CN115102708B

CN115102708B - Data processing method and device

Info

Publication number: CN115102708B
Application number: CN202210482762.4A
Authority: CN
Inventors: 冯冲; 王子宁; 颜琦锐
Original assignee: Alibaba China Co Ltd
Current assignee: Alibaba China Co Ltd
Priority date: 2022-05-05
Filing date: 2022-05-05
Publication date: 2024-04-09
Anticipated expiration: 2042-05-05
Also published as: CN115102708A

Abstract

The embodiment of the specification provides a data processing method and device, wherein the data processing method comprises the following steps: applied to a data processing system, the system comprising a data node, the method comprising: the data node receives a data processing request submitted for data to be processed, and responds to the data processing request to read a target key, wherein the target key is generated by at least two key nodes with communication relation with the data node according to a sub key created by node attribute information corresponding to the data node; and the data node processes the data to be processed based on the target key to generate target data. The method and the device realize that at least two sub-keys are obtained through at least two transmission channels, and the target key is generated on the basis of the at least two sub-keys, so that the safety of the target key is ensured. And then the data is processed through the target key, so that the safety of data processing is further improved.

Description

Data processing method and device

Technical Field

Embodiments of the present disclosure relate to the field of computer technologies, and in particular, to a data processing method and apparatus.

Background

With the development of the internet and digitization technology, applications around data including sensitive data such as user data, customer data, patient data, and enterprise core data have been advanced into everyday life. Data security is critical to the user. At present, encryption is a mainstream practice mode for protecting sensitive data as a plurality of methods for protecting user data security, and constructing strict data encryption capability can help users to improve core data security capability. However, the key generation method in the current encryption method is simple, and there is a risk of easy cracking. Accordingly, there is a need to provide a solution to the above-mentioned problems.

Disclosure of Invention

In view of this, the embodiments of the present specification provide a data processing method, and the present specification also relates to a key generation method, a data processing apparatus, a key generation apparatus, a computing device, a computer-readable storage medium, and a computer program, to solve the technical drawbacks existing in the prior art.

According to a first aspect of embodiments of the present specification, there is provided a data processing method, for use in a data processing system, the system comprising a data node, the method comprising:

the data node receives a data processing request submitted for data to be processed, and responds to the data processing request to read a target key, wherein the target key is generated by at least two key nodes with communication relation with the data node according to a sub key created by node attribute information corresponding to the data node;

and the data node processes the data to be processed based on the target key to generate target data.

According to a second aspect of embodiments of the present specification, there is provided a key generation method applied to a key generation system, the system comprising a data node and at least two key nodes, the method comprising:

The data node reads node attribute information and sends the node attribute information to each key node;

each key node receives the node attribute information, creates a subkey corresponding to the node attribute information and sends the subkey to the data node;

and the data node receives the subkeys sent by each key node and generates a target key according to the subkeys.

According to a third aspect of embodiments of the present specification, there is provided a data processing apparatus for use in a data processing system, the system comprising a data node, the apparatus comprising:

the reading module is configured to receive a data processing request submitted for data to be processed by the data node, and read a target key in response to the data processing request, wherein the target key is generated by at least two key nodes with a communication relationship with the data node according to a subkey created by node attribute information corresponding to the data node;

and the processing module is configured to process the data to be processed based on the target key by the data node to generate target data.

According to a fourth aspect of embodiments of the present specification, there is provided a key generation apparatus for use in a key generation system, the system comprising a data node and at least two key nodes, the apparatus comprising:

The read information module is configured to read node attribute information by the data node and send the node attribute information to each key node;

the creation module is configured to receive the node attribute information by each key node, create a subkey corresponding to the node attribute information and send the subkey to the data node;

the generation module is configured to receive the subkeys sent by each key node by the data node and generate a target key according to the subkeys.

According to a fifth aspect of embodiments of the present specification, there is provided a computing device comprising:

a memory and a processor;

the memory is configured to store computer executable instructions that, when executed by the processor, implement the steps of the data processing method or the key generation method described above.

According to a sixth aspect of embodiments of the present specification, there is provided a computer readable storage medium storing computer executable instructions which, when executed by a processor, implement the steps of the data processing method or key generation method described above.

According to a seventh aspect of the embodiments of the present specification, there is provided a computer program, wherein the computer program, when executed in a computer, causes the computer to perform the steps of the data processing method or key generation described above.

The data processing method is applied to a data processing system, and the system comprises a data node, wherein the data node receives a data processing request submitted for data to be processed, and reads a target key in response to the data processing request, wherein the target key is generated by at least two key nodes with a communication relationship with the data node according to a sub-key created by node attribute information corresponding to the data node; and the data node processes the data to be processed based on the target key to generate target data. The method and the device realize that at least two sub-keys are obtained through at least two transmission channels, and the target key is generated on the basis of the at least two sub-keys, so that the safety of the target key is ensured. And then the data is processed through the target key, so that the safety of data processing is further improved.

Drawings

FIG. 1 is a schematic view of a data processing method according to an embodiment of the present disclosure;

FIG. 2 is a flow chart of a method of data processing provided in one embodiment of the present disclosure;

FIG. 3 is a schematic diagram illustrating interactions in a data processing method according to one embodiment of the present disclosure;

FIG. 4 is a process flow diagram of a data processing method applied to a communication scenario provided in one embodiment of the present disclosure;

FIG. 5 is a flow chart of a key generation method provided by one embodiment of the present description;

FIG. 6 is a schematic diagram of a data processing apparatus according to one embodiment of the present disclosure;

fig. 7 is a schematic structural diagram of a key generating device according to an embodiment of the present disclosure;

FIG. 8 is a block diagram of a computing device provided in one embodiment of the present description.

Detailed Description

In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present description. This description may be embodied in many other forms than described herein and similarly generalized by those skilled in the art to whom this disclosure pertains without departing from the spirit of the disclosure and, therefore, this disclosure is not limited by the specific implementations disclosed below.

The terminology used in the one or more embodiments of the specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of the specification. As used in this specification, one or more embodiments and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used in one or more embodiments of the present specification refers to and encompasses any or all possible combinations of one or more of the associated listed items.

It should be understood that, although the terms first, second, etc. may be used in one or more embodiments of this specification to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first may also be referred to as a second, and similarly, a second may also be referred to as a first, without departing from the scope of one or more embodiments of the present description. The word "if" as used herein may be interpreted as "at … …" or "at … …" or "responsive to a determination", depending on the context.

First, terms related to one or more embodiments of the present specification will be explained.

Key component: one key is a key component, and the two key components are finally combined into one key for encryption and/or decryption.

Key component 1: the data key component V1 is used to derive the first of the two components of the data key.

Key component 2: a data key component V2 for deriving the second of the two components of the data key.

Area controller: the management and control system at the regional level is responsible for management of communication nodes, configuration of keys, acquisition and issuing.

Communication node controller: and the management and control system on the communication node is responsible for management of the communication node, acquisition of the key and the like.

