WO2023124530A1 - 一种数据加密系统及相关产品 - Google Patents

一种数据加密系统及相关产品 Download PDF

Info

Publication number
WO2023124530A1
WO2023124530A1 PCT/CN2022/129790 CN2022129790W WO2023124530A1 WO 2023124530 A1 WO2023124530 A1 WO 2023124530A1 CN 2022129790 W CN2022129790 W CN 2022129790W WO 2023124530 A1 WO2023124530 A1 WO 2023124530A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
encryption
data
ciphertext
node
Prior art date
Application number
PCT/CN2022/129790
Other languages
English (en)
French (fr)
Inventor
赵海飞
郜忠华
李俊
Original Assignee
华为云计算技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为云计算技术有限公司 filed Critical 华为云计算技术有限公司
Publication of WO2023124530A1 publication Critical patent/WO2023124530A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present application relate to the field of data security, and in particular, to a data encryption system and related products.
  • a data encryption method mainly include: a data encryption method.
  • the key distribution system including a key management service (key management service, KMS)
  • KMS key management service
  • an encrypted channel such as a Kafka channel.
  • the device encrypts the data to be transmitted using the key mentioned above, and then transmits the encrypted transmission.
  • this method has the following problems: the key transmitted through the encrypted channel is not encrypted, once the channel is attacked, it is easy to cause the key to be leaked, so that the security of the data to be transmitted cannot be guaranteed.
  • Embodiments of the present application provide a data encryption system and related products, which can improve the security of data to be transmitted.
  • an embodiment of the present application provides an encryption node, where the node includes an encryption chip and a communication interface.
  • the encryption chip is used to create a key pair, wherein the key pair includes a first encryption key and a first decryption key.
  • the communication interface is used to send the first encryption key, receive ciphertext obtained by encrypting the data key based on the first encryption key, and push the ciphertext to the encryption chip.
  • the encryption chip is further configured to use the first decryption key to decrypt the above-mentioned ciphertext to obtain the above-mentioned data key.
  • the key pairs created by different nodes are different, that is, the ciphertext obtained by encrypting the data key with the first encryption key created by the local chip can only be created by the local chip
  • the obtained first decryption key is used for decryption, thereby improving the security of the data key.
  • the encryption chip is further configured to use a data key to encrypt data to be transmitted.
  • the above-mentioned communication interface is also used to send the above-mentioned encrypted data. It should be understood that before the data is transmitted, the encryption node encrypts the data to be transmitted, and then transmits the encrypted data to other nodes. This implementation method can improve the security of the data to be transmitted.
  • the data key is stored in a secure storage area inside the encryption chip. Wherein, this area does not provide an access interface for components outside the chip, that is, it does not support external components to access this area. In this way, the security of the data key can be improved, and the security of the data to be transmitted can be further improved.
  • the key pair is stored in the secure storage area.
  • the components outside the encryption chip will not be able to obtain the first decryption key. Even if the components outside the encryption chip obtain the above-mentioned ciphertext, they will not be able to decrypt the ciphertext to obtain the data key, thereby improving the security of the data key. Further improve the security of the data to be transmitted.
  • the embodiment of the present application provides a device for creating a key
  • the device includes a communication interface and a processor.
  • the communication interface is used for receiving the first encryption key, wherein the first encryption key is created by the encryption node.
  • the processor is configured to create a data key required by the encryption node, and use the first encryption key to encrypt the data key to obtain ciphertext.
  • the communication interface is also used to send the above-mentioned ciphertext. It should be understood that after the above-mentioned key creation device creates the data key, it encrypts the data key by using the first encryption key created by the encryption node, and then sends the encrypted data key to the encryption node. This operation can Improve the security of data keys.
  • an embodiment of the present application provides a data encryption system, the system includes a key creation device, and an encryption node as described in the first aspect and any possible implementation manner of the first aspect.
  • the aforementioned encryption node is used to create a key pair, wherein the key pair includes a first encryption key and a first decryption key.
  • the key creation device is used to create a data key, and use the first encryption key to encrypt the data key to obtain the first ciphertext.
  • the encryption node is further configured to obtain the first ciphertext, use the first decryption key to decrypt the first ciphertext to obtain the data key, and use the data key to encrypt data to be transmitted. It should be understood that the security of the data key can be improved through the above data encryption system, and the security of the data to be transmitted can be improved by using a secure data key to encrypt the data to be transmitted.
  • the above system further includes a control device.
  • the key creation device is further configured to use the second encryption key to encrypt the data key to obtain a second ciphertext, and send the second ciphertext to the control device.
  • the control device is used for receiving the second ciphertext, and sending a notification message to the encryption node.
  • the encryption node is configured to respond to the notification message and return the first encryption key to the control device.
  • control device since the control device does not obtain the second decryption key corresponding to the second encryption key, after the control device obtains the second ciphertext, it cannot obtain the data key by decrypting the second ciphertext, that is, The security of the data key can also be guaranteed through the above implementation manner.
  • control device is further configured to send a re-encryption request to the key creation device, where the re-encryption request is used to instruct the key creation device to encrypt the data using the first encryption key. key to encrypt.
  • the re-encryption request includes the first encryption key, an identifier of the second encryption key, and the second ciphertext.
  • the above-mentioned key creation device is used to determine the second decryption key corresponding to the second encryption key according to the identification of the second encryption key, use the second decryption key to decrypt the second ciphertext to obtain the above-mentioned data key, and then , use the first encryption key to encrypt the data key to obtain the first ciphertext. It should be understood that, through the above implementation manner, the local storage resources of the key creation device can be saved, and the security of the data key can also be improved.
  • the encryption node includes a computing node in a virtual private cloud (virtual private cloud, VPC).
  • VPC virtual private cloud
  • the embodiment of the present application provides a data encryption method, which can be applied to a data encryption system.
  • the system includes a key creation device and an encryption node.
  • the above method includes: the encryption node creates a key through an internal encryption chip pair, wherein the key pair includes a first encryption key and a first decryption key.
  • the key creation device creates a data key, and uses the first encryption key to encrypt the data key to obtain a first ciphertext.
  • the encryption node obtains the first ciphertext, and uses the first decryption key to decrypt the first ciphertext through the internal encryption chip to obtain the above-mentioned data key, and then uses the above-mentioned data key to encrypt the data to be transmitted through the encryption chip .
  • the data key is stored in a secure storage area inside the encryption chip. This area does not provide an access interface for components outside the chip, that is, it does not support external components to access this area.
  • the key pair is stored in the secure storage area.
  • the above data encryption system further includes a control device, and before the key creation device uses the first encryption key to encrypt the data key to obtain the first ciphertext, the above method further includes : The key creation device uses the second encryption key to encrypt the data key to obtain the second ciphertext, and sends the second ciphertext to the control device; the control device receives the second ciphertext, and sends a notification message to the encryption node; encryption The node responds to the notification message and returns the first encryption key to the control device.
  • the above method further includes: the control device sends a re-encryption request to the key creation device; and the key creation device obtains the first encryption key and the data key according to the re-encryption request.
  • the re-encryption request includes the first encryption key, the identifier of the second encryption key, and the second ciphertext
  • the key creation device obtains the first encryption key according to the re-encryption request.
  • the key and the data key comprising: the key creation device determines the second decryption key corresponding to the second encryption key according to the identification of the second encryption key, and then uses the second decryption key to decrypt the second ciphertext Get the data key.
  • the encryption node includes a computing node in the VPC.
  • the embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored in the computer-readable storage medium, and the computer instructions run on the data encryption system, so as to realize the aforementioned fourth aspect and the fourth aspect Part or all of the methods described in any possible implementation.
  • FIG. 1 is a schematic diagram of a key distribution method provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a key distribution scenario provided by an embodiment of the present application.
  • Fig. 3 is a schematic structural diagram of a data encryption system provided by an embodiment of the present application.
  • FIG. 4 is a schematic flow diagram of a data encryption method provided by an embodiment of the present application.
  • Fig. 5 is a schematic flow chart of another data encryption method provided by the embodiment of the present application.
  • FIG. 6 is a schematic diagram of an application scenario of a data encryption system provided by an embodiment of the present application.
  • Fig. 7 is a schematic diagram of a specific example provided by the embodiment of the present application.
  • Fig. 8 is a schematic diagram of a user interface provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another data encryption system provided by an embodiment of the present application.
  • Data encryption is a way to improve data security. Its basic process is to process plaintext (that is, unencrypted data) according to a certain encryption algorithm, making it an unreadable code, that is, ciphertext.
  • An encryption key is required in the process of encrypting plaintext, and the encryption key is a parameter that is input in an encryption algorithm that converts plaintext into ciphertext.
  • the basic process is to process the ciphertext according to a certain decryption algorithm to restore it to plaintext.
  • a decryption key corresponding to the above-mentioned encryption key is needed in the process of decrypting the ciphertext, and the above-mentioned decryption key is also a parameter that is input in the decryption algorithm that converts the ciphertext into plaintext.
  • the data sending end first encrypts the data to be transmitted by means of data encryption, and then transmits it to the data receiving end. This operation can improve the security of the data to be transmitted; After receiving the encrypted data, the receiving end can obtain corresponding data by decrypting the encrypted data. That is to say, the above process can realize secure communication between the data sending end and the data receiving end.
  • symmetric encryption means that the two parties in the communication use the same key and the same algorithm to encrypt and decrypt data, specifically: the data sender uses a symmetric encryption algorithm (such as the advanced encryption standard (AES) algorithm) and encryption The key is used to encrypt the data to be transmitted to obtain the ciphertext. After the data sending end sends the ciphertext to the data receiving end, the data receiving end can use the above algorithm and the above key to decrypt the ciphertext to obtain the above data.
  • Asymmetric encryption means that the communication parties use different keys (key pairs, including public and private keys) to encrypt and decrypt data.
  • the data sender uses an asymmetric encryption algorithm (such as RSA algorithm) and encryption One key in the key pair encrypts the data to obtain the ciphertext.
  • the data sending end sends the ciphertext to the data receiving end
  • the data receiving end uses the above algorithm and the other key in the key pair to decrypt the ciphertext. Get the above data.
  • the key used to encrypt the data may be any key in the key pair.
  • the public key may be used to encrypt the data
  • the private key may be used to decrypt the ciphertext.
  • the data sending end needs to use a key to encrypt the data
  • the data receiving end also needs to use a key to decrypt the encrypted ciphertext. So, how can the data sender and data receiver obtain the required key?
  • one implementation method is: the data sending end and the data receiving end negotiate with each other to determine the key A required by the data sending end to encrypt the data, and the key A required by the data receiving end to decrypt the encrypted data.
  • key B Another implementation is: as shown in Figure 1, the key distribution system includes a device capable of creating a key (such as KMS), so as to create the key A required by the data sending end and the key A required by the data receiving end.
  • Key B wherein, key A and key B may be the same or different.
  • the key distribution system distributes the key A and the key B to the data sending end and the data receiving end respectively.
  • the data sending end can use the key A to encrypt the data to be transmitted
  • the data receiving end can also use the key B to decrypt the above-mentioned encrypted data, so as to obtain the corresponding data.
  • the technical solution provided by the embodiment of this application is applicable to the encrypted communication scenario between devices, that is, before the device M transmits data to the device N, it first encrypts the data to be transmitted using an encryption key, and then transmits the encrypted data to the device N. After receiving the encrypted data, the device N uses the corresponding decryption key to decrypt it to obtain the data.
  • the above encryption key and its corresponding decryption key are issued by the key distribution system to the device M and For device N, refer to the key distribution method described in FIG. 1 for details.
  • the technical solution provided by the embodiment of the present application is especially suitable for encrypted communication scenarios between a large number of devices, for example, encrypted communication between different nodes in a VPC, or encrypted communication between nodes in different VPCs communication.
  • a device may communicate with many devices.
  • the key distribution method described in Figure 1 can greatly reduce the number of devices obtaining keys. The difficulty of the key.
  • the following uses the encrypted communication between nodes in the VPC as an example to further illustrate the applicable scenarios of this embodiment of the present application.
  • VPC is an isolated and private virtual network environment applied by users on the cloud.
  • resources including computing resources, storage resources and network resources
  • nodes including computing nodes, Storage nodes and network nodes
  • these nodes cooperate and communicate with each other to provide cloud services to users.
  • encrypted communication is required between nodes in the VPC, that is, each node needs a key.
  • K nodes ie, node 1, node 2, ..., node K
  • K is an integer greater than 0. Taking node 1 as an example, node 1 communicates with node 2, node 3, ..., node K respectively.
  • node 1 needs to negotiate the key with K-1 nodes respectively.
  • K the load on node 1 is larger, which may affect the quality of cloud services.
  • the key distribution method described in Figure 1 that is, the key distribution system creates the keys required by each node and distributes these keys to corresponding nodes, so that each node can obtain all The required key can also reduce resource consumption. Therefore, compared with the method of obtaining keys through pairwise negotiation between nodes, the key distribution method described in Figure 1 is more suitable for encrypted communication scenarios between a large number of nodes.
  • FIG. 3 exemplarily shows a schematic structural diagram of a data encryption system provided by an embodiment of the present application.
  • a data encryption system 100 includes a key creation device 110 and a plurality of nodes 120.
  • a control device 130 is also included. Each part of the data encryption system 100 is briefly described below.
  • Key creation device 110 a device with key creation function and encryption function, which can support encryption according to a specified key and encryption algorithm, such as KMS.
  • the key creation device 110 is used to create a data key (datakey), wherein the data key includes two types, one is used to encrypt data (hereinafter referred to as the data encryption key), and the other It is used to decrypt the encrypted data (hereinafter referred to as the data decryption key).
  • Node 120 a node that has resources (one or more of computing resources, network resources, and storage resources) and can perform encrypted communication with other nodes or devices, specifically including servers, virtual machines (virtual machines, VMs) , container (container), network card and storage, etc.
  • the node 120 includes an encryption chip 121, and the encryption chip 121 is used to create a key pair, where the key pair includes a first encryption key and a first decryption key.
