CN117336077A - A data encryption and decryption method and system - Google Patents

Abstract

This application provides a data encryption and decryption method and system. The data encryption and decryption method provided by this application is applied to a key management server. The method includes: when receiving a working key acquisition request from a storage node, determining whether the first timestamp carried in the working key acquisition request is historical. timestamp; if not, obtain the first working key of the day, and use the protection key to encrypt the first working key to obtain the ciphertext of the first working key; use the communication key to encrypt the first working key The ciphertext, the hash value of the first working key and the current timestamp are encrypted to obtain the first communication ciphertext; the first communication ciphertext is returned to the storage node to instruct the storage node to obtain the first communication ciphertext based on the first communication ciphertext. working key, and use the first working key to perform data encryption and decryption. The data encryption method and system provided by this application can ensure data security.

Description

A data encryption and decryption method and system

Technical field

This application relates to the technical field of data encryption and decryption, and in particular to a data encryption and decryption method and system.

Background technique

In recent years, with the gradual development of digitalization and intelligence, massive quantities have been generated, collected and stored, and analyzed and utilized through advanced technologies. The importance of data security has become increasingly prominent, and how to ensure data security has become an urgent problem to be solved.

Contents of the invention

In view of this, this application provides a data encryption and decryption method and system to ensure data security.

Specifically, this application is implemented through the following technical solutions:

The first aspect of this application provides a data encryption and decryption method, the method is applied to a key management server; the method includes:

When receiving a work key acquisition request from a storage node, it is determined whether the first timestamp carried by the work key acquisition request is a historical timestamp; wherein, the work key acquisition request is used to request the acquisition of data. The working key for encryption and decryption;

If not, obtain the first working key of the day, and use the protection key to encrypt the first working key to obtain the ciphertext of the first working key;

Use the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext;

Return the first communication ciphertext to the storage node to instruct the storage node to obtain the first working key based on the first communication ciphertext and use the first working key to perform data encryption. Decrypt.

A second aspect of this application provides a data encryption and decryption method. The method is applied to a data encryption and decryption system. The system includes a key management server and multiple storage nodes; the method includes:

When the key management server receives a working key acquisition request from a first storage node among the plurality of storage nodes, the key management server determines whether the first timestamp carried in the working key acquisition request is a historical timestamp; Wherein, the work key acquisition request is used to request to obtain the working key for encrypting and decrypting data;

When the key management server determines that the first timestamp carried in the key acquisition request is the timestamp of the day, it obtains the first working key of the day and uses the protection key to encrypt the first working key. , get the ciphertext of the first working key;

The key management server uses the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext;

The key management server returns the first communication ciphertext to the first storage node;

The first storage node obtains the first working key based on the first communication ciphertext, and uses the first working key to perform data encryption and decryption.

A third aspect of this application provides a data encryption and decryption system, which includes a key management server and multiple storage nodes;

The key management server is configured to, when receiving a work key acquisition request from a first storage node among the plurality of storage nodes, determine whether the first timestamp carried in the work key acquisition request is historical. Timestamp; wherein, the working key acquisition request is used to request to obtain the working key for encrypting and decrypting data;

The key management server is also configured to obtain the first working key of the day when it is determined that the first timestamp carried in the key acquisition request is the time stamp of the day, and use the protection key to update the first working key. The key is encrypted to obtain the ciphertext of the first working key;

The key management server is also configured to use the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext. , and return the first communication ciphertext to the first storage node;

The first storage node is configured to obtain the first working key based on the first communication ciphertext, and use the first working key to perform data encryption and decryption.

The data encryption and decryption method and system provided by this application, when receiving a work key acquisition request from a storage node, determine whether the first timestamp carried in the work key acquisition request is a historical timestamp; wherein, the The work key acquisition request is used to request to obtain the working key for encryption and decryption of data; if the first timestamp carried by the work key acquisition request is not a historical timestamp, obtain the first working key of the day and use The protection key encrypts the first working key to obtain the ciphertext of the first working key, and then uses the communication key to encrypt the ciphertext of the first working key and the hash of the first working key. The hash value and the current timestamp are encrypted to obtain the first communication ciphertext, thereby returning the first communication ciphertext to the storage node to instruct the storage node to obtain the third communication ciphertext based on the first communication ciphertext. A working key, and use the first working key to perform data encryption and decryption. In this way, the protection key and the communication key are used to encrypt the working key, realizing a multi-level protection mechanism for the working key, ensuring the security of the working key, and thereby ensuring data security.

