KR101790757B1

KR101790757B1 - Cloud system for storing secure data and method thereof

Info

Publication number: KR101790757B1
Application number: KR1020150149590A
Authority: KR
Inventors: 이임영; 김원빈
Original assignee: 순천향대학교 산학협력단
Priority date: 2015-10-27
Filing date: 2015-10-27
Publication date: 2017-10-27
Also published as: KR20170049700A

Abstract

The exemplary embodiment of the present invention provides a metadata server that determines whether data is duplicated using metadata of uploaded data and transmits the duplicated data to a user terminal, and receives the duplicated data from the user terminal and verifies the duplicated data, And a storage server for storing data. Therefore, by verifying data transmitted to the information storage server, it is possible to reduce a number of communication times, a calculation amount, and a traffic amount of communication data generated in the process of storing cryptographic data, and reduce the risk of data contamination.

Description

[0001] The present invention relates to a cloud system for storing encrypted data,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cloud system for storing cryptographic data, and more particularly, to a cloud system and method in which cryptographic data is deduplicated and stored.

Recently, demand for cloud storage has increased and many studies are underway. With the development of IT technology, many kinds of devices are being used, and most of the devices are connected to the network. In the environment using existing local storage space, it is changing to store the data of the device in the cloud story using the network in recent years, or to integrate and manage the digital document and information of the enterprise. Cloud storage is largely classified as a private cloud and a public cloud, both of which use data storage in physical storage. As the amount of data stored increases, the number and amount of physical storage devices required increases, which is a costly problem for the cloud environment used by a large number of users. Many researches have been conducted to improve the data storage space efficiency of cloud storage. When many companies and researchers store the same data repeatedly, the actual storage space of the data can be reduced by referring to the originally stored data, rather than allocating space as many times as the number of requests, thereby reducing the maintenance cost of the cloud storage environment.

On the other hand, a technique for preventing repeated storage of data is called a data de-duplication technique. A method for preventing repeated storage of data proceeds in various manners, but a basic operation is performed by comparing previously stored data with newly stored data to determine whether or not the same data is stored. The method of comparing the stored data proceeds through a linear comparison, but the larger the size of the data, the slower the comparison speed of the data becomes.

As a unit for comparing data redundancy, there is a file unit comparison and a block unit comparison. The file-by-file comparison is a method of comparing data of a file unit as a single object, so that even if only one bit of data of two files is recognized as a different file, duplication is not performed. Therefore, the deduplication efficiency is low. However, because the size of a file can be as large as a single file, the deduplication processing speed is very fast. On the other hand, a method of dividing a single file into blocks is also used. In this method, a file is divided into blocks of a certain size and used as one object. The advantage of this method is that even if some of the original files of the two files are different, the duplication is more efficient than the file-by-file comparison method because the two files are individually blocked and only the same part is removed. However, in this method, since a file is divided into a plurality of blocks and each block undergoes a comparison process, the deduplication rate is slower than the deduplication per file unit.

Also, it can be classified into two types depending on the position of deduplication. Data deduplication typically involves deduplicating the original files by sending them to the cloud storage. This method is called a target deduplication method and since the original file is transferred to the cloud storage as it is, the user terminal does not require a deduplication operation. Also, since the hardware processing performance of cloud storage is generally higher than that of an individual user, the processing speed for de-duplication is fast. However, because data sources are transported to cloud storage, there is a lot of data communication traffic. On the other hand, a method of transferring the data to the cloud storage by processing the deduplication at the user's terminal may be used. In this method, data de-duplication is performed at the user's terminal to transmit only the non-duplicated data to the cloud storage. Therefore, data communication traffic is less than the target deduplication method. However, as described above, since the processing performance of the personal user terminal is lower than that of the hardware of the cloud storage, it may take a long time in the deduplication process and a heavy load may be generated on the user's terminal.

