CN117061101A - Key updating method, device, equipment and storage medium - Google Patents

Abstract

The embodiment of the application provides a key updating method, a device, equipment and a storage medium, relating to the technical field of computers, wherein the method comprises the following steps: the service equipment responds to a state switching operation triggered by the application, a state switching request is sent to the management platform, the management platform replaces an original key with an updated key based on the state switching request, switches a common state strategy into a transitional state strategy and sends the transitional state strategy to the encryption equipment in real time, wherein the transitional state strategy can ensure coexistence of the new key and the old key, so that the encryption equipment can encrypt plaintext data of the application by adopting the updated key and send the obtained ciphertext data to the database. Meanwhile, the service equipment can synchronously bypass to execute batch data processing tasks, refresh stock data in the database, update a secret key in the secret state database and process the stock data under the condition that normal service provision of the application is not affected, and service availability of the application and the database is guaranteed.

Description

A key updating method, device, equipment and storage medium

Technical field

The embodiments of the present application relate to the field of computer technology, and in particular, to a key update method, device, equipment and storage medium.

Background technique

In the context of data as a new factor of production, security issues are of vital importance, and paying attention to data security has become a world trend. Sensitive data is encrypted and then transferred to the database. Sensitive data exists in the form of ciphertext in the database. Even database privileged accounts or operation and maintenance personnel cannot access plaintext data at the database level, thus effectively ensuring the security of user sensitive data.

However, when sensitive data is encrypted and then transferred to the database for storage to ensure the security of the sensitive data, there is also a need to update the encryption key. Under the related technology, the existing data in the database is refreshed after the service is stopped. That is, the existing data is decrypted using the old key and then encrypted with the new key. The service is restarted after the existing data is refreshed.

However, during the period of refreshing the existing data, the application cannot provide external services. Moreover, when the amount of existing data is large, the service outage will be longer, which will affect the service availability of the application and database.

Contents of the invention

Embodiments of the present application provide a key updating method, device, equipment and storage medium, which are used to update the key and process the existing data in the database without affecting the normal provision of services by the application, ensuring the security of the application and the database. Service Availability.

On the one hand, embodiments of the present application provide a key update method, which is applied to service equipment, including:

In response to the state switching operation triggered by the application, send a state switching request to the management platform, the state switching request is used to instruct the management platform to replace the original key with the updated key; switch the ordinary state policy to the transition state policy, And deliver the transition state policy to the encryption device, where the transition state policy at least includes: the original key and the updated key;

Send plaintext data to the encryption device, so that the encryption device uses the update key to encrypt the plaintext data, obtain ciphertext data and send the ciphertext data to the database;

The bypass performs a key refresh operation on the existing data in the database based on the original key and the updated key to obtain updated data.

On the one hand, embodiments of the present application provide a key update method, which is applied to the management platform, including:

Receive a state switching request sent by the service device, the state switching request being sent by the service device in response to a state switching operation triggered for the application;

Based on the state switching request, replace the original key with the updated key; switch the ordinary state policy to a transition state policy, and deliver the transition state policy to the encryption device, where the transition state policy at least includes: The original key and the updated key; so that when the encryption device receives the plaintext data sent by the service device, it uses the updated key to encrypt the plaintext data, obtains the ciphertext data, and encrypts the plaintext data. The ciphertext data is sent to the database; the existing data in the database is bypassed by the service device to perform a key refresh operation based on the original key and the updated key.

On the one hand, embodiments of the present application provide a key update method, which is applied to encryption devices, including:

Receive the transition state policy issued by the management platform. The transition state policy at least includes: an original key and an update key. The transition state policy is that after the management platform receives the state switching request sent by the service device, The original key is replaced with the updated key and obtained from the normal state policy switch;

Receive the plaintext data sent by the service device;

The plaintext data is encrypted using the updated key, ciphertext data is obtained and the ciphertext data is sent to a database. The stock data in the database is bypassed by the service device based on the original key and The update key performs a key refresh operation.