Gateway: refers to a virtual gateway or gateway device for forwarding traffic, and is typically composed of multiple servers.

Bottom encryption module: the traffic encryption module on the data node is responsible for encrypting and decrypting the data packet in the communication data transmission.

Flow inlet and outlet: and a functional module for controlling network traffic by using the secret key on the communication node.

Digital certificate: it is a digital authentication for marking the identity information of each party in the internet communication, and people can use it to identify the identity of the other party on the internet. Digital certificates are also referred to as digital identifications. The digital certificate ensures the integrity and the security of information and data in an encrypted or decrypted form for the information and the data of network users in computer network communication.

In the present specification, a data processing method is provided, and the present specification relates to a key generation method, a data processing apparatus, a key generation apparatus, a computing device, and a computer-readable storage medium, which are described in detail in the following embodiments one by one.

Referring to fig. 1, fig. 1 is a schematic view of a scenario of a data processing method according to an embodiment of the present disclosure. The application scenario may include a data node, a control node, a key node.

The data nodes comprise a data node 1 and a data node 2; the key nodes comprise a key node 1 (key service 1) and a key node 2 (key service 2); in the implementation, each data node comprises a data node controller and a bottom encryption module; the data node controller is a management and control system on the data node and is responsible for management of the data node, acquisition of a key and the like. In practical applications, the data node controller may interact with the control node, receive the subkey 1 (key component 1) sent by the control node, and interact with the key node 2 to obtain the subkey 2 (key component 2). The bottom encryption module is a traffic encryption module on the data node and is responsible for encrypting and decrypting the data packet in the data transmission. In practical applications, the bottom encryption module may store the subkey 1 and the subkey 2 obtained by the data node controller, and synthesize the subkey 1 and the subkey 2 to generate an encryption and/or decryption key.

The control node can be configured with a control node as a regional level management and control system (namely, a regional controller) or a control node corresponding to a type of data node as a type level management and control system, and the control node can divide the data according to other information so as to configure the corresponding control node. The control node is responsible for data node management, key configuration, acquisition and issuing. In practical application, the control node may interact with the key node 1, obtain the subkey 1 from the key service 1, and return the subkey 1 to the data node controller of the data node through the transmission path of the subkey 1.

The key node 1 generates a subkey 1 used by a data node for data processing; the key node 2 generates a subkey 2 for the data node to process data, and transmits the subkey 2 to a data node controller of the data node through a subkey 2 transmission path.

Before data communication is performed between the data node 1 and the data node 2, the bottom encryption module of the data node synthesizes a key for encrypting (i.e. encrypting traffic) or decrypting traffic coming in and going out from a traffic gateway (a functional module for controlling network traffic by using a key on the data node) according to the obtained subkey 1 and the subkey 2 (i.e. key component). The transmitted data is encrypted by the key, generating an encrypted data packet. And transmitting the encrypted data packet to a data node of the opposite communication end based on the routing path provided by the gateway.

In the embodiment of the specification, the security of the secret key is ensured mainly by adopting a mode of double secret key components (sub secret keys) +double issuing channels, so that the problem of single point attack existing in a single component or single channel encryption model is avoided. The security of data processing of the data node is improved by adopting the double-key component, the security of the key is improved by adopting a double-path issuing mode, and even if one key is lost or cracked, the other key component is still used for protection. In the data communication scene, not only the security of data transmission can be improved, but also the robustness of the traffic encryption scheme can be further improved. In addition, the subkey 1 generated by the key node 1 is issued to the bottom encryption module of the data node through the area controller, the subkey 2 generated by the key service 2 is obtained to the bottom encryption module of the data node through the data node pulling mode, the key components are mutually independent, and the flow encryption architecture of mutual decoupling of the key issuing components is realized.

Referring to fig. 2, fig. 2 is a flowchart of a data processing method according to an embodiment of the present disclosure. The data processing method is applied to a data processing system, the system comprises a data node, and the method specifically comprises the following steps:

Step 202: and the data node receives a data processing request submitted for the data to be processed, and responds to the data processing request to read a target key, wherein the target key is generated by at least two key nodes with communication relation with the data node according to a sub-key created by node attribute information corresponding to the data node.

The data node refers to a computing device for performing data processing, and the computing device may be a computer, a server, a mobile phone, etc., which is not limited herein. Specifically, the data processing performed by the data node may be data encryption, data decryption, data communication, and the like, which is not limited herein. Correspondingly, the data to be processed refers to the data to be processed. In practical applications, the data to be processed may be data to be stored and data to be communicated, and the data type and data content of the data to be processed may be arbitrary, which is not limited herein. The data processing request refers to a request for requesting data processing of data to be processed. The target key is a key used to process data to be processed.

In practical applications, the corresponding target key may be read according to a request type (such as an encryption type, a communication type, a decryption type, a storage type) of the data processing request, and the like. In addition, the same target key corresponding to all the data processing requests can be read after the data processing requests are received, and the method is not limited herein.

A key node refers to a computing device or functional module that is used to generate and manage keys. In particular implementations, the data node obtains the subkey from at least two key nodes in communication therewith. Since each key node belongs to different nodes, when the data nodes are in direct or indirect communication with the key nodes, the sub-keys created by the different key nodes are obtained through different transmission channels.

The sub-keys are understood as key components, and each sub-key is used as a component for generating the target key to generate the target key. Node attribute information is information related to data nodes; specifically, the node attribute information may be encryption information of the data node, network information (such as a network identifier, a network type, etc.) and/or user information (such as a user identifier, a user name, etc.) of the data node, and so on. Wherein the encryption information is information for indicating whether the data node supports encryption or decryption; network identification refers to information that may be used to identify a virtual network or physical network; user identification refers to information that can be used to uniquely identify a user.

Taking the Data node a as an example, when the Data node a receives a Data encryption request for the Data1 to be processed, the target key K is read in response to the Data encryption request.

In particular, since there may be at least one data node in the data processing system that needs to perform data processing according to the target key. Therefore, these data nodes all need to generate the target key in advance. In order to facilitate the generation and management of the sub-keys of the key nodes to different data nodes, the key nodes can create corresponding sub-keys according to the node attribute information so as to distinguish and manage the generated sub-keys, and further ensure the data processing order of the data nodes.

Because the target key is generated in the data node, the sub-key generated in the key node is acquired from at least two key nodes, and then the target key is generated according to the sub-key. In a first alternative embodiment provided in the present specification, the system further includes at least two key nodes, and the method further includes:

each key node creates a sub-key corresponding to the node attribute information and sends the sub-key to the data node;

and the data node generates a target key according to the subkeys sent by each key node.

In practical application, the data node sends the node attribute information to each key node, each key node responds to the node attribute information to generate sub-keys needed by the data node, and the sub-keys are sent to the data node through a transmission channel connected with each key node by the data node. And generating a target key by the data node according to the subkey.