  • the key creation device 110 is further configured to obtain a first encryption key, and use the first encryption key to encrypt the data key to obtain ciphertext.
  • the node 120 is also configured to obtain the above-mentioned ciphertext, and use the first decryption key to decrypt the ciphertext through the internal encryption chip 121 to obtain a data key. It should be understood that since the data key is transmitted from the key creation device 110 to the node 120 after being encrypted, the data encryption system 100 can improve the security of the data key.
  • the encryption chip 121 has the function of protecting the security of the key.
  • the encryption chip 121 is provided with a secure storage area, which does not provide an access interface for components outside the chip, that is, does not support external components to access this area.
  • the encryption chip 121 is also used to store the data key in the secure storage area. In this way, components outside the encryption chip 121 will not be able to obtain the data key, thereby improving the security of the data key.
  • the encryption chip 121 is also used to store the locally created key pair in the secure storage area, so that components outside the encryption chip 121 will not be able to obtain the first decryption key, even if the components outside the encryption chip 121 obtain the above-mentioned The ciphertext cannot be decrypted to obtain the data key, thereby further improving the security of the data key.
  • the node 120 when the node 120 is used as the data sender, the node 120 is also used to encrypt the data to be transmitted using the data key (specifically the data encryption key) through the encryption chip 121, and send the encrypted data to other node.
  • the node 120 is also used to decrypt the received ciphertext by using the data key (specifically a data decryption key) through the encryption chip 121 to obtain corresponding data.
  • the above data encryption and ciphertext decryption processes are implemented by the encryption chip 121, it means that the data key is always located in the encryption chip 121, so that the data key can be guaranteed not to be leaked, thereby improving the security of the data key.
  • the number of nodes 120 may be many, for example, when the data encryption system 100 is applied to the scenario described in FIG.
  • the key creation device 110 can have high performance and can handle a large number of accesses concurrently, wherein the accesses here include the access to create the data key and the first encrypted key created by the node 120
  • the key encrypts the access to the data key; or, the key creation device 110 can also support a queuing mechanism, so that when the key creation device 110 receives a large number of accesses, it can respond based on the queuing mechanism, thereby avoiding the failure of the node 120
  • the key creation device 110 fails due to an excessive number, or some nodes 120 cannot obtain the required data key.
  • the data encryption system 100 may further include a control device 130, and the control device 130 is used to be responsible for the processing of the control plane logic in the data encryption system 100, for example, the control device 130 may include a software defined network (software defined network, SDN ) controller.
  • SDN software defined network
  • control device 130 is configured to send a key creation request to the key creation device 110, so that the key creation device 110 creates a data key. After the data key is created, the control device 130 is further configured to send a notification message to the node 120, so that the node 120 returns the created first encryption key to the device 130.
  • control device 130 is further configured to send a re-encryption request to the key creation device 110, so as to forward the first encryption key created by the node 120 to the key creation device 110, and make the key creation device 110 use the first
  • the encryption key encrypts the data key to obtain the above ciphertext.
  • the control device 130 is also configured to forward the above-mentioned ciphertext to the node 120, so that the node 120 can obtain the required data key.
  • the control device 130 supports a queuing mechanism. Then, when the number+quantity of nodes 120 is large, the existence of the control device 130 can also avoid failure of the key creation device 110 caused by too many nodes 120, or partial The situation where the node 120 cannot obtain the required data key.
  • the specific reason is as follows: when a large number of nodes 120 request data keys at the same time, the control device 130 can send the key creation request and re-encryption request to the key creation device 110 based on the queuing mechanism, so that the key creation device 110 needs to concurrently
  • the number of accesses processed is always within the range of the maximum number of accesses that the apparatus 110 can process concurrently.
  • the above-mentioned data encryption system 100 will be further introduced below in conjunction with the data encryption method described in FIG. 4 and FIG. 5 . It should be noted that, in order to introduce the above-mentioned data encryption system 100 more clearly, the encrypted communication process between the first node and the second node among the multiple nodes 120 will be described here as an example, that is, the first node is described How to obtain the required data key with the second node, and the process of encrypted communication based on the obtained data key.
  • FIG. 4 shows a schematic flowchart of a data encryption method provided by an embodiment of the present application.
  • the key creation device 110 creates a first data key.
  • the first data key is the data key required by the first node, which is used to encrypt the data to be transmitted, and the "first” here is used for the data key required by the second node (that is, the second data key) to distinguish.
  • the key creation means 110 creates the first data key in response to the data encryption command.
  • the data encryption command is a command indicating that encrypted communication is enabled between the first node and the second node, and is used to instruct the key creation device 110 to create a first data key for the first node and a second data key for the second node. key.
  • the first data key and the second data key may be the same key or different keys
  • the first data key is a data encryption key
  • the second data key is a data decryption key
  • the key namely the second data key, is used to decrypt the data encrypted using the first data key.
  • the key creation device 110 provides an application programming interface (application programming interface, API), and the user can send a data encryption command to the key creation device 110 by calling the API; or, the data encryption system 100 provides a user interface (user interface) , UI), the user sends a data encryption command to the data encryption system 100 by operating on the UI.
  • API application programming interface
  • UI user interface
  • the key creation device 110 may create the first data key in various ways, for example, generate a random number and use the random number as the first data key, or for example, process the key specified by the user (such as adding characters to the key, changing the positions of different numbers in the key, etc.), and using the processed key as the first data key, which is not limited in this embodiment of the present application.
  • the key creation device 110 sends a notification message to the first node.
  • the above-mentioned data encryption command includes the identifier of the first node
  • the key creation device 110 may send a notification message to the first node in the following manner: obtain the identifier of the first node according to the data encryption command, and then based on the first node An identifier of a node sends the notification message to the first node.
  • the identifier of the first node may be the ID of the first node, or, when the first node is a node in the VPC, the identifier of the first node may also be the identifier of the VPC where the first node is located.
  • the above communication message is used to notify the key creation device 110 that the creation of the first data key has been completed, and instruct the first node to use the first encryption key created by the local encryption chip (hereinafter referred to as the first encryption chip)
  • the key is returned to the key creation device 110.
  • the steps may be further performed: (1) encrypting the first data key by using the second encryption key Encrypt to obtain the second ciphertext, wherein the second encryption key can be preset by the user (for example, the user master key), and in specific implementation, the second encryption key can be carried in the above-mentioned data encryption command; or, the second encryption key can be carried in the above-mentioned data encryption command;
  • the second encryption key may also be automatically created by the key creation device 110 (for example, a random number created by the key creation device 110). (2) Delete the first data key.
  • the notification message may include the identifier of the second encryption key, or include the second ciphertext and the identifier of the second encryption key.
  • the above-mentioned notification message includes the second ciphertext and the identification of the second encryption key, after the key creation device 110 sends the notification message to the first node, it can also delete the locally stored second ciphertext, thereby further saving local storage resources.
  • the key request includes the first encryption key.
  • the first node specifically, it may be the communication interface of the first node
  • requests the first encryption key from the first encryption chip and then the first encryption chip pushes the first encryption key to A processor within the first node and outside the first encryption chip.
  • the processor After receiving the first encryption key, the processor generates the key request according to the first encryption key, and sends the key request to the key creation device 110 .
  • the first encryption chip before the first encryption chip sends the first encryption key to the processor, the first encryption chip also performs the following steps: the first encryption chip creates a key pair, wherein the key pair includes the first encryption key and The first decryption key, the first encryption key corresponds to the first decryption key, that is, the first decryption key is used to decrypt the ciphertext encrypted with the first encryption key.
  • the embodiment of this application proposes that the key pairs created by the encryption chips inside different nodes are different, that is, the first encryption key created by the first encryption chip is different from the encryption of other node memories.
  • the first encryption keys created by the chips are different, and the first decryption keys created by the first encryption chip are different from the first decryption keys created by the encryption chips stored in other nodes. In this way, it can be guaranteed that the ciphertext encrypted with the first encryption key created by the node can only be decrypted by the local encryption chip, that is, using the first encryption key to encrypt the first data key can improve the encryption of the first data. key security.
  • the first encryption chip also stores the key pair in a local secure storage area, where this area is not connected to components outside the first encryption chip (such as processors inside the first node and outside the first encryption chip) Provides an access interface, that is, does not support external components to access this area.
  • components outside the first encryption chip will not be able to obtain the first decryption key, so the components outside the first encryption chip cannot decrypt the ciphertext encrypted with the first encryption key, that is, using the first Encrypting the first data key with the encryption key can improve the security of the first data key.
  • the key request when the above notification message in S102 includes the identifier of the second encryption key, the key request further includes the identifier of the second encryption key; when the above notification message includes the second ciphertext and the ID of the second encryption key When identifying, the key request also includes the second ciphertext and the identification of the second encryption key.
  • the key creation device 110 encrypts the first data key according to the key request to obtain a first ciphertext, and sends the first ciphertext to the first node.
  • the key creation device 110 encrypts the first data key according to the key request to obtain the first ciphertext, and its specific implementation methods include the following:
  • the key request includes the first encryption key
  • the key creation device 110 stores the first data key
  • the key creation device 110 encrypts the first data key according to the key request to obtain the first
  • the ciphertext includes: obtaining a first encryption key according to the key request, and then using the first encryption key to encrypt the first data key to obtain the first ciphertext.
  • the key request includes the identification of the first encryption key and the second encryption key
  • the second ciphertext is stored in the key creation device 110
  • the key creation device 110 performs the first data encryption according to the key request
  • Encrypting the key to obtain the first ciphertext includes: obtaining the first encryption key and the identification of the second encryption key according to the key request, and then determining the first encryption key corresponding to the second encryption key according to the identification of the second encryption key.
  • Two decryption keys and the second ciphertext use the second decryption key to decrypt the second ciphertext to obtain the first data key, and finally use the first encryption key to encrypt the first data key to obtain the first ciphertext .
  • the second decryption key is used to decrypt the ciphertext encrypted with the second encryption key, and, similar to the second encryption key, the second decryption key can also be preset by the user (for example, user master key), or automatically created by the key creation device 110.
  • the second encryption key and the second decryption key may be the same key or different keys.
  • the key request may include the first encryption key, the identifier of the second encryption key, and the second ciphertext.
  • the key creation device 110 encrypts the first data key according to the key request to obtain the first encryption key.
  • the text includes: obtaining the first encryption key, the identification of the second encryption key, and the second ciphertext according to the key request, and then determining the second decryption key corresponding to the second encryption key according to the identification of the second encryption key key, use the second decryption key to decrypt the second ciphertext to obtain the first data key, and finally use the first encryption key to encrypt the first data key to obtain the first ciphertext.
  • the key request may also include an encryption algorithm, for example, the RSAES_OAEP_SHA_256 algorithm, the SM2_ENCRYPT algorithm, and the like.
  • the encryption algorithm may be preset by the user.
  • the second encryption key may be carried in the above-mentioned data encryption command; or, the encryption algorithm may also be obtained from the local algorithm library by the key creation device 110 according to the actual situation. selected in . Then, the key creation device 110 may use the above encryption algorithm and the first encryption key to encrypt the first data key to obtain the first ciphertext.
  • the first node receives the first ciphertext, and uses the first decryption key to decrypt the first ciphertext to obtain a first data key.
  • the first node (specifically, the communication interface of the first node) receives the first ciphertext, it pushes the first ciphertext to the first encryption chip, and after the first encryption chip obtains the first ciphertext, it uses the first ciphertext to A decryption key decrypts the first ciphertext to obtain the first data key.
  • the first encryption chip stores the first data key in an internal secure storage area. In this way, the security of the first data key can be improved.
  • the first node encrypts the data to be transmitted by using the first data key, and transmits the encrypted data to the second node.
  • the first node when the first node wants to send data to the second node through the internal communication interface, it first pushes the data to be transmitted to the first encryption chip, and the first encryption chip uses the first data key to process the data. After encrypting, push the encrypted data to the communication interface of the first node, and then transmit the encrypted data to the second node through the interface. It should be understood that since the above data is encrypted using a secure first data key before transmission, the security of the above data can be improved.
  • the second node specifically, the communication interface of the second node
  • the second encryption chip uses the second data key to decrypt the encrypted data to obtain the above data, thereby completing the encrypted communication between the first node and the second node.
  • the second data key refers to the above S101.
  • the process for the second node to obtain the second data key is similar to the process for the first node to obtain the first data key.
  • S101-S105 For simplicity, no further description is given here.
  • FIG. 5 shows a schematic flowchart of another data encryption method provided by an embodiment of the present application.
  • the data encryption system 100 may also include a control device 130.
  • FIG. 5 describes how the first node and the second node obtain the required data key when the data encryption system 100 includes the control device 130, and based on the obtained The process of encrypting communication with a data key.
  • control device 130 In response to the data encryption command, the control device 130 sends a key creation request to the key creation device 110 .
  • the data encryption command is a command indicating that encrypted communication is enabled between the first node and the second node.
  • the data encryption command may be initiated by a user.
  • the control device 130 provides an API or UI, so that the user can send a data encryption command to the control device 130 by calling the API or operating on the UI.
  • the key creation device 110 creates a first data key according to the above key creation request, and returns a first message to the control device 130 .
  • the first message is used to notify the key creation device 110 that the creation of the first data key has been completed.