On the one hand, embodiments of the present application provide a key update device, which is applied to service equipment, including:

The first sending module is configured to send a state switching request to the management platform in response to the state switching operation triggered by the application. The state switching request is used to instruct the management platform to replace the original key with the updated key; The policy is switched to a transition state policy, and the transition state policy is delivered to the encryption device, where the transition state policy at least includes: the original key and the updated key;

The first sending module is also used to send plaintext data to the encryption device, so that the encryption device uses the updated key to encrypt the plaintext data, obtains ciphertext data, and converts the ciphertext data into Data is sent to the database;

A refresh module, configured to perform a key refresh operation on the existing data in the database based on the original key and the update key to obtain updated data.

Optionally, the refresh module is specifically used for:

The bypass uses the original key to decrypt the existing data to obtain the existing plaintext data;

The bypass uses the update key to encrypt the existing plaintext data to obtain the update data.

Optionally, the refresh module is also used to:

Based on the original key and the updated key, the bypass receives a batch processing task of the existing data issued by the management platform before performing a key refresh operation on the existing data in the database.

Optionally, it also includes a first receiving module;

The first sending module is also used for:

Send a data reading request carrying original query conditions to the encryption device, where the original query conditions include a plaintext query field, so that the encryption device uses the original key to encrypt the plaintext query field, and obtain The first encrypted field, and the update key is used to encrypt the plain text query field to obtain the second encrypted field, and the query conditions containing the first encrypted field and the query conditions containing the second encrypted field are combined Splicing to obtain a target query condition; and querying the database to obtain a ciphertext query result set based on the target query condition, where the ciphertext query result set includes: the first ciphertext data obtained through the first encrypted field query , and the second ciphertext data obtained through the second encrypted field query;

The first receiving module is specifically used for:

Receive a plaintext query result set returned by the encryption device. The plaintext query result set includes: the first plaintext data obtained by decrypting the first ciphertext data using the original key, and the updated key pair. The second plaintext data is obtained by decrypting the second ciphertext data.

Optionally, the first sending module is also used to:

The bypass uses the update key to encrypt the existing plaintext data. After obtaining the update data, in response to the state recovery operation triggered for the application, a state recovery request is sent to the management platform. The state switching request is used to indicate The management platform switches the transition state policy to a common state policy, and delivers the common state policy to the encryption device, where the common state policy includes: the update key.

On the one hand, embodiments of the present application provide a key update device, which is applied to a management platform and includes:

The second receiving module is configured to receive a state switching request sent by the service device, where the state switching request is sent by the service device in response to a state switching operation triggered for an application;

A processing module, configured to replace the original key with the updated key based on the state switching request; switch the ordinary state policy to the transition state policy;

The second sending module is configured to send the transition state policy to the encryption device. The transition state policy at least includes: the original key and the update key; so that the encryption device receives the When the plaintext data is sent by the service device, the update key is used to encrypt the plaintext data, obtain the ciphertext data and send the ciphertext data to the database; the stock data in the database is bypassed by the service device based on The original key and the updated key perform a key refresh operation.

On the one hand, embodiments of the present application provide a key update device, which is applied to encryption equipment, including:

The third receiving module is used to receive the transition state policy issued by the management platform. The transition state policy at least includes: an original key and an updated key. The transition state policy is a state sent by the management platform after receiving it from the service device. After the switch request, replace the original key with the updated key obtained from the normal state policy switch;

The third receiving module is used to receive the plaintext data sent by the service device;

An encryption module, configured to encrypt the plaintext data using the update key, obtain ciphertext data, and send the ciphertext data to a database. The stock data in the database is bypassed by the service device based on the The original key and the updated key are used to perform the key refresh operation.

