A method for protecting cloud data security, comprising: receiving (S201, S401, S501), by a key management center, original data M sent by a first terminal; encrypting (S202, S402, S502), by the key management center, the original data M according to a key K to obtain encrypted data C1; uploading (S203, S403, S503), by the key management center, the encrypted data C1 to a cloud server for storage; receiving (S204, S406, S504), by the key management center, a request sent by a second terminal for decrypting the encrypted data C1 or a request for downloading the encrypted data C1; obtaining (S204, S406, S507), by the key management center, the encrypted data C1; encrypting (S409, S509), by the key management center, the encrypted data C1 using a key Ki to obtain first intermediate encrypted data C1',wherein the key Ki is owned by the second terminal; decrypting (S410, S510), by the key management center, the first intermediate encrypted data C1' according to the key K to obtain encrypted data C2; and sending (S411, S511), by the key management center, the encrypted data C2 to the second terminal; and, decrypting (S412, S512), by the second terminal, the encrypted data C2 according to the key Ki owned by the second terminal to obtain the original data M; wherein the key management center encrypts the original data M according to the key K by using an exchangeable encryption algorithm E, wherein the exchangeable encryption algorithm E is: E(K1,E(K2,Q))=E(K2,E(K1,Q)), wherein K1 and K2 are encryption keys, Q is data to be encrypted and a result of encryption by using the exchangeable algorithm has no relation with a sequence for using a key. receiving (S201, S401, S501), by a key management center, original data M sent by a first terminal; encrypting (S202, S402, S502), by the key management center, the original data M according to a key K to obtain encrypted data C1; uploading (S203, S403, S503), by the key management center, the encrypted data C1 to a cloud server for storage; receiving (S204, S406, S504), by the key management center, a request sent by a second terminal for decrypting the encrypted data C1 or a request for downloading the encrypted data C1; obtaining (S204, S406, S507), by the key management center, the encrypted data C1; encrypting (S409, S509), by the key management center, the encrypted data C1 using a key Ki to obtain first intermediate encrypted data C1',wherein the key Ki is owned by the second terminal; decrypting (S410, S510), by the key management center, the first intermediate encrypted data C1' according to the key K to obtain encrypted data C2; and sending (S411, S511), by the key management center, the encrypted data C2 to the second terminal; and, decrypting (S412, S512), by the second terminal, the encrypted data C2 according to the key Ki owned by the second terminal to obtain the original data M; wherein the key management center encrypts the original data M according to the key K by using an exchangeable encryption algorithm E, wherein the exchangeable encryption algorithm E is: E(K1,E(K2,Q))=E(K2,E(K1,Q)), wherein K1 and K2 are encryption keys, Q is data to be encrypted and a result of encryption by using the exchangeable algorithm has no relation with a sequence for using a key. E(K1,E(K2,Q))=E(K2,E(K1,Q)), wherein K1 and K2 are encryption keys, Q is data to be encrypted and a result of encryption by using the exchangeable algorithm has no relation with a sequence for using a key.