.

[0174] The computer device may also include a network device and / or a user device, wherein the network device includes, but is not limited to, a single network server, a server group consisting of multiple network servers, or a cloud based on cloud computing consisting of a large number of hosts or network servers.

[0175] The network where the computer device is located includes but is not limited to the Internet, wide area network, metropolitan area network, local area network, virtual private network (VPN), etc.

[0176] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0177] The steps of the various methods above are divided only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications or introducing insignificant designs to the algorithm or process without changing the core design of the algorithm and process are all within the scope of protection of this application.

[0178] The phrases "specific examples" or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0179] Other embodiments of the present invention will readily occur to those skilled in the art upon consideration of the present invention and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present invention being indicated by the following claims.

[0180] It should be understood that the present description is not limited to the exact structure that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0181] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for processing key data, the method being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the method comprises: After determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates the device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates the domain key; Synchronize the device key ciphertext and the domain key ciphertext to other cryptographic machine instances; wherein the other cryptographic machine instances are used to decrypt the synchronized device key ciphertext using the initial key they hold to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; In response to receiving a cryptographic operation request from the initiator, the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

2. The method according to claim 1, wherein after determining the target cryptographic machine instance in the cryptographic machine cluster, obtaining the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance comprises: After creating a cryptographic machine instance for the first time in the cryptographic machine cluster, determining the cryptographic machine instance created for the first time as a target cryptographic machine instance, and obtaining a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance; The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes: After the cryptographic machine cluster creates other cryptographic machine instances, the device key ciphertext and the domain key ciphertext are synchronized to the other cryptographic machine instances.

3. The method according to claim 1 or 2, wherein the cryptographic operation request comprises a user key creation request, and the step of sending the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance receiving the cryptographic operation request processes the cryptographic operation request using a domain key held by itself, comprises: Sending the user key creation request to any cryptographic machine instance in the cryptographic machine cluster, and obtaining the user key ciphertext created by the cryptographic machine instance that receives the user key creation request using the domain key held by itself; The identifier of the initiator and the ciphertext of the user key are stored in a database.

4. According to the method according to any one of claims 1 to 3, the cryptographic operation request includes a user key use request, the user key use request carries user data, and the cryptographic operation request is sent to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key held by itself, comprising: Querying a user key ciphertext corresponding to the identifier of the initiator from a database; Sending the user key ciphertext and the user key usage request to any cipher machine instance in the cipher machine cluster; Obtain the cryptographic operation result and return it to the initiator; wherein, the cryptographic operation result is obtained by the cryptographic machine instance that receives the user key use request using the domain key it holds to decrypt the user key ciphertext to obtain the user key, and then using the decrypted user key to perform a cryptographic operation on the user data.

5. The method according to any one of claims 1 to 4, further comprising: After the set period arrives, determine the first cryptographic machine instance in the cryptographic machine cluster, and obtain the domain key ciphertext updated by the first cryptographic machine instance; wherein the first cryptographic machine instance is used to create a new domain key to replace the existing domain key, and the updated domain key ciphertext is obtained by encrypting the new domain key using the device key; The updated domain key ciphertext is synchronized to other cryptographic machine instances, so that other cryptographic machine instances use their own device keys to decrypt the updated domain key ciphertext and obtain the updated domain key to replace the domain key they already have.

6. The method according to claim 5, after synchronizing the updated domain key ciphertext to other cryptographic machine instances, the method further comprises: Obtaining the ciphertext of each user key stored in the database, and providing the ciphertext of each user key to one or more cipher machine instances in the cipher machine cluster; After obtaining the updated ciphertexts of each user key returned by the one or more cryptographic machine instances, the ciphertexts are stored in the database; wherein, the updated ciphertexts of each user key are obtained by decrypting the user key ciphertexts with the domain keys already held by the one or more cryptographic machine instances themselves to obtain the user key, and then encrypting the user key with the updated domain key.

7. The method according to any one of claims 1 to 6, wherein the hardware cryptographic machine provides a cryptographic machine interface for the server to call, and the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; The service end includes at least one service node, the method is applied in the service node, the service interface configured by the service node supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine.