Description of drawings

Figure 1 is a flow chart of Embodiment 1 of the data encryption and decryption method provided by this application;

Figure 2 is a flow chart of Embodiment 2 of the data encryption and decryption method provided by this application;

Figure 3 is a flow chart of Embodiment 3 of the data encryption and decryption method provided by this application;

Figure 4 is a flow chart of Embodiment 4 of the data encryption and decryption method provided by this application;

Figure 5 is a flow chart of Embodiment 5 of the data encryption and decryption method provided by this application;

Figure 6 is a schematic diagram of the data encryption system provided by this application.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this application. Rather, they are merely examples of apparatus and methods consistent with aspects of the application as detailed in the appended claims.

The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a," "the" and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. It will also be understood that the term "and/or" as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of the present application, the first information may also be called second information, and similarly, the second information may also be called first information. Depending on the context, the word "if" as used herein may be interpreted as "when" or "when" or "in response to determining."

This application provides a data encryption and decryption method and system to ensure data security.

The data encryption and decryption method and system provided by this application, when receiving a work key acquisition request from a storage node, determine whether the first timestamp carried in the work key acquisition request is a historical timestamp; wherein, the The work key acquisition request is used to request to obtain the work key for encrypting and decrypting data; and after judging that the first timestamp carried in the work key acquisition request is not a historical timestamp, obtain the first working key of the day, And use the protection key to encrypt the first working key to obtain the ciphertext of the first working key, and then use the communication key to encrypt the ciphertext of the first working key, the first working key The hash value and the current timestamp are encrypted to obtain the first communication ciphertext, thereby returning the first communication ciphertext to the storage node to instruct the storage node to obtain the communication ciphertext based on the first communication ciphertext. The first working key is used to perform data encryption and decryption. In this way, the protection key and the communication key are used to encrypt the working key, realizing a multi-level protection mechanism for the working key, ensuring the security of the working key, and thereby ensuring data security.

Specific examples are given below to introduce the technical solution of the present application in detail.

Figure 1 is a flow chart of Embodiment 1 of the data encryption and decryption method provided by this application. Please refer to Figure 1. This embodiment provides a method, which is applied to a key management server; the method includes:

S101. When receiving a work key acquisition request from a storage node, determine whether the first timestamp carried in the work key acquisition request is a historical timestamp; wherein the work key acquisition request is used to request to obtain a pair of The working key for data encryption and decryption.

Specifically, the key management server is a server used to manage working keys required in encryption and decryption algorithms. Furthermore, the storage node is a device used to store and manage data, and it uses a working key to encrypt and decrypt data.

The work key acquisition request is used to request to obtain the work key for encrypting and decrypting data, which can carry timestamps, identification information of storage nodes, etc. It should be noted that the working key changes every day, and the timestamp carried in the work key acquisition request is used to indicate the acquisition of the working key under this timestamp. For example, in one embodiment, the timestamp carried in the work key acquisition request is September 2, 2023. At this time, the work key acquisition request is used to indicate obtaining the work key on September 2, 2023.

In specific implementation, when the storage node needs to encrypt and decrypt data, it will obtain the working key from the key management server to use the working key to encrypt and decrypt the data.

During specific implementation, the first timestamp can be compared with the current time to determine whether the first timestamp is a historical timestamp.

For example, in one embodiment, the first timestamp carried in the work key acquisition request is September 1, 2023, and the current time is September 8, 2023. At this time, it is determined that the first time stamp carried in the work key acquisition request The stamp is a historical timestamp.

For another example, in another embodiment, the first timestamp carried in the work key acquisition request is September 8, 2023, and the current time is September 8, 2023. At this time, it is determined that the work key acquisition request carries The first timestamp is the current day's timestamp, not the historical timestamp.

