Abstract: Through the research and analysis of the existing key storage schemes and key update schemes, aiming at solving the problem of mass key storage and dynamic update in the cloud environment, a key storage management scheme derived from key matrix is designed. Among them, the key matrix derivation process, scalable key exchange protocol and key update scheme based on Chinese remainder theorem are mainly considered. In the scheme, the file encryption and decryption calculations are implemented on a private cloud, and the public cloud is responsible for providing the service of storing and querying ciphertext data. Through the matrix derivation method, the file encryption key is directly derived from the root key. Tenant only need to store and manage the key matrix configuration and the root key to dynamically generate the file encryption key. Finally, compared with the key storage scheme in relevant literature, as well as security analysis and performance analysis, the simulation experiment proved that this scheme could effectively reduce the overhead of key storage and computing and save the cost of key update in cloud environment.

Key words: cloud computing, key management, key derivation, key storage, key matrix

摘要： 通过对现有的密钥存储方案、密钥更新方案进行研究分析，针对云环境下海量密钥存储与用户动态密钥更新需求，设计了一种基于密钥矩阵派生的密钥存储管理方案.其中，主要考虑了密钥矩阵派生过程、可扩展的密钥交换协议以及基于中国剩余定理的密钥更新方案3个部分.方案将文件加解密计算设置在私有云上实施，公有云负责提供存储和查询密文数据的服务.通过矩阵派生方法，由根密钥直接派生文件加密密钥，用户只需存储管理密钥矩阵配置及根密钥即可动态生成文件加密密钥.最后通过实验验证，与相关文献的密钥存储方案进行对比，并进行安全性分析和性能分析，证明该方案可有效降低云环境下的密钥存储开销和计算开销，节省密钥更新成本.

关键词: 云计算, 密钥管理, 密钥派生, 密钥存储, 密钥矩阵