CN114282244A - Multi-cloud key management and BYOK-based data security management methods - Google Patents

Abstract

The invention discloses a multi-cloud key management and BYOK-based data security management method, which can practically protect the security of encrypted data of an enterprise. The method comprises the following steps: acquiring SK and AK by using KMS provided by a plurality of cloud service manufacturers; acquiring a BYOK with a key; the encryption key EK corresponding to each cloud service manufacturer KMS is generated by calling the pre-compiled encryption and decryption API corresponding to each cloud service manufacturer KMS and combining BYOK; storing the SK, AK, and EK in a configuration file; and calling the API of the KMS to acquire the BYOK with the key during the starting process of the software or the program. The invention realizes that an organization is allowed to keep complete control over data and encryption keys while using key management services of different cloud service manufacturers, so that the organization can use own keys to encrypt the data in the cloud service, and meanwhile, the local encryption service of a cloud provider is still continuously utilized to ensure the data security.

Description

Multi-cloud key management and BYOK-based data security management methods

technical field

The present application relates to the technical field of cloud data security management, and in particular to a data security management method utilizing a cloud vendor KMS key management service.

Background technique

With the promulgation of the National Data Security Law and the Personal Information Protection Law (Draft), together with the Cybersecurity Law, the information security of domestic enterprises and individuals will be further protected. At the same time, the products of Internet companies will usher in new security challenge.

When enterprises protect data security, they need to encrypt sensitive data. But businesses are dealing with data keys used to encrypt data. Usually, most companies or service providers store it in a configuration file or persist it in a database. When the software or application needs to perform encryption and decryption, it is used after being read from the configuration file or database. However, the data key is directly stored in the configuration file or in the database, so when others obtain the source code of the product or directly drag the library through loopholes or program backdoors, it is easy to cause the data key to be leaked, and the attacker can directly encrypt the encrypted data. Decryption is very insecure, cannot protect encrypted data, and cannot meet compliance and reporting requirements.

Some companies will also directly use the KMS key management service provided by cloud vendors, and directly entrust the key to a third party. When the software or application needs to use the key, encryption and decryption are performed by directly calling the API of the KMS service. . Although this can meet the compliance and reporting requirements, but the key is escrowed to a third party, then when the third party leaks information, the data key is leaked, and the sensitive data we encrypt is leaked, and it cannot be satisfied. Some customers want to encrypt data with their own key.

SUMMARY OF THE INVENTION

Based on this, in view of the above technical problems, a multi-cloud key management and BYOK-based data security management method is provided to effectively protect the encrypted data security of enterprises.

First, multi-cloud key management and BYOK-based data security management methods, including:

(1) Use KMS provided by multiple cloud service providers to obtain SK and AK;

(2) Obtain the own key BYOK;

(3) by calling the pre-written encryption and decryption API corresponding to each cloud service vendor KMS, in combination with the self-owned key BYOK, generate an encryption key EK corresponding to each cloud service vendor KMS;

(4) the SK, AK and EK are stored in the configuration file;

(5) According to the classification and grading of the data in the system, determine the data type that needs to be encrypted and stored;

(6) in the software or program startup process, call the API of KMS to obtain the self-contained key BYOK; for the plaintext data that needs to be encrypted and stored in the memory cache, use BYOK encryption to store in the database; for the ciphertext stored in the database Data, decrypted to memory using BYOK.

Optionally, the encryption and decryption process in step (6), specifically by introducing a pre-written Starter, realizes automatic encryption and decryption based on annotations and the typeHandler of Mybatis.

Further, the pre-written Starter specifically includes:

c) Write a mybatis interceptor to intercept objects containing @DataSecurity annotated attributes for encryption;

d) Write the typeHandler type processor of mybatis to intercept objects containing encrypted text prefixes and suffixes for decryption.

Optionally, the multiple cloud service providers include HUAWEI CLOUD and AWS.

Further, write the encryption and decryption API of HUAWEI CLOUD's KMS, including:

Use the getToken method to obtain the authorization of HUAWEI CLOUD through the AK, SK and keyId information;

Use the encryptKms method to call the encryption API of HUAWEI CLOUD's key management service;

Use the decryptKms method to call the decryption API of HUAWEI CLOUD's key management service.

Further, write the encryption and decryption API of ASW's KMS, including:

Use the getAuthorize method to obtain AWS authorization through AK, SK, and keyId information;

Use the encrypt method to call the encryption API of AWS's key management service;

Use the decrypt method to call the decryption API of AWS's key management service.

Optionally, in step (5), it is determined that the data types to be encrypted and stored are C3 and C4 level data; wherein, C3 is user secret data, and C4 is user secret data.

In a second aspect, a computer device includes a memory and a processor, wherein the memory stores a computer program, and is special in that the processor implements the above-mentioned multi-cloud key management and BYOK-based data when the processor executes the computer program The steps of the security management method.

A third aspect is a computer-readable storage medium on which a computer program is stored, the special feature of which is that when the computer program is executed by a processor, the steps of the above-mentioned multi-cloud key management and BYOK-based data security management method are implemented .