Optionally, the third receiving module is also configured to receive a data reading request carrying original query conditions sent by the service device, where the original query conditions include a plain text query field;

The encryption module is also configured to use the original key to encrypt the plaintext query field to obtain a first encrypted field, and to use the updated key to encrypt the plaintext query field to obtain a second encrypted field. and splice the query condition including the first encrypted field with the query condition including the second encrypted field to obtain the target query condition; query the ciphertext query result set from the database based on the target query condition, so The ciphertext query result set includes: the first ciphertext data obtained through the first encryption field query, and the second ciphertext data obtained through the second encryption field query; using the original key to Decrypt the first ciphertext data to obtain the first plaintext data, and use the update key to decrypt the second ciphertext data to obtain the second plaintext data; which will include the first plaintext data and the second plaintext data. The clear text query result set of the data is sent to the service device.

On the one hand, embodiments of the present application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above key update method is implemented. A step of.

On the one hand, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the above key update method. A step of.

In the embodiment of this application, the service device responds to the state switching operation triggered by the application and sends a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with an updated key and switches the ordinary state policy to Transition state policy, and deliver the transition state policy to the encryption device in real time. The transition state policy can ensure the coexistence of old and new keys, so that the encryption device can use the updated key to encrypt the application's plaintext data and obtain the ciphertext. Data is sent to the database. At the same time, the service device can synchronize and bypass the execution of batch data processing tasks, refresh the existing data in the database, and realize the update of keys in the dense database and the processing of existing data without affecting the normal service provided by the application, ensuring the application and database service availability.

Description of the drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings needed to describe the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting any creative effort.

Figure 1 is a schematic structural diagram of a system architecture provided by an embodiment of the present application;

Figure 2 is a schematic flow chart of a key update method provided by an embodiment of the present application;

Figure 3 is a schematic flow chart of a state recovery method provided by an embodiment of the present application;

Figure 4 is a schematic flow chart of a key update device provided by an embodiment of the present application;

Figure 5 is a schematic flow chart of a key update device provided by an embodiment of the present application;

Figure 6 is a schematic flow chart of a key update device provided by an embodiment of the present application;

Figure 7 is a schematic structural diagram of a computer device provided by an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and beneficial effects of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention.

Refer to Figure 1, which is a system architecture diagram applicable to the embodiment of the present application. The system architecture at least includes a service device 101, a management platform 102, an encryption device 103 and a database 104. The management platform 102 and the encryption device 103 can be two An independent device can also be integrated into one device, which is not specifically limited in this application.

The management platform 102 includes a key management module and a policy management module. The key management module is used for key management, and the policy management module is used for managing encryption and decryption policies.

The service device 101 and the management platform 102 can be independent physical servers, or a server cluster or distributed system composed of multiple physical servers, or they can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, and networks. Services, cloud communications, middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and cloud servers for basic cloud computing services such as big data and artificial intelligence platforms. The service device 101 and the management platform 102 can be connected directly or indirectly through wired or wireless communication methods, which is not limited in this application.

The encryption device 103 is placed in front of the database 104. Before the plaintext data of the service device 101 is stored in the database 104, it needs to be encrypted by the encryption device 103. That is, the database 104 stores ciphertext data. Therefore, the database 104 can also be called Dense database.

Based on the system architecture diagram shown in Figure 1, the embodiment of the present application provides a process of a key update method, as shown in Figure 2. The process of the method is interactively executed by the service device, the management platform, the encryption device and the database, including Following steps:

Step S201: The service device responds to the state switching operation triggered by the application and sends a state switching request to the management platform.

Specifically, the application on the service device logs in to the management platform. When the application switches from the normal state to the transition state, the service device sends a state switching request to the management platform.

Step S202: Based on the state switching request, the management platform replaces the original key with the updated key, and switches the ordinary state policy to the transition state policy.

Specifically, the management platform includes a key management module and a policy management module. When the management platform receives the state switching request, the key management module replaces the original key with the updated key, and then triggers the policy management module to switch from the ordinary state policy to the transition state policy, where the ordinary state policy includes the update key, the transition state The policy includes: original key and updated key, such as key: keyID1|keyID2. In addition to the key, the normal state policy and the transition state policy each include other policy information, such as databases, tables, fields and other information required for encryption by the application.