8. The method according to claim 7, wherein the service interface comprises: A stateful class management interface and / or a stateless class management interface; the calling parameters of the stateful class management interface include information of the called cryptographic machine instance; The calling parameters of the stateless class management interface do not include the information of the called cryptographic machine instance; The obtaining of the device key ciphertext and the domain key ciphertext provided by the target cryptographic machine instance includes: Obtain information of a target cryptographic machine instance, and call the stateful class management interface using the information of the target cryptographic machine instance; after the stateful class management interface determines the target hardware cryptographic machine where the target cryptographic machine instance is located according to the information of the target cryptographic machine instance, call the cryptographic machine interface of the target hardware cryptographic machine; Obtaining the device key ciphertext and domain key ciphertext obtained and returned from the target hardware ciphertext machine instance after the ciphertext machine interface is called; and / or, The step of synchronizing the device key ciphertext and the domain key ciphertext to the other cryptographic machine instances includes: Obtain information of the other cryptographic machine instance, and call the stateful class management interface using the information of the other cryptographic machine instance; after the stateful class management interface determines the other hardware cryptographic machine where the other cryptographic machine instance is located according to the information of the other cryptographic machine instance, call the cryptographic machine interface of the other hardware cryptographic machine to synchronize the device key ciphertext and domain key ciphertext of the other hardware cryptographic machine to the other cryptographic machine instance; and / or, The requesting any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request includes: The cryptographic machine interface of any hardware cryptographic machine in the cryptographic machine cluster is called through the stateless class management interface, so that the called hardware cryptographic machine schedules any cryptographic machine instance to process the cryptographic operation request.

9. A cryptographic service management system, the cryptographic service management system is used to manage a cryptographic machine cluster, the cryptographic machine cluster includes at least one hardware cryptographic machine, the hardware cryptographic machine is used to run at least one cryptographic machine instance, the hardware cryptographic machine provides a cryptographic machine interface for the management system to call, the cryptographic machine interfaces of different hardware cryptographic machines support the same interface standard; each cryptographic machine instance has the same domain key; The cryptographic service management system includes at least one service node, the service node is configured with at least one service interface, the service interface supports the interface standard, and the service node calls the cryptographic machine interface through the service interface to communicate with the cryptographic machine instance in the hardware cryptographic machine; in, The service interface is used to: after receiving a cryptographic operation request from an initiator, request any cryptographic machine instance in the cryptographic machine cluster to process the cryptographic operation request; wherein the cryptographic machine instance is used to process the cryptographic operation request using a domain key held by itself.

10. A device for processing key data, the device being applied to a server, the server being used to manage a cryptographic machine cluster, the cryptographic machine cluster comprising at least one hardware cryptographic machine, the hardware cryptographic machine being used to run at least one cryptographic machine instance; Each of the hardware cryptographic machines is configured with an initial key that complies with a preset key rule for the running cryptographic machine instance; the device comprises: an acquisition module, configured to: after determining a target cryptographic machine instance in the cryptographic machine cluster, acquire a device key ciphertext and a domain key ciphertext provided by the target cryptographic machine instance, wherein the device key ciphertext is encrypted by using the initialization key after the target cryptographic machine instance creates a device key, and the domain key ciphertext is encrypted by using the device key after the target cryptographic machine instance creates a domain key; A synchronization module is used to synchronize the device key ciphertext and domain key ciphertext to other cryptographic machine instances; wherein the The other cryptographic machine instance is used to decrypt the synchronized device key ciphertext using the initial key held by itself to obtain the device key, and then use the decrypted device key to decrypt the synchronized domain key ciphertext to obtain the domain key; The request operation module is used to: in response to receiving a cryptographic operation request from an initiator, send the cryptographic operation request to any cryptographic machine instance in the cryptographic machine cluster, and the cryptographic machine instance that receives the cryptographic operation request processes the cryptographic operation request using the domain key it holds.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1 to 8 when executed by a processor.

13. A computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

Images