  • the following steps may be performed: use the second encryption key to encrypt the first data key to obtain a second ciphertext, wherein the second encryption key
  • the key may be preset by the user (for example, a user master key), or may be automatically created by the key creation device 110 (for example, a random number created by the key creation device 110 ).
  • the first message may include the identification of the second encryption key, then, after the key creation device 110 generates the second ciphertext, it may delete the first data key, thus saving the key creation device 110 Internal storage resources can also prevent the first data key from being leaked due to the failure of the key creation device 110 .
  • the first message may also include the second ciphertext. In this way, after the key creation device 110 sends the first message to the control device 130, it may also delete the second ciphertext. ciphertext, thereby further saving local memory resources.
  • S203 The control device 130 sends a second message to the first node.
  • the above-mentioned data encryption command includes the identifier of the first node
  • the control device 130 may send the second message to the first node in the following manner: After receiving the first message, the control device 130 obtains according to the data encryption command identification of the first node, and then sending a second message to the first node based on the identification of the first node.
  • the identifier of the first node may be the ID of the first node, or, when the first node is a node in the VPC, the identifier of the first node may also be the identifier of the VPC where the first node is located.
  • the second message is used to notify the first node that the creation of the first data key has been completed, and instruct the first node to return the first encryption key.
  • the first node After receiving the second message, the first node returns a key request to the control device 130 according to the second message.
  • the key request includes the first encryption key.
  • the specific implementation process of this step will not be described here, and details can be referred to above S103.
  • the control device 130 receives the key request, and sends a re-encryption request to the key creation device 110 .
  • the re-encryption request is used to instruct the key creation device 110 to use the first encryption key to encrypt the first data key, and the re-encryption request includes the first data key.
  • the re-encryption request in S204 includes the identification of the second encryption key
  • the re-encryption request further includes the identification of the second encryption key
  • the re-encryption request further includes the identification of the second ciphertext and the second encryption key.
  • the key creation device 110 encrypts the first data key according to the re-encryption request to obtain a first ciphertext, and sends the first ciphertext to the control device 130 .
  • the specific process of the key creation device 110 encrypting the first data key to obtain the first ciphertext according to the re-encryption request is the same as that of encrypting the first data key according to the key request to obtain the first ciphertext in S104 above.
  • the process is similar, and for the sake of brevity, the description is not repeated here.
  • the control device 130 sends the first ciphertext to the first node.
  • the first node receives the first ciphertext, and uses the first decryption key to decrypt the first ciphertext to obtain a first data key.
  • the first node encrypts the data to be transmitted by using the first data key, and transmits the encrypted data to the second node.
  • the second node specifically, the communication interface of the second node
  • receives the encrypted data sent by the first node it also performs the following steps: push the encrypted data to the internal encryption chip (hereinafter referred to as second encryption chip), and then, the second encryption chip uses the second data key to decrypt the above-mentioned encrypted data to obtain the above-mentioned data, thereby completing the encrypted communication between the first node and the second node.
  • second encryption chip hereinafter referred to as second encryption chip
  • the second data key and the first data key may be the same key or different keys
  • the first data key is a data encryption key
  • the second data key is a data decryption key, That is, the second data key is used to decrypt data encrypted using the first data key.
  • the process for the second node to obtain the second data key is similar to the process for the first node to obtain the first data key. For details, refer to the above S201-S208. For simplicity, no further description is given here.
  • the data encryption method provided by the embodiment of the present application is described in detail above with reference to FIG. 4 and FIG. 5 .
  • the data encryption system 100 is described in more detail in terms of the deployment and structure of the data encryption system 100 in conjunction with FIGS. 7-9 .
  • the deployment of the data encryption system 100 provided by the embodiment of the present application is flexible. Specifically, it can be deployed in a cloud environment.
  • the cloud environment is an entity that uses basic resources to provide cloud services to users under the cloud computing mode.
  • the cloud environment includes cloud data centers and cloud services.
  • the cloud data center includes a large number of basic resources (including computing resources, storage resources and network resources) owned by the cloud service provider, and the computing resources included in the cloud data center can be a large number of computing devices (such as servers).
  • the data encryption system 100 can be independently deployed on servers or virtual machines in the cloud data center, and the data encryption system 100 can also be deployed on multiple servers in the cloud data center in a distributed manner, or distributed in the cloud data center On multiple virtual machines in the cloud, or distributedly deployed on servers and virtual machines in the cloud data center.
  • the data encryption system 100 is abstracted into a data encryption cloud service by the cloud service provider on the cloud service platform and provided to the user. Settlement based on usage), the cloud environment uses the data encryption system 100 deployed in the cloud data center to provide users with data encryption cloud services.
  • a specific example is described below:
  • the data encryption system 100 deployed in the cloud data center includes a key creation device 110, a plurality of nodes 120, and a control device 130, wherein the plurality of nodes 120 include nodes in the first VPC, and the first VPC is where user A
  • nodes in the first VPC work together to provide user A with cloud services.
  • user A has purchased a data encryption cloud service on the cloud service platform to ensure the security of communication between different nodes in the first VPC.
  • user A when using the data encryption cloud service, user A can send a data encryption command to the control device 130 through the API or UI, taking the UI shown in Figure 8 as an example, the UI displays "user information", “Key Name”, “User Master Key”, “Key Algorithm” and other options, users can optionally fill in the box after these options.
  • the user selects the identity of the VPC purchased by the user in the option box after "User Information", that is, the identity of the first VPC; fill in the data key required by the nodes in the first VPC after "Key Name” Name; fill in the user preset key (for example, composed of 6-18 digits and letters) in the box after "User Master Key", which is used to encrypt the above data key; Fill in the user-preset encryption algorithm in the box after Key Algorithm, which is used to encrypt the above data key.
  • click the “Finish” option click the “Finish” option, and the UI will generate a data encryption command based on the information filled in by the user, and send the command to the control device 130 .
  • the control device 130 sends a key creation request to the key creation device 110.
  • the key creation device 110 creates a data key, and uses the user master key to encrypt the data key to obtain a ciphertext A. Then, generate a first message according to the ciphertext A and the identification of the user master key, and return the first message to the control device 130 .
  • the control device 130 sends the second message to the nodes in the first VPC based on the identifier of the first VPC. After receiving the second message, the nodes in the first VPC return the encryption key created by the local encryption chip to the control device 130 .
  • the control device 130 After receiving the encryption key, the control device 130 sends a re-encryption request to the key creation device 110, wherein the re-encryption request includes the ciphertext A, the identifier of the user master key, and the above-mentioned encryption key.
  • the key creation device 110 After the key creation device 110 receives the re-encryption request, it first determines the user master key according to the identity of the user master key, and then uses the user master key to decrypt the ciphertext A to obtain the data key, and then uses the encryption chip to create The encryption key encrypts the data key and the encryption algorithm preset by user A to encrypt the data key to obtain ciphertext B, and returns ciphertext B to the control device 130 .
  • the control device 130 After receiving the ciphertext B, the control device 130 returns the ciphertext B to the corresponding node 120 .
  • the local encryption chip uses the created decryption key to decrypt the ciphertext B to obtain a data key, and stores the data key in a secure storage area inside the encryption chip.
  • the above-mentioned data key is stored in the nodes in the first VPC, then the nodes in the first VPC can use the above-mentioned data key to encrypt and decrypt the data when communicating with each other, so as to realize the security between nodes communication.
  • the data encryption system 100 may also be deployed in different environments in a distributed manner, for example, the key creation device 110 and the control device 130 are deployed in a cloud environment or an edge environment, and multiple nodes 120 are terminal computing devices, where , the edge environment is an environment that includes a collection of edge computing devices that are close to the terminal computing device.
  • Edge computing devices include: edge servers, edge small stations with computing power, etc.
  • Terminal computing devices can include: terminal servers, smart phones, laptops , tablet computers, personal desktop computers, smart cameras, etc.
  • the key creation device 110 and the control device are deployed in a cloud environment, and the multiple nodes 120 are computing nodes in an edge environment.
  • the key creation device 110 is deployed in a cloud environment
  • the control device is deployed in an edge environment
  • multiple nodes 120 are terminal computing devices.
  • the embodiment of the present application does not restrictively divide which parts of the data encryption system 100 are specifically deployed in which environment, and the actual application format can be based on the computing capability of the terminal computing device, the resource occupancy of the edge environment and the cloud environment, or specific applications Deploy adaptively.
  • the key creation device 110 and the control device 130 may be deployed on the same computing device, or may be respectively deployed on different computing devices. Therefore, the embodiment of the present application also provides another schematic structural diagram of the data encryption system 100 .
  • the data encryption system 100 includes a plurality of computing devices 200, and each computing device 200 includes a memory 210, a processor 220, a communication interface 230, and a bus 240, wherein the memory 210, the processor 220, and the communication interface 230 pass through The bus 240 realizes the communication connection between each other.
  • the memory 210 may be a read only memory (read only memory, ROM), a static storage device, a dynamic storage device or a random access memory (random access memory, RAM).
  • the memory 210 can store computer instructions. When the computer instructions stored in the memory 210 are executed by the processor 220 , the processor 220 and the communication interface 230 are used to execute some methods executed by the data encryption system 100 .
  • the memory 210 can also store data, for example, intermediate data or result data generated by the processor 220 during execution.
  • Processor 220 may adopt a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application specific integrated circuit (application specific integrated circuit, ASIC), a graphics processing unit (graphics processing unit, GPU) or one or more integrated circuit.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • GPU graphics processing unit
  • the processor 220 may also be an integrated circuit chip, which has a signal processing capability. During implementation, part of the functions of the data encryption system 100 can be implemented through hardware integrated logic circuits in the processor 220 or instructions in the form of software.
  • the processor 220 can also be a general-purpose processor, a data signal processor (digital signal process, DSP), a field programmable logic gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices,
  • DSP data signal processor
  • FPGA field programmable gate array
  • the discrete hardware components can realize or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc., and the steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware decoding processor to execute and complete, or use decoding processing
  • the combination of hardware and software modules in the device is completed.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory 210, and the processor 220 reads the information in the memory 210, and completes some functions of the data encryption system 100 in combination with its hardware.
  • the communication interface 230 uses a transceiver module such as but not limited to a transceiver to implement communication between the computing device 200 and other devices or communication networks. For example, a data encryption command sent by a user may be obtained through the communication interface 230, or data encrypted using a data key may be sent.
  • a transceiver module such as but not limited to a transceiver to implement communication between the computing device 200 and other devices or communication networks. For example, a data encryption command sent by a user may be obtained through the communication interface 230, or data encrypted using a data key may be sent.
  • Bus 240 may comprise a pathway for communicating information between various components in computing device 200 (eg, memory 210 , processor 220 , communication interface 230 ).
  • Any computing device may be a computing device (for example, a server) in a cloud data center, or a computing device in an edge data center, or a terminal computing device.
  • any one or more of the key creation device 110 and the control device 130 runs on some of the computing devices 200 , and the other part of the computing devices 200 is the node 120 .
  • the processor 220 in the computing device 200 further includes an encryption chip 121, and the encryption chip 121 is used to create a key pair, and use the first
  • the data key encrypts the data to be transmitted, or uses the second data key to decrypt the received encrypted data.
  • the memory 210 in the computing device 200 includes a secure storage area in the encryption chip 121. This area does not provide an access interface to components outside the chip, that is, it does not support access by external components. This area is used to store the above-mentioned first data key, key equal.
  • the computing device 200 may include an intelligent network card, and the intelligent network card is used to implement communication with other devices.
  • the encryption chip 121 is set on the smart network card, and the communication port of the smart network card is connected to the encryption chip 121 through a hardware interface.
  • the encryption chip 121 can send the created first encryption key to the computing device on which the control device 130 is deployed through this interface; the computing device on which the control device 130 is deployed can also push the first ciphertext to The encryption chip 121 enables the encryption chip 121 to use the first decryption key to decrypt the encrypted data key to obtain the data key; the smart network card can also push the data to be transmitted to the encryption chip 121 through the interface, correspondingly, The encryption chip 121 can also use the data key to encrypt the data to be transmitted, and send the encrypted data to other devices through this interface; or, the smart network card can also push the encrypted data to the encryption chip 121 through this interface , correspondingly, the encryption chip 121 uses the data key to decrypt the encrypted data to obtain the data.
  • all or part may be implemented by software, hardware or a combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product that provides the data encryption system 100 includes one or more computing instructions executed by the data encryption system 100. When these computer program instructions are loaded and executed on the computer, all or part of the process or process described in the embodiment of the present application will be generated. Function.
  • the above-mentioned computers may be general-purpose computers, special-purpose computers, computer networks, or other programmable devices.
  • the above-mentioned computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. (eg, coaxial cable, optical fiber, twisted pair, or wireless (eg, infrared, wireless, microwave), etc.) to another website site, computer, server, or data center.
  • the above-mentioned computer-readable storage medium stores computer program instructions for providing the data encryption system 100 .
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more media.
  • the above-mentioned usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, an optical disk), or a semiconductor medium (for example, a solid state disk (solid state disk, SSD)).
  • a magnetic medium for example, a floppy disk, a hard disk, or a magnetic tape
  • an optical medium for example, an optical disk
  • a semiconductor medium for example, a solid state disk (solid state disk, SSD)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供了一种数据加密系统及相关产品，能够提高待传输数据的安全性。具体地，该系统包括密钥创建装置以及加密节点。加密节点用于通过内部的加密芯片创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥。密钥创建装置用于创建数据密钥，并使用第一加密密钥对数据密钥进行加密得到第一密文。加密节点还用于获取第一密文，并通过加密芯片使用第一解密密钥对第一密文进行解密得到上述数据密钥，以及使用数据密钥对待传输的数据进行加密。利用上述系统可以提高数据密钥的安全性，也就可以提高使用该数据密钥加密后的数据的安全性。