The present invention has at least the following beneficial effects:

The present invention uses BYOK (bring your own key), which can help enterprises to more comprehensively solve compliance and reporting requirements, and at the same time, combined with KMS (key management services) provided by different cloud service vendors, realizes the use of different cloud service vendors. Key management service while allowing organizations (enterprise users) to retain full control over data and encryption keys, enabling organizations to encrypt data in cloud services with their own keys, while still continuing to leverage the cloud provider's native encryption services to ensure the security of its data.

Enterprise users can ensure that the encryption key is generated with a sufficient source of entropy, and the key can be protected from being leaked, and the encrypted data of the enterprise can be protected.

Description of drawings

1 is a schematic diagram of the operation flow of a multi-cloud key management and a BYOK-based data security management method provided by an embodiment of the present invention;

2 is a schematic diagram of the principle (key acquisition and use process) of implementing multi-cloud key management and a BYOK-based data security management method according to an embodiment of the present invention;

FIG. 3 is an example of a KMS management console interface provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

The purpose of the embodiments of the present invention is to ensure that sufficient entropy sources are used to generate data keys for organizations (especially enterprise users) when using keys to encrypt sensitive data, so as to protect data keys more securely and prevent encryption It can also meet compliance and reporting requirements, and can meet the needs of customers who want to use their own data keys.

In one embodiment, as shown in FIG. 1 , a method for multi-cloud key management and BYOK-based data security management, applied to an enterprise user terminal, includes the following steps:

S1: Use KMS provided by multiple cloud service providers to obtain SK and AK;

S2: Get the own key BYOK;

S3: generate an encryption key EK corresponding to each cloud service provider KMS by calling the pre-written encryption/decryption API corresponding to each cloud service provider KMS, combined with the self-owned key BYOK;

S4: store the SK, AK and EK in the configuration file;

S5: Determine the type of data that needs to be encrypted and stored according to the classification and grading of the data in the system;

S6: During the software or program startup process, call the API of KMS to obtain the self-owned key BYOK; for the plaintext data that needs to be encrypted and stored in the memory cache, use BYOK encryption to store it in the database; for the ciphertext data stored in the database , decrypted to memory using BYOK.

In one embodiment, as shown in Figure 2, implementing the data security management method specifically includes the following links:

1) Create a new master key in KMS, and obtain SK (Secret Access Key) and AK (Access Key Id);

a) Log in to the KMS service console provided by cloud service providers such as HUAWEI CLOUD and AWS; Figure 3 is an example of the KMS management console interface;

b) create a key;

c) Save AK, SK, keyId and other information;

2) Write the encryption and decryption API of KMS of different cloud service vendors, the present invention mainly connects HUAWEI CLOUD and AWS

a) Write ASW's KMS encryption and decryption tool class;

Use the getAuthorize method to obtain the authorization of AWS through AK, SK, keyId and other information, use the encrypt method to call the encryption API of the AWS key management service, and use the decrypt method to call the decryption API of the AWS key management service.

b) Write HUAWEI CLOUD KMS encryption and decryption tool classes;

Use the getToken method to obtain the authorization of HUAWEI CLOUD through AK, SK, keyId and other information, use the encryptKms method to call the encryption API of HUAWEI CLOUD's key management service, and use the decryptKms method to call the decryption API of HUAWEI CLOUD's key management service.

3) Use a cipher machine or other key generation device to generate a data key (BYOK);

4) Use encryption and decryption API to obtain EK

a) Call the API provided by the KMS service of HUAWEI CLOUD, and use the encryptKms method plus the key (BYOK) obtained in step 3) to generate the EK of HUAWEI CLOUD; for example:

i. Introduce SDK dependencies provided by HUAWEI CLOUD vendors into the project;

ii. Write a program to call the encryption API in the SDK;

iii. Run the program, use the encryptKms method plus the data key (BYOK) obtained in step 3) to generate the EK of HUAWEI CLOUD;

b) Call the API provided by the KMS service of ASW, and use the encrypt method plus the key obtained in step 3) to generate the EK of AWS; for example:

i. Introduce SDK dependencies provided by HUAWEI CLOUD vendors into the project;

ii. Write a program to call the encryption API in the SDK;

iii. Run the program, use the encryptKms method plus the data key (BYOK) obtained in step 3) to generate the EK of HUAWEI CLOUD;

5) configure the information such as SK, AK, EK obtained in the above steps 1), 3) in the CM;

6) Write Starter to realize automatic encryption and decryption based on annotations and typeHandler of Mybatis;

a) Write a mybatis interceptor to intercept objects containing @DataSecurity annotated attributes for encryption;

b) Write the typeHandler type processor of mybatis to intercept objects containing encrypted text prefixes and suffixes for decryption;

7) Classify and grade the data in the system, and encrypt and store C3 and C4 level data

a) Customer Confidential C3

Example: employee information in the organizational structure;

b) Customer Secret C4

Example: ID card, etc.;

8) Starter is introduced into business services to realize encryption protection of sensitive data

a) The maven dependency of srm-starter-security is introduced into the pom file of each service and placed at the top;

b) Modify the data type of the database field that needs to be encrypted to VARCHAR, and expand varchar (32+character length*8);

c) Add the @DataSecurity annotation to the entity class for the fields that need to be encrypted;

d) Fuzzy search is not supported after field encryption;

e) After the field is encrypted, if you want to use it as a query condition, you need to call the following method to manually encrypt it and then transfer it to the database for query DataSecurityInterceptor.encrypt("xxx");

f) After the field is encrypted, it is not supported to use database functions for processing. For example, after the amount is encrypted, the FORMAT() function cannot be used for precision processing.

