Granted Patent B2

US 12,289,407 · App. 18/714,541 · Granted Apr 29, 2025

Inventor: Xishuang Xing (Jiangsu, CN)

Assignee: SUZHOU METABRAIN INTELLIGENT TECHNOLOGY CO., LTD.

H04L9/0894H04L9/0819

Abstract

Claims (71)

1. A secret-key managing method, wherein the method comprises:

constructing a multi-node secret-key storing system;

in response to secret-key data required by an encryption-decryption service program being not in an operating state, storing the secret-key data into a random node in the multi-node secret-key storing system, and controlling the secret-key data to migrate among nodes in the multi-node secret-key storing system according to a predetermined migration rule; wherein the predetermined migration rule comprises a migration sequence and a migration period of the secret-key data among the nodes; and

when a secret-key invoking request based on the encryption-decryption service program is received, determining a storage position of the secret-key data at a current moment based on the predetermined migration rule, to feed back the secret-key invoking request;

wherein the step of constructing the multi-node secret-key storing system comprises:

constructing a secret-key-buffer dynamic link library; and

the step of receiving the secret-key invoking request based on the encryption-decryption service program comprises:

receiving the secret-key invoking request to an encryption-decryption-service deriving function of the secret-key-buffer dynamic link library based on the encryption-decryption service program;

wherein the step of storing the secret-key data into the random node in the multi-node secret-key storing system comprises:

replacing pseudo-data pre-stored in the random node with the secret-key data; and

the step of controlling the secret-key data to migrate among the nodes in the multi-node secret-key storing system according to the predetermined migration rule comprises:

according to the predetermined migration rule, replacing the pseudo-data of a node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at a node where the secret-key data are located at a previous moment;

wherein the step of, according to the predetermined migration rule, replacing the pseudo-data of the node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at the node where the secret-key data are located at the previous moment comprises:

at a target node that does not store the secret-key data currently in the multi-node secret-key storing system, generating the pseudo-data that have a length equal to a length of the secret-key data and a same encoding mode as an encoding mode of the secret-key data, replacing the pseudo-data at the target node when the secret-key data migrate to the target node, and re-generating the pseudo-data when the secret-key data migrate away from the target node.

2. The secret-key managing method according to claim 1 , wherein all of the random node and the nodes are internal-memory nodes.

3. The secret-key managing method according to claim 1 , wherein the step of constructing the multi-node secret-key storing system comprises:

constructing the multi-node secret-key storing system by using a high-usability cluster software.

4. The secret-key managing method according to claim 1 , wherein the nodes in the multi-node secret-key storing system are connected to each other with a tree structure or graph structure.

5. The secret-key managing method according to claim 1 , wherein the method further comprises:

receiving a configuration on the predetermined migration rule;

wherein configuration items of the predetermined migration rule comprise at least one of a secret-key-data length, a secret-key-data encoding, a data-structure type, a quantity of the nodes comprised by the multi-node secret-key storing system, and a secret-key migration frequency.

6. The secret-key managing method according to claim 1 , wherein the method further comprises:

when a command of deleting the secret-key data is received or a storage time limit of the secret-key data is reached, replacing the secret-key data with predetermined data, and deleting the predetermined data.

7. The secret-key managing method according to claim 1 , wherein the step of storing the secret-key data into the random node in the multi-node secret-key storing system, and controlling the secret-key data to migrate among the nodes in the multi-node secret-key storing system according to the predetermined migration rule comprises:

storing the secret-key data into a random node in the multi-node secret-key storing system according to a type of the secret-key data, and controlling the secret-key data to migrate among the nodes in the multi-node secret-key storing system according to a predetermined migration rule corresponding to the secret-key data.

8. The secret-key managing method according to claim 1 , wherein the method further comprises:

when an attacking signal is detected, changing the predetermined migration rule.

9. The secret-key managing method according to claim 1 , wherein the method further comprises:

when an illegal secret-key invoking request is received, changing the predetermined migration rule.

10. The secret-key managing method according to claim 1 , wherein the step of, when the secret-key invoking request based on the encryption-decryption service program is received, determining the storage position of the secret-key data at the current moment based on the predetermined migration rule, to feed back the secret-key invoking request comprises:

when the secret-key invoking request is received, verifying a validity of the encryption-decryption service program; and

in response to the encryption-decryption service program having a validity, determining a storage position of the secret-key data at a current moment based on the predetermined migration rule, to feed back the secret-key invoking request.

11. The secret-key managing method according to claim 10 , wherein the step of verifying the validity of the encryption-decryption service program comprises:

when the secret-key invoking request is received, checking whether the secret-key invoking request comprises an agreed password; in response to the secret-key invoking request comprising the agreed password, confirming that the encryption-decryption service program has a validity; and in response to the secret-key invoking request not comprising the agreed password, confirming that the encryption-decryption service program does not have a validity.