Description

一种数据加密系统及相关产品
本申请要求于2021年12月29日提交中国专利局、申请号为202111648273.3、申请名称为“一种数据加密系统及相关产品”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及数据安全领域，尤其涉及一种数据加密系统及相关产品。
背景技术
近年来，用户对于数据安全性的要求越来越高，这就需要保证设备间的通信是安全的。对于提高设备间通信的安全性，目前采用的方式主要有：数据加密方式。具体地，密钥分发系统(包括密钥管理服务(key management service,KMS))创建设备所需的密钥，并基于加密后的通道(例如Kafka通道)将密钥推送至设备。之后，设备使用上述密钥对待传输的数据进行加密，再将加密后的传输进行传输。但是，这种方式存在以下问题：经由加密后的通道传输的密钥是未经过加密处理的，一旦该通道被攻击，就很容易导致密钥被泄漏，从而无法保证待传输数据的安全。
因此，如何提高待传输数据的安全性仍然是一个急需解决的问题。
发明内容
本申请实施例提供了一种数据加密系统及相关产品，能够提高待传输数据的安全性。
第一方面，本申请实施例提供了一种加密节点，该节点包括加密芯片和通信接口。加密芯片用于创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥。通信接口用于发送第一加密密钥，以及接收基于第一加密密钥对数据密钥进行加密得到的密文，并将该密文推送至加密芯片。加密芯片还用于使用第一解密密钥对上述密文进行解密，得到上述数据密钥。应理解，在实际应用中，不同的节点创建出的密钥对不同，也就是说，使用本地芯片创建的第一加密密钥对数据密钥进行加密得到的密文，仅能由本地芯片创建出的第一解密密钥进行解密，从而可以提高数据密钥的安全性。
在第一方面的一种可能的实现方式中，上述加密芯片还用于使用数据密钥对待传输的数据进行加密。上述通信接口还用于发送上述加密后的数据。应理解，加密节点在传输数据之前，先对待传输的数据进行加密，再将加密后的数据传输至其他的节点，通过这一实现方式可以提高待传输数据的安全性。
在第一方面的一种可能的实现方式中，上述数据密钥存储在加密芯片内部的安全存储区域中。其中，该区域不对芯片外部的部件提供访问接口，即不支持外部部件访问该区域。如此，可以提高了数据密钥的安全性，进一步提高待传输数据的安全性。
在第一方面的一种可能的实现方式中，上述密钥对存储在上述安全存储区域中。如此，加密芯片外部的部件将无法获得第一解密密钥，那么即便加密芯片外部的部件获得上述密文，也无法对密文进行解密得到数据密钥，从而提高了数据密钥的安全性，进一步提高待传输数据的安全性。
第二方面，本申请实施例提供了一种密钥创建装置，该装置包括通信接口和处理器。通信接口用于接收第一加密密钥，其中，第一加密密钥是加密节点创建的。处理器用于创建上述加密节点所需的数据密钥，并使用第一加密密钥对数据密钥进行加密得到密文。通信接口还用于发送上述密文。应理解，上述密钥创建装置创建出数据密钥后，通过使用加密节点创建的第一加密密钥对数据密钥进行加密，再将加密后的数据密钥下发至加密节点，如此操作可以提高数据密钥的安全性。
第三方面，本申请实施例提供了一种数据加密系统，该系统包括密钥创建装置，以及如第一方面以及第一方面的任一种可能的实现方式中所描述的加密节点。上述加密节点用于创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥。密钥创建装置用于创建数据密钥，并使用第一加密密钥对数据密钥进行加密得到第一密文。上述加密节点还用于获取第一密文，并使用第一解密密钥对第一密文进行解密得到上述数据密钥，以及使用上述数据密钥对待传输的数据进行加密。应理解，通过上述数据加密系统，可以提高数据密钥的安全性，那么，使用安全的数据密钥对待传输的数据进行加密，可以提高待传输数据的安全性。
在第三方面的一种可能的实现方式中，上述系统还包括控制装置。上述密钥创建装置还用于使用第二加密密钥对数据密钥进行加密得到第二密文，并向控制装置发送第二密文。控制装置用于接收第二密文，并向加密节点发送通知消息。加密节点用于响应上述通知消息，将第一加密密钥返回至控制装置。应理解，在实际应用中，为了节省存储资源，密钥创建装置可能不会持久存储数据密钥，因此，通过上述实现方式可以使得解决这一问题。而且，由于控制装置并不会获得第二加密密钥对应的第二解密密钥，因此控制装置获得第二密文后，将无法通过对第二密文解密获得数据密钥，也就是说，通过上述实现方式还可以保证数据密钥的安全性。
在第三方面的一种可能的实现方式中，上述控制装置还用于向密钥创建装置发送重加密请求，其中，重加密请求用于指示密钥创建装置使用第一加密密钥对数据密钥进行加密。
在第三方面的一种可能的实现方式中，上述重加密请求包括第一加密密钥、第二加密密钥的标识以及第二密文。上述密钥创建装置用于根据第二加密密钥的标识确定与第二加密密钥对应的第二解密密钥，使用第二解密密钥对第二密文进行解密得到上述数据密钥，之后，使用第一加密密钥对数据密钥进行加密得到第一密文。应理解，通过上述实现方式，既可以节省密钥创建装置本地的存储资源，还可以提高数据密钥的安全性。
在第三方面的一种可能的实现方式中，上述加密节点包括虚拟私有云(virtual private cloud,VPC)内的计算节点。
第四方面，本申请实施例提供了一种数据加密方法，该方法可以应用于数据加密系统，该系统包括密钥创建装置和加密节点，上述方法包括：加密节点通过内部的加密芯片创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥。密钥创建装置创建数据密钥，并使用第一加密密钥对数据密钥进行加密得到第一密文。之后，加密节点获取第一密文，并通过内部的加密芯片使用第一解密密钥对第一密文进行解密得到上述数据密钥，再通过加密芯片使用上述数据密钥对待传输的数据进行加密。
在第四方面的一种可能的实现方式中，上述数据密钥存储在加密芯片内部的安全存储区域中。该区域不对芯片外部的部件提供访问接口，即不支持外部部件访问该区域。
在第四方面的一种可能的实现方式中，上述密钥对存储在上述安全存储区域中。
在第四方面的一种可能的实现方式中，上述数据加密系统还包括控制装置，在密钥创建装置使用第一加密密钥对数据密钥进行加密得到第一密文之前，上述方法还包括：密钥创建 装置使用第二加密密钥对数据密钥进行加密得到第二密文，并向控制装置发送第二密文；控制装置接收第二密文，并向加密节点发送通知消息；加密节点响应上述通知消息，将第一加密密钥返回至控制装置。
在第四方面的一种可能的实现方式中，上述方法还包括：控制装置向密钥创建装置发送重加密请求；密钥创建装置根据重加密请求获得第一加密密钥和数据密钥。
在第四方面的一种可能的实现方式中，上述重加密请求包括第一加密密钥、第二加密密钥的标识以及第二密文，上述密钥创建装置根据重加密请求获得第一加密密钥和数据密钥，包括：密钥创建装置根据第二加密密钥的标识确定与第二加密密钥对应的第二解密密钥，然后使用第二解密密钥对第二密文进行解密得到数据密钥。
在第四方面的一种可能的实现方式中，上述加密节点包括VPC内的计算节点。
第五方面，本申请实施例提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，计算机指令运行在数据加密系统上，以实现前述第四方面以及第四方面的任一种可能的实现方式中所描述的部分或全部方法。
附图说明
图1是本申请实施例提供的一种密钥分发方式的示意图；
图2是本申请实施例提供的一种密钥分发场景的示意图；
图3是本申请实施例提供的一种数据加密系统的结构示意图；
图4是本申请实施例提供的一种数据加密方法的流程示意图；
图5是本申请实施例提供的另一种数据加密方法的流程示意图；
图6是本申请实施例提供的一种数据加密系统的应用场景示意图；
图7是本申请实施例提供的一种具体示例的示意图；
图8是本申请实施例提供的一种用户界面的示意图；
图9是本申请实施例提供的另一种数据加密系统的结构示意图。
具体实施方式
为了使本申请实施例的方案更清晰，在具体描述本申请实施例的方案之前，首先介绍本申请实施例涉及到的相关术语。
在大数据和人工智能的时代，人们能够更方便并且更高效地获取到各种数据，但与此同时，人们访问数据的行为也被记录、被学习以及被使用。如果在这一过程中不注重数据安全，用户信息就可能被泄漏。为此，对数据进行保护是至关重要的。
数据加密是一种提高数据安全性的方式，其基本过程是按照某种加密算法对明文(即未经加密的数据)进行处理，使其成为一段不可读的代码，即密文。对明文进行加密处理的过程中需要使用到加密密钥，加密密钥是一种参数，它是在将明文转换为密文的加密算法中输入的参数。一般地，对数据加密后，还需要对加密后的数据进行解密，其基本过程是按照某种解密算法对密文进行处理，使其还原成明文。对密文进行解密处理的过程中需要使用到与上述加密密钥对应的解密密钥，上述解密密钥也是一种参数，它是在将密文转换为明文的解密算法中输入的参数。对于通信双方来说，数据发送端在发送数据之前，先采用数据加密的方式对待传输的数据进行加密，之后，再传输至数据接收端，这一操作可以提高待传输的数据的安全性；数据接收端接收到加密后的数据后，通过对加密后的数据进行解密，可以得到 相应的数据。也就是说，上述过程可以实现数据发送端和数据接收端之间的安全通信。
常见的数据加密方式包括对称加密(symmetric cryptography)和非对称加密(asymmetric cryptography)。其中，对称加密是指通信双方使用相同的密钥和相同的算法对数据进行加密和解密，具体地：数据发送端使用对称加密算法(例如高级加密标准(advanced encryption standard,AES)算法)和密钥对待传输的数据进行加密得到密文，当数据发送端将密文发送至数据接收端之后，数据接收端可以使用上述算法和上述密钥对密文进行解密得到上述数据。非对称加密是指通信双方使用不同的密钥(即密钥对，包括公钥和私钥)对数据进行加密和解密，具体地：数据发送端使用非对称加密算法(例如RSA算法)和密钥对中的一个密钥对数据进行加密得到密文，当数据发送端将密文发送至数据接收端之后，数据接收端使用上述算法和密钥对中的另一个密钥对密文进行解密得到上述数据。需要说明的是，用于对数据进行加密的密钥可以是密钥对中的任一个密钥，一般地，可以使用公钥对数据进行加密，私钥对密文进行解密。