On the other hand, information leakage may occur due to internal and external factors of providers of cloud storage. If the information stored in the cloud storage is plain unencrypted, the contents of the leaked data can be fully known. Therefore, it is necessary to encrypt the data stored in the cloud storage. A simple encryption scheme is a technique in which different ciphertexts are generated according to the encryption key possessed by the encrypting subject even if the original text is the same. On the other hand, the data de-duplication technique is a technique of comparing two data to judge whether or not they are the same data. Therefore, even if the original data is the same, different ciphers are different from each other. Various encryption methods and communication methods are applied for this purpose. In this process, there arises a problem that a large number of communications and calculation are performed.

In addition, if integrity is not guaranteed because the verification procedure of the data stored in the cloud storage is not included, the data corresponding to the metadata by the third party different from the stored data and the data actually stored may be different from the data corresponding to the metadata There is a risk of contamination where the problem of getting stolen, corrupted, or malicious code is acquired.

Korean Registered Patent No. 10-1374594 (Published date 2014.03.10.)

SUMMARY OF THE INVENTION An object of the present invention is to provide an encryption data deduplication storage method which improves the communication method and communication data and has a relatively small number of communication and a calculation amount.

The exemplary embodiment of the present invention provides a metadata server that determines whether data is duplicated using metadata of uploaded data and transmits the duplicated data to a user terminal, and receives the duplicated data from the user terminal and verifies the duplicated data, And a storage server for storing data.

The metadata server may generate and transmit a unique session key for encrypting the data to the user terminal.

The metadata server decrypts the data encrypted with the session key and can read whether or not the data is duplicated with the stored metadata.

The metadata server may generate an unsaved data list and a signature value of the data list and transmit the generated signature list to the user terminal.

The storage server may receive the data block of the unsaved data list from the user terminal, process the data block, and compare the data block with the signature value.

The metadata server receives the signature value of the storage server and can generate and store metadata of the file from the signature value.

Data transmission between the user terminal and the metadata server may be performed through a hash value.

According to another embodiment of the present invention, there is provided a method for receiving a hash value of encrypted data from a user terminal and performing deduplication with previously stored data, receiving a duplicated data block generated from the duplicated data list from the user terminal, And synchronizing the stored data blocks. The present invention also provides a method for deduplicating and storing encrypted data in a cloud system.

And generating and transmitting a unique session key for encrypting the data to the user terminal before the deduplication step.

The deduplication step may decrypt the data encrypted with the session key and read the duplication with the stored metadata.

In the deduplication step, deduplication may be performed to generate an unsaved data list and a signature value of the data list, and transmit the unsigned data list and the signature value to the user terminal.

The storing may include receiving a data block of the unsaved data list from the user terminal, processing the data block, and comparing the data block with the signature value.

The synchronizing step may generate and store metadata of a file from the signature value.

As described above, the cloud system according to the present invention distinguishes between a metadata server and an information storage server, determines whether the meta data server is duplicated, and transmits only data that is not duplicated to the information storage server. Also, by verifying data transmitted to the information storage server, it is possible to reduce a number of communication times, a calculation amount, and a traffic amount of communication data generated in the process of storing encrypted data, and reduce the risk of data contamination.

FIG. 1 is a block diagram illustrating a system for redundantly storing encrypted data according to an embodiment of the present invention. Referring to FIG.
FIG. 2 is a diagram illustrating a method of Convergent Encryption (CE) technology according to an embodiment of the present invention.
3 is a diagram illustrating a structure of metadata according to an embodiment of the present invention.
4 is a flowchart showing a deduplication / storage method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between .

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

The cloud system for duplicating and storing password data of the present invention is based on a metadata server and an information storage server. In order to compare and remove the encrypted data, the user communicates with the metadata server and has a procedure of uploading the corresponding file to the information storage server based on the result of communication with the metadata server.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a system 100 for eliminating and storing encrypted data according to an embodiment of the present invention.

Referring to FIG. 1, a cloud system 100 according to an exemplary embodiment of the present invention includes a metadata server 110 that transmits / receives data to / from a user terminal 200, and an information storage server.

At this time, the information transmission / reception of each of the metadata server 110, the user terminal 200, and the information storage server 120 is performed through a network including wired and wireless, ID) and the public keys of each other are distributed.

The user terminal 200 is a terminal 200 capable of performing upload and download for accessing a cloud service provided by the cloud system 100 and sharing information, and includes a smart phone, a notebook, or a tablet PC.

