【作者】 石磊；

【导师】 黄浩；

【作者基本信息】 华中科技大学 ， 软件工程， 2019， 硕士

【摘要】 现如今人们正处在大数据蓬勃发展的信息时代,随之产生的各个维度的数据正以指数级爆炸式的增长。大数据给人们生产生活带来红利的同时,各方面的数据安全问题也正威胁着大数据未来的健康发展。同时,传统的基于对称加密和非对称加密的安全技术逐渐表现出不足与乏力。然而,内容关联密钥加密技术有别与传统之处就在于密钥和密文之间是一一对应的,不同密钥与密文之间的离散关系保证了数据的安全性。以此加密技术形成的密钥文件则通过密钥管理服务器进行管理。但随着用户数量和密钥文件的增加,密钥管理服务器将面临高并发、大流量场景以及面对市场不断提出新需求的难题。针对这些问题,密钥管理服务器优化的核心则是高可用性和可扩展性两方面。因此首先需要对密钥管理服务器的功能模块和部署架构的现状进行梳理分析,找出系统存在的紧耦合设计和单点故障问题,以此明确设计需求。然后以集群和分布式技术为主要思路,将业界主流的解决方案和密钥管理服务器的特点相结合,按照客户端请求的链路逐一对应用系统各层进行高可用性或可扩展性设计。具体包括对反向代理层、缓存层、数据库层采用集群部署保证高可用,对系统采用微服务化设计,结合Spring Cloud微服务框架达到高内聚低耦合的效果,并且使用JWT令牌机制来解决微服务应用的单点登录问题;最后对于密钥文件的存取则借力OSS来保证密钥存取的安全性与高可用性。最后基于详细设计对密钥管理服务器的每一层进行具体的配置与编码实现。并且通过接口测试、恢复测试、观察日志等多种方式对系统进行了测试验证,结果表明优化后的密钥管理服务器具备了高可用性和可扩展性的特点。更多还原

【Abstract】 At present,people are in the information age when big data is booming,and the data generated from all dimensions are exploding exponentially.While big data brings dividends to people’s production and life,all aspects of data security issues are also threatening the healthy development of big data in the future.At the same time,traditional security technologies based on symmetric encryption and asymmetric encryption have gradually shown deficiencies and weaknesses.However,the content association key encryption technology is different from the traditional one in that there is a one-to-one correspondence between the key and the ciphertext.The discrete relationship between the different keys and the ciphertext ensures the security of the data.The key file formed by this encryption technology is managed by the key management server.However,as the number of users and key files increase,the key management server will face high concurrency,large traffic scenarios,and the challenges of constantly raising new demands in the market.To address these issues,the core of key management server optimization is high availability and scalability.Therefore,it is necessary to sort out the current status of the key management server’s functional modules and deployment architecture,and finds out the tight coupling design and single point of failure problems in the system to clarify the design requirements.Then,with cluster and distributed technology as the main idea,combine the mainstream solutions of the industry with the characteristics of the key management server,and design the high availability or scalability of each layer of the application system according to the link requested by the client.Specifically,cluster deployment is adopted for reverse proxy layer,cache layer and database layer to ensure high availability,micro-service design is adopted for the system,high cohesion and low coupling are achieved by combining Spring Cloud micro-service framework,and JWT token mechanism is used to solve the single sign-on problem of micro-service application.Finally,OSS is used to guarantee the security and high availability of key file access.Finally,each layer of key management server is configured and coded based ondetailed design.The system is tested and verified by interface test,recovery test,observation log and other methods.The results show that the optimized key management server has the characteristics of high availability and scalability.更多还原