It should be noted that, in a possible implementation, when receiving a request to obtain a working key, the identity of the storage node can be authenticated first, and then after the storage node passes the identity authentication, the judgment of obtaining the working key can be performed. Check whether the first timestamp carried in the request is a historical timestamp. If the storage node fails identity authentication, a failure message is returned to the storage node. For specific implementation principles of identity authentication, please refer to the description in related technologies and will not be described again here.

S102. If not, obtain the first working key of the day, and use the protection key to encrypt the first working key to obtain the ciphertext of the first working key.

Specifically, when the first timestamp carried in the work key acquisition request is not a historical timestamp, it means that the work key acquisition request is used to indicate obtaining the working key of the day. In this step, the first working key of the day is obtained. key.

In specific implementation, when obtaining the first working key of the day, you can first determine whether the first working key of the day exists in the memory. If so, obtain the first working key directly from the memory; further, if there is no first working key in the memory, When the first working key exists, determine whether the first working key exists in the database used to store the working key. If so, obtain the first working key from the database; further, if the first working key does not exist in the database either key, the first working key is generated. For example, in one embodiment, a random number generator can be used to generate the working key.

Specifically, the protection key is the key that encrypts and decrypts the working key. In this step, the public key of the protection key can be used to encrypt the working key to obtain the ciphertext of the first working key.

S103. Use the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext.

Specifically, the communication key is a key different from the protection key, which is used to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp, to obtain First communication cipher text. Through the communication key, the security of the transmission of the working key between the server and the storage node can be ensured, and the working key can be prevented from being tampered with or carried.

During specific implementation, a preset hash algorithm can be used to calculate the hash value of the first working key, and then the communication key can be used to pair the ciphertext of the first working key, the hash value of the first working key and the current The timestamp is encrypted.

S104. Return the first communication ciphertext to the storage node to instruct the storage node to obtain the first working key based on the first communication ciphertext and use the first working key to perform Data encryption and decryption.

In specific implementation, after receiving the first communication ciphertext, the storage node can obtain the first working key based on the first communication ciphertext, and then use the first working key to perform data encryption and decryption.

Specifically, the storage node obtains the working key based on the communication ciphertext, and uses the first working key to perform data encryption and decryption, including:

(1) The storage node uses the communication key to decrypt the communication ciphertext to obtain the ciphertext of the working key, the hash value of the working key and the timestamp.

Specifically, the storage node stores the private key of the communication key, and the storage node uses the private key of the communication key to decrypt the communication ciphertext to obtain the ciphertext of the working key, the hash value of the working key, and the timestamp. Among them, the communication key includes the communication key public key and the communication key private key. The public key of the communication key is used to encrypt the ciphertext of the working key, the hash value of the working key and the current timestamp. , obtain the communication ciphertext; the private key of the communication key is used to decrypt the communication ciphertext, and obtain the ciphertext of the working key, the hash value of the working key and the timestamp.

(2) The storage node uses the protection key to decrypt the ciphertext of the working key to obtain the working key.

Specifically, the storage node stores the private key that protects the key. After obtaining the ciphertext of the working key, the storage node can use the private key that protects the key to decrypt the ciphertext of the working key to obtain the working key. Among them, the protection key includes the public key of the protection key and the private key of the protection key. The public key of the protection key encrypts the ciphertext of the working key, and the private key of the protection key encrypts the ciphertext of the working key. Decrypt.

(3) The storage node calculates the hash value of the working key.

During specific implementation, the storage node may calculate the hash value of the first working key based on a preset hash algorithm. For example, in one embodiment, the calculated hash value of the working key is a1.

(4) When the calculated hash value and the decrypted hash value are consistent, the storage node uses the working key to encrypt and decrypt the data.

Specifically, when the calculated hash value and the decrypted hash value are consistent, the storage node considers that the working key has not been tampered with and the working key is safe. At this time, the working key is used to encrypt and decrypt the data. .

Combined with the above example, for example, the hash value obtained by decryption by the storage node is a1, which is consistent with the hash value calculated by the storage node. At this time, the storage node uses the working key to encrypt and decrypt the data.