The user terminal 200 interacts with the servers of the cloud system 100 via a wired / wireless network, wherein the wireless network may include wifi, bluetooth, and the like.

In addition, the user terminal 200 may further include a display device capable of displaying an operation with the cloud system 100.

The cloud system 100, which removes encrypted data and stores it, confirms the user terminal 200, issues a session key, verifies whether or not the blocks of the file to be uploaded by the user terminal 200 are stored, and returns a result And an information storage server 120 for storing only data that is not overlapped with the metadata server 110 in cooperation with the metadata server 110.

The metadata server 110 receiving the upload request from the user terminal 200 confirms the corresponding user terminal 200 and issues a session key which is a symmetric encryption key for the communication session with the corresponding user terminal 200.

After issuing the session key, the user terminal 200 encrypts the file to be uploaded by dividing it into blocks, encrypts the encrypted file with the session key, and transmits the encrypted hash value to the metadata server 110.

The metadata server 110 compares the received hash values with the hash values previously stored in the metadata server 110 to determine whether to store the hash values, and reconstructs only the unsaved hash values to construct the data. The metadata server 110 encrypts the reconstructed hash value using the secret key of its own public key encryption algorithm, generates a signature value, and transmits the signature value to the user terminal 200. The user terminal 200 reconstructs a block to be uploaded based on the reconstructed hash value received from the metadata server 110 and transmits the reconstructed block to the information storage server 120 together with the signature value transmitted by the metadata server 110 send.

The information storage server 120 compares the transmitted block with the signature value to determine whether the user has transmitted the correct blocks. When the user transmits the correct block, the information storage server 120 notifies that the user has transmitted the correct block through synchronization with the metadata server 110, and the metadata server 110 stores the data stored in the information storage server 120 Lt; / RTI >

In FIG. 1, the information storage server 120 and the metadata server 110 are illustrated as being formed together, but this does not indicate physical proximity.

Hereinafter, specific symbols will be used to describe them.

Before describing the embodiments of the present invention, the symbols used in the following description are defined as follows.

*: Participating object (

:user

,

: Metadata Server,

: Information storage server)

: Original file

: One-way hash function

: Duplicate

Number of

: Not duplicated

Number of

:

All

Number of

:

Convergent Encryption Encryption Key to Encrypt

:

Encrypted with

:

Hash < / RTI >

:

Consisting of a set of

List of

: Duplicate removed

:file

Hash < / RTI >

:user

Identifier

: Encrypted

Set of

: The session key between the metadata server and the user

: * Symmetric key

: * Public key

: * Private key

: Encryption using key ** as an encryption key

: Decryption using key ** as decryption key

Figure 2 illustrates a method of the Convergent Encryption (CE) technology used in the system 100 of the present invention.

CE encryption method is the original file

The hash value obtained by hashing the hash algorithm in the hash module

As a symmetric key, and calculates it as shown in Equation (1) by using an encryption key encrypted by the encryption module.

[ Equation 1 ]

3 is a diagram illustrating a structure of metadata according to an embodiment of the present invention.

Referring to FIG. 3, the metadata stored in the metadata server 110 includes metadata

Identifier (

), A list of hashed blocks (

), Data obtained by encrypting a set of encryption keys (block

), user

Identifier (

).

Specifically, as shown in Equation 2,

Hash

.

& Quot; (2 ) & quot ;

Also,

And uses CE to encrypt it. CE encryption is a specially generated encryption key

To use a general symmetric key encryption scheme. The generation of the encryption key used at this time is calculated as shown in Equation (3).

& Quot; (3 ) & quot ;

Encrypted using

The

( CID ), and the hashed data

List of

.

Also,

List of

And

on

,

To generate metadata.

Hereinafter, with reference to FIG. 4, a description will be given of a method of deduplicating and storing encryption data between the cloud system 100 and the user terminal 200 according to an embodiment of the present invention.

The embodiment includes an encryption and deduplication request step of the user terminal 200, a deduplication processing step, a step in which the user terminal 200 uploads the deduplicated encrypted data, and a data synchronization step.