在上述加密通信的过程中，数据发送端对数据进行加密需要使用密钥，数据接收端对加密得到的密文进行解密也需要使用密钥。那么，数据发送端和数据接收端如何能获取到所需的密钥呢？其中，一种实现方式是：数据发送端和数据接收端相互协商，确定数据发送端所需的对数据进行加密的密钥A，以及数据接收端所需的对加密后的数据进行解密的密钥B。另一种实现方式是：如图1所示，密钥分发系统包括能够创建密钥的装置(例如KMS)，以用于创建出数据发送端所需的密钥A和数据接收端所需的密钥B，其中，密钥A和密钥B可以相同，也可以不同。之后，密钥分发系统将密钥A和密钥B分别下发至数据发送端和数据接收端。这样，数据发送端就可以使用密钥A对待传输的数据进行加密，数据接收端也可以使用密钥B对上述加密后的数据进行解密，从而得到相应的数据。
接下来，介绍本申请实施例提供的技术方案适用的场景。
本申请实施例提供的技术方案适用于设备间的加密通信场景，即：设备M在向设备N传输数据之前，先使用加密密钥对待传输的数据进行加密，再将加密后的数据传输至设备N，设备N接收到上述加密后的数据后，使用相应的解密密钥对其进行解密得到数据，其中，上述加密密钥及其对应的解密密钥是密钥分发系统下发至设备M和设备N的，具体可参见图1所描述的密钥分发方式。
需要说明的是，本申请实施例提供的技术方案尤其适用于数量众多的设备间的加密通信场景，比如说，VPC内的不同节点之间的加密通信，或者不同VPC内的节点之间的加密通信。在这种场景下，一个设备可能与很多个设备进行通信，此时互相通信的设备间将难以通过两两协商的方式获取密钥，而图1所描述的密钥分发方式可以大大降低设备获取密钥的难度。下面以VPC内的节点之间的加密通信为例，来进一步说明本申请实施例适用的场景。
VPC是用户在云上申请的隔离的、私密的虚拟网络环境，VPC内拥有大量资源(包括计算资源、存储资源和网络资源)，这些资源分别散落在数以万计的节点(包括计算节点、存储节点和网络节点)上，这些节点彼此协作、相互通信以向用户提供云服务。为提高云服务的质量，VPC内的节点之间需要进行加密通信，也就是说，每个节点均需要密钥。如图2所示，VPC内存在K个节点(即节点1、节点2、…、节点K)，K是大于0的整数。以节点1为例，节点1分别与节点2、节点3、…、节点K通信，如果采用节点两两协商的方式获取密，那么，节点1需要分别与K-1个节点进行密钥协商，当K的数值越大，节点1上的负荷越大，这可能会影响云服务的质量。但是，如果采用图1所描述的密钥分发方式，即密钥分发系统 创建各节点所需的密钥，并将这些密钥分别下发至相应的节点，这样，各个节点既能够获取到所需的密钥，还能够减少资源占用。因此，相较于节点间两两协商获取的密钥的方式，图1所描述的密钥分发方式更适用于数量众多的节点间的加密通信场景。
不难看出，节点间传输的数据的安全性依赖于密钥，也就是说，密钥自身的安全性尤为重要，那么如何提高密钥的安全性，以提高数据的安全性呢？
针对上述问题，本申请实施例提供了一种数据加密系统，能够提高密钥的安全性，那么利用安全的密钥对待传输数据进行加密便可以提高数据的安全性。图3示例性的展示了本申请实施例提供的数据加密系统的结构示意图，如图3所示，数据加密系统100包括密钥创建装置110和多个节点120，可选的，数据加密系统100还包括控制装置130。下面简单描述数据加密系统100的各个部分。
密钥创建装置110：是一种具有密钥创建功能和加密功能的装置，可支持按照指定的密钥和加密算法进行加密，例如KMS。本申请实施例中，密钥创建装置110用于创建数据密钥(datakey)，其中，数据密钥包括两种类型，一种用于加密数据(以下简称为数据加密密钥)，另一种用于对加密后的数据进行解密(以下简称为数据解密密钥)。
节点120：是具有资源(计算资源、网络资源以及存储资源中的一种或多种)的、可以与其他节点或设备进行加密通信的节点，具体可以包括服务器、虚拟机(virtual machine,VM)、容器(container)、网卡以及存储器等。本申请实施例中，节点120包括加密芯片121，加密芯片121用于创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥。
密钥创建装置110还用于获取第一加密密钥，并使用第一加密密钥对数据密钥进行加密得到密文。节点120还用于获取上述密文，并通过内部的加密芯片121使用第一解密密钥对该密文进行解密得到数据密钥。应理解，由于数据密钥是经过加密后才由密钥创建装置110传输至节点120的，因此利用数据加密系统100可以提高数据密钥的安全性。
可选的，加密芯片121具有保护密钥安全的功能，例如，加密芯片121中设置有安全存储区域，该区域不对芯片外部的部件提供访问接口，即不支持外部部件访问该区域。加密芯片121还用于将数据密钥存储至上述安全存储区域，这样，加密芯片121外部的部件将无法获得数据密钥，从而提高了数据密钥的安全性。进一步地，加密芯片121还用于将本地创建的密钥对存储至上述安全存储区域，这样，加密芯片121外部的部件将无法获得第一解密密钥，那么即便加密芯片121外部的部件获得上述密文，也无法对密文进行解密得到数据密钥，从而进一步提高了数据密钥的安全性。
可选的，当节点120作为数据发送端，节点120还用于通过加密芯片121使用数据密钥(具体为数据加密密钥)对待传输的数据进行加密，并将加密后的数据发送至其他的节点。当节点120作为数据接收端，节点120还用于通过加密芯片121使用数据密钥(具体为数据解密密钥)对接收到的密文进行解密，得到相应的数据。应理解，当上述数据加密以及密文解密的过程由加密芯片121实现时，说明数据密钥始终位于加密芯片121中，那么可以保证数据密钥不被泄漏，从而提高数据密钥的安全性。
考虑到实际应用中，节点120的数量可能很多，例如，当数据加密系统100应用于图2描述的场景时，节点120相当于云计算模式下的节点，这意味着节点120的数量是数以万计的，在这种情况下，密钥创建装置110可以具有高性能，能够并发地处理大量的访问，其中，此处的访问包括创建数据密钥的访问以及使用节点120创建的第一加密密钥对数据密钥进行加密的访问；或者，密钥创建装置110还可以支持排队机制，使得密钥创建装置110在接收 到大量的访问时，能够基于排队机制作出响应，从而避免因节点120数量过多而导致的密钥创建装置110出现故障，或者部分节点120无法获取到所需的数据密钥的情况。
在一些实施例中，数据加密系统100还可以包括控制装置130，控制装置130用于负责数据加密系统100中管控面逻辑的处理，例如，控制装置130可以包括软件定义网络(software defined network,SDN)控制器。
可选的，控制装置130用于向密钥创建装置110发送密钥创建请求，以使得密钥创建装置110创建数据密钥。当数据密钥创建完成后，控制装置130还用于向节点120发送通知消息，以使得节点120将创建的第一加密密钥返回至该装置130。
可选的，控制装置130还用于向密钥创建装置110发送重加密请求，以将节点120创建的第一加密密钥转发至密钥创建装置110，并使得密钥创建装置110使用第一加密密钥对数据密钥进行加密得到上述密文。控制装置130还用于将上述密文转发至节点120，从而使得节点120可以获得所需的数据密钥。
可选的，控制装置130支持排队机制，那么，当节点120的数+量很多时，控制装置130的存在也可以避免因节点120数量过多而导致的密钥创建装置110出现故障，或者部分节点120无法获取到所需的数据密钥的情况。具体理由如下：当出现大量节点120同时请求数据密钥的情况时，控制装置130可以基于排队机制向密钥创建装置110发送的密钥创建请求和重加密请求，使得密钥创建装置110需要并发处理的访问数量始终在该装置110能够并发处理的最大访问数量的范围内。
下面结合图4和图5描述的数据加密方法来进一步介绍上述数据加密系统100。需要说明的是，为了更加清晰地介绍上述数据加密系统100，此处将以多个节点120中的第一节点和第二节点之间的加密通信过程为例展开描述，即描述了第一节点和第二节点如何获取所需的数据密钥，以及基于获得的数据密钥进行加密通信的过程。
首先，请参见图4，图4示出了本申请实施例提供的一种数据加密方法的流程示意图。
S101：密钥创建装置110创建第一数据密钥。
其中，第一数据密钥是第一节点所需的数据密钥，用于对待传输的数据进行加密，此处的“第一”用于与第二节点所需的数据密钥(即第二数据密钥)进行区分。
在一些实施例中，响应于数据加密命令，密钥创建装置110创建第一数据密钥。其中，数据加密命令是表示第一节点和第二节点之间启用加密通信的命令，用于指示密钥创建装置110为第一节点创建第一数据密钥，以及为第二节点创建第二数据密钥。需要说明的是，第一数据密钥和第二数据密钥可以是同一个密钥，也可以是不同的密钥，第一数据密钥是数据加密密钥，第二数据密钥是数据解密密钥，即第二数据密钥用于对使用第一数据密钥进行加密的数据进行解密。
可选的，密钥创建装置110提供应用程序编程接口(application programming interface,API)，用户可以通过调用API向密钥创建装置110发送数据加密命令；或者，数据加密系统100提供用户界面(user interface,UI)，用户通过在UI上操作来向数据加密系统100发送数据加密命令。
可选的，密钥创建装置110可以采用多种方式创建第一数据密钥，例如，产生随机数，将随机数作为第一数据密钥，又例如，通过对用户指定的密钥进行处理(如在密钥中增加字符、改变密钥中不同数字的位置等)，将处理后的密钥作为第一数据密钥，本申请实施例不作限定。
S102：密钥创建装置110向第一节点发送通知消息。
在一些实施例中，上述数据加密命令包括第一节点的标识，那么，密钥创建装置110可以通过以下方式向第一节点发送通知消息：根据数据加密命令获得第一节点的标识，然后基于第一节点的标识向第一节点发送上述通知消息。其中，第一节点的标识可以是第一节点的ID，或者，当第一节点是VPC内的节点时，第一节点的标识还可以是第一节点所在的VPC的标识。
可选的，上述通信消息用于通知密钥创建装置110已完成第一数据密钥的创建，并指示第一节点将通过本地加密芯片(以下称为第一加密芯片)创建的第一加密密钥返回至密钥创建装置110。
示例性地，为了提高第一数据密钥的安全性，密钥创建装置110创建出第一数据密钥后，还可以执行步骤：(1)使用第二加密密钥对第一数据密钥进行加密得到第二密文，其中，第二加密密钥可以是用户预设的(例如，用户主密钥)，具体实现中，第二加密密钥可以携带在上述数据加密命令中；或者，第二加密密钥也可以是密钥创建装置110自动创建的(例如，密钥创建装置110创建的随机数)。(2)删除第一数据密钥。这样，密钥创建装置110中将不会存储第一数据密钥，既可以节省本地的存储资源，也可以避免因密钥创建装置110故障而导致的第一数据密钥被泄漏。在这种情况下，上述通知消息可以包括第二加密密钥的标识，或者，包括第二密文以及第二加密密钥的标识。当上述通知消息包括第二密文以及第二加密密钥的标识时，密钥创建装置110在将通知消息发送至第一节点之后，还可以删除存储在本地的第二密文，从而进一步节省本地的存储资源。