Step S203: The management platform delivers the transition state policy to the encryption device.

Specifically, after receiving the transition state policy, the encryption device also switches from the normal state policy to the transition state policy.

Step S204: The encryption device receives the plaintext data sent by the service device.

Step S205: The encryption device uses the updated key to encrypt the plaintext data to obtain ciphertext data.

Specifically, the plaintext data is the data that the application needs to newly write into the database; the encryption device uses the new key to encrypt the plaintext data to obtain the ciphertext data.

Step S206: The encryption device sends the ciphertext data to the database.

Step S207: The service device bypass performs a key refresh operation on the existing data in the database based on the original key and the updated key to obtain updated data.

In the embodiment of this application, the service device responds to the state switching operation triggered by the application and sends a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with an updated key and switches the ordinary state policy to Transition state policy, and deliver the transition state policy to the encryption device in real time. The transition state policy can ensure the coexistence of old and new keys, so that the encryption device can use the updated key to encrypt the application's plaintext data and obtain the ciphertext. Data is sent to the database. At the same time, the service device can synchronize and bypass the execution of batch data processing tasks, refresh the existing data in the database, and realize the update of keys in the dense database and the processing of existing data without affecting the normal service provided by the application, ensuring the application and database service availability.

In some embodiments, the service device sends a data read request carrying original query conditions to the encryption device, where the original query conditions include a plaintext query field. The encryption device uses the original key to encrypt the plaintext query field to obtain the first encrypted field, and uses the updated key to encrypt the plaintext query field to obtain the second encrypted field, and compares the query condition containing the first encrypted field with the query condition containing the first encrypted field. The query conditions of the two encrypted fields are spliced together to obtain the target query conditions.

The ciphertext query result set is obtained from the database query based on the target query conditions. The ciphertext query result set includes: the first ciphertext data obtained through the first encrypted field query, and the second ciphertext data obtained through the second encrypted field query; Use the original key to decrypt the first ciphertext data to obtain the first plaintext data, and use the updated key to decrypt the second ciphertext data to obtain the second plaintext data; convert the plaintext containing the first plaintext data and the second plaintext data The query result set is sent to the service device.

Specifically, in the transition state, the database contains not only new data encrypted with the updated key, but also existing data encrypted with the original key. In order to ensure the integrity of the data query results, a parser is used to rewrite the original query conditions (i.e., the original query statement), that is, the original key is used to encrypt the plaintext query field, the first encrypted field is obtained, and the update key is used to encrypt the plaintext The query field is encrypted to obtain the second encrypted field, and the query condition containing the first encrypted field is spliced with the query condition containing the second encrypted field to obtain the target query condition (i.e., the target query statement), and the target query condition is used for data query At this time, all ciphertext data before and after the key change can be queried, all ciphertext data can be decrypted to obtain all plaintext data, and then all plaintext data can be sent to the service device.

For example, set the original key to key 1, the update key to key 2, and the original query statement is: "select*from table_A where name=Zhang San", that is, the original query statement includes: the plain text field "Zhang San" three". The SQL parser in the encryption device uses key 1 to encrypt the plaintext field "Zhang San" to obtain ciphertext 1; then uses key 2 to encrypt the plaintext field "Zhang San" to obtain ciphertext 2. The SQL parser uses the union statement to splice the query statement containing ciphertext 1 and the query statement containing ciphertext 2 to obtain the target query statement: "select*from table_A where name=ciphertext1union(select*from table_A where name=ciphertext Text 2)".

In some embodiments, after the management platform switches the normal state policy to the transition state policy, it creates a batch processing task of existing data, and then delivers the batch processing task of existing data to the service device. The service device bypass uses the original key to decrypt the existing data and obtains the existing plain text data; the bypass uses the updated key to encrypt the existing plain text data and obtains the updated data.

