CN118368063A - A cluster implementation method and device for massive key management - Google Patents

Abstract

The invention discloses a cluster realization method and device for mass key management, comprising the following steps: invoking the service of the key management cluster, performing first analysis on the key management request after verifying the user identity and the authority based on the key management request, and performing caching and multilevel hierarchical storage updating of the key based on a first analysis result; after user identity and authority verification are carried out based on the password operation request, the service of the key management cluster is called through an RDMA protocol, the password operation request is subjected to second analysis, a ciphertext key is obtained from a cache or multi-level hierarchical storage based on a second analysis result, and the ciphertext key or a plaintext key obtained by decrypting the ciphertext key is returned to the password operation cluster through the RDMA protocol to complete encryption or decryption of data, so that the problems of mass key dispersion, low management efficiency, strong coupling with the password operation, high resource consumption and the like are solved.

Description

A cluster implementation method and device for massive key management

Technical Field

The present invention relates to the technical field of key cluster management, and in particular to a cluster implementation method and device for massive key management.

Background technique

With the rapid development of mobile Internet and cloud computing technology, more and more data are processed in the cloud computing environment. Cryptography technology is the core technology to ensure network security. It protects the security of information and information transmission by protecting the confidentiality, integrity and availability of data.

Cryptographic cloud service is a new cryptographic function delivery model, which is a deep integration of cloud computing technology with cryptographic technologies such as identity authentication, authorized access, transmission encryption, and storage encryption. Cryptographic service providers integrate cryptographic products, cryptographic usage policies, cryptographic service interfaces, and service processes in accordance with the requirements of cloud computing technology architecture, and combine cryptographic system design, deployment, operation and maintenance, management, and billing into a service to solve users' cryptographic application needs. Users no longer need to purchase cryptographic products such as cryptographic hardware or cryptographic systems, but use various cryptographic functions provided in the cloud in a rented manner. Cryptographic cloud services are aimed at scenarios such as key hosting and fast key calculation.

In this scenario, we face technical problems such as difficulty in managing and quickly querying massive amounts of keys, and reduced cryptographic operation efficiency. Traditional cloud cryptographic machine-based solutions are also gradually facing technical problems such as difficulty in elastic expansion, high cost, difficult maintenance, and low efficiency. Therefore, a new technical solution is urgently needed to solve these technical problems.

The patent document with publication number CN116781248A discloses an encryption method, device and key management system, which is applied to a first computing node, including: obtaining one or more key factors; using an encryption key to encrypt plaintext data to obtain ciphertext data, wherein the encryption key is obtained based on the one or more key factors and the identifier of the first computing node, the identifier is the identifier of the first computing node or the identifier of the device where the first computing node is located or the identifier of the target processor; the ciphertext data and the identifier of the first computing node are sent to the second computing node. The patent document with publication number CN115549898A discloses a symmetric key management method in a multi-level cross-domain environment, including: a multi-level cross-domain key management hierarchy system, a multi-level cross-domain symmetric key generation and storage mechanism, a multi-level cross-domain symmetric key distribution mechanism and a multi-level cross-domain symmetric key update mechanism. These two technical solutions cannot solve the above-mentioned technical problems at the same time.

Summary of the invention

In view of the above, the purpose of the present invention is to provide a cluster implementation method and device for massive key management, which decouples the cryptographic operation cluster and the key management cluster, and sets up a cross-cluster communication mechanism and a cache and a multi-level hierarchical storage mechanism, thereby solving the technical problems in the prior art such as high communication delay, difficulty in massive key management, low cryptographic operation efficiency, and difficulty in elastic expansion.

To achieve the above-mentioned object of the invention, an embodiment of the present invention provides a cluster implementation method for massive key management, comprising the following steps:

The key management process based on the key management cluster includes: initiating a key management request to the key management process, calling the service of the key management cluster, performing a first analysis on the key management request after verifying the user identity and authority based on the key management request, and performing a key cache and multi-level hierarchical storage update based on the first analysis result;

The cryptographic operation process based on the cryptographic operation cluster and the key management cluster includes: sending a cryptographic operation request to the cryptographic operation process of the cryptographic operation cluster, performing user identity and authority verification based on the cryptographic operation request, calling the service of the key management cluster through the RDMA protocol, performing a second analysis on the cryptographic operation request, and obtaining a ciphertext key from a cache or multi-level hierarchical storage based on the second analysis result, and returning the ciphertext key or the plaintext key obtained by decrypting the ciphertext key to the cryptographic operation cluster through the RDMA protocol to complete data encryption or decryption.