The data encryption and decryption method provided in this embodiment is applied to the key management server. When receiving a working key acquisition request from a storage node, it determines whether the first timestamp carried in the working key acquisition request is is a historical timestamp; wherein, the work key acquisition request is used to request to obtain a work key for encrypting and decrypting data; and when the first timestamp carried in the work key acquisition request is not a historical timestamp, obtain The first working key of the day is encrypted using the protection key to obtain the ciphertext of the first working key, and then the communication key is used to encrypt the ciphertext of the first working key. , encrypt the hash value of the first working key and the current timestamp to obtain the first communication ciphertext, thereby returning the first communication ciphertext to the storage node to indicate that the storage node is based on the The first communication ciphertext obtains the first working key, and uses the first working key to perform data encryption and decryption. In this way, the protection key and the communication key are used to encrypt the working key, realizing a multi-level protection mechanism for the working key, ensuring the security of the working key, and thereby ensuring data security.

Optionally, in a possible implementation of this application, after obtaining the first working key ciphertext, the method further includes:

The correspondence between the ciphertext of the first working key, the hash value of the first working key and the current timestamp is stored.

For example, the first timestamp is the current timestamp 1, the ciphertext of the first working key is ciphertext 1, and the hash value of the first working key is hash value 1. In this step, the current timestamp 1 is , ciphertext 1 and hash value 1 exist in the correspondence table as a set of correspondences. For example, Table 1 shows the correspondence between the ciphertext of a locally stored working key, the hash value of the working key and the current timestamp according to an exemplary embodiment of the present application:

Table 1 Correspondence between the locally stored ciphertext of the working key, the hash value of the working key and the timestamp

The method provided in this embodiment, after obtaining the ciphertext of the first working key, stores the ciphertext of the first working key, the hash value of the first working key and the current timestamp. In this way, when the working key needs to be obtained later, it can be obtained based on the corresponding relationship.

Figure 2 is a flow chart of Embodiment 2 of the data encryption and decryption method provided by this application. Please refer to Figure 2. The method provided in this embodiment, based on the above embodiment, when the first timestamp carried in the working key acquisition request is a historical timestamp, the method further includes:

S201. Find a target correspondence related to the first timestamp from the stored correspondence between the ciphertext of the work key, the hash value of the work key, and the timestamp.

Specifically, when the storage node needs to decrypt previously encrypted data, it needs to obtain the working key used to encrypt the data from the key management server. Combined with the above example, for example, the current time is September 8, 2023, and when the storage node wants to decrypt the data encrypted on September 6, 2023, at this time, it sends a working key acquisition request to the key management server, The timestamp carried in the work key acquisition request is September 6, 2023, which is used to indicate the acquisition of the work key on September 6, 2023.

Specifically, when the first timestamp carried in the working key acquisition request is a historical timestamp, the key management server can obtain the ciphertext from the stored working key, the hash value of the working key, and the timestamp. Among the corresponding relationships between, search for the target corresponding relationship related to the first timestamp.

It should be noted that the target correspondence relationship related to the first timestamp refers to the correspondence relationship in which the timestamp is the first timestamp.

For example, in one embodiment, the first timestamp is historical timestamp 2. Combined with the example shown in Table 1, in this step, the corresponding relationship related to historical timestamp 2 is searched from Table 1. The found target corresponds to The relationship is the second record in Table 1, that is, the found target correspondence is: the ciphertext of the working key is ciphertext 2, the hash value of the working key is hash value 2, and the timestamp is the historical timestamp. 2.

S202. Use the communication key to encrypt the ciphertext of the historical working key, the hash value of the historical working key and the historical timestamp in the target correspondence relationship to obtain a second communication ciphertext.

Combined with the above example, in this step, the communication key is used to encrypt the ciphertext 2, the hash value 2 and the historical timestamp 2 to obtain the second communication ciphertext 2.

S203. Return the second communication ciphertext to the storage node to instruct the storage node to obtain the historical working key based on the second communication ciphertext and use the historical working key to perform data decryption. .

Specifically, referring to the previous description, the private key of the communication key and the private key of the protection key are stored on the storage node. The private key of the communication key can be used to decrypt the second communication ciphertext to obtain the historical working key. The ciphertext, the hash value of the historical working key and the historical timestamp; then, after obtaining the ciphertext of the historical working key, the private key of the protection key is used to decode the ciphertext of the historical working key and obtain the historical working key. key.