S103：第一节点向密钥创建装置110返回密钥请求。
其中，密钥请求包括第一加密密钥。具体地，第一节点(具体可以是第一节点的通信接口)接收到上述通知消息后，向第一加密芯片请求第一加密密钥，之后，第一加密芯片将第一加密密钥推送至第一节点内且第一加密芯片外的处理器。该处理器接收到第一加密密钥后，根据第一加密密钥生成上述密钥请求，并将上述密钥请求发送至密钥创建装置110。
进一步地，第一加密芯片将第一加密密钥发送至上述处理器之前，第一加密芯片还执行以下步骤：第一加密芯片创建密钥对，其中，密钥对包括第一加密密钥和第一解密密钥，第一加密密钥对应于第一解密密钥，即第一解密密钥用于对使用第一加密密钥加密得到的密文进行解密。为了提高第一数据密钥的安全性，本申请实施例提出：不同节点内部的加密芯片创建出的密钥对不同，即第一加密芯片创建出的第一加密密钥与其他节点内存的加密芯片创建的第一加密密钥不同，第一加密芯片创建出的第一解密密钥与其他节点内存的加密芯片创建的第一解密密钥不同。这样，可以保证使用节点创建的第一加密密钥加密得到的密文仅能由本地加密芯片解密，也就是说，使用第一加密密钥对第一数据密钥进行加密可以提高第一数据密钥的安全性。
更进一步地，第一加密芯片还将上述密钥对存储至本地的安全存储区域，其中，该区域不对第一加密芯片外部的部件(例如第一节点内且第一加密芯片外的处理器)提供访问接口，即不支持外部部件访问该区域。如此，第一加密芯片外部的部件将无法获得第一解密密钥，那么，第一加密芯片外部的部件无法对使用第一加密密钥加密得到的密文进行解密，也就是说，使用第一加密密钥对第一数据密钥进行加密可以提高第一数据密钥的安全性。
可选的，当上述S102中的通知消息包括第二加密密钥的标识时，密钥请求还包括第二加密密钥的标识；当上述通知消息包括第二密文以及第二加密密钥的标识时，密钥请求还包括第二密文以及第二加密密钥的标识。
S104：密钥创建装置110根据密钥请求对第一数据密钥进行加密得到第一密文，并将第一密文发送至第一节点。
具体地，密钥创建装置110根据密钥请求对第一数据密钥进行加密得到第一密文，其具体实现方式包括以下几种：
方式1、密钥请求包括第一加密密钥，且密钥创建装置110中存储有第一数据密钥，那么，密钥创建装置110根据密钥请求对第一数据密钥进行加密得到第一密文，包括：根据密钥请求获得第一加密密钥，然后使用第一加密密钥对第一数据密钥进行加密得到第一密文。
方式2、密钥请求包括第一加密密钥以及第二加密密钥的标识，且密钥创建装置110中存储有第二密文，那么，密钥创建装置110根据密钥请求对第一数据密钥进行加密得到第一密文，包括：根据密钥请求获得第一加密密钥以及第二加密密钥的标识，然后根据第二加密密钥的标识确定与第二加密密钥对应的第二解密密钥以及第二密文，使用第二解密密钥对第二密文进行解密得到第一数据密钥，最后使用第一加密密钥对第一数据密钥进行加密得到第一密文。
其中，第二解密密钥用于对使用第二加密密钥加密得到的密文进行解密，并且，与第二加密密钥类似的，第二解密密钥也可以是用户预设的(例如，用户主密钥)，或者是密钥创建装置110自动创建的。第二加密密钥与第二解密密钥可以是同一个密钥，也可以是不同的密钥。
方式3、密钥请求可以包括第一加密密钥、第二加密密钥的标识以及第二密文，那么，密钥创建装置110根据密钥请求对第一数据密钥进行加密得到第一密文，包括：根据密钥请求获得第一加密密钥、第二加密密钥的标识以及第二密文，然后根据第二加密密钥的标识确定与第二加密密钥对应的第二解密密钥，使用第二解密密钥对第二密文进行解密得到第一数据密钥，最后使用第一加密密钥对第一数据密钥进行加密得到第一密文。
可选的，密钥请求还可以包括加密算法，例如，RSAES_OAEP_SHA_256算法、SM2_ENCRYPT算法等。其中，该加密算法可以是用户预设的，具体实现中，第二加密密钥可以携带在上述数据加密命令中；或者，该加密算法也可以是密钥创建装置110根据实际情况从本地算法库中选择的。那么，密钥创建装置110可以使用上述加密算法和第一加密密钥对第一数据密钥进行加密得到第一密文。
S105：第一节点接收第一密文，并使用第一解密密钥对第一密文进行解密得到第一数据密钥。
具体地，第一节点(具体可以是第一节点的通信接口)接收到第一密文后，将第一密文推送至第一加密芯片，第一加密芯片获得第一密文后，使用第一解密密钥对第一密文进行解密得到第一数据密钥。
可选的，第一加密芯片获得第一数据密钥后，还执行以下步骤：第一加密芯片将第一数据密钥存储至内部的安全存储区域。如此，可以提高第一数据密钥的安全性。
S106：第一节点使用第一数据密钥对待传输的数据进行加密，并将加密后的数据传输至第二节点。
具体地，当第一节点想要通过内部的通信接口向第二节点发送数据时，先将待传输的数据推送至第一加密芯片，由第一加密芯片使用第一数据密钥对该数据进行加密，之后，将加密后的数据推送至第一节点的通信接口，再由该接口将加密后的数据传输至第二节点。应理解，由于上述数据在传输之前使用了安全的第一数据密钥进行加密，因此可以提高上述数据的安全性。
本申请实施例中，第二节点(具体为第二节点的通信接口)接收到上述加密后的数据之后，将加密后的数据推送至内部的加密芯片(以下称为第二加密芯片)，之后，第二加密芯片使用第二数据密钥对上述加密后的数据进行解密得到上述数据，从而完成了第一节点和第二节点之间的加密通信。其中，第二数据密钥的相关描述可参见上述S101。另外，第二节点获得第二数据密钥的过程与第一节点获得第一数据密钥的过程类似，具体可参见上述S101-S105，为了简便，此处不再进行描述。
接下来，请参见图5，图5示出了本申请实施例提供的另一种数据加密方法的流程示意图。由前文可知，数据加密系统100还可以包括控制装置130，图5描述了当数据加密系统100包括控制装置130时，第一节点和第二节点如何获取所需的数据密钥，以及基于获得的数据密钥进行加密通信的过程。
S201：响应于数据加密命令，控制装置130向密钥创建装置110发送密钥创建请求。
其中，数据加密命令是表示第一节点和第二节点之间启用加密通信的命令。可选的，数据加密命令可以是用户发起的。在一些实施例中，控制装置130提供API或UI，以方便用户可以通过调用API或在UI上操作来向控制装置130发送数据加密命令。
S202：密钥创建装置110根据上述密钥创建请求创建第一数据密钥，并向控制装置130返回第一消息。其中，第一消息用于通知密钥创建装置110已完成第一数据密钥的创建。
可选的，密钥创建装置110创建出第一数据密钥之后，还可以执行以下步骤：使用第二加密密钥对第一数据密钥进行加密得到第二密文，其中，第二加密密钥可以是用户预设的(例如，用户主密钥)，也可以是密钥创建装置110自动创建的(例如，密钥创建装置110创建的随机数)。
可选的，第一消息可以包括第二加密密钥的标识，那么，密钥创建装置110在生成第二密文后，可以删除第一数据密钥，如此，既可以节省密钥创建装置110内部的存储资源，也可以避免因密钥创建装置110故障而导致的第一数据密钥被泄漏。进一步地，除上述第二加密密钥的标识之外，第一消息还可以包括第二密文，如此，密钥创建装置110在将第一消息发送至控制装置130后，还可以删除第二密文，从而进一步节省本地的内存资源。
S203：控制装置130向第一节点发送第二消息。
在一些实施例中，上述数据加密命令包括第一节点的标识，那么，控制装置130可以通过以下方式向第一节点发送第二消息：控制装置130接收到第一消息后，根据数据加密命令获得第一节点的标识，然后基于第一节点的标识向第一节点发送第二消息。其中，第一节点的标识可以是第一节点的ID，或者，当第一节点是VPC内的节点时，第一节点的标识还可以是第一节点所在的VPC的标识。第二消息用于通知第一节点已完成第一数据密钥的创建，以及指示第一节点返回第一加密密钥。
S204：第一节点向控制装置130返回密钥请求。
具体地，第一节点接收到第二消息后，根据第二消息向控制装置130返回密钥请求。其中，密钥请求包括第一加密密钥。为了简便，此处不再对该步骤的具体实现过程展开描述，具体可参见上述S103。
S205：控制装置130接收密钥请求，并向密钥创建装置110发送重加密请求。
其中，重加密请求用于指示密钥创建装置110使用第一加密密钥对第一数据密钥进行加密，重加密请求包括第一数据密钥。可选的，当上述S204中的密钥请求包括第二加密密钥的标识时，重加密请求还包括第二加密密钥的标识；当上述密钥请求包括第二密文以及第二加 密密钥的标识时，重加密请求还包括第二密文以及第二加密密钥的标识。
S206：密钥创建装置110根据重加密请求对第一数据密钥进行加密得到第一密文，并将第一密文发送至控制装置130。
具体地，密钥创建装置110根据重加密请求对第一数据密钥进行加密得到第一密文的具体过程与上述S104中根据密钥请求对第一数据密钥进行加密得到第一密文的过程类似，为了简便，此处不再展开叙述。
S207：控制装置130将第一密文发送至第一节点。
S208：第一节点接收第一密文，并使用第一解密密钥对第一密文进行解密得到第一数据密钥。
S209：第一节点使用第一数据密钥对待传输的数据进行加密，并将加密后的数据传输至第二节点。
应理解，上述S208-S209的具体实现过程与上述S105-S106的具体实现过程类似，为了简便，此处不再展开叙述。还应理解，第二节点(具体为第二节点的通信接口)接收到第一节点发送的加密后的数据后，还执行以下步骤：将加密后的数据推送至内部的加密芯片(以下称为第二加密芯片)，之后，第二加密芯片使用第二数据密钥对上述加密后的数据进行解密得到上述数据，从而完成了第一节点和第二节点之间的加密通信。其中，第二数据密钥和第一数据密钥可以是同一个密钥，也可以是不同的密钥，第一数据密钥是数据加密密钥，第二数据密钥是数据解密密钥，即第二数据密钥用于对使用第一数据密钥进行加密的数据进行解密。另外，第二节点获得第二数据密钥的过程与第一节点获得第一数据密钥的过程类似，具体可参见上述S201-S208，为了简便，此处不再进行描述。
前文中结合图4和图5，详细描述了本申请实施例提供的数据加密方法，下面结合图7-图9，从数据加密系统100的部署以及结构方面，更详细地描述数据加密系统100。