Preferably, the services of the key management cluster include:

Client API service, which provides a unified calling interface to the outside world and parses the request to obtain the parsing result;

Massive key management service, which provides a unified key management interface, with identity authentication and access control strategies based on smart password keys, directory structure and index structure for fast reading and writing of massive key files, and creates a key cache layer for data caching and processing key-related services;

The secure key storage service provides a storage and query interface for massive keys, with multi-level hierarchical storage of keys. The master key is stored in the hardware security module, and the encryption key and user key generated by the key management cluster are stored in the database. The user's managed files are encrypted and stored in the distributed file system. The database includes structured databases, unstructured databases, and distributed databases, and the managed files include massive key files and sensitive files.

The hardware security module stores the master key, generates true random numbers, and provides an operating environment for secure encryption and decryption of user ciphertext keys.

Preferably, calling the service of the key management cluster, performing a first analysis on the key management request after verifying the user identity and authority based on the key management request, and performing a key cache and multi-level hierarchical storage update based on the first analysis result, including:

After verifying the user identity and authority of the key management request based on the identity authentication and access control policy of the massive key management service, the load balancing distribution of the call flow is performed, and then the client API service interface is called to perform a first analysis of the key management request. When it is a key modification or query type, a unified key index analysis is performed to obtain a first analysis result including the key index;

Call the massive key management service and the secure key storage service, search in the cache layer or multi-level hierarchical storage based on the key index to obtain the ciphertext key specified by the index and update it, where the update includes deletion and replacement.

Preferably, the method further comprises: performing a first analysis on the key management request, and when a new class is added to the key, performing an analysis on the directory/file index to obtain a first analysis result including the directory/file index;

Call the massive key management service and the secure key storage service to create an index of the managed files for the directory/file index based on the directory structure and index structure for fast reading and writing of massive key files, and store it in the cache layer and distributed file system.

Preferably, it also includes: after the ciphertext key is updated based on the key index and the new storage of the hosted file is added based on the directory/file index, the secure key storage service key cache and the massive key management service key cache are deleted layer by layer in the cache layer to ensure the consistency of the cache and storage data, and finally complete the key management task.

Preferably, during cryptographic operation, the service of the key management cluster is called through the RDMA protocol, a second analysis is performed on the cryptographic operation request, and the ciphertext key is obtained from the cache or multi-level hierarchical storage based on the second analysis result, including:

Based on the key management thread, the unified index specified by the user is parsed, and according to the definition of the unified index, the key index or managed file index of the specified user is parsed, and the corresponding key or managed file is queried in the cache based on the key index or managed file index to obtain the ciphertext key.

Preferably, when the corresponding key or managed file cannot be queried in the cache according to the key index or managed file index, the client API service is called, and the key index or managed file index is transmitted to the client API service interface, and the key index resolution information is re-parsed to obtain the key index resolution information, wherein the index resolution information includes the database code, the database table code, the key index code or the corresponding directory index code, and the file index code;

Call the massive key management service, and call the secure key storage service based on the index parsing information to search for the corresponding key or managed file from the multi-level hierarchical storage to obtain the ciphertext key.

Preferably, the method further comprises: synchronously creating a key management thread when the cryptographic operation process is started, and remotely calling a service interface of a key management cluster in the key management thread through an RDMA protocol.

Preferably, the key management cluster defines a unified 32-bit key index, where bit 0 is the unified index version number, bits 1-10 are specific key index values or hosted file index values, bits 11-15 are storage database table codes or directory index codes, bits 16-19 are storage database type codes or directory index codes, bits 20-21 are index type codes, bits 22-27 are user codes, and other bits are reserved extension fields.