In other words, the storage node obtains the historical working key based on the second communication ciphertext, and uses the historical working key to perform data encryption and decryption. The process may include:

(1) The storage node uses the communication key to decrypt the second communication ciphertext to obtain the ciphertext of the historical working key, the hash value of the historical working key and the historical timestamp.

(2) The storage node uses the protection key to decrypt the ciphertext of the historical working key to obtain the historical working key.

(3) The storage node calculates the hash value of the historical working key.

(4) When the calculated hash value and the decrypted hash value are consistent, the storage node uses the working key to encrypt and decrypt the data.

Specifically, for the specific implementation process of steps (1) to (4), reference may be made to the description in the above embodiments, which will not be described again here.

Combined with the above example, in this step, the second communication ciphertext 2 is returned to the storage node, and the storage node uses the communication key to decrypt the second communication ciphertext 2 to obtain the ciphertext 2 of the historical working key and the historical working key. hash value 2 and historical timestamp 2, and then uses the protection key to decrypt the ciphertext 2 of the historical working key, obtains the historical working key, and calculates the hash value of the historical working key, thereby calculating When the hash value of the historical working key is consistent with the hash value 2 of the historical working key, the historical working key is used to encrypt and decrypt the data.

The data encryption and decryption method provided in this embodiment, when the first timestamp carried in the work key acquisition request is a historical timestamp, by obtaining the ciphertext of the stored work key, the hash value of the work key and Among the correspondences between the three timestamps, find the target correspondence related to the first timestamp, and use the communication key to compare the ciphertext of the historical working key in the target correspondence, the The hash value and timestamp of the historical working key are encrypted to obtain a second communication ciphertext, and then the second communication ciphertext is returned to the storage node to instruct the storage node to use the second communication ciphertext based on the second communication ciphertext. The historical working key is obtained, and the historical working key is used to perform data encryption and decryption. In this way, the corresponding relationship between the stored ciphertext of the working key, the hash value of the working key and the timestamp can be used to find the target corresponding relationship related to the first timestamp, and then based on the target corresponding relationship. Obtain historical working keys to ensure the security of data transmission.

Figure 3 is a flow chart of Embodiment 3 of the data encryption and decryption method provided by this application. Please refer to Figure 3. The method provided in this embodiment, based on the above embodiment, further includes:

S301. Receive an initialization instruction from the administrator client; wherein the initialization instruction carries the master password and the protection key.

Specifically, for example, after the key management server is restarted, the administrator will trigger an initialization instruction through the administrator client. Further, the administrator client will send the initialization instruction to the key management server.

Specifically, the initialization command carries the master password and protection key. Among them, the master password is used to encrypt the protection key, and the protection key is used to encrypt and decrypt the data of the working key to protect its security.

S302: Encrypt the protection key using the master password to obtain the ciphertext of the protection key.

Specifically, for the specific implementation process and implementation principle of using the master password to encrypt the protection key, please refer to the description in the related technology, and will not be described again here.

For example, in one embodiment, the ciphertext protecting the key is ciphertext A.

S303: When the ciphertext of the protection key is consistent with the ciphertext of the protection key currently stored locally, save the ciphertext of the protection key.

For example, in one embodiment, the ciphertext of the protection key currently stored locally is ciphertext A, which is consistent with the ciphertext A of the protection key. At this time, the ciphertext A of the protection key is saved.

For another example, in another possible implementation, the ciphertext of the protection key currently saved locally is ciphertext B, which is inconsistent with the ciphertext A of the protection key. In this case, an error reminder message is output.

The data encryption and decryption method provided in this embodiment receives an initialization instruction from the administrator client; wherein the initialization instruction carries a master password and a protection key, and uses the master password to encrypt the protection key, thus obtaining The ciphertext of the protection key, and further, when the ciphertext of the protection key is consistent with the ciphertext of the protection key currently saved locally, the ciphertext of the protection key is saved. In this way, the administrator has the right to initialize, encrypt and save the protection key, ensuring the security of data transmission.

Figure 4 is a flow chart of Embodiment 4 of the data encryption and decryption method provided by this application. Please refer to Figure 4. This embodiment provides a method, which is applied to a data encryption and decryption system. The system includes a key management server and multiple storage nodes; the method includes:

S401. When the key management server receives a working key acquisition request from the first storage node among the plurality of storage nodes, determine whether the first timestamp carried in the working key acquisition request is a historical time. Stamp; wherein, the working key acquisition request is used to request to obtain the working key for encrypting and decrypting data.