本申请实施例提供的数据加密系统100的部署灵活，具体可以全部部署在云环境中，云环境是云计算模式下利用基础资源向用户提供云服务的实体，云环境包括云数据中心和云服务平台，云数据中心包括云服务提供商拥有的大量基础资源(包括计算资源、存储资源和网络资源)，云数据中心包括的计算资源可以是大量的计算设备(例如服务器)。数据加密系统100可以独立地部署在云数据中心中的服务器或虚拟机上，数据加密系统100也可以分布式地部署在云数据中心中的多台服务器上，或者分布式地部署在云数据中心中的多台虚拟机上，又或者是分布式地部署在云数据中心中的服务器和虚拟机上。
如图6所示，数据加密系统100由云服务提供商在云服务平台抽象成一种数据加密云服务提供给用户，用户在云服务平台购买数据加密云服务后(可预先充值再根据最终资源的使用情况进行结算)，云环境利用部署在云数据中心的数据加密系统100向用户提供数据加密云服务。下面通过一个具体的示例进行描述：
本示例中部署在云数据中心的数据加密系统100包括密钥创建装置110、多个节点120以及控制装置130，其中，多个节点120包括第一VPC内的节点，第一VPC是用户A在云环境上申请的隔离的、私密的虚拟网络环境，第一VPC内的节点协同工作以为用户A提供云服务。为保证用户数据的安全性，用户A在云服务平台购买了数据加密云服务，以用于保证第一VPC内不同节点之间的通信的安全性。
如图7所示，在使用数据加密云服务时，用户A可以通过API或UI向控制装置130发送数据加密命令，以图8示出的UI为例，UI上显示有“用户信息”、“密钥名称”、“用户主 密钥”、“密钥算法”等选项，用户可以选择性地在这些选项后的方框中进行填写。例如，用户在“用户信息”后的选项框中选择该用户购买的VPC的标识，即第一VPC的标识；在“密钥名称”后填写第一VPC内的节点所需的数据密钥的名称；在“用户主密钥”后的方框中填写用户预设的密钥(例如由6-18位数字及字母组成)，该密钥用于对上述数据密钥进行加密；在“密钥算法”后的方框中填写用户预设的加密算法，该算法用于对上述数据密钥进行加密。在填写完成后，点击“完成”选项，UI会基于用户填写的信息生成数据加密命令，并向控制装置130发送该命令。控制装置130向密钥创建装置110发送密钥创建请求，密钥创建装置110接收到上述密钥创建请求后，创建数据密钥，并使用上述用户主密钥对数据密钥进行加密得到密文A，之后，根据密文A以及用户主密钥的标识生成第一消息，将第一消息返回至控制装置130。控制装置130接收到第一消息后，基于第一VPC的标识向第一VPC内的节点发送第二消息。第一VPC内的节点接收到第二消息后，向控制装置130返回通过本地加密芯片创建的加密密钥。控制装置130接收到加密密钥后，向密钥创建装置110发送重加密请求，其中，重加密请求包括密文A、用户主密钥的标识以及上述加密密钥。密钥创建装置110接收到重加密请求后，首先根据用户主密钥的标识确定用户主密钥，然后使用用户主密钥对密文A进行解密得到数据密钥，之后，使用加密芯片创建的加密密钥对数据密钥以及用户A预设的加密算法对数据密钥进行加密得到密文B，并将密文B返回控制装置130。控制装置130接收到上述密文B之后，将密文B返回至对应的节点120。该节点120接收到密文B之后，由本地加密芯片使用创建出的解密密钥对密文B进行解密得到数据密钥，并将数据密钥存储至加密芯片内部的安全存储区域中。这样，第一VPC内的节点中均存储有上述数据密钥，那么，第一VPC内的节点在互相通信时就可以使用上述数据密钥对数据进行加密以及解密，从而实现节点之间的安全通信。
可选的，数据加密系统100还可以分布式地部署在不同的环境中，例如，密钥创建装置110和控制装置130部署在云环境或边缘环境中，多个节点120是终端计算设备，其中，边缘环境是包括距离终端计算设备较近的边缘计算设备集合的环境，边缘计算设备包括：边缘服务器、拥有计算力的边缘小站等，终端计算设备可以包括：终端服务器、智能手机、笔记本电脑、平板电脑、个人台式电脑、智能摄像机等。又例如，密钥创建装置110和控制装置部署在云环境中，多个节点120是边缘环境中的计算节点。又例如，密钥创建装置110部署在云环境中，控制装置部署在边缘环境中，多个节点120是终端计算设备。应理解，本申请实施例不对数据加密系统100的哪些部分具体部署在什么环境进行限制性的划分，实际应用格式可根据终端计算设备的计算能力，边缘环境和云环境的资源占有情况或具体应用需求进行适应性的部署。
进一步地，密钥创建装置110和控制装置130可以部署在同一个计算设备上，也可以分别部署在不同的计算设备上。因此，本申请实施例还提供了数据加密系统100的另一种结构示意图。如图9所示，数据加密系统100包括多个计算设备200，每个计算设备200包括存储器210、处理器220、通信接口230以及总线240，其中，存储器210、处理器220、通信接口230通过总线240实现彼此之间的通信连接。
存储器210可以是只读存储器(read only memory,ROM)，静态存储设备、动态存储设备或者随机存取存储器(random access memory,RAM)。存储器210可以存储计算机指令，当存储器210中存储的计算机指令被处理器220执行时，处理器220和通信接口230用于执行数据加密系统100所执行的部分方法。存储器210还可以存储数据，例如：处理器220在执行过程中产生的中间数据或结果数据。
处理器220可以采用通用的中央处理器(central processing unit,CPU)，微处理器，专用集成电路(application specific integrated circuit,ASIC)，图形处理器(graphics processing unit,GPU)或者一个或多个集成电路。
处理器220还可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，数据加密系统100的部分功能可用通过处理器220中的硬件的集成逻辑电路或者软件形式的指令完成。处理器220还可以是通用处理器、数据信号处理器(digital signal process,DSP)、现场可编程逻辑门阵列(field programmable gate array,FPGA)或者其他可编程逻辑器件，分立门或者晶体管逻辑器件，分立硬件组件，可以实现或者执行本申请实施例中公开的方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等，结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器、闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器210，处理器220读取存储器210中的信息，结合其硬件完成数据加密系统100的部分功能。
通信接口230使用例如但不限于收发器一类的收发模块，来实现计算设备200与其他设备或通信网络之间的通信。例如，可以通过通信接口230获取用户发送的数据加密命令，或发送使用数据密钥加密后的数据。
总线240可以包括在计算设备200中的各个部件(例如，存储器210、处理器220、通信接口230)之间传送信息的通路。
上述多个计算设备200之间通过通信网络建立通信通路，以实现数据加密系统100的功能。任一计算设备可以是云数据中心中的计算设备(例如，服务器)，或边缘数据中心中的计算设备，或终端计算设备。
上述多个计算设备200中，一部分计算设备200上运行密钥创建装置110和控制装置130中任意一个或多个，另一部分计算设备200是节点120。在一些实施例中，如图9所示，当计算设备200是节点120时，该计算设备200中的处理器220还包括加密芯片121，加密芯片121用于创建密钥对，以及使用第一数据密钥对待传输的数据进行加密，或者，使用第二数据密钥对接收到的加密后的数据进行解密。该计算设备200中的存储器210包括加密芯片121中的安全存储区域，该区域不对芯片外部的部件提供访问接口，即不支持外部部件访问，该区域用于存储上述第一数据密钥、密钥对等。
进一步地，当计算设备200是节点120时，该计算设备200可以包括智能网卡，智能网卡用于实现与其他设备之间的通信。加密芯片121设置在智能网卡上，智能网卡的通信端口和加密芯片121通过硬件接口连接。这样，加密芯片121可以将创建好的第一加密密钥通过该接口发送至部署有控制装置130的计算设备上；部署有控制装置130的计算设备也可以将第一密文通过上述接口推送至加密芯片121，使得加密芯片121能够使用第一解密密钥对加密后的数据密钥进行解密得到数据密钥；智能网卡还可以将待传输的数据通过该接口推送至加密芯片121，对应的，加密芯片121还可以使用数据密钥对待传输的数据进行加密，并通过该接口将加密后的数据发送至其他的设备；或者，智能网卡还可以将加密后的数据通过该接口推送至加密芯片121，对应的，加密芯片121使用数据密钥对加密后的数据进行解密得到数据。
上述各个附图对应的流程的描述各有侧重，某个流程中没有详细描述的部分，可以参见 其他流程的相关描述。
在上述实施例中，可以全部或部分地通过软件、硬件或者其组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。提供数据加密系统100的计算机程序产品包括一个或多个数据加密系统100执行的计算指令，在计算机上加载和执行这些计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。
上述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。上述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，上述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如，同轴电缆、光纤、双绞线或无线(例如，红外、无线、微波)等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。上述计算机可读存储介质存储有提供数据加密系统100的计算机程序指令。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个介质集成的服务器、数据中心等数据存储设备。上述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，光盘)、或者半导体介质(例如，固态硬盘(solid state disk,SSD))。