In the embodiment of the present invention, while using BYOK (bring your own key), the KMS key management service provided by different cloud service vendors is used in combination, and the EK (encryption key) generated by BYOK combined with KMS is stored in the configuration file, Then, when the software or program is started, the API of KMS is called to obtain the data key (BYOK), which is stored in the memory, so that the data key does not fall to the disk, and the security of encrypted sensitive data is further guaranteed.

The embodiments of the present invention allow organizations to retain complete control over data and encryption keys while using key management services (KMS) of different cloud service vendors, so that organizations can use their own keys to encrypt data in cloud services, While still continuing to leverage the cloud provider's native encryption services to keep its data safe. BYOK helps businesses address compliance and reporting requirements more holistically. Moreover, enterprise users can ensure that the encryption key is generated with a sufficient source of entropy, and the key can be protected from being leaked, and the encrypted data of the enterprise can be protected.

In one embodiment, a computer device is also provided, and the computer device may be an enterprise user terminal. The computer device includes a memory and a processor, and a computer program is stored in the memory, which involves all or part of the processes in the methods of the above embodiments.

In one embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, involving all or part of the processes in the methods of the above-mentioned embodiments.

The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, all It is considered to be the range described in this specification.

The above-mentioned embodiments only represent several embodiments of the present application, and the descriptions thereof are relatively specific and detailed, but should not be construed as a limitation on the scope of the invention patent. It should be noted that, for those skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the scope of protection of the patent of the present application shall be subject to the appended claims.

Claims (9)

1. Multi-cloud key management and BYOK-based data security management method, characterized in that, comprising: (1) Use KMS provided by multiple cloud service providers to obtain SK and AK; (2) Obtain the own key BYOK; (3) by calling the pre-written encryption and decryption API corresponding to each cloud service vendor KMS, in combination with the self-owned key BYOK, generate an encryption key EK corresponding to each cloud service vendor KMS; (4) the SK, AK and EK are stored in the configuration file; (5) According to the classification and grading of the data in the system, determine the data type that needs to be encrypted and stored; (6) in the software or program startup process, call the API of KMS to obtain the self-contained key BYOK; for the plaintext data that needs to be encrypted and stored in the memory cache, use BYOK encryption to store in the database; for the ciphertext stored in the database Data, decrypted to memory using BYOK. 2. multi-cloud key management according to claim 1 and the data security management method based on BYOK, it is characterized in that, encryption, decryption process in step (6), specifically by introducing the Starter written in advance, realize based on annotation and Mybatis Automatic encryption and decryption of typeHandler. 3. multi-cloud key management according to claim 2 and data security management method based on BYOK, it is characterised in that described pre-written Starter, specifically includes: a) Write a mybatis interceptor to intercept objects containing @DataSecurity annotated attributes for encryption; b) Write the typeHandler type processor of mybatis to intercept objects containing encrypted text prefixes and suffixes for decryption. 4. The method for multi-cloud key management and BYOK-based data security management according to claim 1, wherein the multiple cloud service providers include HUAWEI CLOUD and AWS. 5. multi-cloud key management according to claim 4 and the data security management method based on BYOK, it is characterized in that, write the encryption and decryption API of the KMS of HUAWEI CLOUD, comprising: Use the getToken method to obtain the authorization of HUAWEI CLOUD through the AK, SK and keyId information; Use the encryptKms method to call the encryption API of HUAWEI CLOUD's key management service; Use the decryptKms method to call the decryption API of HUAWEI CLOUD's key management service. 6. multi-cloud key management according to claim 4 and the data security management method based on BYOK, it is characterised in that writing the encryption and decryption API of the KMS of ASW, comprising: Use the getAuthorize method to obtain AWS authorization through AK, SK, and keyId information; Use the encrypt method to call the encryption API of AWS's key management service; Use the decrypt method to call the decryption API of AWS's key management service. 7. multi-cloud key management according to claim 1 and the data security management method based on BYOK, it is characterised in that in step (5), it is determined that the data type that needs to be encrypted and stored is C3, C4 level data; Wherein, C3 is User secret data, C4 is user secret data. 8. A computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein the processor implements the multi-cloud key of any one of claims 1 to 7 when the processor executes the computer program Governance and steps of a BYOK-based approach to data security management. 9. A computer-readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by the processor, the multi-cloud key management and BYOK-based key management of any one of claims 1 to 7 are realized. Steps of a data security management approach.

Images