S402. When the key management server determines that the first timestamp carried in the key acquisition request is the timestamp of the day, obtain the first working key of the day, and use the protection key to verify the first working key. Encrypt to obtain the ciphertext of the first working key.

S403. The key management server uses the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext.

S404. The key management server returns the first communication ciphertext to the first storage node.

Regarding the specific implementation principles of steps S401 to S404, reference may be made to the description in Embodiment 1, which will not be described again here.

S405. The first storage node obtains the first working key based on the first communication ciphertext, and uses the first working key to perform data encryption and decryption.

Specifically, the first storage node obtains the first working key based on the first communication ciphertext, and uses the first working key to perform data encryption and decryption, including:

(1) The first storage node uses the communication key to decrypt the communication ciphertext to obtain the ciphertext of the working key, the hash value of the working key and the timestamp.

(2) The first storage node uses the protection key to decrypt the ciphertext of the working key to obtain the working key.

(3) The first storage node calculates the hash value of the working key.

(4) When the calculated hash value and the decrypted hash value are consistent, the first storage node uses the working key to encrypt and decrypt the data.

For the specific implementation principles of steps (1) to (4), please refer to the previous description and will not be repeated here.

Further, the first storage node uses the working key to perform data encryption, including:

The data is divided into granularities, and the data is encrypted according to the divided granularities.

For example, the data can be granularly divided according to rows or columns, and then the data can be encrypted according to rows or columns. This can provide fine-grained field content protection, encrypt data on demand, and improve the flexibility of data use.

This embodiment provides a data encryption and decryption method. The method is applied to a data encryption and decryption system. The system includes a key management server and multiple storage nodes; the system includes a key management server and multiple storage nodes; When the key management server receives a work key acquisition request from a first storage node among the plurality of storage nodes, the key management server determines whether the first timestamp carried in the work key acquisition request is a historical timestamp; wherein , the work key acquisition request is used to request to obtain the working key for encrypting and decrypting data. When the key management server determines that the first timestamp carried in the key acquisition request is the timestamp of the current day, the work key acquisition request is obtained. the first working key, and uses the protection key to encrypt the first working key to obtain the ciphertext of the first working key; and then the key management server uses the communication key to encrypt the first working key The ciphertext of the key, the hash value of the first working key and the current timestamp are encrypted to obtain the first communication ciphertext; the key management server returns the first communication ciphertext to the third communication ciphertext. A storage node; the first storage node obtains the first working key based on the first communication ciphertext, and uses the first working key to perform data encryption and decryption. In this way, the security of the working key is ensured through the multi-level protection mechanism of the working key, thereby ensuring data security.

Figure 5 is a flow chart of Embodiment 5 of the data encryption and decryption method provided by this application. Please refer to Figure 5. The method provided in this embodiment is based on the above embodiment. When the key management server determines that the first timestamp carried in the working key acquisition request is a historical timestamp, the method Also includes:

S501. The key management server searches for the target correspondence related to the first timestamp from the correspondence between the stored ciphertext of the working key, the hash value of the working key and the timestamp. relation.

S502. The key management server uses the communication key to encrypt the ciphertext of the historical working key in the target correspondence relationship, the hash value and the timestamp of the historical working key to obtain the second communication ciphertext.

S503. The key management server returns the second communication ciphertext to the first storage node.

S504. The first storage node obtains the historical working key based on the second communication ciphertext, and uses the historical working key to perform data encryption and decryption.

Specifically, the specific implementation process of this step may include:

(1) The first storage node uses the communication key to decrypt the second communication ciphertext to obtain the ciphertext of the historical working key, the hash value of the historical working key and the historical timestamp.

(2) The first storage node uses the protection key to decrypt the ciphertext of the historical working key to obtain the historical working key.

(3) The first storage node calculates the hash value of the historical working key.

(4) When the calculated hash value and the decrypted hash value are consistent, the first storage node uses the historical working key to encrypt and decrypt the data.

Specifically, for the specific implementation process of steps (1) to (4), reference may be made to the description in the above embodiments, which will not be described again here.