To achieve the above-mentioned purpose of the invention, an embodiment of the present invention provides a cluster implementation device for massive key management, including:

A key management module, which is used for a key management process based on a key management cluster, including: initiating a key management request to a key management process, calling a service of the key management cluster, performing a first analysis on the key management request after verifying the user identity and authority based on the key management request, and performing a key cache and multi-level hierarchical storage update based on the first analysis result;

A cryptographic operation module is used for a cryptographic operation process based on a cryptographic operation cluster and a key management cluster, including: sending a cryptographic operation request to the cryptographic operation process of the cryptographic operation cluster, performing user identity and authority verification based on the cryptographic operation request, calling the service of the key management cluster through the RDMA protocol, performing a second analysis on the cryptographic operation request, and obtaining a ciphertext key from a cache or multi-level hierarchical storage based on the second analysis result, and returning the ciphertext key or the plaintext key obtained by decrypting the ciphertext key to the cryptographic operation cluster through the RDMA protocol to complete data encryption or decryption.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention decouples the key management cluster and the cryptographic operation cluster of the cryptographic cloud service, reduces communication delays through a multi-level hierarchical storage system and a cross-cluster communication mechanism based on the RDMA protocol, improves the performance and efficiency of cryptographic operations in the cluster, and can implement a more secure key management strategy, manage more massive key resources, and provide better reliability and stability.

The present invention can make full use of software and hardware resources and improve the utilization rate of hardware security modules in the key management cluster, especially in the scenario of massive password-related business requests, thereby improving the low efficiency of cryptographic operations.

The key management cluster system performance index of the cryptographic cloud service in the present invention is significantly better than the solution adopted by the traditional hardware-software integrated cryptographic machine with fixed resources and difficult elastic increase and decrease, and has strong scalability and extensibility.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

FIG1 is a flow chart of a cluster implementation method for massive key management provided by an embodiment;

FIG2 is a schematic diagram of the structure of a service of a key management cluster provided in an embodiment;

3 is a schematic diagram of the interaction between the key management cluster, the cryptographic operation cluster and other service clusters provided in the embodiment;

FIG4 is a schematic diagram of a key management process and a cryptographic operation process provided by an embodiment;

FIG5 is a schematic diagram of the structure of a cluster implementation device for massive key management provided by an embodiment.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

As shown in FIG1 , the cluster implementation method for massive key management provided by the embodiment includes the following steps:

S1, key management process based on key management cluster.

In the embodiment, the user initiates a computing request to the cryptographic cloud service and specifies a unified key index. When a large number of users initiate their own computing requests, a large number of key management tasks are faced. In the cryptographic cloud service, there are many business clusters, among which the core clusters are the cryptographic operation cluster and the key management cluster. The present invention sets the cryptographic operation cluster and the key management cluster to run decoupled, that is, to perform their respective tasks in different devices, thereby reducing the amount of computing and being able to support massive key management.

As shown in Figure 3, the user or other clusters in the password cloud service initiate a key management request to the key management process, and call the service of the key management cluster to implement the key management process, including performing a first analysis of the key management request after verifying the user identity and authority based on the key management request, and caching and multi-level hierarchical storage update of the key based on the first analysis result.

As shown in Figure 2, the services of the key management cluster include client API service (Client API), massive key management service (MKMS, Massive Key Management Service), secure key storage service (SKS, Secure KeyStorage), and hardware security module (HSM).

Among them, the client API service provides a unified calling interface to the outside world, shields internal differences, and parses the request to obtain the parsing result.

The massive key management service provides a unified key management interface with identity authentication and access control strategies based on smart password keys (USBKey), directory structures and index structures for fast reading and writing of massive key files, as well as read and write performance. It also creates a key cache layer (CL) for data caching and handles key-related services.

The secure key storage service provides a storage and query interface for massive keys, with multi-level hierarchical storage of keys. The master key is stored in the hardware security module, the encryption key generated by the key management cluster and the user key are stored in the database (DataBase), and the user's managed files are encrypted and stored in the distributed file system (HDFS). The database includes structured databases, unstructured databases, and distributed databases, and the managed files include massive key files and sensitive files. The multi-level hierarchical storage and cache system constructed can quickly find the corresponding key by using software and hardware resources, thereby improving the access speed of ciphertext keys, managed files, etc., and further improving the efficiency of cryptographic operations.

In this multi-level hierarchical storage, software and hardware resources are fully utilized, and the master key is stored in the hardware security module to ensure the absolute security of the master key. The encryption key and user key generated by the key management cluster are stored in the database. When the user initiates a data encryption request, if the corresponding encryption key can be found from the cache, the encryption speed and system performance can be significantly improved.

In the embodiment, the key management cluster defines a unified 32-bit key index, where bit 0 is the unified index version number, bits 1-10 are specific key index values or hosted file index values, bits 11-15 are storage database table codes or directory index codes, bits 16-19 are storage database type codes or directory index codes, bits 20-21 are index type codes, bits 22-27 are user codes, and the remaining bits are reserved extension fields.

