KR101107056B1 - Method for protecting important information of virtual machine in cloud computing environment - Google Patents

Abstract

PURPOSE: A VM security information processing method in a cloud computing environment is provided to safely protect important information without the leakage of an important information file even though a VM image which a user uses is leaked to the third person. CONSTITUTION: A security client records an encoded information file in a storing unit. The encoded information file includes information which is not leaked to an operator of a cloud computing system. A VM(Virtual Machine) generates a RAM disk from a part of RAM(110). The security client loads the encoded information file(130). If the security client is authenticated by the security server, the security client transmits the encrypted information file and key ID information to the security server(150). The security server encodes the encoded information file to the loaded key based on key ID information(170).

Description

How to process security information for a virtual machine in a cloud computing environment {Method for Protecting Important Information of Virtual Machine In Cloud Computing Environment}

The present invention relates to a method of protecting sensitive information of a virtual machine in a cloud computing environment, and more particularly, to a method of preventing sensitive information existing in a file form in a virtual machine from being leaked to a cloud computing service provider.

Recently, cloud computing environments have been widely used for efficient distribution of IT resources and secure storage of data. The concept of cloud computing was advocated by American computer scientist John McCarthy in the 1960s. Recently, as the communications infrastructure is rapidly improving and the demand for efficient allocation of resources in the computing environment is increasing. The speed of development and development is increasing.

In a cloud computing environment, physical servers are connected in parallel to configure a special operating system and logically perceived as one server, then create multiple logical computers, called virtual machines (VMs), to provide users with logical To provide a computing environment. With this technology, for example, in the past, ten operating systems could be installed and operated on ten servers, but it is also possible to install and operate dozens of operating systems simultaneously in the form of virtual machines.

In the cloud computing environment, the user does not need a high-end terminal, thereby reducing the IT equipment investment cost at the client level, and has the advantage of enabling efficient distribution of IT resources according to the usage environment. However, if a server in the cloud computing is hacked, there is a risk of data leakage, and there is a security problem that a user's important data is more likely to be leaked by the malicious side of the service provider who provides the cloud computing service.

Korean Patent Application Publication No. 10-2011-0051028 published on May 17, 2011 discloses a cloud computing system having a security function. This prior art relates to a technique for performing an integrity verification on each of the virtual machines of the cloud computing system to block the connection between the virtual machine and the network when the integrity verification fails. However, if the virtual machine is infected with malicious code, such a technology can proactively respond by blocking network connection quickly before the vaccine program is updated, and can respond to malicious information leakage or hacking on the cloud computing service provider side. There is no limit.

An object of the present invention is to overcome the limitations of the prior art and to provide an information processing method that can ensure more secure use of the cloud computing environment by responding to malicious information leakage and hacking of the cloud computing service provider at the source. do.

The security information processing method according to the present invention includes a virtual machine operating in a cloud computing environment including a security client and a storage device, a security server connected through a communication network to enable data communication with the virtual machine, and the cloud. It is performed in an environment including RAM provided to the environment. And the method comprises: (1) a first step of the security client writing an encrypted information file in which the predetermined information is recorded to the storage device; and (2) the virtual machine is a part of the RAM. A second step of creating a RAM disk from the third step; (3) a third step of loading the encrypted information file by the security client; and (4) the security client authenticating to the security server. (4) a fifth step of transmitting, by the security client, the encrypted information file and key identification information to the security server if the authentication is successful; and (6) the security server transmits the key identification information. A sixth step of generating the decrypted information file by decrypting the encrypted information file based on the loaded key; and (7) a seventh step of transmitting the decrypted information file to the security client; ) An eighth step of recording the decrypted information file to the RAM disk.

According to the present invention, even if an image of a virtual machine generated by a cloud computing system and used by a user is leaked to a third party, the important information file specified by the user is not leaked, so even when a cloud computing environment is used, important information is safely stored. I can protect it.

1 illustrates an environment in which the present invention is carried out.
2 is a flowchart of a security information processing method according to the present invention;

EMBODIMENT OF THE INVENTION Hereinafter, this invention is demonstrated in detail with reference to an accompanying drawing.

1 shows an environment in which the security information processing method according to the present invention is performed. As shown in FIG. 1, the environment in which the present invention is performed is largely divided into a cloud computing system 1 and a security server 50. The illustration of the user side client connecting to the cloud computing system 1 is omitted for simplicity of explanation.

The virtual machine 10 is created in the cloud computing system 1, and the virtual machine 10 is managed in the form of an image file (for example, an extension .vmx or .vhd) within the cloud operating system. However, the virtual machine 10 managed in the form of an image file may be easily leaked by the cloud computing system service provider or the service provider may view the contents.