Since each key node generates a sub-key, the data node needs to generate a target key from multiple sub-keys. In particular, the generation method of the target key according to the sub-key is various. The data node can combine the sub-keys to generate a combined key, and then generate the combined key through a key generation algorithm to obtain the target key. And the data node can also intercept part of information in each sub-key to splice so as to generate a spliced key, and then the spliced key is subjected to key generation by a key generation algorithm so as to obtain a target key. In addition, the data node can also directly adopt a key generation algorithm to a plurality of sub-keys to generate a target key.

The key generation algorithm may include: KDF (Key derivation function ), AES (Advanced Encryption Standard, advanced encryption standard algorithm), DES (Data Encryption Standard ) algorithm, SHA (Secure Hash Algorithm, secure hash algorithm), or the like, without limitation.

For example, the virtual network identifier read by the data node a is d1, and the user identifier is p1. The virtual network identification d1 and the user identification p1 are transmitted as node attribute information to the key node 1 and the key node 2. The key node 1 generates a subkey 1 corresponding to the node attribute information according to the random number and the AES algorithm, and sends the subkey 1 to the data node A. The key node 2 also generates a subkey 2 corresponding to the node attribute information according to the random number and the AES algorithm, and sends the subkey 2 to the data node a. After receiving the subkey 1 and the subkey 2, the data node a generates a target key K on the basis of the subkey 1 and the subkey 2 through a key derivation function.

In summary, the data node generates the target key according to the sub-key created and sent by each key node, and the security of the key itself is improved by adopting a multi-path issuing sub-key mode. Even if one subkey is lost or cracked, the other subkey is still protected. In addition, the key transmission paths are mutually independent, and the transmission components are mutually decoupled, so that the robustness of the data processing method is improved, the attack difficulty of an attacker is improved, and the safety of data is further ensured.

Consider that the risk of subkey leakage is greater if the subkey is transmitted in the clear. In order to increase the security of the sub-key transmission, the sub-key may be encrypted before being transmitted to the data node, and the second alternative embodiment provided in the present specification further includes:

each key node creates a sub-key corresponding to the node attribute information, encrypts the sub-key through a preset key, generates an encrypted sub-key and sends the encrypted sub-key to the data node;

and the data node decrypts the encrypted subkeys sent by each key node through the preset key to obtain the subkeys corresponding to each key node, and generates a target key according to the subkeys corresponding to each key node.

The preset key may be a key preset by the key node and the data node to encrypt or decrypt the sub-key. The preset key may be generated by any device or means and distributed to the key nodes and data nodes after generation. The preset key can be a symmetric key or an asymmetric key. Under the condition that the preset key is a symmetric key, the sub-key is directly encrypted or decrypted through the preset key. Under the condition that the preset key is an asymmetric key, the sub-key can be encrypted by the key node through a public key in the preset key, and then the sub-key can be decrypted by the data node through a private key in the preset key. In addition, the secret key node may encrypt the subkey through a private key in the preset secret key, and the data node may decrypt the subkey through a public key in the preset secret key, which is not limited herein. Accordingly, encrypting the subkey refers to the subkey generated after encrypting the subkey.

In specific implementation, different key nodes can use the same preset key to encrypt, or can use different preset keys to encrypt respectively, and the method is not limited herein. In the case that different key nodes encrypt the subkeys by using different preset keys, the data node also needs to decrypt the encrypted subkeys by using the preset keys corresponding to the key nodes.

In the above example, after the key node 1 generates the sub-key 1, the sub-key 1 is encrypted by the symmetric key k1, the encrypted sub-key 1 is generated, and the encrypted sub-key 1 is transmitted to the data node a. After generating the key 2, the key node 2 encrypts the sub-key 2 also by means of the symmetric key k1, generates an encrypted sub-key 2 and sends the encrypted sub-key 2 to the data node a. After receiving the encryption subkey 1 and the encryption subkey 2, the data node a decrypts the encryption subkey 1 through the symmetric key k1 to obtain the subkey 1, and decrypts the encryption subkey 2 through the symmetric key k1 to obtain the subkey 2. And generating a target key K on the basis of the sub-key 1 and the sub-key 2 through a key derivation function.

In summary, the key node encrypts the created sub-key to generate an encrypted sub-key, and then sends the encrypted sub-key to the data node, and then the data node decrypts the encrypted sub-key, so that the secure transmission of the sub-key is realized, the security of the sub-key is further improved, and the security of the target key is also potentially improved.

In an actual scenario, in the case that the number of the data nodes may be multiple, in order to facilitate management of the data nodes, corresponding control nodes may be set for the data nodes, and issuing of the subkeys may be implemented through the control nodes. In a third alternative implementation manner provided by the embodiments of the present specification, the system further includes a control node, at least one indirect communication key node is included in the at least two key nodes, and the method further includes:

the control node receives node attribute information sent by the data node and sends the node attribute information to the indirect communication key node;

the indirect communication key node creates an indirect communication subkey corresponding to the node attribute information; encrypting the indirect communication subkey through a node public key in the digital certificate corresponding to the node attribute information to obtain an encrypted indirect communication subkey, and sending the encrypted indirect communication subkey to the control node;

the control node sends the encrypted indirect communication subkey to the data node;

and the data node decrypts the encrypted indirect communication subkey through the node private key corresponding to the node public key to obtain an indirect communication subkey, and takes the indirect communication subkey as the subkey corresponding to the indirect communication key node.

An indirect communication key node refers to a key node that does not communicate directly with a data node, but indirectly through a control node and a data node. The number of the indirect communication key nodes may be one or more, and is not limited herein. And the control node is responsible for data node management, key configuration, acquisition and issuing.

In the implementation, after the data node is ready, i.e. after the data processing service is provided, node attribute information is sent to the corresponding control node. After receiving the node attribute information sent by the data node, the control node forwards the node attribute information to the indirect communication key node so that the indirect communication key node creates an indirect communication subkey corresponding to the node attribute information. The indirect communication subkey may be understood as a subkey created by the indirect communication key node. In particular, the specific implementation manner of creating the indirect communication subkey is similar to the specific implementation manner of creating the subkey, and the specific implementation manner of creating the subkey is referred to above, without limitation.

In practical application, if the node attribute information is the encryption information (i.e. whether encryption or decryption is supported) of the data nodes, because the encryption information of the data nodes supporting encryption or decryption under the management of the same control node is the same, the data nodes correspond to the same indirect communication subkeys; if the node attribute information is a network identifier and/or a user identifier, the network identifiers and/or the user identifiers of the data nodes may be different. In the case where the node attribute information is different, these data nodes may correspond to different indirect communication subkeys.

Digital certificates refer to certificates used to authenticate data nodes. The digital certificate may include: node public key of data node, public key validity period, etc. The node public key refers to a public key extracted from a digital certificate. In practical application, the control node is required to send the digital certificate of the data node and the node attribute information to the indirect communication key node for storage. After the indirect communication sub-key is created by the indirect communication key node, the indirect communication sub-key can be encrypted by the node public key, and an encrypted indirect communication sub-key (i.e., an encrypted indirect communication sub-key) is generated. And then the encrypted indirect communication subkey is sent to the control node. And forwarding the encrypted indirect communication subkey to the data node by the control node. And decrypting the encrypted indirect communication subkey by a node private key corresponding to a node public key prestored on the data node to obtain a subkey (namely an indirect communication subkey) corresponding to the indirect communication key node.