In the embodiment, the key management process based on the above-mentioned calling of the key management cluster, as shown in FIG4 , includes:

The key management process receives the key management request, performs USBKey verification (i.e., identity authentication) and user authority verification on the key management request based on the identity authentication and access control policies of the massive key management service, and then performs load balancing distribution of the call flow. Then, the client API service interface is called to perform a first analysis of the key management request. When it is a key modification or query type, a unified key index analysis is performed to obtain a first analysis result including the key index, and the massive key management service interface and the secure key storage service interface are called to search in the cache layer or multi-level hierarchical storage based on the key index to obtain the ciphertext key specified by the index and update it, where the update includes deletion and replacement.

Perform a first analysis on the key management request, and when a new class is added to the key, analyze the directory/file index to obtain a first analysis result containing the directory/file index; call the massive key management service interface and the secure key storage service interface, and create an index of managed files for the directory/file index based on the directory structure and index structure for fast reading and writing of massive key files, and store it in the cache layer and distributed file system.

In the embodiment, during the key management process, after the ciphertext key based on the key index is updated and the new storage of the managed file based on the directory/file index is added, the key cache of the secure key storage service, the key cache of the massive key management service, and the key cache of the client API are deleted layer by layer in the cache layer to ensure that the cache and storage data are consistent, and finally complete the key management task. It should be noted that when the service of the password management cluster is called during the key calculation process, the key cache of the key calculation cluster also needs to be deleted at this time.

S2, cryptographic operation process based on cryptographic operation cluster and key management cluster.

In an embodiment, as shown in Figure 3, a user or other clusters in the cryptographic cloud service sends a cryptographic operation request to the cryptographic operation process of the cryptographic operation cluster, and after user identity and authority verification is performed based on the cryptographic operation request, the service of the key management cluster is called through the RDMA protocol, and the cryptographic operation request is subjected to a second analysis, and a ciphertext key is obtained from the cache or multi-level hierarchical storage based on the second analysis result, and the ciphertext key or the plaintext key obtained by decrypting the ciphertext key is returned to the cryptographic operation cluster through the RDMA protocol to complete the encryption or decryption of the data.

In the embodiment, the cryptographic operation process based on the service of the key management cluster is performed, as shown in FIG4 , including:

A cryptographic operation process receives cryptographic operation requests sent by users or other business clusters in the cryptographic cloud service, and performs the first user authority verification. Specifically, it verifies whether it has cryptographic operation resources based on the login information. At the same time, it synchronously creates a key management thread, parses the unified index specified by the user based on the key management thread, and parses the key index or managed file index of the specified user according to the definition of the unified index, and deserializes the parsed information sequence into the object. After querying the corresponding key or managed file in the cache based on the key index or managed file index, the ciphertext key is obtained.

When the corresponding key or managed file cannot be queried in the cache based on the key index or managed file index (that is, the key is not hit in the cache layer), the client API service is called, and the key index or managed file index is transmitted to the client API service interface, and the key index resolution information is re-parsed to obtain the key index resolution information, where the index resolution information includes database code, database table code, key index code or corresponding directory index code, file index code, and unified index code for all keys or files in the key management cluster, which can quickly find the key.

The key management service interface is called, and based on the index parsing information, the security key storage service interface is called to search for the corresponding key or managed file from the multi-level hierarchical storage to obtain the ciphertext key.

After obtaining the ciphertext key, decryption can be completed in the hardware security module of the key management cluster to obtain the plaintext key, and the plaintext key can be fed back to the cryptographic operation process of the cryptographic operation cluster through the RDMA protocol to encrypt or decrypt data based on the plaintext key.

After obtaining the ciphertext key, the ciphertext key can be directly fed back to the cryptographic operation process of the cryptographic operation cluster through the RDMA protocol. The cryptographic operation cluster then decrypts the ciphertext key locally through the hardware security module to obtain the plaintext key, and then uses the plaintext key to encrypt or decrypt the data.

In an embodiment, a key management thread is synchronously created when a cryptographic operation process is started, and a service interface of a key management cluster is remotely called through the low-latency RDMA protocol in the key management thread to obtain a key to participate in the calculation, thereby reducing communication delays and improving cryptographic operation efficiency.