In the cloud system 100 of the embodiment, since the confidentiality of data is required, it is necessary to encrypt the transmitted data. Therefore, it is necessary to distribute the session key between the metadata and the user terminal 200.

First, the user terminal 200 transmits its identifier < RTI ID = 0.0 >

(S100).

After confirming the user's identity from the identifier, the metadata server 110 distributes the encrypted session key to the user using the public key of the user terminal 200 (S110).

Next, the user terminal 200 transmits the session key of the file to be uploaded

By encrypting

And

,

To the metadata server 110 (S120).

Next, the deduplication step of the metadata server 110 proceeds (S130).

The deduplication step may include comparing the hash value of the cipher data transmitted from the user terminal 200 with the data stored in the metadata server 110, comparing the cipher data and generating a list of the unsaved data, &Lt; / RTI >

First, the metadata server 110 transmits

Decoded

And the metadata stored in the metadata server 110

And determines whether or not each block is stored.

Next, the metadata server 110 transmits the metadata

Blocks which are not stored among the blocks of

. In addition, the metadata server 110 creates a signature value that can be created only by the metadata server 110

To the user (S140). The signature value generation is as shown in Equation (4).

& Quot; (4 ) & quot ;

Next, the user terminal 200 uploads the block to the information storage server 120, and the information storage server 120 verifies the block.

First, the user terminal 200

And signature value

And reconstructs a block that is not stored in the information storage server 120

.

to the next,

And the signature value received from the metadata server 110

,

To the information storage server 120 (S160).

Accordingly, the information storage server 120

Included in

Respectively.

. next,

With a list of

And is compared with the signature value (S170).

The comparison operation procedure is shown in Equation (5).

& Quot; (5 ) & quot ;

If the two hash values are equal to each other as in Equation (5), the unsaved data is stored.

Finally, when the data is normally stored in the information storage server 120, the metadata server 110 may synchronize with the metadata server 110 so that the metadata can be normally stored in the metadata server 110.

The information storage server 120 verifies the operation value of the data uploaded by the user and the signature value of the metadata server 110, and when the normal data is uploaded, the signature value of the metadata server 110

Signed with its own secret key, and transmits it to the metadata server 110 (S180).

The operation of the secret key is shown in Equation (6).

& Quot; (6 ) & quot ;

The metadata server 110 receives the signature value of the information storage server 120 and can confirm the contents of the signature value. The signature value generated by the metadata server 110 itself,

Through the

It is confirmed that the block of < RTI ID = 0.0 >

(S190), and terminates the cloud upload.

As described above, after confirming whether or not the data is duplicated through the metadata, the information is stored in the information storage server 120, thereby minimizing the data transmission for duplicate verification, and using the encryption technology to solve the security problem.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but is capable of numerous modifications and alterations without departing from the spirit or scope of the invention.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the following claims. There will be.

100: Cloud system
110: Metadata server
200: user terminal

Claims

A session key for a communication session with the user terminal is issued to the user terminal when the upload request is received from the user terminal, and the file to be uploaded by the user terminal is divided into blocks and encrypted by hashing The encrypted hash value is compared with a previously stored hash value to determine whether to store the hash value, reconstructs only the hash value that is not stored, encrypts the hash value with the secret key using the reconstructed hash value, A metadata server for generating and transmitting to the user terminal, and
And if the block to be uploaded is reconstructed based on the reconstructed hash value and the signature value is transmitted from the user terminal together with the signature value,
&Lt; / RTI >

The metadata server generates a unique session key for data encryption and transmits the generated session key to the user terminal,
The metadata server decrypts the data encrypted with the session key by the user terminal and reads the hash value of the encrypted data from the user terminal by reading the duplication with the metadata stored in the metadata server And performing duplicate removal with the stored data,
The information storage server receives and verifies and stores the deduplicated data block generated from the deduplicated data list from the user terminal, and
Wherein the information storage server is configured to synchronize the stored data block with the metadata server
And storing the encrypted data in the storage medium.

delete

3. The method of claim 2,
Wherein the de-
And generating a signature value of the unlisted data list and the data list and transmitting the generated signature list to the user terminal.