Claims (17)

  1. 一种加密节点，其特征在于，包括加密芯片和通信接口，
    所述加密芯片，用于创建密钥对，其中，所述密钥对包括第一加密密钥和第一解密密钥；
    所述通信接口，用于发送所述第一加密密钥，以及接收基于所述第一加密密钥对数据密钥进行加密得到的密文，并将所述密文推送至所述加密芯片；
    所述加密芯片，还用于使用所述第一解密密钥对所述密文进行解密，得到所述数据密钥。
  2. 根据权利要求1所述的节点，其特征在于，
    所述加密芯片，还用于使用所述数据密钥对待传输的数据进行加密；
    所述通信接口，还用于发送所述加密后的数据。
  3. 根据权利要求1或2所述的节点，其特征在于，所述数据密钥存储在所述加密芯片内部的安全存储区域中。
  4. 根据权利要求3所述的节点，其特征在于，所述密钥对存储在所述安全存储区域中。
  5. 一种数据加密系统，其特征在于，包括密钥创建装置以及如权利要求1-4任一项所述的加密节点，
    所述加密节点，用于创建密钥对，其中，所述密钥对包括第一加密密钥和第一解密密钥；
    所述密钥创建装置，用于创建数据密钥，并使用所述第一加密密钥对所述数据密钥进行加密得到第一密文；
    所述加密节点，还用于获取所述第一密文，并使用所述第一解密密钥对所述第一密文进行解密得到所述数据密钥，以及使用所述数据密钥对待传输的数据进行加密。
  6. 根据权利要求5所述的系统，其特征在于，还包括控制装置，
    所述密钥创建装置，还用于使用第二加密密钥对所述数据密钥进行加密得到第二密文，并向所述控制装置发送所述第二密文；
    所述控制装置，用于接收所述第二密文，并向所述加密节点发送通知消息；
    所述加密节点，用于响应所述通知消息，将所述第一加密密钥返回至所述控制装置。
  7. 根据权利要求6所述的系统，其特征在于，
    所述控制装置，还用于向所述密钥创建装置发送重加密请求，其中，所述重加密请求用于指示所述密钥创建装置使用所述第一加密密钥对所述数据密钥进行加密。
  8. 根据权利要求7所述的系统，其特征在于，所述重加密请求包括所述第一加密密钥、所述第二加密密钥的标识以及所述第二密文，
    所述密钥创建装置，用于根据所述第二加密密钥的标识确定与所述第二加密密钥对应的第二解密密钥，使用所述第二解密密钥对所述第二密文进行解密得到所述数据密钥，使用所述第一加密密钥对所述数据密钥进行加密得到所述第一密文。
  9. 根据权利要求5-8任一项所述的系统，其特征在于，所述加密节点包括虚拟私有云VPC内的计算节点。
  10. 一种数据加密方法，其特征在于，应用于数据加密系统，所述数据加密系统包括密钥创建装置和加密节点，所述方法包括：
    所述加密节点通过内部的加密芯片创建密钥对，其中，所述密钥对包括第一加密密钥和第一解密密钥；
    所述密钥创建装置创建数据密钥，并使用所述第一加密密钥对所述数据密钥进行加密得到第一密文；
    所述加密节点获取所述第一密文，并通过所述加密芯片使用所述第一解密密钥对所述第一密文进行解密得到所述数据密钥；
    所述加密节点通过所述加密芯片使用所述数据密钥对待传输的数据进行加密。
  11. 根据权利要求10所述的方法，其特征在于，所述数据密钥存储在所述加密芯片内部的安全存储区域中。
  12. 根据权利要求11所述的方法，其特征在于，所述密钥对存储在所述安全存储区域中。
  13. 根据权利要求10-12任一项所述的方法，其特征在于，所述数据加密系统还包括控制装置，在所述密钥创建装置使用所述第一加密密钥对所述数据密钥进行加密得到第一密文之前，所述方法还包括：
    所述密钥创建装置使用第二加密密钥对所述数据密钥进行加密得到第二密文，并向所述控制装置发送所述第二密文；
    所述控制装置接收所述第二密文，并向所述加密节点发送通知消息；
    所述加密节点响应所述通知消息，将所述第一加密密钥返回至所述控制装置。
  14. 根据权利要求13所述的方法，其特征在于，所述方法还包括：
    所述控制装置向所述密钥创建装置发送重加密请求；
    所述密钥创建装置根据所述重加密请求获得所述第一加密密钥和所述数据密钥。
  15. 根据权利要求14所述的方法，其特征在于，所述重加密请求包括所述第一加密密钥、所述第二加密密钥的标识以及所述第二密文，所述密钥创建装置根据所述重加密请求获得所述第一加密密钥和所述数据密钥，包括：
    所述密钥创建装置根据所述第二加密密钥的标识确定与所述第二加密密钥对应的第二解密密钥；
    所述密钥创建装置使用所述第二解密密钥对所述第二密文进行解密得到所述数据密钥。
  16. 根据权利要求13-15任一项所述的方法，其特征在于，所述加密节点包括虚拟私有云VPC内的计算节点。
  17. 一种计算机可读存储介质，其特征在于，存储有计算机指令，所述计算机指令运行在数据加密系统上，以实现前述权利要求10-16任一项所述的方法。
PCT/CN2022/129790 2021-12-29 2022-11-04 一种数据加密系统及相关产品 WO2023124530A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111648273.3A CN116418486A (zh) 2021-12-29 2021-12-29 一种数据加密系统及相关产品
CN202111648273.3 2021-12-29

Publications (1)

Publication Number Publication Date
WO2023124530A1 true WO2023124530A1 (zh) 2023-07-06

Family

ID=86997537

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/129790 WO2023124530A1 (zh) 2021-12-29 2022-11-04 一种数据加密系统及相关产品

Country Status (2)

Country Link
CN (1) CN116418486A (zh)
WO (1) WO2023124530A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015185331A1 (en) * 2014-06-06 2015-12-10 Gemalto Sa Management of high number of unique keys by a secure element
CN109450631A (zh) * 2018-12-27 2019-03-08 石更箭数据科技(上海)有限公司 密钥生成设备及管理系统、数据处理设备、数据交易系统
US20190229902A1 (en) * 2018-01-19 2019-07-25 Vmware, Inc. System and methods of managing shared keys in a computer cluster with high availability
US10491576B1 (en) * 2017-06-16 2019-11-26 Intuit Inc. System and method for security breach response using hierarchical cryptographic key management
US20210258148A1 (en) * 2019-03-22 2021-08-19 Advanced New Technologies Co., Ltd. Key management method, security chip, service server and information system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015185331A1 (en) * 2014-06-06 2015-12-10 Gemalto Sa Management of high number of unique keys by a secure element
US10491576B1 (en) * 2017-06-16 2019-11-26 Intuit Inc. System and method for security breach response using hierarchical cryptographic key management
US20190229902A1 (en) * 2018-01-19 2019-07-25 Vmware, Inc. System and methods of managing shared keys in a computer cluster with high availability
CN109450631A (zh) * 2018-12-27 2019-03-08 石更箭数据科技(上海)有限公司 密钥生成设备及管理系统、数据处理设备、数据交易系统
US20210258148A1 (en) * 2019-03-22 2021-08-19 Advanced New Technologies Co., Ltd. Key management method, security chip, service server and information system

Also Published As

Publication number Publication date
CN116418486A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
KR101894232B1 (ko) 클라우드-보조 암호화를 위한 방법 및 장치
US9037870B1 (en) Method and system for providing a rotating key encrypted file system
US20200204530A1 (en) Self-encrypting key management system
CN111541725B (zh) 区块链一体机及其密码加速卡、密钥管理方法和装置
US10230697B2 (en) User terminals, and methods and computer-readable recording mediums storing computer programs for transmitting and receiving messages
CN108418817B (zh) 一种加密方法及装置
EP3962021A1 (en) Service processing methods, apparatuses, devices and systems
US20190109708A1 (en) Revocable stream ciphers for upgrading encryption in a shared resource environment
WO2023000502A1 (zh) 虚拟机磁盘数据的加解密方法、装置、设备及存储介质
CN112055004A (zh) 一种基于小程序的数据处理方法和系统
CN110177099B (zh) 基于非对称加密技术的数据交换方法、发送终端和介质
JP7486530B2 (ja) 管理されたコンテナ環境における共有機密情報へのアクセス方法、システム、プログラム
CN111954879B (zh) 互不信任的飞地
WO2022073429A1 (zh) 数据管理方法、装置及系统、存储介质
JP2012032892A (ja) 情報送信装置、ネットワークシステム、情報送信方法および情報送信プログラム
CN112822177A (zh) 数据传输方法、装置、设备和存储介质
US20200322158A1 (en) Method and apparatus for determining trust status of tpm, and storage medium
Abd Elminaam et al. SMCACC: developing an efficient dynamic secure framework for mobile capabilities augmentation using cloud computing
WO2023169271A1 (zh) 一种数据存储方法及数据处理设备
WO2023124530A1 (zh) 一种数据加密系统及相关产品
CN115688165A (zh) 一种节点文件处理方法、装置、设备及存储介质
CN114788221A (zh) 带访问控制谓词的包装密钥
KR102474897B1 (ko) 양자 내성 암호화 알고리즘에 기초한 봉인 키 교환을 통해 가상 사설 네트워크를 제공하는 가상 사설 네트워크 형성 방법 및 이를 수행하는 가상 사설 네트워크 운용 시스템
US11647013B1 (en) Encryption of data via public key cryptography with certificate verification of target
CN114244515B (zh) 基于Hypervisor的虚拟机通信方法、装置、可读存储介质及电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22913793

Country of ref document: EP

Kind code of ref document: A1