When faced with small batch computing requests, the user-specified key unified index and the data to be processed can be distributed to the key management cluster, where the specified key is found and the data to be processed is processed. After the plaintext key corresponding to the key unified index is found in the key management cluster to complete the computing request initiated by the user, the ciphertext key corresponding to the plaintext key needs to be updated to the cache, so that it can be directly searched from the cache the next time it is used, saving computing resources and running time.

Taking the key deletion in a key management process as an example, the above cluster implementation method is explained, including:

The user initiates a request to the key management process of the cryptographic computing cluster, and the key management process verifies the user's identity and authority through the smart cryptographic key;

If the user identity and permission verification is passed, the service of the key management cluster is remotely called through the RDMA protocol, and the calling traffic is load balanced and distributed;

After the distributed traffic reaches the key management cluster, the client API interface service is called to parse the user request. If it is a key modification or query type, a unified index analysis is performed;

According to the parsing results, call the massive key management service interface and the security key storage service interface to query the specified database, database table, and the ciphertext key of the specified index. After deleting the index key, trigger the multi-level cache update;

In the multi-level cache, delete the key storage service key cache, key management service key cache, and cryptographic operation cluster key cache layer by layer to ensure that the cache and database data are consistent, and finally complete this key management task.

As shown in Figure 5, the embodiment also provides a cluster implementation device 50 for massive key management, including a key management module 51 and a cryptographic operation module 52, wherein the key management module 51 is used for a key management process based on a key management cluster, and the cryptographic operation module 52 is used for a cryptographic operation process based on a cryptographic operation cluster and a key management cluster.

It should be noted that the cluster implementation device for massive key management provided in the above embodiment should be illustrated by the division of the above functional modules when performing the key management process and the cryptographic operation process. The above functions can be assigned to different functional modules as needed, that is, the internal structure of the terminal or server is divided into different functional modules to complete all or part of the functions described above. In addition, the cluster implementation device for massive key management provided in the above embodiment and the cluster implementation construction method embodiment for massive key management belong to the same concept. The specific implementation process is detailed in the cluster implementation method embodiment for massive key management, which will not be repeated here.

The cluster implementation method and device for massive key management provided in the embodiment decouple the cryptographic operation cluster and the key management cluster, improve the performance and efficiency of cryptographic operations in the cluster by building a multi-level cache system and a cross-cluster communication mechanism based on the RDMA protocol, and enhance the scalability of the cluster; the identity of the user operating the key management is more securely verified through the intelligent password key. The key management cluster of the present invention can achieve more effective use of software and hardware resources, support users to perform key generation, management, destruction, backup, key hosting, encrypted file hosting and other services, and solve the problems of massive key dispersion, low management efficiency, strong coupling with cryptographic operations, and high resource consumption.

The specific implementation methods described above have described in detail the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims (10)