12. The secret-key managing method according to claim 10 , wherein the step of verifying the validity of the encryption-decryption service program comprises:

when the secret-key invoking request is received, checking whether the encryption-decryption service program is an encryption-decryption service program that is registered at initialization of the multi-node secret-key storing system; in response to the encryption-decryption service program being the encryption-decryption service program that is registered at the initialization of the multi-node secret-key storing system, confirming that the encryption-decryption service program has a validity; and in response to the encryption-decryption service program being not the encryption-decryption service program that is registered at the initialization of the multi-node secret-key storing system, confirming that the encryption-decryption service program does not have a validity.

13. The secret-key managing method according to claim 1 , wherein the secret-key data are a secret-key encrypting secret key of a data secret key required by encryption and decryption of the encryption-decryption service program.

14. The secret-key managing method according to claim 1 , wherein the secret-key data comprise a symmetrical secret key and an asymmetrical secret key; and/or

the secret-key data are a secret key itself, or a secret key in the form of ciphertext.

15. The secret-key managing method according to claim 1 , wherein constructing a multi-node secret-key storing system comprises:

determining information of the nodes, and determining the predetermined migration rule, wherein the information at least comprises address information.

16. A secret-key managing device, wherein the device comprises:

a memory configured for storing a computer program; and

a processor configured for executing the computer program, wherein the computer program, when executed by the processor, implements operations:

constructing a multi-node secret-key storing system;

in response to secret-key data required by an encryption-decryption service program being not in an operating state, storing the secret-key data into a random node in the multi-node secret-key storing system, and controlling the secret-key data to migrate among nodes in the multi-node secret-key storing system according to a predetermined migration rule; wherein the predetermined migration rule comprises a migration sequence and a migration period of the secret-key data among the nodes; and

when a secret-key invoking request based on the encryption-decryption service program is received, determining a storage position of the secret-key data at a current moment based on the predetermined migration rule, to feed back the secret-key invoking request;

wherein the step of constructing the multi-node secret-key storing system comprises:

constructing a secret-key-buffer dynamic link library; and

the step of receiving the secret-key invoking request based on the encryption-decryption service program comprises:

receiving the secret-key invoking request to an encryption-decryption-service deriving function of the secret-key-buffer dynamic link library based on the encryption-decryption service program;

wherein the step of storing the secret-key data into the random node in the multi-node secret-key storing system comprises:

replacing pseudo-data pre-stored in the random node with the secret-key data; and

the step of controlling the secret-key data to migrate among the nodes in the multi-node secret-key storing system according to the predetermined migration rule comprises:

according to the predetermined migration rule, replacing the pseudo-data of a node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at a node where the secret-key data are located at a previous moment;

wherein the step of, according to the predetermined migration rule, replacing the pseudo-data of the node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at the node where the secret-key data are located at the previous moment comprises:

at a target node that does not store the secret-key data currently in the multi-node secret-key storing system, generating the pseudo-data that have a length equal to a length of the secret-key data and a same encoding mode as an encoding mode of the secret-key data, replacing the pseudo-data at the target node when the secret-key data migrate to the target node, and re-generating the pseudo-data when the secret-key data migrate away from the target node.

17. A non-transitory readable storage medium, storing a computer program, wherein the computer program, when executed by a processor, implements operations:

constructing a multi-node secret-key storing system;

in response to secret-key data required by an encryption-decryption service program being not in an operating state, storing the secret-key data into a random node in the multi-node secret-key storing system, and controlling the secret-key data to migrate among nodes in the multi-node secret-key storing system according to a predetermined migration rule; wherein the predetermined migration rule comprises a migration sequence and a migration period of the secret-key data among the nodes; and

when a secret-key invoking request based on the encryption-decryption service program is received, determining a storage position of the secret-key data at a current moment based on the predetermined migration rule, to feed back the secret-key invoking request;

wherein the step of constructing the multi-node secret-key storing system comprises:

constructing a secret-key-buffer dynamic link library; and

the step of receiving the secret-key invoking request based on the encryption-decryption service program comprises:

receiving the secret-key invoking request to an encryption-decryption-service deriving function of the secret-key-buffer dynamic link library based on the encryption-decryption service program;

wherein the step of storing the secret-key data into the random node in the multi-node secret-key storing system comprises:

replacing pseudo-data pre-stored in the random node with the secret-key data; and

the step of controlling the secret-key data to migrate among the nodes in the multi-node secret-key storing system according to the predetermined migration rule comprises:

according to the predetermined migration rule, replacing the pseudo-data of a node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at a node where the secret-key data are located at a previous moment;

wherein the step of, according to the predetermined migration rule, replacing the pseudo-data of the node where the secret-key data are located at the current moment with the secret-key data, and re-generating the pseudo-data at the node where the secret-key data are located at the previous moment comprises:

at a target node that does not store the secret-key data currently in the multi-node secret-key storing system, generating the pseudo-data that have a length equal to a length of the secret-key data and a same encoding mode as an encoding mode of the secret-key data, replacing the pseudo-data at the target node when the secret-key data migrate to the target node, and re-generating the pseudo-data when the secret-key data migrate away from the target node.

Assignments (2)

Priority Claims (1)

Continuity (1)

References Cited (17)