In the data encryption and decryption method provided by this embodiment, when the first timestamp carried in the working key acquisition request is a historical timestamp, the key management server obtains the ciphertext of the working key and the working key from the stored working key. In the correspondence between the hash value and the timestamp, by searching for the target correspondence related to the first timestamp, and then using the communication key to compare the historical working key in the target correspondence. The ciphertext, the hash value of the historical working key and the timestamp are encrypted to obtain a second communication ciphertext, thereby returning the second communication ciphertext to the first storage node; the first storage The node obtains the historical working key based on the second communication ciphertext, and uses the historical working key to perform data encryption and decryption. In this way, the corresponding relationship between the stored ciphertext of the working key, the hash value of the working key and the timestamp can be used to find the target corresponding relationship related to the first timestamp, and then based on the target corresponding relationship. Obtain historical working keys to ensure the security of data transmission.

Corresponding to the foregoing embodiment of a data encryption and decryption method, this application also provides an embodiment of a data encryption and decryption system. Figure 6 is a schematic diagram of the data encryption system provided by this application. Please refer to Figure 6. The system provided by this implementation includes a key management server and multiple storage nodes; wherein,

The key management server is configured to, when receiving a work key acquisition request from a first storage node among the plurality of storage nodes, determine whether the first timestamp carried in the work key acquisition request is historical. Timestamp; wherein, the working key acquisition request is used to request to obtain the working key for encrypting and decrypting data;

The key management server is also configured to use the communication key to encrypt the ciphertext of the first working key, the hash value of the first working key and the current timestamp to obtain the first communication ciphertext. , and return the first communication ciphertext to the first storage node;

The plurality of storage nodes are configured to obtain the first working key based on the first communication ciphertext, and use the first working key to perform data encryption and decryption.

Optionally, the key management server is further configured to store the ciphertext of the first working key, the hash value of the first working key and the ciphertext of the first working key after obtaining the ciphertext of the first working key. Describe the correspondence between the three current timestamps.

Optionally, the key management server is also configured to, when determining that the first timestamp carried in the work key acquisition request is a historical timestamp, obtain the ciphertext of the work key and the Among the correspondences between the hash value and the timestamp, find the target correspondence related to the first timestamp;

The key management server is also configured to use the communication key to encrypt the ciphertext of the historical working key in the target correspondence relationship, the hash value and the timestamp of the historical working key to obtain the first 2. Communication cipher text;

The key management server is also configured to return the second communication ciphertext to the first storage node;

The first storage node is also configured to obtain the historical working key based on the second communication ciphertext, and use the historical working key to perform data encryption and decryption.

Optionally, the first storage node is also used to decrypt the communication ciphertext using the communication key to obtain the ciphertext of the working key, the hash value of the working key and the timestamp;

The first storage node is also configured to use the protection key to decrypt the ciphertext of the working key to obtain the working key;

The first storage node is also used to calculate the hash value of the working key, and when the calculated hash value is consistent with the hash value obtained by decryption, use the working key to encrypt and decrypt data. .

The specific implementation process of the functions and roles of each unit in the above system can be found in the implementation process of the corresponding steps in the above method, and will not be described again here.

The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the present application. within the scope of protection.

Claims (10)

1. The data encryption and decryption method is characterized in that the method is applied to a key management server; the method comprises the following steps:

when a working key acquisition request from a storage node is received, judging whether a first timestamp carried by the working key acquisition request is a historical timestamp or not; the working key acquisition request is used for requesting to acquire a working key for encrypting and decrypting the data;

if not, acquiring a first working key of the current day, and encrypting the first working key by using a protection key to obtain a ciphertext of the first working key;

encrypting the ciphertext of the first working key, the hash value of the first working key and the current time stamp by using the communication key to obtain a first communication ciphertext;

and returning the first communication ciphertext to the storage node to instruct the storage node to acquire the first working key based on the first communication ciphertext, and encrypting and decrypting data by using the first working key.

2. The method of claim 1, wherein after the obtaining the first working key ciphertext, the method further comprises:

storing the corresponding relation among the ciphertext of the first working key, the hash value of the first working key and the current time stamp.