In practical applications, the service device reads the existing data in the database in batches, uses the original key to decrypt the existing data, then uses the update key to encrypt the existing plaintext data, and rewrites the obtained updated data into the database. During the key refresh process, the pressure on the database is controlled within an appropriate range by controlling parameters (such as the number of concurrencies and the amount of data processed in batches), so that it will not affect the application's normal service provision. After the existing data is refreshed, the existing data batch processing task is terminated, and the database contains ciphertext data encrypted with the update key.

In some embodiments, after the inventory data is refreshed, the application returns to the normal state, and the encryption and decryption policies are updated accordingly. See Figure 3, which includes the following steps:

Step S301: The service device responds to the state recovery operation triggered by the application and sends a state recovery request to the management platform.

Step S302: The management platform switches the transition state policy to the normal state policy based on the state recovery request.

Step S303: The management platform delivers the normal state policy to the encryption device.

Common state policies include: Update keys.

Step S304: The encryption device receives the plaintext data sent by the service device.

Step S305: The encryption device uses the updated key to encrypt the plaintext data to obtain ciphertext data.

Step S306: The encryption device sends the ciphertext data to the database.

Specifically, after the existing data processing is completed, the application returns to the normal running state, the encryption and decryption policy of the management platform switches back to the normal state policy (the key in the normal state policy only contains the update key), and the management platform issues the encryption and decryption policy in real time. to the encryption device.

In the embodiment of this application, the service device performs batch data processing tasks in synchronous bypass, refreshes the existing data in the database, and returns to the normal state after the refresh is completed, so as to realize the normal service provision of the application without affecting the application. Update keys and process existing data in dense databases to ensure the service availability of applications and databases.

Based on the same technical concept, the embodiment of the present application provides a schematic structural diagram of a key update device, which is applied to service equipment. As shown in Figure 4, the device 400 includes:

The first sending module 401 is configured to send a state switching request to the management platform in response to the state switching operation triggered by the application. The state switching request is used to instruct the management platform to replace the original key with the updated key; replace the ordinary key with the updated key. The state policy is switched to a transition state policy, and the transition state policy is delivered to the encryption device, where the transition state policy at least includes: the original key and the updated key;

The first sending module 401 is also used to send plaintext data to the encryption device, so that the encryption device uses the update key to encrypt the plaintext data, obtains ciphertext data, and encrypts the ciphertext data. Send text data to the database;

The refresh module 402 is configured to bypass and perform a key refresh operation on the existing data in the database based on the original key and the update key to obtain updated data.

Optionally, the refresh module 402 is specifically used to:

The bypass uses the original key to decrypt the existing data to obtain the existing plaintext data;

The bypass uses the update key to encrypt the existing plaintext data to obtain the update data.

Optionally, the refresh module 402 is also used to:

Based on the original key and the updated key, the bypass receives a batch processing task of the existing data issued by the management platform before performing a key refresh operation on the existing data in the database.

Optionally, it also includes a first receiving module 403;

The first sending module 401 is also used to:

Send a data reading request carrying original query conditions to the encryption device, where the original query conditions include a plaintext query field, so that the encryption device uses the original key to encrypt the plaintext query field, and obtain The first encrypted field, and the update key is used to encrypt the plain text query field to obtain the second encrypted field, and the query conditions containing the first encrypted field and the query conditions containing the second encrypted field are combined Splicing to obtain a target query condition; and querying the database to obtain a ciphertext query result set based on the target query condition, where the ciphertext query result set includes: the first ciphertext data obtained through the first encrypted field query , and the second ciphertext data obtained through the second encrypted field query;

The first receiving module 403 is specifically used for:

Receive a plaintext query result set returned by the encryption device. The plaintext query result set includes: the first plaintext data obtained by decrypting the first ciphertext data using the original key, and the updated key pair. The second plaintext data is obtained by decrypting the second ciphertext data.

Optionally, the first sending module 401 is also used to:

The bypass uses the update key to encrypt the existing plaintext data. After obtaining the update data, in response to the state recovery operation triggered for the application, a state recovery request is sent to the management platform. The state switching request is used to indicate The management platform switches the transition state policy to a common state policy, and delivers the common state policy to the encryption device, where the common state policy includes: the update key.