Such as: the key node 1 is an indirect communication key node, after the data node A sends the node attribute information to the control node, the control node sends the node attribute information to the key node 1, after the key node 1 creates an indirect communication sub-key, the indirect communication sub-key is encrypted through a node public key k2 in a pre-stored digital certificate C1 of the data node A, an encrypted indirect communication sub-key is generated, and the encrypted indirect communication sub-key is sent to the control node. And then the control node sends the encrypted indirect communication subkey to the data node A. After receiving the encrypted indirect communication subkey, the data node A decrypts the encrypted indirect communication subkey through a node private key k3 corresponding to the node public key k2 to obtain the indirect communication subkey. The indirect communication subkey is used as the subkey corresponding to the key node 1.

In summary, the data node interacts with the indirect communication key node through the control node, the control node obtains the encrypted indirect communication subkey generated by the indirect communication key node, and then issues the encrypted indirect communication subkey to the data node. The control node is used for interacting with the indirect communication key node instead, so that the control node can uniformly manage the data nodes communicated with the control node. In addition, the control node is used for butting the indirect communication key nodes, so that the indirect communication key nodes are prevented from being frequently butted with different data nodes, the safety of the indirect communication key nodes is ensured, and the safety of subkeys required by the data nodes is further ensured.

In particular implementations, it is contemplated that after an indirect communication sub-key is created by an indirect communication key node, a node public key may not have been received that requires encryption thereof. Accordingly, the present specification embodiment further includes:

the indirect communication key node creates an intermediate key corresponding to the node attribute information, encrypts the indirect communication sub-key through the intermediate key to obtain an intermediate encryption sub-key, and sends an intermediate key identifier corresponding to the intermediate key and the intermediate encryption sub-key to the control node;

The control node sends the digital certificate corresponding to the node attribute information, the intermediate key identifier and the intermediate encryption sub-key to the indirect communication key node under the condition that the digital certificate sent by the data node and the node attribute information are received;

and the indirect communication key node decrypts the intermediate encryption sub-key according to the intermediate key corresponding to the intermediate key identifier to obtain the indirect communication sub-key.

The intermediate key refers to a key used to encrypt the indirect communication subkey, thereby generating an intermediate encrypted subkey. The intermediate encryption subkey is not required to be sent to the data node and is only used for being stored in the control node. Accordingly, the intermediate key identifier refers to information for uniquely identifying the intermediate key, and the information may be a pure number, may be formed by combining a number and a letter, and may be formed in other manners, which are not limited herein.

In practical application, after receiving the digital certificate and the node attribute information sent by the data node, the control node searches the intermediate key identifier and the intermediate encryption subkey which are pre-stored in the control node through the node attribute information. And sends both and the digital certificate to the indirect communication key node.

After the indirect communication key node receives the digital certificate, the intermediate key identifier and the intermediate encryption sub-key, the intermediate key for encrypting the intermediate encryption sub-key can be determined according to the intermediate key identifier. And then decrypting the intermediate encryption subkey through the intermediate key to obtain the indirect communication subkey. And encrypting the indirect communication subkey by the node public key in the digital certificate to generate an encrypted indirect communication subkey. The encrypted indirect communication subkey is sent to the control node. The control node forwards the encrypted indirect communication subkey to the data node for decryption so that the data node obtains the indirect communication subkey.

Along the above example, after the key node 1 receives the node attribute information of the data node a sent by the control node, an intermediate key k4 and an indirect communication subkey corresponding to the node attribute information are created. And encrypts the indirect communication subkey with the intermediate key k4 to generate an intermediate encrypted subkey. Then, the node attribute information, the intermediate key identification ID1 of the intermediate key k4, and the intermediate encryption sub-key are transmitted to the control node. The data node a, after obtaining the digital certificate, also transmits the digital certificate and node attribute information to the control node.

After receiving the digital certificate C1 and the node attribute information, the control node determines the corresponding intermediate key identification ID1 and intermediate encryption sub-key according to the node attribute information, and sends the digital certificate C1, the intermediate key identification ID1 and the intermediate encryption sub-key to the key node 1. The key node 1 can determine the intermediate key k4 according to the received intermediate key identifier ID1, and then decrypt the intermediate encrypted subkey through the intermediate key k4 to obtain the indirect communication subkey. And encrypting the indirect communication subkey through the node public key k2 in the digital certificate C1, generating an encrypted indirect communication subkey, and transmitting the encrypted indirect communication subkey to the control node.

After receiving the encrypted indirect communication subkey, the control node sends the encrypted indirect communication subkey to the data node A. After receiving the encrypted indirect communication subkey, the data node A decrypts the encrypted indirect communication subkey through a node private key k3 corresponding to the node public key k2 to obtain the indirect communication subkey. The indirect communication subkey is used as the subkey corresponding to the key node 1.

In summary, the indirect communication key node encrypts the created indirect communication subkey once before receiving the digital certificate sent by the control node, and sends the encryption result (the intermediate encryption subkey) to the control node, and the control node sends the encryption result and the digital certificate to the indirect communication key node after receiving the digital certificate. The indirect communication secret key node is guaranteed to be capable of rapidly conducting encryption processing on the indirect communication secret sub-key based on the received data public key in the digital certificate, and therefore safety of the indirect communication secret sub-key in the process of being transmitted to the data node is guaranteed.

In practice, a digital certificate of a data node needs to be generated in advance so as to perform identity verification on the data node. Thus, in an embodiment of the present specification, the system further comprises a certificate service node, the method further comprising:

the data node creates a node private key and a certificate request corresponding to the node private key based on a preset key algorithm, and sends the certificate request to a certificate service node;

and the certificate service node generates a digital certificate corresponding to the node private key according to the certificate request and sends the digital certificate to the data node.

The certificate service node refers to an organization, a company, a device or the like which can provide a digital certificate. The preset key algorithm may be an RSA algorithm. The data node can generate a private key (namely a node private key) and a certificate request corresponding to the private key according to the RSA algorithm. The certificate request is used to request generation of a corresponding digital certificate. Specifically, the certificate request may be a CSR (Certificate Signing Request, certificate request file).

The data node sends a certificate request to the certificate service node on the basis of creating the certificate request. The certificate service node can generate a digital certificate corresponding to the node private key according to the certificate request, and return the digital certificate to the data node.

Such as: the data node A generates a node private key k3 and a certificate request file CSR1 corresponding to the node private key through an RSA algorithm, and sends the CSR1 to a certificate service node. The certificate service node generates a digital certificate C1 according to the CSR1 and sends the digital certificate C1 to the data node a.

In sum, after the data node generates the node private key and the certificate request, the certificate service node generates the digital certificate corresponding to the node private key based on the certificate request, so that the reliability of the digital certificate is ensured, and the security of the subkey is further ensured.