3. The method of claim 2, wherein when the first timestamp carried by the working key acquisition request is a historical timestamp, the method further comprises:

searching a target corresponding relation related to the first timestamp from the corresponding relation among the stored ciphertext of the working key, the hash value of the working key and the timestamp;

encrypting the ciphertext of the historical working key, the hash value of the historical working key and the historical timestamp in the target corresponding relation by using the communication key to obtain a second communication ciphertext;

and returning the second communication ciphertext to the storage node to instruct the storage node to acquire the historical working key based on the second communication ciphertext, and decrypting data by using the historical working key.

4. The method according to claim 1, wherein the method further comprises:

receiving an initialization instruction from an administrator client; the initialization instruction carries a main password and a protection key;

encrypting the protection key by using the master password to obtain a ciphertext of the protection key;

and when the ciphertext of the protection key is consistent with the ciphertext of the protection key stored locally at present, storing the ciphertext of the protection key.

5. The data encryption and decryption method is characterized in that the method is applied to a data encryption and decryption system, and the system comprises a key management server and a plurality of storage nodes; the method comprises the following steps:

when receiving a working key acquisition request from a first storage node in the plurality of storage nodes, the key management server judges whether a first timestamp carried by the working key acquisition request is a historical timestamp; the working key acquisition request is used for requesting to acquire a working key for encrypting and decrypting the data;

when judging that the first timestamp carried by the key acquisition request is the time stamp of the day, the key management server acquires a first working key of the day, and encrypts the first working key by using a protection key to obtain a ciphertext of the first working key;

the key management server encrypts the ciphertext of the first working key, the hash value of the first working key and the current timestamp by using a communication key to obtain a first communication ciphertext;

the key management server returns the first communication ciphertext to the first storage node;

and the first storage node acquires the first working key based on the first communication ciphertext, and encrypts and decrypts data by using the first working key.

6. The method of claim 5, wherein after the key management server obtains the first working key ciphertext, the method further comprises:

the key management server stores a correspondence relationship among the ciphertext of the first working key, the hash value of the first working key, and the current timestamp.

7. The method of claim 6, wherein the key management server, upon determining that the first timestamp carried by the working key acquisition request is a historical timestamp, further comprises:

the key management server searches a target corresponding relation related to the first timestamp from the corresponding relation among the stored ciphertext of the working key, the hash value of the working key and the timestamp;

the key management server encrypts ciphertext of a historical working key, a hash value of the historical working key and a time stamp in the target corresponding relation by using the communication key to obtain a second communication ciphertext;

the key management server returns the second communication ciphertext to the first storage node;

and the first storage node acquires the historical working key based on the second communication ciphertext and encrypts and decrypts data by utilizing the historical working key.

8. The method of claim 5, wherein the first storage node obtains a working key based on a communication ciphertext and encrypts and decrypts data using the working key, comprising:

the first storage node decrypts the communication ciphertext by using the communication key to obtain the ciphertext of the working key, the hash value of the working key and the time stamp;

the first storage node decrypts the ciphertext of the working key by using the protection key to obtain the working key;

the first storage node calculates a hash value of the working key;

and when the calculated hash value and the hash value obtained by decryption are consistent, the first storage node encrypts and decrypts the data by using the working key.

9. The method of claim 5, wherein the first storage node encrypting data using the working key comprises:

and carrying out granularity division on the data, and encrypting the data according to the granularity after division.

10. A data encryption and decryption system, wherein the system comprises a key management server and a plurality of storage nodes;

the key management server is used for judging whether a first timestamp carried by a working key acquisition request is a historical timestamp or not when the working key acquisition request from a first storage node in the plurality of storage nodes is received; the working key acquisition request is used for requesting to acquire a working key for encrypting and decrypting the data;

the key management server is further configured to, when determining that the first timestamp carried by the key acquisition request is a time stamp of the day, acquire a first working key of the day, and encrypt the first working key with a protection key to obtain a ciphertext of the first working key;

the key management server is further configured to encrypt, with a communication key, a ciphertext of the first working key, a hash value of the first working key, and a current timestamp, to obtain a first communication ciphertext, and return the first communication ciphertext to the first storage node;

the first storage node is configured to obtain the first working key based on the first communication ciphertext, and perform data encryption and decryption by using the first working key.