Based on the same technical concept, the embodiment of the present application provides a schematic structural diagram of a key update device, which is applied to the management platform. As shown in Figure 5, the device 500 includes:

The second receiving module 501 is configured to receive a state switching request sent by the service device, where the state switching request is sent by the service device in response to a state switching operation triggered for an application;

The processing module 502 is configured to replace the original key with the updated key based on the state switching request; switch the ordinary state policy to the transition state policy;

The second sending module 503 is configured to send the transition state policy to the encryption device. The transition state policy at least includes: the original key and the update key; so that the encryption device receives the When the plaintext data is sent by the service device, the plaintext data is encrypted using the update key, the ciphertext data is obtained, and the ciphertext data is sent to the database; the existing data in the database is bypassed by the service device A key refresh operation is performed based on the original key and the updated key.

Based on the same technical concept, the embodiment of the present application provides a schematic structural diagram of a key update device, which is applied to encryption equipment. As shown in Figure 6, the device 600 includes:

The third receiving module 601 is used to receive the transition state policy issued by the management platform. The transition state policy at least includes: the original key and the updated key. The transition state policy is the management platform receiving the transition state policy sent by the service device. After the state switch request, replace the original key with the updated key obtained from the ordinary state policy switch;

The third receiving module 601 is used to receive the plaintext data sent by the service device;

The encryption module 602 is configured to encrypt the plaintext data using the update key, obtain ciphertext data, and send the ciphertext data to a database. The stock data in the database is bypassed by the service device based on The original key and the updated key perform a key refresh operation.

Optionally, the third receiving module 601 is also configured to receive a data reading request carrying original query conditions sent by the service device, where the original query conditions include a plain text query field;

The encryption module 602 is also configured to use the original key to encrypt the plaintext query field to obtain a first encrypted field, and to use the updated key to encrypt the plaintext query field to obtain a second encrypted field. field, and splice the query condition including the first encrypted field with the query condition including the second encrypted field to obtain the target query condition; query the ciphertext query result set from the database based on the target query condition, The ciphertext query result set includes: the first ciphertext data obtained through the first encryption field query, and the second ciphertext data obtained through the second encryption field query; using the original key pair Decrypt the first ciphertext data to obtain the first plaintext data, and use the update key to decrypt the second ciphertext data to obtain the second plaintext data; including the first plaintext data and the second plaintext data. The plaintext query result set of plaintext data is sent to the service device.

In the embodiment of this application, the service device responds to the state switching operation triggered by the application and sends a state switching request to the management platform. Based on the state switching request, the management platform replaces the original key with an updated key and switches the ordinary state policy to Transition state policy, and deliver the transition state policy to the encryption device in real time. The transition state policy can ensure the coexistence of old and new keys, so that the encryption device can use the updated key to encrypt the application's plaintext data and obtain the ciphertext. Data is sent to the database. At the same time, the service device can synchronize and bypass the execution of batch data processing tasks, refresh the existing data in the database, and realize the update of keys in the dense database and the processing of existing data without affecting the normal service provided by the application, ensuring the application and database service availability.

Based on the same technical concept, embodiments of the present application provide a computer device. The computer device may be at least one of the service device, management platform, and encryption device shown in Figure 7. As shown in Figure 7, it includes at least one process The processor 701 and the memory 702 connected to at least one processor. The specific connection medium between the processor 701 and the memory 702 is not limited in the embodiment of this application. In Figure 7, the processor 701 and the memory 702 are connected through a bus as an example. . The bus can be divided into address bus, data bus, control bus, etc.

In this embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. At least one processor 701 can execute the steps of the above key update method by executing the instructions stored in the memory 702.

Among them, the processor 701 is the control center of the computer equipment. It can use various interfaces and lines to connect various parts of the computer equipment, and implement encryption by running or executing instructions stored in the memory 702 and calling data stored in the memory 702. Key update. Optionally, the processor 701 may include one or more processing units. The processor 701 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor The debug processor mainly handles wireless communications. It can be understood that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips.