In practical applications, at least two key nodes may include a direct communication key node in addition to an indirect communication key node. In an embodiment of the present disclosure, the at least two key nodes further include at least one direct communication key node, and the method further includes:

the certificate service node sends the node attribute information and the digital certificate to the direct communication key node;

the direct communication key node creates a direct communication subkey corresponding to the node attribute information, encrypts the direct communication subkey through a node public key in the data certificate, generates an encrypted direct communication subkey, and sends the encrypted direct communication subkey to the data node;

And the data node decrypts the encrypted direct communication subkey through the node private key to generate a direct communication subkey, and takes the direct communication subkey as a subkey corresponding to the direct communication key node.

The direct communication key node refers to a key node which can directly interact with the data node. In particular, in order to facilitate secure communication of the data node by the direct communication key node, after the certificate service node generates the digital certificate, the node attribute information of the data node and the digital certificate are transmitted to the direct communication key node. The direct communication subkey refers to a subkey created by the direct communication key node.

In order to ensure the security of the direct communication subkey in the transmission process, the direct communication subkey can be encrypted by a node public key in the digital certificate, so as to obtain an encrypted direct communication subkey (namely, an encrypted direct communication subkey). The encrypted direct communication subkey is sent to the data node. After receiving the encrypted direct communication subkey sent by the direct communication key node, the data node can decrypt the encrypted direct communication subkey through the private key of the self-storage node to obtain the direct communication subkey.

In summary, the direct communication subkey is encrypted in the direct communication key node by the node public key in the digital certificate, and the encrypted direct communication subkey is obtained. And then the encrypted direct communication subkey is sent to the data node, and the data node decrypts the encrypted direct communication subkey, so that the safety of the direct communication subkey in the transmission process is ensured.

In practical application, since the direct communication key node directly communicates with the data node, more data nodes can interact with the direct communication key node, and in order to ensure the security of the subkey, the data node needs to be authenticated. Thus, in embodiments of the present description, the method further comprises:

the data node signs the digital certificate through the node private key to generate an encryption certificate, and sends the encryption certificate and the node attribute information to the direct communication key node;

the direct communication key node decrypts the encryption certificate according to the node public key in the data certificate corresponding to the node attribute information; and executing the creation of the direct communication subkey corresponding to the node attribute information under the condition that decryption is successful.

Specifically, signing the digital certificate by the node private key may also be understood as encrypting the digital certificate by the node private key. The encrypted digital certificate, i.e., the encrypted certificate, can be generated after encryption. And on the basis of the data node generating the encryption certificate, transmitting the encryption certificate and the node attribute information to the direct communication key node. Since the direct communication key node has previously received the digital certificate sent by the certificate service node. The digital certificate has a node public key that can decrypt the encrypted certificate.

If the node public key in the digital certificate corresponding to the node attribute information stored in the direct communication key node can decrypt the encrypted certificate, the data node identity verification is proved to pass, and a direct communication sub-key can be created for the data node; if the node public key in the digital certificate corresponding to the node attribute information stored in the direct communication key node can not decrypt the encrypted certificate, the identity verification of the data node is not passed, and the data node is not processed.

In sum, under the condition that the direct communication secret key node successfully decrypts the encryption certificate through the node public key, the direct communication secret sub-key is created again, the direct communication secret sub-key is prevented from being sent to the data node with unknown identity, and the safety of the direct communication secret sub-key is guaranteed.

In the specific implementation, as shown in fig. 3, a data node is initialized by a control node, and after the data node is initialized, the control node requests an initialization key a from a key node 1. The key node 1 may send the key a to the control node after generating the key a. After receiving the key a, the control node issues the key a to the data node controller of the data node. And the data node controller sends the key A to a bottom encryption module of the data node for storage, namely the key A is stored through the bottom encryption module. In addition, after the data node is initialized, the data node controller of the data node requests the initialization key B from the key node 2, and acquires the key B generated by the key node 2. And storing the key B to the bottom encryption module of the data node. After the underlying cryptographic module stores key a and key B, a ready notification is sent by the data node controller to the control node to indicate that the data node is ready for data processing.

Step 204: and the data node processes the data to be processed based on the target key to generate target data.

Specifically, the data node receives the data processing request and determines the target key, so that the data to be processed can be processed based on the target key.

In practical application, in the data communication scenario, since the target key may be changed, in order to ensure the security and effectiveness of the communication between the data nodes, the target key needs to be identified by the key version identifier. After data transmission, the target key for decryption needs to be determined by the key version identification. Accordingly, the present specification embodiment further includes:

the data node creates a key version identifier corresponding to the target key; encrypting the data to be processed based on the target key to generate target data;

the data node determines a corresponding opposite-end data node according to the data processing request; transmitting the target data and the key version identifier to the opposite-end data node;

the opposite-end data node determines the corresponding target key based on the key version identifier;

and the opposite-end data node decrypts the target data according to the target key to obtain decrypted data.

The key version identification refers to information that can uniquely identify the version of the target key. Specifically, the key version identifier may be a version serial number, a version name, or the like, which is not limited herein. The decrypted data is plaintext data generated after decrypting the target data, and the content of the decrypted data is the same as the content of the data to be processed.

In the implementation, in the data communication scenario, the data processing node may carry information for identifying the peer data node. Based on this information, the data node can determine the correspondent data node for receiving the target data. And then the target data and the key version identification are sent to the opposite-end data node. After the correspondent data node receives the information, it can search the target key for decrypting the target data by using the correspondent relationship between the key version identification and the target key.

In practical application, when the target data and the key version identifier are sent to the opposite-end data node, the key version identifier can be added to the packet header part of the data packet of the target data for data transmission. It should be noted that, in order to ensure that the same target key can be used between the data node and the opposite data node to encrypt or decrypt the data. The data node at the opposite end is used as a data node, which also generates the target key and the key version identifier corresponding to the target key in the same way as the data node, and in addition, the node attribute information is the same. In the implementation, after the data node determines that the node attribute information of the data node already has the corresponding subkey, the subkey can be directly synchronized, and the generation of the subkey is not needed.

In a cloud service scenario, typically one user may own multiple virtual networks, and data nodes within the same virtual network under the same user may communicate. Therefore, in the communication scene of the cloud service, the node attribute information of the data node is a virtual network identifier and a user identifier. The virtual network identity and the user identity of the data nodes communicating with each other are the same, i.e. the node attribute information is the same. Therefore, when the node attribute information already has a corresponding subkey, the subkey generation is not required.

The communication data among the data nodes adopting the same encryption mode under a plurality of sub-keys are encrypted and decrypted, so that the reliability and the safety of data interaction among the data nodes are ensured, and the safety problems of traffic hijacking, content tampering, information leakage and the like in the communication process are avoided. Compared with the encryption scheme of the single key model (when the key link node is broken, the security of the single key model is not guaranteed), the encryption mode of the multi-key component has higher security, and can ensure that communication data can not be decrypted even if the single key is acquired by an attacker.