According to the present invention, a secure client 20 and a storage device 30 are provided in a virtual machine 10 that is created in the cloud computing system 1 and made available to a user. The security server 50 outside of the cloud computing system 1 must be operated by a third party operator or user of the virtual machine 10 that is not an operator of the cloud computing system 1. The storage device 30 is a storage device allocated to the virtual machine 10 through logical virtualization of a physical recording device such as a hard disk provided to the cloud computing system 1.

Next, the security information processing method according to the present invention will be described with reference to FIG. Prior to the start of the process shown in FIG. 2, the security client 20 encrypts a predetermined critical information file and records it in the storage device 30. When an important information file is recorded by encrypting the storage device 30 in the virtual machine 10, the service provider of the cloud computing system 1 may not open the image file of the virtual machine 10. The contents cannot be checked or leaked. The information file to be encrypted and stored may be determined by a user using the virtual machine 10 as a file of information that should be prevented from being leaked or viewed outside, such as a source file or a database existing inside the virtual machine 10.

When the operating system (O / S) of the virtual machine 10 is booted (step 100) while the important information file is encrypted and recorded in the storage device 30, RAM provided in the cloud computing system 1 To allocate a portion of the disk to a RAM disk 40 (Mount; step 100). Then, the security client 20 is executed (step 120), and the security client 20 stores the storage device 30. In step 130, the secure client 20 attempts to authenticate the secure server 50. The authentication method can be variously applied and known. ID / Password method, PKI authentication method, and authentication method using IP / MAC adress can be applied. If authentication with the security server 50 is successful, the security client 20 transmits the encrypted information file 2 loaded from the storage device 30 to the security server 50 through a communication network. key) ID information is transmitted together (step 150).

The security server 50 checks whether the received key ID is an accessible key (step 160), and if it is confirmed as an accessible key, loads the corresponding key to decrypt the encrypted information file 2 and decrypts the decrypted information file 3. (Step 170)

The security server 50 transmits the decrypted information file 3 to the security client 20 (step 180), and the security client 20 records the decrypted information file 3 on the RAM disk 40. (Step 190) Although the RAM disk is a service provider of the cloud computing system 1, since the specific virtual machine 10 does not know which RAM among the numerous RAMs existing in the cloud environment, the RAM disk generated in the RAM disk is decrypted in the RAM disk. Even if the recorded information file 3 is recorded, it is safe. In addition, even if the cloud computing system service provider leaks the image file of the virtual machine 10, only the important information file that is encrypted and recorded in the storage device 30 is leaked, so that the third party cannot secure the important information file. Can be protected.

While the invention has been described above with reference to the accompanying drawings, the scope of the invention is determined by the claims that follow, and should not be construed as limited to the embodiments and / or drawings described above. And it should be clearly understood that improvements, changes and modifications apparent to those skilled in the art of the invention described in the claims are included in the scope of the present invention.

1: cloud computing system
2: encrypted information file
3: decrypted information file
10: virtual machine
20: security client
30: storage
40: ram disk

Claims (2)

A virtual machine that operates within a cloud computing system and includes a secure client and a storage device, a security server connected via a communication network to enable data communication with the virtual machine, and disposed outside of the cloud computing system, and the cloud A security information processing method performed in an environment including RAM provided to a computing system,
A first step of the security client recording an encrypted information file on the storage device, the encrypted information file encrypting a file in which predetermined information determined to not be leaked to an operator of the cloud computing system is recorded;
A second step of the virtual machine creating a RAM disk from a portion of the RAM;
A third step of the security client loading the encrypted information file;
A fourth step of the security client authenticating to the security server;
A fifth step of, if the authentication succeeds, the security client transmitting the encrypted information file and key identification information to the security server;
Generating a decrypted information file by decrypting the encrypted information file with a key loaded by the security server based on the key identification information;
A seventh step of transmitting, by the security server, the decrypted information file to the security client;
An eighth step of the security client writing the decrypted information file to the ram disk;
How security information is handled.
A virtual machine that operates within a cloud computing system and includes a secure client and a storage device, a security server connected through a communication network to enable data communication with the virtual machine and disposed outside the cloud computing system, the cloud computing system In the security information processing method performed by the security client in an environment including a RAM provided to,
A first step of the security client recording an encrypted information file on the storage device, the encrypted information file encrypting a file in which predetermined information determined to not be leaked to an operator of the cloud computing system is recorded;
A second step of the security client loading the encrypted information file;
A third step of the security client authenticating to the security server;
A fourth step of, if the authentication is successful, the security client transmitting the encrypted information file and key identification information to the security server;
A fifth step of the security client receiving a decrypted information file generated by decrypting the encrypted information file with a key loaded by the security server based on the key identification information;
And a sixth step of recording, by the security client, the decrypted information file to a RAM disk created from a portion of the RAM.
How security information is handled.

Images