The processor 701 may be a general processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors. Logic devices and discrete hardware components can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

As a non-volatile computer-readable storage medium, the memory 702 can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, for example, may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk, CDs etc. Memory 702 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer device. The memory 702 in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.

Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device is caused to perform the steps of the above key update method. .

Those skilled in the art will understand that embodiments of the present invention may be provided as methods, or computer program products. Thus, the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer device or other programmable data processing device produce Means for implementing the functions specified in a process or processes of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer device or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, The instruction means implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer device or other programmable data processing device, such that a series of operating steps are performed on the computer device or other programmable device to produce processing implemented by the computer device, thereby causing the computer device or other programmable data processing device to perform a process on the computer device or other programmable data processing device. The instructions executed on the device provide steps for implementing the functions specified in the process or processes of the flow diagrams and/or the block or blocks of the block diagrams.

Although the preferred embodiments of the present invention have been described, those skilled in the art will be able to make additional changes and modifications to these embodiments once the basic inventive concepts are apparent. Therefore, it is intended that the appended claims be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims (13)

1. A key updating method applied to a service device, comprising:

responding to a state switching operation triggered by aiming at an application, and sending a state switching request to a management platform, wherein the state switching request is used for indicating the management platform to replace an original key with an updated key; switching the common state strategy into a transitional state strategy, and issuing the transitional state strategy to the encryption equipment, wherein the transitional state strategy at least comprises: the original key and the updated key;

the plaintext data is sent to the encryption equipment, so that the encryption equipment encrypts the plaintext data by adopting the updated secret key to obtain ciphertext data and sends the ciphertext data to a database;

and bypassing the key refreshing operation on the stock data in the database based on the original key and the updated key to obtain updated data.

2. The method of claim 1, wherein the bypassing, based on the original key and the updated key, performs a key refresh operation on the stock data in the database, comprising:

the bypass adopts the original secret key to decrypt the stock data to obtain stock plaintext data;

and the bypass adopts the updating key to encrypt the stock plaintext data to obtain the updating data.

3. The method of claim 1, wherein the bypass further comprises, prior to performing a key refresh operation on the stock data in the database based on the original key and the updated key:

and receiving the batch processing task of the stock data issued by the management platform.

4. The method as recited in claim 1, further comprising:

sending a data reading request carrying an original query condition to the encryption equipment, wherein the original query condition comprises a plaintext query field, so that the encryption equipment encrypts the plaintext query field by adopting the original key to obtain a first encryption field, encrypts the plaintext query field by adopting the updated key to obtain a second encryption field, and splices the query condition containing the first encryption field with the query condition containing the second encryption field to obtain a target query condition; and obtaining a ciphertext query result set from the database query based on the target query condition, the ciphertext query result set comprising: first ciphertext data obtained by the first encryption field query, and second ciphertext data obtained by the second encryption field query;

Receiving a plaintext query result set returned by the encryption device, wherein the plaintext query result set comprises: and decrypting the first plaintext data obtained by adopting the original key and the second plaintext data obtained by adopting the updating key.

5. The method of claim 1, wherein the bypass encrypts the stock plaintext data using the update key, and further comprising, after obtaining the update data:

responding to a state recovery operation triggered by an application, sending a state recovery request to a management platform, wherein the state switching request is used for indicating the management platform to switch a transitional state strategy into a common state strategy and issuing the common state strategy to encryption equipment, and the common state strategy comprises the following steps: the update key.

6. A key updating method applied to a management platform, comprising:

receiving a state switching request sent by service equipment, wherein the state switching request is sent by the service equipment in response to a state switching operation triggered by an application;

replacing the original key with an updated key based on the state switching request; switching the common state strategy into a transitional state strategy, and issuing the transitional state strategy to the encryption equipment, wherein the transitional state strategy at least comprises: the original key and the updated key; when receiving the plaintext data sent by the service equipment, the encryption equipment encrypts the plaintext data by adopting the updated key to obtain ciphertext data and sends the ciphertext data to a database; and bypassing, by a service device, the stock data in the database to perform a key refreshing operation based on the original key and the updated key.