For example, after creating the target key K, the data node a creates a key version E corresponding to the target key K. And encrypting the data to be processed through the target key K to generate target data D. And then determining the opposite end data node B corresponding to the opposite end node identification ID2 according to the opposite end node identification ID2 carried in the data communication request. And sends the target data D and the key version E to the correspondent data node B.

In summary, in the data communication scene, the data to be processed is encrypted through the target key, and then the target data is decrypted through the target key corresponding to the key version identifier by the opposite-end data node, so that the safety of data communication is ensured.

In view of the diversity of data nodes, some data nodes do not conduct encrypted communications. In this case, the encryption of the data node may be broadcast by the gateway node in order to avoid sending encrypted data thereto. In an embodiment of the present specification, the system further includes a gateway node, and the method further includes:

the data node sends the key version identification and the node identification of the data node to a gateway node with a communication relationship with the data node;

and the gateway node broadcasts the key version identifier and the node identifier.

In particular, the gateway node has a communication relationship with the data node, and the routing information indicating the data node originates from the gateway node. I.e. the data node needs the gateway node to provide the routing information required for the communication. In addition, the gateway node receives configuration information, namely an encrypted version identifier and a node identifier, of the data node. After the gateway node receives this information, it broadcasts it to the data nodes in communication with the gateway node (i.e., other data nodes in communication with the data nodes).

In practical applications, some data nodes do not support encrypted communication, and then the corresponding key version identifiers of the data nodes in the gateway node are null. In this case, when the data nodes communicate with each other, if the key version identifier is determined to be empty, the data to be communicated is not encrypted, that is, the data to be communicated in the clear is directly transmitted.

Such as: on the basis of determining the opposite end node identification ID2, the data node A firstly reads the broadcast information corresponding to the opposite end node identification ID2 sent by the gateway node, and determines whether the key version identification of the opposite end data node B is empty; if the data is empty, indicating that the opposite end data node B does not support the encrypted communication, directly sending the data to be processed to the opposite end data node B. If the data is not null, indicating that the opposite end data node B supports encrypted communication, the target data D and the key version E are sent to the opposite end data node B.

In summary, the gateway node broadcasts the key version identifier of the data node, so that the data node communicating with the data node can instantly acquire the key condition of the data node, thereby guaranteeing the effectiveness of data communication.

In particular, in order to further ensure security of the target key, the target key needs to be updated, and in this embodiment of the present disclosure, further includes:

And the data node updates the target key according to a preset time interval, generates an updated key and takes the updated key as the target key.

The preset time interval refers to a preset time interval. The time interval may be 1 hour, 1 day, 1 week, etc., and is not limited herein. In particular, the process of updating the target key may be understood as a process of re-reconstructing the target key. Updating the key refers to the updated target key. In practical application, after updating the target key each time, the corresponding key version identifier needs to be updated, and the key version identifier is sent to the gateway node to inform the gateway node of the change of the target key.

For example, the data node a updates the target key K at intervals of each day to generate the updated key K1, and takes the updated key K1 as the target key K.

In sum, the target key is updated according to the preset time interval, so that the target key can be updated frequently, and the safety of data processing is improved.

Referring to fig. 4, fig. 4 shows a process flow chart of a data processing method applied to a communication scenario according to an embodiment of the present disclosure, and specifically includes the following steps.

Step 402: the data node a reads the node attribute information and transmits the node attribute information to the key node 1 and the key node 2.

Step 404: the key node 1 creates a sub-key 1 corresponding to the node attribute information, encrypts the sub-key 1 through a preset key, generates an encrypted sub-key 1 and sends the encrypted sub-key 1 to the data node A.

Step 406: the key node 2 creates a sub-key 2 corresponding to the node attribute information, encrypts the sub-key 2 through a preset key, generates an encrypted sub-key 2 and sends the encrypted sub-key 2 to the data node A.

Specifically, the execution order of steps 404 and 406 may be interchanged or parallel, which is not limited herein.

Step 408: the data node A decrypts the encrypted subkey 1 sent by the key node 1 through a preset key to obtain the subkey 1 corresponding to the key node 1, and decrypts the encrypted subkey 2 sent by the key node 2 through the preset key to obtain the subkey 2 corresponding to the key node 2.

Step 410: and the data node A generates a target key according to the sub-key 1 and the sub-key 2, and creates a key version identifier corresponding to the target key.

Step 412: the data node a sends the key version identification and the node identification to a gateway node having a communication relationship with the data node a.

Step 414: the network node broadcasts the key version identification and the node identification.

Step 416: the data node a receives a data communication request for data to be communicated and reads a target key in response to the data communication request.

Step 418: the data node A encrypts the data to be communicated based on the target key to generate target data.

Step 420: and the data node A determines a corresponding opposite-end data node B according to the data communication request, and sends the target data and the key version identification to the opposite-end data node B.

Specifically, after determining the opposite end data node B, the data node a further needs to determine whether the key version identifier broadcasted by the gateway node for the opposite end data node B is null; and if the target data is not null, sending the target data and the key version identification corresponding to the target key in the data node A to the opposite data node B.

Step 422: the correspondent data node B determines the corresponding target key based on the key version identification.

Step 424: and the opposite-end data node B decrypts the target data according to the target key to obtain decrypted data.

Specifically, the decrypted data is the same as the data to be communicated, and is the data after the data to be communicated is communicated.

The data processing method is applied to a data processing system, the system comprises a data node A and a data node B, the data node A receives a data communication request submitted for data to be communicated, and a target key is read in response to the data communication request, wherein the target key is generated by a key node 1 and a key node 2 which have communication relation with the data node A and are created according to node attribute information corresponding to the data node A; and the data node A processes the data to be communicated based on the target key to generate target data. The method and the device realize that two sub-keys are obtained through two transmission channels, and the target key is generated on the basis of the two sub-keys, so that the safety of the target key is ensured. And then the data is encrypted and communicated through the target key, so that the safety of data communication is further improved.

Corresponding to the data processing method embodiment, the present specification also provides a key generation method embodiment, which can correspond to the data processing embodiment when reading the present embodiment. Fig. 5 shows a flowchart of a key generation method according to an embodiment of the present disclosure, where the key generation method is applied to a key generation system, and the system includes a data node and at least two key nodes, and the method specifically includes the following steps:

Step 502: and the data node reads the node attribute information and sends the node attribute information to each key node.

Step 504: each key node receives the node attribute information, creates a subkey corresponding to the node attribute information and sends the subkey to the data node.

Step 506: and the data node receives the subkeys sent by each key node and generates a target key according to the subkeys.