1. A cluster implementation method for massive key management, characterized by comprising the following steps: The key management process based on the key management cluster includes: initiating a key management request to the key management process, calling the service of the key management cluster, performing a first analysis on the key management request after verifying the user identity and authority based on the key management request, and performing a key cache and multi-level hierarchical storage update based on the first analysis result; The cryptographic operation process based on the cryptographic operation cluster and the key management cluster includes: sending a cryptographic operation request to the cryptographic operation process of the cryptographic operation cluster, performing user identity and authority verification based on the cryptographic operation request, calling the service of the key management cluster through the RDMA protocol, performing a second analysis on the cryptographic operation request, and obtaining a ciphertext key from a cache or multi-level hierarchical storage based on the second analysis result, and returning the ciphertext key or the plaintext key obtained by decrypting the ciphertext key to the cryptographic operation cluster through the RDMA protocol to complete data encryption or decryption. 2. The cluster implementation method for massive key management according to claim 1, characterized in that the services of the key management cluster include: Client API service, which provides a unified calling interface to the outside world and parses the request to obtain the parsing result; Massive key management service, which provides a unified key management interface, has identity authentication and access control strategies based on cryptographic keys, directory structures and index structures for reading and writing massive key files, and creates a key cache layer for data caching and handles key-related services; The secure key storage service provides a storage and query interface for massive keys, with multi-level hierarchical storage of keys. The master key is stored in the hardware security module, and the encryption key and user key generated by the key management cluster are stored in the database. The user's managed files are encrypted and stored in the distributed file system. The database includes structured databases, unstructured databases, and distributed databases, and the managed files include massive key files and sensitive files. The hardware security module stores the master key, generates true random numbers, and provides an operating environment for secure encryption and decryption of user ciphertext keys. 3. The cluster implementation method for massive key management according to claim 2 is characterized in that the service of the key management cluster is called, after user identity and authority verification is performed based on the key management request, the key management request is first parsed, and the key cache and multi-level hierarchical storage update are performed based on the first parsing result, including: After verifying the user identity and authority of the key management request based on the identity authentication and access control policy of the massive key management service, the load balancing distribution of the call flow is performed, and then the client API service interface is called to perform a first analysis of the key management request. When it is a key modification or query type, a unified key index analysis is performed to obtain a first analysis result including the key index; Call the massive key management service and the secure key storage service, search in the cache layer or multi-level hierarchical storage based on the key index to obtain the ciphertext key specified by the index and update it, where the update includes deletion and replacement. 4. The cluster implementation method for mass key management according to claim 2, characterized in that it also includes: performing a first analysis on the key management request, and when a new class is added to the key, performing a directory/file index analysis to obtain a first analysis result including the directory/file index; Call the massive key management service and the secure key storage service to create an index of the managed files for the directory/file index based on the directory structure and index structure of reading and writing massive key files, and store it in the cache layer and distributed file system. 5. The cluster implementation method for massive key management according to claim 3 or 4 is characterized in that it also includes: after the ciphertext key based on the key index is updated and the hosted file based on the directory/file index is newly stored, the secure key storage service key cache and the massive key management service key cache are deleted layer by layer in the cache layer to ensure that the cache and storage data are consistent, and finally complete the key management task. 6. The cluster implementation method for massive key management according to claim 1 is characterized in that, during cryptographic operations, the service of the key management cluster is called through the RDMA protocol, a second analysis is performed on the cryptographic operation request, and the ciphertext key is obtained from the cache or multi-level hierarchical storage based on the second analysis result, including: Based on the key management thread, the unified index specified by the user is parsed, and according to the definition of the unified index, the key index or managed file index of the specified user is parsed, and the corresponding key or managed file is queried in the cache based on the key index or managed file index to obtain the ciphertext key. 7. The cluster implementation method for massive key management according to claim 6 is characterized in that when the corresponding key or managed file cannot be queried in the cache according to the key index or managed file index, the client API service is called, and the key index or managed file index is transmitted to the client API service interface, and the key index resolution information is re-parsed to obtain the key index resolution information, wherein the index resolution information includes the database code, the database table code, the key index code or the corresponding directory index code, and the file index code; Call the massive key management service, and call the secure key storage service based on the index parsing information to search for the corresponding key or managed file from the multi-level hierarchical storage to obtain the ciphertext key. 8. The cluster implementation method for massive key management according to claim 1 is characterized in that it also includes: synchronously creating a key management thread when the cryptographic operation process is started, and remotely calling the service interface of the key management cluster through the RDMA protocol in the key management thread. 9. According to the cluster implementation method for massive key management according to claim 1, it is characterized in that the key management cluster defines a unified 32-bit key index, bit 0 is the unified index version number, bits 1-10 are specific key index values or hosted file index values, bits 11-15 are storage database table codes or directory index codes, bits 16-19 are storage database type codes or directory index codes, bits 20-21 are index type codes, bits 22-27 are user codes, and other bits are reserved extension fields. 10. A cluster implementation device for massive key management, comprising: A key management module, which is used for a key management process based on a key management cluster, including: initiating a key management request to a key management process, calling a service of the key management cluster, performing a first analysis on the key management request after verifying the user identity and authority based on the key management request, and performing a key cache and multi-level hierarchical storage update based on the first analysis result; A cryptographic operation module is used for a cryptographic operation process based on a cryptographic operation cluster and a key management cluster, including: sending a cryptographic operation request to the cryptographic operation process of the cryptographic operation cluster, performing user identity and authority verification based on the cryptographic operation request, calling the service of the key management cluster through the RDMA protocol, performing a second analysis on the cryptographic operation request, and obtaining a ciphertext key from a cache or multi-level hierarchical storage based on the second analysis result, and returning the ciphertext key or the plaintext key obtained by decrypting the ciphertext key to the cryptographic operation cluster through the RDMA protocol to complete data encryption or decryption.