7. A key updating method applied to an encryption device, comprising:

receiving a transition state strategy issued by a management platform, wherein the transition state strategy at least comprises: the transient state strategy is obtained by replacing the original key with the updated key and switching from the common state strategy after the management platform receives a state switching request sent by service equipment;

receiving plaintext data sent by the service equipment;

encrypting the plaintext data by adopting the updated key to obtain ciphertext data and sending the ciphertext data to a database, wherein the stock data in the database is bypassed by the service equipment to carry out key refreshing operation based on the original key and the updated key.

8. The method as recited in claim 7, further comprising:

receiving a data reading request carrying an original query condition sent by service equipment, wherein the original query condition comprises a plaintext query field;

encrypting the plaintext query field by adopting the original key to obtain a first encrypted field, encrypting the plaintext query field by adopting the updated key to obtain a second encrypted field, and splicing the query condition containing the first encrypted field with the query condition containing the second encrypted field to obtain a target query condition;

Obtaining a ciphertext query result set from the database query based on the target query condition, the ciphertext query result set comprising: first ciphertext data obtained by the first encryption field query, and second ciphertext data obtained by the second encryption field query;

decrypting the first ciphertext data by using the original key to obtain first plaintext data, and decrypting the second ciphertext data by using the updated key to obtain second plaintext data;

and sending a plaintext query result set containing the first plaintext data and the second plaintext data to the service device.

9. A key updating apparatus applied to a service device, comprising:

the system comprises a first sending module, a second sending module and a management platform, wherein the first sending module is used for responding to a state switching operation triggered by an application and sending a state switching request to the management platform, and the state switching request is used for indicating the management platform to replace an original key with an updated key; switching the common state strategy into a transitional state strategy, and issuing the transitional state strategy to the encryption equipment, wherein the transitional state strategy at least comprises: the original key and the updated key;

The first sending module is further configured to send plaintext data to the encryption device, so that the encryption device encrypts the plaintext data by using the updated key to obtain ciphertext data and send the ciphertext data to a database;

and the refreshing module is used for bypassing the execution of key refreshing operation on the stock data in the database based on the original key and the updated key to obtain updated data.

10. A key updating apparatus applied to a management platform, comprising:

the second receiving module is used for receiving a state switching request sent by the service equipment, wherein the state switching request is sent by the service equipment in response to a state switching operation triggered by the application;

the processing module is used for replacing the original key with the updated key based on the state switching request; switching the common state strategy into a transition state strategy;

the second sending module is configured to send the transitional state policy to an encryption device, where the transitional state policy at least includes: the original key and the updated key; when receiving the plaintext data sent by the service equipment, the encryption equipment encrypts the plaintext data by adopting the updated key to obtain ciphertext data and sends the ciphertext data to a database; and bypassing, by a service device, the stock data in the database to perform a key refreshing operation based on the original key and the updated key.

11. A key updating apparatus applied to an encryption device, comprising:

the third receiving module is configured to receive a transitional state policy issued by the management platform, where the transitional state policy at least includes: the transient state strategy is obtained by replacing the original key with the updated key and switching from the common state strategy after the management platform receives a state switching request sent by service equipment;

the third receiving module is used for receiving the plaintext data sent by the service equipment;

and the encryption module is used for encrypting the plaintext data by adopting the updated key to obtain ciphertext data and sending the ciphertext data to a database, and the server device bypasses the stock data in the database to perform key refreshing operation based on the original key and the updated key.

12. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method of any of claims 1-8 when the program is executed.

13. A computer readable storage medium, characterized in that it stores a computer program executable by a computer device, which program, when run on the computer device, causes the computer device to perform the steps of the method according to any one of claims 1-8.