Optionally, the method comprises:

the data node receives a data processing request submitted for data to be processed, and reads a target key in response to the data processing request;

Optionally, the method further comprises:

Optionally, the system further comprises a control node, at least one indirect communication key node is included in the at least two key nodes, and the method further comprises:

Optionally, the method further comprises:

Optionally, the system further comprises a certificate service node, the method further comprising:

Optionally, at least one direct communication key node is further included in the at least two key nodes, and the method further includes:

Optionally, the method further comprises:

Optionally, the system further comprises a gateway node, the method further comprising:

Optionally, the method further comprises:

The key generation method is applied to a key generation system, the system comprises data nodes and at least two key nodes, the data nodes read node attribute information and send the node attribute information to each key node; each key node receives the node attribute information, creates a subkey corresponding to the node attribute information and sends the subkey to the data node; and the data node receives the subkeys sent by each key node and generates a target key according to the subkeys. The method and the device realize that at least two sub-keys are obtained through at least two transmission channels, and the target key is generated on the basis of the at least two sub-keys, so that the safety of the target key is ensured.

Corresponding to the above-mentioned data processing method embodiment, the present disclosure further provides an embodiment of a data processing apparatus, and fig. 6 shows a schematic structural diagram of a data processing apparatus provided in one embodiment of the present disclosure. As shown in fig. 6, the data processing apparatus is applied to a data processing system, the system including a data node, the apparatus including:

a reading module 602, configured to receive a data processing request submitted for data to be processed by the data node, and read a target key in response to the data processing request, where the target key is generated by at least two key nodes having a communication relationship with the data node according to a subkey created by node attribute information corresponding to the data node;

and the processing module 604 is configured to process the data to be processed by the data node based on the target key to generate target data.

Optionally, the system further comprises at least two key nodes, and the apparatus further comprises:

the first creation module is configured to create a subkey corresponding to the node attribute information for each key node and send the subkey to the data node;

The first generation module is configured to generate a target key by the data node according to the subkeys sent by each key node.

Optionally, the apparatus further comprises:

the second creating module is configured to create a subkey corresponding to the node attribute information for each key node, encrypt the subkey through a preset key, generate an encrypted subkey and send the encrypted subkey to the data node;

the second generation module is configured to decrypt the encrypted subkeys sent by each key node through the preset keys by the data node, obtain the subkeys corresponding to each key node, and generate the target key according to the subkeys corresponding to each key node.

Optionally, the system further comprises a control node, at least one indirect communication key node is included in the at least two key nodes, and the apparatus further comprises:

the receiving module is configured to receive the node attribute information sent by the data node by the control node and send the node attribute information to the indirect communication key node;

a third creation module configured to create an indirect communication subkey corresponding to the node attribute information for the indirect communication key node; encrypting the indirect communication subkey through a node public key in the digital certificate corresponding to the node attribute information to obtain an encrypted indirect communication subkey, and sending the encrypted indirect communication subkey to the control node;

A transmission module configured to transmit the encrypted indirect communication subkey to the data node by the control node;

the first decryption module is configured to decrypt the encrypted indirect communication subkey through a node private key corresponding to the node public key to obtain an indirect communication subkey, and the indirect communication subkey is used as a subkey corresponding to the indirect communication key node.

Optionally, the apparatus further comprises:

a fourth creation module configured to create an intermediate key corresponding to the node attribute information by the indirect communication key node, encrypt the indirect communication sub-key by the intermediate key to obtain an intermediate encrypted sub-key, and send an intermediate key identifier corresponding to the intermediate key and the intermediate encrypted sub-key to the control node;

the second sending module is configured to send the digital certificate corresponding to the node attribute information, the intermediate key identifier and the intermediate encryption sub-key to the indirect communication key node when the control node receives the digital certificate sent by the data node and the node attribute information;

And the second decryption module is configured as the indirect communication secret key node and is used for decrypting the intermediate encryption subkey according to the intermediate secret key corresponding to the intermediate secret key identifier to obtain the indirect communication subkey.

Optionally, the system further comprises a certificate service node, and the apparatus further comprises:

the request module is configured to create a node private key and a certificate request corresponding to the node private key based on a preset key algorithm by the data node, and send the certificate request to a certificate service node;

and the generation certificate module is configured to generate a digital certificate corresponding to the node private key according to the certificate request by the certificate service node and send the digital certificate to the data node.

Optionally, at least one direct communication key node is further included in the at least two key nodes, and the apparatus further includes:

a transmission certificate module configured to transmit the node attribute information and the digital certificate to the direct communication key node by the certificate service node;

a fifth creation module configured to create a direct communication subkey corresponding to the node attribute information by the direct communication key node, encrypt the direct communication subkey by a node public key in the data certificate, generate an encrypted direct communication subkey, and send the encrypted direct communication subkey to the data node;

And the third decryption module is configured to decrypt the encrypted direct communication subkey through the node private key by the data node to generate a direct communication subkey, and the direct communication subkey is used as a subkey corresponding to the direct communication key node.

Optionally, the apparatus further comprises:

the signature module is configured to sign the digital certificate through the node private key by the data node, generate an encryption certificate and send the encryption certificate and the node attribute information to the direct communication key node;

a decryption certificate module configured to decrypt the encrypted certificate by the direct communication key node according to a node public key in a data certificate corresponding to the node attribute information; and executing the creation of the direct communication subkey corresponding to the node attribute information under the condition that decryption is successful.

Optionally, the apparatus further comprises:

the creating version module is configured to create a key version identifier corresponding to the target key for the data node; encrypting the data to be processed based on the target key to generate target data;

the data sending module is configured to determine a corresponding opposite-end data node according to the data processing request by the data node; transmitting the target data and the key version identifier to the opposite-end data node;

A determining key module configured to determine the corresponding target key based on the key version identifier by the peer data section;

and the decryption data module is configured to decrypt the target data according to the target key by the opposite-end data node to obtain decryption data.

Optionally, the system further comprises a gateway node, and the apparatus further comprises:

the sending identification module is configured to send the key version identification and the node identification of the data node to a gateway node with a communication relationship with the data node;

and the broadcasting module is configured to broadcast the key version identifier and the node identifier by the network node.

Optionally, the apparatus further comprises:

the updating module is configured to update the target key according to a preset time interval by the data node, generate an updating key and take the updating key as the target key.

The data processing device is applied to a data processing system, and the system comprises a data node, wherein the data node receives a data processing request submitted for data to be processed, and reads a target key in response to the data processing request, wherein the target key is generated by at least two key nodes with a communication relationship with the data node according to a sub-key created by node attribute information corresponding to the data node; and the data node processes the data to be processed based on the target key to generate target data. The method and the device realize that at least two sub-keys are obtained through at least two transmission channels, and the target key is generated on the basis of the at least two sub-keys, so that the safety of the target key is ensured. And then the data is processed through the target key, so that the safety of data processing is further improved.

Corresponding to the above-mentioned key generation method embodiment, the present disclosure further provides a key generation device embodiment, and fig. 7 shows a schematic structural diagram of a key generation device provided in one embodiment of the present disclosure. As shown in fig. 7, the key generation apparatus is applied to a key generation system, the system includes a data node and at least two key nodes, and the apparatus includes:

a read information module 702 configured to read node attribute information by the data node, and send the node attribute information to each key node;

a creating module 704, configured to receive the node attribute information by each key node, create a subkey corresponding to the node attribute information, and send the subkey to the data node;

the generating module 706 is configured to receive the subkeys sent by each key node by the data node, and generate a target key according to the subkeys.

Optionally, the apparatus further comprises:

The key generation device is applied to a key generation system, the system comprises data nodes and at least two key nodes, the data nodes read node attribute information and send the node attribute information to each key node; each key node receives the node attribute information, creates a subkey corresponding to the node attribute information and sends the subkey to the data node; and the data node receives the subkeys sent by each key node and generates a target key according to the subkeys. The method and the device realize that at least two sub-keys are obtained through at least two transmission channels, and the target key is generated on the basis of the at least two sub-keys, so that the safety of the target key is ensured.

Fig. 8 illustrates a block diagram of a computing device 800 provided in accordance with one embodiment of the present description. The components of computing device 800 include, but are not limited to, memory 810 and processor 820. Processor 820 is coupled to memory 810 through bus 830 and database 850 is used to hold data.

Computing device 800 also includes access device 840, access device 840 enabling computing device 800 to communicate via one or more networks 860. Examples of such networks include the Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the internet. Access device 840 may include one or more of any type of network interface, wired or wireless (e.g., a Network Interface Card (NIC)), such as an IEEE802.11 Wireless Local Area Network (WLAN) wireless interface, a worldwide interoperability for microwave access (Wi-MAX) interface, an ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a bluetooth interface, a Near Field Communication (NFC) interface, and so forth.

In one embodiment of the present description, the above-described components of computing device 800, as well as other components not shown in FIG. 8, may also be connected to each other, such as by a bus. It should be understood that the block diagram of the computing device illustrated in FIG. 8 is for exemplary purposes only and is not intended to limit the scope of the present description. Those skilled in the art may add or replace other components as desired.

Computing device 800 may be any type of stationary or mobile computing device including a mobile computer or mobile computing device (e.g., tablet, personal digital assistant, laptop, notebook, netbook, etc.), mobile phone (e.g., smart phone), wearable computing device (e.g., smart watch, smart glasses, etc.), or other type of mobile device, or a stationary computing device such as a desktop computer or PC. Computing device 800 may also be a mobile or stationary server.

Wherein the processor 820 is configured to execute computer-executable instructions that, when executed by the processor, perform the steps of the data processing method or the key generation method described above.

The foregoing is a schematic illustration of a computing device of this embodiment. It should be noted that, the technical solution of the computing device and the technical solution of the data processing method or the key generating method belong to the same concept, and details of the technical solution of the computing device, which are not described in detail, can be referred to the description of the technical solution of the data processing method or the key generating method.

An embodiment of the present disclosure also provides a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the data processing method or the key generation method described above.

The above is an exemplary version of a computer-readable storage medium of the present embodiment. It should be noted that, the technical solution of the storage medium and the technical solution of the data processing method or the key generating method belong to the same concept, and details of the technical solution of the storage medium which are not described in detail can be referred to the description of the technical solution of the data processing method or the key generating method.

An embodiment of the present specification also provides a computer program, wherein the computer program, when executed in a computer, causes the computer to perform the steps of the data processing method or the key generation method described above.

The above is an exemplary version of a computer program of the present embodiment. It should be noted that, the technical solution of the computer program and the technical solution of the data processing method or the key generating method belong to the same concept, and details of the technical solution of the computer program, which are not described in detail, can be referred to the description of the technical solution of the data processing method or the key generating method.

The foregoing describes specific embodiments of the present disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The computer instructions include computer program code that may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer Memory, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), an electrical carrier signal, a telecommunications signal, a software distribution medium, and so forth.

It should be noted that, for simplicity of description, the foregoing method embodiments are all expressed as a series of combinations of actions, but it should be understood by those skilled in the art that the embodiments are not limited by the order of actions described, as some steps may be performed in other order or simultaneously according to the embodiments of the present disclosure. Further, those skilled in the art will appreciate that the embodiments described in the specification are all preferred embodiments, and that the acts and modules referred to are not necessarily all required for the embodiments described in the specification.

In the foregoing embodiments, the descriptions of the embodiments are emphasized, and for parts of one embodiment that are not described in detail, reference may be made to the related descriptions of other embodiments.

The preferred embodiments of the present specification disclosed above are merely used to help clarify the present specification. Alternative embodiments are not intended to be exhaustive or to limit the invention to the precise form disclosed. Obviously, many modifications and variations are possible in light of the teaching of the embodiments. The embodiments were chosen and described in order to best explain the principles of the embodiments and the practical application, to thereby enable others skilled in the art to best understand and utilize the invention. This specification is to be limited only by the claims and the full scope and equivalents thereof.

Claims

1. A data processing method applied to a data processing system, the system comprising a data node, the method comprising:

the data node receives a data processing request submitted for data to be processed, and responds to the data processing request to read a target key, wherein the target key is generated by at least two key nodes with communication relation with the data node according to a subkey created by node attribute information corresponding to the data node, the key nodes are used for generating the subkey and managing the subkey, the at least two key nodes comprise at least one direct communication key node and at least one indirect communication key node, the direct communication key node directly interacts with the data node, and the indirect communication key node interacts with the data node through a control node;

2. The data processing method of claim 1, the system further comprising at least two key nodes, the method further comprising:

3. The data processing method of claim 2, further comprising:

4. The data processing method of claim 1, the system further comprising a control node, the method further comprising:

5. The data processing method of claim 4, further comprising:

6. The data processing method of claim 5, the system further comprising a credential service node, the method further comprising:

7. The data processing method of claim 6, the method further comprising:

The direct communication key node creates a direct communication subkey corresponding to the node attribute information, encrypts the direct communication subkey through a node public key in the digital certificate, generates an encrypted direct communication subkey, and sends the encrypted direct communication subkey to the data node;

8. The data processing method of claim 7, the method further comprising:

the direct communication key node decrypts the encryption certificate according to the node public key in the digital certificate corresponding to the node attribute information; and executing the creation of the direct communication subkey corresponding to the node attribute information under the condition that decryption is successful.

9. The data processing method according to any one of claims 1 to 8, further comprising:

10. The data processing method of claim 9, the system further comprising a gateway node, the method further comprising:

11. The data processing method of claim 1, further comprising:

12. A key generation method applied to a key generation system, the system comprising a data node and at least two key nodes, the method comprising:

the data node reads node attribute information and sends the node attribute information to each key node, wherein the key nodes are used for generating sub-keys and managing the sub-keys;

each key node receives the node attribute information, creates a subkey corresponding to the node attribute information, sends the subkey to the data node, and the at least two key nodes comprise at least one direct communication key node and at least one indirect communication key node, wherein the direct communication key node directly interacts with the data node, and the indirect communication key node interacts with the data node through a control node;

13. A computing device, comprising:

a memory and a processor;

the memory is configured to store computer executable instructions, the processor being configured to execute the computer executable instructions, which when executed by the processor, implement the steps of the method of any one of claims 1-12.

14. A computer readable storage medium storing computer executable instructions which when executed by a processor perform the steps of the method of any one of claims 1 to 12.